c30d3db66f181998112187c06e46d6deb101e2fa38cf58afd72ed312b740b7b8

Analysis

max time kernel
137s
max time network
153s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59fecb3e2f0e2e096817903abf32c611_JaffaCakes118.html
Size

57KB
MD5

59fecb3e2f0e2e096817903abf32c611
SHA1

672fa20f8d20cf3292f933c8d023a6177c9b6ec4
SHA256

c30d3db66f181998112187c06e46d6deb101e2fa38cf58afd72ed312b740b7b8
SHA512

763528803c9fc31ea1d7cfaa6f370076814847854da0f7c4e20829a2e0c8a901a97a4e0d85d21a57a4a3f728b73cee32b63f6ee31512fb2888248380067f7670
SSDEEP

1536:gQZBCCOdv0IxCNtLbqfrlfjfKfdfjf7fsfcf/fqflfdfvfMfKfPfpfefHfnfOfJR:gk2p0Ixlx7C1bjkE3CdFHUiHBmfPWRYI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000001cac8c4dc582ee5d1ef5c4f4d24b60c4c5f579019332fd1ce3af7581299a20e0000000000e800000000200002000000096b57ed707e1c9c36fca87c7fe0887bb94b389b1607614d1d404cb11127a2f799000000010c3e1037a1e4ba5cfcf601021f5eb9fb0632557c60ef69397c411d2b7e238cb9cecf00c5d7fb65740d1865b46f78f6fe9ad6e6c509d9fff884ae0ee0dec9cc780698dae4fddb53a980f2e18dbd1d4f588341e2db3c14e36854ebbe3eba6d7eb940b4bedf604a9cd33832d76b87bde2be4b2e02007fc6ee438a889b32c9d39a9a7bf84a22b9428eadfa9d4521fba059b40000000b17bef641ff9f46c2dab18ffff6f98d7914d9af497984d9f345a4e4eae1f9194b5ee5b8266d20de6a4d49cb5aaa1f189aae09cecfbd65a925f8d7e3030c6c0c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D2DBA61-4571-11EF-B166-DA486F9A72E4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909a51637ed9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000043d9f58fe0c3de521ab7369b09bc770c785f2e4d1873d48e563afbfaf3f1eb6e000000000e80000000020000200000006edf79eff0b402241d3b3e18db99144af6786e3eaf2779e566f8313d1dd4c69c200000006407350953a314a7ded22f2b07e9c08ba03f9d9e0b662cb0f5dd2be7240e4fd840000000e51f27c8178d244287f04a683c2498d974c4538a08bf0a5d98244b7e0eabadfad41d0563f9a7ee7ae47e2c3bd7d50578227b7930a2509d5385ba40c668c5caa6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427515818"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2760	2144	iexplore.exe	30
PID 2144 wrote to memory of 2760	2144	iexplore.exe	30
PID 2144 wrote to memory of 2760	2144	iexplore.exe	30
PID 2144 wrote to memory of 2760	2144	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\59fecb3e2f0e2e096817903abf32c611_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a54b71699acb3cc8658afdb8fb6ac829

SHA1
04bba6349998d91da29d498c74a1bd6b2da44c88

SHA256
42c465e945156e49cd75a27e9930b4e34b398b2fede40c7bf78b6b1cc6c85370

SHA512
5672b97a8a17983b55543d3e7dbca5f9fb27ee00e906d56b26e41edba88a1f2ae9bf38353a4ac673bff2c47a17b03a229745bfbb0b12c3a9a3d936a863f95ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a87ba525afff59d7626b730c092a104

SHA1
bd8fc4488c27b9c5d8e6fcbbd7c8c8247bd9a867

SHA256
f3e14c2aaa1eec2c80dbd3db1908ee6bad30bbad0cffdc8da15dd93eb2fe57b4

SHA512
77fac35f91fab4cec209155e484e5ff1e6e6540e604746aec48de62ed987dad076a97fa19fa9412441cfd0a1f8c2ec99bc31fa81b4d72df206a54019a6740a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34bfbce45ece521d925b6f8ad0786269

SHA1
faf0a41442b8aaf1bb38508be37fff8109aafd03

SHA256
ddd4dd1e30b1870aa7a92d07cee80dc35015f984bd013cc4f232792c7f6bb099

SHA512
4afc7f1d6759b75ebae1542968880159bc6916af481f3db649ba443780899aa2feba6e20475212421412c3b68ba70dac777b246aa408a0b7d29c5f4339d006de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22ebbaa4606a43770ae3b9ae60899c42

SHA1
806a31b37a698fa4d44a1dc540f1b47e8af7c030

SHA256
96cedf0a78ebcc5bf1690dbedbf5e6268d534577837738585e04dd3ab7a3be9f

SHA512
ad8c8c87a6d17e8ab4bfce3033735232049f99986607bfdedbe9ef1db28ba0d01122151eb7b72b3f2f4e69d14af847bfcf53d4842a1fe5c55291933ae370b313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
296a0a04d6ede9220f40007d9c7f7a75

SHA1
7de71e24b6d063765b1d4bb92e1065084b76f3a2

SHA256
149ff1943983f9e60635d6803fe09ead03ace09094aba377618ae73ad68b9cdc

SHA512
346bfe5e51cae1e197c331edfc4cf6368016592f8c3fa363bd35155a9bbb3cd722ecc3e9006a70e3cc458e8b08cfd22aa4363178f9cbd4ed66e8dd345a5cbe6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
387f8dc13b1476c03f6da04b1f5c7832

SHA1
9f2411b7fb9e5ff42134f4d6de91178770eef3bd

SHA256
2d3843a03b70c5fa6c66b6a5b471e6c76def455279cf09763baf40a67e0a9184

SHA512
9d717cb03db12aed636a27f845f3057459f39668f452c982f469b7af0b455d6fb91d841ac17f881e163a3db63464ddd56aa6eeb0db5906b7eb94ef26189deeae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b98f301576a1b91ae8075ca7bd1c82f

SHA1
04af7fc21745029802aeacef129f7a30028686bb

SHA256
70cee65b5748f01d76d17eea1a5ec40f567ce5c3fb6077c085e9cdd059bacc7d

SHA512
1cbbde60607bddea6cb87ff8e987e9fb888b583fa7f228e970fb7b8534c0619e936e2c2cebf4b26d2323af9151009323710cef7770889fdfe8a223851c665759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cabc30badc089dcb282913473a605659

SHA1
3db340b9c956bd1f6e17f07d5453ee6303d30945

SHA256
7c4f3b9056c23367e0b1fc3d0021274e48ce0918d328170877913e16dd75ded5

SHA512
25ee69445131b41b29a6064ca315cfae48b89d711659a2c612eb88d255383eb46ae8421c92397b0f105bd1765fd38d449dd60e50f821f07a8754b8760ba33577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16a278813abe7775fc89f63a30511508

SHA1
4a30dc5edcf6347c45e761166c7699e3f3c2c7d4

SHA256
89192e546dd108219a04d59f5096d7796e59635adf420041f0f9983ac5cc358a

SHA512
25913a7dc3f14fc1cddf6510c945ea9b777ee3a8a9f6185fef86991cba786a84aab5f1716c1546af28d91fd2ad763d40b46b7a7e4976ce03c9cab6e77e4fa169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0acaaf12091c946415fb76d8bbac0a80

SHA1
5f58147947566528a2acd9afbe08058c37023e24

SHA256
a8866437ba5909b15a2dae480fd1256e0d96fe422bd39258edcdb23f17995853

SHA512
813b842a0f55d5a2d3e028e84f4006313be5c8ec7ff9ace2f76e1e9c696aee872fe444209081c6aab96178a105430e27963127a427fb937eb23c361108d051be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b0c1fb54e769abd2eac9902decfe19a

SHA1
1884f97aa6550580a709d251806eaf79709d8d62

SHA256
efcf7c04579514c1704ba612a32e9a1c236840602ce0c16d23afc0517c0804ca

SHA512
c296ec343dd80960d0dd5c997acd1913411483c1d432bd4e3fed8a76d35308abffcabd2d7005fcf7431bcc357a7c03d9e91f5bc32e56795f2c2f28f02f914cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f4f5c4076cd9d5c067a3d0e0b5b5dab

SHA1
3b5b98481a73afb8756dc0bd6faf82d09d957d2d

SHA256
77fc5f5335c7f22e62c07c2174af2911ad2c92eff09dd5b4b2edc7ec1082bf0f

SHA512
12a58e7dedf8db56481bb48c2bfc9ad13ce13e56d2871f663723b54a4ba77ab18affa9db94a511dcdfac3874825190d64d8d88e446524e08bdb9fdda13454553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84a2291409086f21318a345b0196effe

SHA1
92f978cdf78ecc5016bd393dac6d67ab2f6ce716

SHA256
2e1e7d46661198d47d1b083fd790c9dbeafae072cc85db20becef6ff7f2d8c29

SHA512
32b47f03df00fbe63a6dddb9ae9873b1038c8bf3753db9b89042372f227ae84db3edc16056695f47ce7bc753b4d26b96b4ad8274cd74fe1c2b6ef416a98b56e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3370.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3373.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit