1b8b26a10b9b46f0fd7da1bef795a8a24d4a233b9c56294221e6fcd182472551

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5df2ac81ad30529e99f39648798eb04b_JaffaCakes118.html
Size

53KB
MD5

5df2ac81ad30529e99f39648798eb04b
SHA1

c2bfbd748553db5ac5117bb871c64e14de296276
SHA256

1b8b26a10b9b46f0fd7da1bef795a8a24d4a233b9c56294221e6fcd182472551
SHA512

927af94c14e01ee9e7b97b976b00ef83563d759b74a4d12dc80ae66a8e7900135c3a3bf30c8cf07b25666e921afa7d0b4b0defbae7d619935a52858896f268d0
SSDEEP

1536:CkgUiIakTqGivi+PyUcrunlYw63Nj+q5VyvR0w2AzTICbbqoN/t9M/dNwIUTDmDO:CkgUiIakTqGivi+PyUcrunlYw63Nj+q8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2CA74D1-461E-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000114fb8276720a12c00611e6859584ebe1e1ee724afeae71e8d3710f0c221ce28000000000e80000000020000200000005125d904be13712c6c1fd05431fbd2acfa16302622fe43b7a54f3f8bb03f9046200000002b0289dc72ae387a51f6cbdf30258a5a2acb6ec4a3c818b42a6e7ac4346ce9c0400000004c377d22943def9e635ce2a50bd7d202f8b8be0994b1770c4d624aa3c8f42e859b993633e7524c3d91ce3bbbae8ac53abcf4aa47aaef4fe2bcc4ce0a9f3687c8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a090bd982bdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427590209"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000724f0df8b4f1e70ae9ace8b0f6341b6773527dab1d62c642b48bdd297ffe7ed5000000000e80000000020000200000001ee7c31d441547b58b37f05b9df47d5624cd68236a69185960431f74d12f293f900000003af28d37a506fcdadab67dd649702c396ce9ccb03c3ba54132b9b6abc987e0eda3aa70748abdce1a0a7e79118f1d48452a8a4abca036af30f8eaf6ea3a81740fa023756d535f02b99f49223dfa93a9e42f1202a9b79b1df263bfd31ec06672beaaf3aee0c874322d4c80134c7c4d948b7ed234aaec862a60bbaabc84c56879449ced70b8700da3ebacc45c8c7685a2fc40000000e9dec453393cc8ad7fc1679a12f08276fd8c16c1994ec97c41eb0e17ba3dc8c1d58df6f18969ee4d5efec885cc617ac385aab95e1d88db30caa74c3d1afc167e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2656	2632	iexplore.exe	31
PID 2632 wrote to memory of 2656	2632	iexplore.exe	31
PID 2632 wrote to memory of 2656	2632	iexplore.exe	31
PID 2632 wrote to memory of 2656	2632	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5df2ac81ad30529e99f39648798eb04b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4572aa2c439423b22385fd0dfc51967

SHA1
af71c772b77b3b642b5e53a67bf38e7ae82d47da

SHA256
8146eda1bb570632b41e09e96a02afb142db22ace22d7d4864ae71a250a4d978

SHA512
beb8baa3e73cbb915c82f6f4b5ebbe20ff47781579c46bc57d0674c49b7a53b7c3647db874aaf2429cbb8be0ecd7a55eb2041fd8a41767b4e9109ab316455061

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77a2e18904908d5a531651ab18187582

SHA1
2403288df7f252a22ddfee708a888a38fb871c39

SHA256
987a6aea6c34ee1b08cf0d4287dd0fee24a611b9d98c2ea9ce17435fc90a8852

SHA512
7b891d54e50ea4e8057827608d242289e4381dc1ebf64408de3675756a876580ef68c0eb1b10c3a27eb77e531112df178a8a93a5d1e7167f6987b491fed5fc75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e089e6c92c2f3e49b19095546359b9a

SHA1
40a390726cbc36aee41f26f60451e6093d17729b

SHA256
bd762ba3839a61e0c444b71fb6681b0eee0e1b9162899bd710c6e8227aca2722

SHA512
1a821c44d6370824e369368f6bb41c059d0924c8ce565d1fe5adad2980f7ed80f405882028a37892e692954a9f05fd56eff585f5d5fa57e266f24b5c6796f0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d04304517e49787673a08e5b08d58e

SHA1
6cacabeb232a5987b19f360cbed14aad9f0230f3

SHA256
71903d421d227ab929d20001d9df24fb37dcbf60dcd9d691cedbe7e5f3d72caa

SHA512
b0dbe31b85f16d8bd2d891b0ab35a228f56b554021b849dd5d465bc41a5f708acc07c61d0a12e9f081cf04fe7bc00e353f19b891bb0765ea2906b492c7b5402a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3d063ff630ca9fbe0e99ef2e86b3f51

SHA1
df907cdc8e176bc48055a071fb665565cf51c4ba

SHA256
9a244682c4128ea948a57ce1fdc16a07f1a2c6ee5e5595a37a603adb7b8573f6

SHA512
f1b94169335d745d3763cba0b6a7616ab0e80d4c555c8b5202f3158eaab61c746f93469ad474ddb031c201f78fd57c41a80f649202f3ace69c27fae85584e900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e54a3ed35dfc12b38f94d7ffb607117

SHA1
616f5102dc7ba51437bca56df45215ae0643ca05

SHA256
a192baaf19baf486a08f3b6a87e47a0c2be3447f1ffa23a9b01f3c7e996aeccc

SHA512
ad11e47c181728ad237e8053f1c6eac59939005776cd2093dc88c885d22d225d47980172647d8350b4dcc8cbc39329bb528223bfd7fc008698f3f6ddf04098cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
318970ac575e7fc7ce9c7ea1b7c05a1a

SHA1
d480b7d8353e037a8c83cb1e783fc1f24a892f7e

SHA256
95646e95ea052fcd49deb941d5dae5a687218824b3b0cd4d8d21b80bbc796546

SHA512
510432212a29bbffd20aa649e16c9778b49291b6bd57b60e2f66242f36a2bc170186fec90bd5093a5c7743b4b7670458041b6adbe3a50ab23ca1931d01a28edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab777e1db7235b15d237f970fb3e4efe

SHA1
6d44a7c164516ed1d3934976f199f8aceca5fc56

SHA256
92b738b99203b9536060346740f8883babf5435e41b7b06f3521d2fff3b8339d

SHA512
05e95eb6d130a4912c5aaec04b3168a3fc33f1c063e63b3f37f61a4259f1ded15c3debba20fd26d2c80ec97e897262263c6df2fe4f205a007cc3407f05736e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3188e5d1c1f592b97c7501bb582424a3

SHA1
6905c1f35d3f35130d7f5358b94d3be0fb793fc2

SHA256
9e712d2f893f4642990a8104a19b515b26533ffb51e524ced2d19d6f24e9ff3f

SHA512
2c57de7f70c88a4297215f315a45679232a2c0bd97975f63006878fb9d7eb5f6e33b7276f9bf1c0cd9f035c682e7596d4d6b877b835623421d127a1e15f0fbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15f24660c2f558ebbbec4ecbe57b030a

SHA1
b10b5f75a90eff52df17777db7df11c6f0dd794c

SHA256
6bcea26feb64561c6c2f257d2d1bcef86d835dab2682a52d00093a5a2d2948cb

SHA512
6c7f655df13105f1a8702050185fcd46984ae96f9944e7dad937426facedba1ef339cf5075bcd94249ceaa3f1c33bed03bb5784358f4604d99530a33fe8e1d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d31001585e008a765045bdcee2ab661

SHA1
d47b8c5e56bf5966e80701bc24bbb02cb4ce0027

SHA256
31b089ddd3e20f0a5bd4d0bae62d21ac122548fb99c00572382c48ba188bc9e0

SHA512
a0635172889e0893f54e306134ff2896a40d7e62ae5e08c425433e3fe3c02944e59db5c3897d6412fbeeb5e295b652fddfa6cbb007f5f957043f0a298851e2e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdf7179ca3deeaddb36e79979e6401c9

SHA1
d7e3e33b91e3268158d8189ae6f142b2abb93bd7

SHA256
a3280d104cd2b7cfc2e6018100483f4d16da389d8ae507900acae13ea7da45fb

SHA512
e6192cca0f77c464b1b07cf3e49d372af316a97be5f5bfd332f4de25890f179d7583ab5f6d4285cf889162c682a0538bac5cf002985214ea57c77d201b8475ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247e09d6c965be68aa108c6f88d99e52

SHA1
e5e17cb575d8ae09e7f240251f0255e2f7a2b480

SHA256
f4ce886e1e3353722115105e14e2ab9cac6873ff5aa4de34ef6513b19ffdcb86

SHA512
6eed295b1e5077cd1252084475a1b0745cbcf767748676151b2b05d35507757444e675fab5c49f6839aacdf08239acfd5b6d92af4fbc6ec6ae36f157ceeeb12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d473ff9523e7ff2a3a9ee21883c2347f

SHA1
2684f3ced7daca55bbed4a78095d013bc7741229

SHA256
bd17a48ea31b39ade94d4b9fd12ce4f2549814e23a58e8c8753817db182da019

SHA512
a286ca0a4008d8b6dbe990b50c93de19f32dc6f8a5e800ccdfb789f2a0e0d78cbd3ca977009421a57ba8152e4dc63fddbe09f9bbf96fdf8e591bd234af8ce68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea242965f49dc42768a899baa84e88af

SHA1
47aaf595beeb429351cfe72d30218b5467f33a0b

SHA256
ed8ce9babfd5152abc61f4720401cd10e955803fe9a675241ca18affb810d29c

SHA512
0cf774978c655cc7d85230ba965e44b7a1b4a3fa09b626d8ba897ccad5472e529809ac7e563e19c79351d2b23af27394d9a70815e660e96bb0a17e3811cd633e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d8209e62189787f91462031b2f5d82

SHA1
0f799a1c6d1a5d2affb6d8d4365bee22820f2cf2

SHA256
7731e149ee7f1546f4640f960697c69b33633d616654af1779176cbe2d3c1e4e

SHA512
2a94ee4c482b34d208725ab6a2ed6b75978043b50414ef29d2afac144e85922d708a34f49229a2ad64decd74c65eda035868810e0eca75dc2e165fdbae01b7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit