432d9495c0530ae3c9493e15d5a711d97b46a848cc93e142c5a3e9c4404a7d9c

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c8763220f5e1038ac91d0ed52172c3c_JaffaCakes118.html
Size

6KB
MD5

4c8763220f5e1038ac91d0ed52172c3c
SHA1

c543af5e10fbb8b574216853bc94918e628c0f4b
SHA256

432d9495c0530ae3c9493e15d5a711d97b46a848cc93e142c5a3e9c4404a7d9c
SHA512

b8b66a8cb333c336b5b29e979e19148f0a87c99c6ba8249bec15fd3610cc0d05fa8163cc2b523d9c51ff3c00944c1ab1f6f225f9fe390d0fabf0ed6330822d44
SSDEEP

96:uzVs+ux751fLLY1k9o84d12ef7CSTUQGfcEZ7ru7f:csz751fAYS/gfb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427260664"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A9EA071-431F-11EF-960D-6A8D92A4B8D0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000f92523f4996b98d20d717eab6dfea36d397e93b0f3f760342cf5c984254966b7000000000e80000000020000200000007f3cd4a8699e83bdcdd6e69be053faff3ba7e54cabb403ba9b4aaf8f7f0e3c6920000000ddc545d83122b5a0d0783ac1a83ae30d5935962140fdd0c0adff0204cf2ee748400000003d966307910e538fcf8741495322271e5d53e279bc574eb4cd2abc5f8ebeb02c9f7494dcb841a42502f77095d1a42c36bb442fe0eb746050b10012141c2e6062	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c94f502cd7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c9049617a9984176ac4bab8cddfc20acc15148534cd4aa879ddc47a5f7d85f41000000000e800000000200002000000083d55ee06fd231282df819529af0b0bbca020fa250ca64068bd3225721e2363e900000003bb52d85eab17ff63ed8881c7e396815f75fb7ac9d8280b665e24077f7eef6176090818a77393b2188d18f27071991a016d4ca89212fbd5ccf77c2c891245afa57e9a9f93bb0e20ec45ee640314c5acbc067c7d85a54bed03a03df5aa9c64db76df6ab1fb459e09bc1187b0161d01f19c95f291e254556a9c2f4ebd79de4e02c91663b837a3dc0a491318976ed6e6a274000000077343ab9bb8caeaa290bfa378ab2216e28d3a75bca083ff23de484bfeac1437fd502c7c60cf2667e24b94797c440d45e76769823596cec629e22e77614415c87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2768	2796	iexplore.exe	29
PID 2796 wrote to memory of 2768	2796	iexplore.exe	29
PID 2796 wrote to memory of 2768	2796	iexplore.exe	29
PID 2796 wrote to memory of 2768	2796	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c8763220f5e1038ac91d0ed52172c3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bcb9c25497bd3e4344d5dbddc0b37ae

SHA1
d52dce6e99d64f0a41c218ce3dde7ad44921f1d7

SHA256
abe4af42a509801de67c6b36a61da593beaafd95c9cacfe9e0310704da28038e

SHA512
d1715295cc32a1b679bdceadac74b806fd9f14347ed7cc76dd3f34822a593a75725f2210ee75418f6c6e06168a0d9a52f9f12acc3991861c9db159da0022eeba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9291fe8a555d58d64a89967987fa989

SHA1
cff48c6091a3d0fa9a85829357664936a692016a

SHA256
bb8ed4bded057470f55db421e1adf3b7986704e23df9d58c118446ee6971aa9b

SHA512
9b5a19216757099af83a6bdfa987bd86cc5363eac3fac41901bcba321696007f6072d344a0f054377bc755ce5adde3e614b1dc2c486d1a4befa76f8f7706610d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82e6e46aa8284451fa0a088bec34161c

SHA1
d6a9f49ce7333dd0f179e9489d7db15fe80a69a2

SHA256
d22aa810ce7720d101a117861c091ea9d0c9144818be51dba56813a56128838d

SHA512
917f302179a9f1c57e5f2529e3c65941a3baacdf8a7c7f889a80abd75ab55653fc0ccb0a825e87bfdadfd596c451b8eda640a80cdd8e909a32c649dee3785d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b35c2ded822fdd4f2c77a90791db495

SHA1
d9a6d82462fa796faa51321cd183a08d0e5dc1cb

SHA256
0e13a48c863c82b241bb3329a0c5b7c71aaec08f00e6aefe42af41c752cb17f2

SHA512
818fff5839627f26e740b12945c7a719cb79356288dac4fbef33189f37cc8fe32909181e0329fd54c5933983975a3e317d5b408a2120d8b84d908ff77b58a70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18dc5cf480ca6b957b76ee86be42712c

SHA1
8598130c46ff9f19f4a1554cdcb46690652f4223

SHA256
a4d683934d69a78c02b3a0a78787344f66f2bd1e32c9f418f70c7ec992602256

SHA512
58f26f395550cb4c478fac40a75430843464ee185a92790a288c823d1c1d7991c2675cab85dffb70304e918a4425d00035e0bf7d2cb50be621af38c586b7b683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9027c5afdd1295d7e5af3bb71c68795b

SHA1
552e43da1539a54e0146db304d7da90d53f0df58

SHA256
b3769d36cc88dbd5c502b2ff0ac8f363013e49df0636a812ba2322b4293243de

SHA512
e4adace4b66ccf4f0a30992968f3a454499e799de51f966eef7fb3bf1ff428b39a82a4e02818ee68b872f6ecef58d81137a337d40b74b13117750d0c8b96f54c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6566c4189360dc657d9399434ec378bd

SHA1
ba4d09e8673d410f2cc439b71027db96424b13bc

SHA256
29ab993e9177f1608fdfe7f0cc09d7a6577a3558e382004686b7c1822bb9a687

SHA512
b966cc434776c64bf4703cdbe076522d55392c240ddf6af4d77b3115237e48e6b9f3551008b7b136511c1f343769b123c2c4ffdeb9d243faad0c36bf8ebf9ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6e43c507208ca7b614a8f95471d9a1d

SHA1
f6712de209dec82e9f5a5ea85bc3bd6c1a5fa652

SHA256
7119896c278bbf53dde723eb63f4e9af21009f19811b8337f35889e908f171f5

SHA512
10252dc0efc70e1e9a6f6c92a03417f160aff4ab0a2616d0aadc88bd26a059bea187736dcb2d609ff6bee95e375ef36360f0eb15170f0d1be5bf9ebd65180008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7898e6ba916aee8d549b8b4d03361e7

SHA1
baa89c9bf9e34f456f0fb01045c116097d801988

SHA256
807fc1bf1cb78e7effea1305f6c9eee96cd3eaf98690541305e7c7a7c3015686

SHA512
f02a9423556c6f36a54ab933185057fbe7182e2c5bd0d3427217eecf254032b104e563b5ae338a902c4b528d45f69bbd19107732d7b0835543abfd21486d18e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e382c169764ce0210f3bf287fecf6b3

SHA1
8cdd0f6449388110da83194b9fb0e810d3bdd531

SHA256
8f7e1bb35435721b532a294afceafab66689ad56f33d5a7949c770715f55dd89

SHA512
6c197f0784abcc371405fb00d3e99616e71227581ccb90e97753b4bfdc996a11ddb8efe72813cf6d5398590c6a5fbf18710bfed1904ac286a6aa755e94d13a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d9651a17a7e35bb6486fa50a3a8137

SHA1
7737ee64506d5e83c6adabc21d17a7970cc97a8f

SHA256
9f90f8768992a8702251b7caccb733d07db3210587916b90dccdbf24b0cf78a5

SHA512
27903bcd4ff965aa584e406e1bef7181f894099405a3b27660307e64bb1ea1a5fe6838ba7a1b18a9a738c607734b4cf070360ff2f3f979d3a9b847f3e491c559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee84d8d8f05cbb0e0785be56c1c83338

SHA1
2e889a7a1385fd805055c01289e30c5c09f6fb21

SHA256
9f855788a36d017aa0d3d00b8c40e337c09fc97e8aacdf6e280f244e652fa8e9

SHA512
80f29678a665f92949976e316428511579324dae8b6fb971245a1ab943b48161177646c255f32e4e2e75ea6e73ad9a14db018c7c86f5ce5b5ec650334de0b9fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0c6b05c5bcd2503e663f1471fa3b486

SHA1
bf6db806a0c30d6b93ec49763f69dfcb4c965be2

SHA256
ada3b932d17ce476a49ff865fc86eed1e137300fd0ccdcfdcaa0e376006a9d38

SHA512
6274cbba9305332c2c6de0d189a650a3e03bab07935da5492018ffa6b7a685f65d7c9896fd814eb9aace1c5db869badb574652875906746b2a0f69113c0900a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7c4fee8b63577dc44cd3cadea30a923

SHA1
3d26f4f50efe54037144ef738bf5c41843359a38

SHA256
8558f62961d89177234f048cbe55a7701fd1c2636ebe752cc0c03ff12860d1ca

SHA512
116a3509ac73388594114f2b967de3d6ed02c54f837a26583e59c2110f7f196b7472924100da45fc5cbab5685ae11b29b7ae89d7bf0a14aca4c114f469666211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78785c88c3f305bedcc0eff256012f4d

SHA1
68f0455156866b8c7bb909f1393f893d592c757a

SHA256
1d785c00da8fe774285d1115e34eed8c142b5a0b4c2358108357babe063721fb

SHA512
41c316d8ea5c202ab5f7b52492828c7d9f9a66f4b0b86cb18b6a4896276e4354743fd88832a378cf84ec4ee1715b928ac14ae54401f20cdd4c4dea092737e929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09ecbbd0cd246a983568fcec7464bf0d

SHA1
0cd5ca484d44ed2b7c1146d5d5ffb01f802a96ba

SHA256
ce1a042bb496c54305215a952422ae5f03d953b7ed05598615d2fac76da440e7

SHA512
c702b7cc5c297d1d2984419ac1ed264717c8a17cf4a2b7d9ce68c61455278cb77f20f87e38487901e5e9bcd65acbd66b274c01f564226ceffb1e229fa2584fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24896b3a6765312cdfd86b681ecac719

SHA1
e1e1a5ded403761594d2c3f99e7f8fc47430a5ad

SHA256
08fdc3a048230dde45f6d69986640785eda70fc7842491e47881c8c3d918d745

SHA512
d68e5a4589a44f3748e2dc816759ebc3dea185d0371c1cd6b02ad78c41bb2a77ba725124f0c1d6adcaaf2ade698a25f4c4e972c5385ef0944961ccbc821bb049

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2ABE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit