6280ebfa11ce1d8412558bd90ddae46429c5163b4c95da4d8c6a7a5f28f814da

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e133a93eebdd6a04af5ac593dae0e58_JaffaCakes118.html
Size

10KB
MD5

5e133a93eebdd6a04af5ac593dae0e58
SHA1

3e7743b7339d936735fdaf9e619c92220a25d598
SHA256

6280ebfa11ce1d8412558bd90ddae46429c5163b4c95da4d8c6a7a5f28f814da
SHA512

0dc0ef6455acbad5fba9da7b4b92fff8492f0b476532a0b1a6ce14deae4dd23c084b24419491161bd445198307a84c559cbf6e8fc25f9f6b8f552d253f38b322
SSDEEP

192:Fohy15Mkz5GnOXwuhqvEm+DUX09qKeITgtpVMOs701CIgteSpOx7AcotQLcwux:6g15zAEQsHtQ1CIgUSpOsa41x

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000b0ec94f4c84bb6859850c16d5f490a31cabd56bc8b1ddb2c4745f539740a1065000000000e8000000002000020000000764fce403363993ba44e518b22d91c714973a0a97ff3a9246f111514444abb702000000093790290502b63598bb01e1ad0d8a8080edb073d7ae077bf83c01549c6fc53d34000000088f66acd8a81c5c1d4b503c4a509940df3c6f26d39fe7d7b215d96a276a3c789b003c91797c587c772f21bf03334df4df0a13fd6a4b42ce4703dc2d949cdc57f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000064ecff7a03356b68b0ef66c85b548205b053d028187e5a3a6260d54aa49e6807000000000e800000000200002000000048226b787540a3e08f201fdaea840cee7ae9295919567c6aa11a09618a511787900000007a1f2a97e6612e0d8d4054fcfff2340ea424ef1148cfcfdfac3317f817f66c57d34d73936ccdbf9dd5bd7e10b224f65fcca75fa46f27b9ff59109667bb64abbf17a396b04e22bc2cb790ebdd6aea137c1ea27b7f74e028230509fb16ed56ded1e346312a6ef212c690affd07d01a5f07658fe4dd158371ea23f80b8bd9339671a82c0f830148c696bf65abef723af0c6400000003557bf0a8d281c490477315c18c853b4d1df08628a847978989e95207ab9a6e0b0ae3456335e37634c0953434814b3e9f62c69186e1a6ed8df631e493e4ef421	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08ace6831dada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90C986A1-4624-11EF-8705-5AE8573B0ABD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427592715"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2772	2164	iexplore.exe	30
PID 2164 wrote to memory of 2772	2164	iexplore.exe	30
PID 2164 wrote to memory of 2772	2164	iexplore.exe	30
PID 2164 wrote to memory of 2772	2164	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e133a93eebdd6a04af5ac593dae0e58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80863e323abe2edecc3416aa90c125db

SHA1
07eca6ca5ee99e094f9032418a5786fefd11d19b

SHA256
1cdad24eaba75a530b560f978bf22044b68e62a7ee1eee8147a8bad16e7cdf36

SHA512
3d130e8c60d249a0d434831ffa0c2aea30dbe4276dae1fb204484f4072c8dc8da47e274bfce6a4d5e1051080422799d6fa3fa807945de0d04fcb47a0a1bbbf3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1768fc58487da75f9fa1c494647a9b

SHA1
b03691d10554cf19f4bfe0837fab64d7319fffac

SHA256
177d713601275386a47b61ccd3477cf4003f3757333951c7d8a5af7526002a1f

SHA512
8f78489dc00cb2837648696a50a302b78787f05e1fb5840fc9823f14356ea664fca82c5e2ab758d2682d15705da4b03330517d00711b7fb6b9e5365b46225853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47b9c573bb4ddee66b7151a4407e41ea

SHA1
b80d02ea398f1e7571ad0b5ec9e402aebcae4252

SHA256
190e93478b909b87972008cf1bde6d069b18909c1d076a00e4c4d2b66e21c39c

SHA512
a2e73df064b54521049a183a66267a5438689a8e01646bc39e1250993f4d833cd72ef6f60594ee56185e0b169a86423c916a351ed7e8b897472f94ac9c3729bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d4784ffc5f7601f71d72210c0aea8b

SHA1
a7a22562af95c8d8c91653ec10b0dc3528a29d5c

SHA256
94f71134df46a556c3050a8ec222538c64942d4325976f327dd42f94b7a12a32

SHA512
b6b2b048598894e18d9697e7d3bbdf825ef4bde9f5a26c984d083ba4850af2089adc226b1b060bc285dad9136059193644339157f69bfd57ec78b5a2a73f2d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b897649d01fc1029ab1d63157b0d3deb

SHA1
619d916bfaaeb92ceffa63d1e7514c6cc24d90db

SHA256
004b9c2b10bd493a2593474e23d2356ae52f0a391259cd6a5e160c74fe8a29a5

SHA512
48a20ec027d4363db1a338c6279953c9e9588082e679f1ddd007241e4a0de59a5ff55921358ff08905b9edda1c76318f65e3862bccd3c8e7e2e20ca671e29eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d18e28c1512f334264d3bf6a126b193

SHA1
dda20e56e3bd5df8b494ae44a91b7be9a736cc05

SHA256
7f7500db40e286fec6dbd310aef72c52393235135a71ed90bbd7c639d6909bb1

SHA512
53a3c2f317305fd4675451e16c06926e6c0f60e55a6586723d5123cf356645e99fd8df6b2f9d8d69e0800e1163601b480d1bb5b751509360ede38aef5f7c7976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0c4604756a841df46b033e2241e4702

SHA1
34b8d45d92187317cc879f87f25c71af54cd7be6

SHA256
b4ac88ad002863db9d000e3627ada38d064deb999d5b7906f31c9879ae51faf5

SHA512
d530fd50dc409f34c319765721cc6c613b425a5d37c225c001d8d6242f19f280463892cd462a2aad188b5e7a7242da006f133c1fc9c590aaac666069e11a82d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a766b98274c61ff169a699fc8936e457

SHA1
a5716b1e3cb26b0b5984ac2de1ed5ece96c5958b

SHA256
5f107cdbfd7e085668b5fbb9a2e6fb0de2b941bd2f1e25b23960b80cb0ffc9ed

SHA512
4c30e2ef37184799470072b23f3e4175d114b761911fa2cb4dbd631f1e84f6701522e8ee79441f6e36b301fdebcff5bf2cd82a6610337a3594c9c1e1a7fd69c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3dd4779ab7d8c2800533abc431d021

SHA1
bb305cc714317dd079ee8e10bea2f035f5497ad8

SHA256
d7a28f6c6f4a488beaaf7286d01027b8a1ace34caaf70eaff4c710ab7b5ad46e

SHA512
c9f2df82c52607368452b18fc1db8d62a7b9af8daafd13272ce525d0dcd80502af7cc33455fcd0ec117f24b43ddb25697cd24e329b1c6e4907e95d964262953f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78492c0c3fb12f4f0c87c940eb7a82db

SHA1
0b593435d9494cdb5380b04e460da0b69ac7f097

SHA256
8157e7fec225a7fe743ff1b6741dfba6752d6f9c5a7180673d43f2f97d8b412e

SHA512
27fa093ca85b3f44e545b6dd6e26cc6227f5530fab4a6a7b8a4d381f74b8995cea8f6edf4be4575480dd9a2ba70822ccb649086d8f7f10891fc0fd5ad32eb1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7876ed40e7bd7a79ebb6ae011790dc5b

SHA1
09f933b1fd6ee81806646c09102f33f71b54c516

SHA256
5bff1a888b4da861e2e7846b01af8b6fef7c44f538af649a0cc3e96ed32e4949

SHA512
0dacc2a6d634dd0bdbad4a258f529c4befd38db69a42c6ec05ea8a12134a5c1c80d0eb9c7c8ad3f9e20b1bf0c311e583f40c3864d90e9423d8e13d2cd7d77b10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1eeabd1f5f726da0321be3311834b41

SHA1
ee3cf19b524d3b5a21d264d2171761fad5553708

SHA256
7b16af04f6c3f0df5a5f3f863c76cefe731d19cbb8ee8b80d7c946b6260cc33d

SHA512
8a494bf16d75f2628a83ff18931188fa7db3a0e6ee1fe7a7eac0d94cf569856c3fb9b7812bd2b7080ee3375a678ba7fa7f010c555a3e9cd5f4a608b9b60b4f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2482.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2485.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit