46140f503b01cd433fda094d18ab7083eb87cbf875e545998ca4e3e55eb4fdc5

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a4d84e08c006668222fd28debd924a3_JaffaCakes118.html
Size

7KB
MD5

5a4d84e08c006668222fd28debd924a3
SHA1

bf7c2b7207b1d547f82f2f22b0d9a1a502455286
SHA256

46140f503b01cd433fda094d18ab7083eb87cbf875e545998ca4e3e55eb4fdc5
SHA512

1904195f9ca8cfeecc1f5efc39ecfae7181ca612e20d936a18e5a6b6ad37c288c5ec4b8a8764c5dc50cec1156bc43f074f1ccab5dc8cff0a9233928959cdd70a
SSDEEP

192:SI3ionxuIuuz1hMF36olKGmNvfu046uw1aPvek:SIahuzfMFflpv3r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3307601-457F-11EF-83D9-4E15D54E5731} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427521865"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c137918cd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007f453cadb9912a31d4a15efe97e3e505448a929513f88db159acd9c493cbeb24000000000e8000000002000020000000d8f788424f6b8f52bd08545838bb9ace0473c51ce7eb7c5b2c27deec9ae247f6900000003aa2d40c582738c81e14d41b1454b8535112e94f0fb963997048f5e96e042c79516fd8a302020544252883446c8122671ed1a90178f740f1c642b1dcacaece3bda061aa18b65fff137a3bf0980b5aa28363cabe86d1be2ac5cb4217f542e2c9ea9e9a69451416b9b4a978b0fb39135d16a76e3d01bcaf5c3b09df4b54f6d69f5bdb04590b3aedbc85f623d5a530aa338400000006ef356abf19c97f1766f19c7568502e8e5c29ca5b12e31af9f1969a8e458e45bd5d3b391e23d075d87528bb40864286789e7fb00db771b1519a63a9e6d4e2452	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007ec8af47774ab40070b50b1f7de92e704c712c69e40dca5677df32ce12d8ba77000000000e8000000002000020000000296929c8e0a424b35a5021113b4a475dc6daabd49a1c936d0c4f8ea4fed533e1200000000ce5b9ea0d8b13459800bde3e6993dd822f7bceb8e6b29664ee8e47be535130340000000cd8258f94b2dc11c5c7b23ff84190aa212624f9d1cc20bcaa53346629cc40d6aa093a730f621625fa19344df31646bfef2f0c492a8e0adef0f58975f15993757	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2696	2836	iexplore.exe	30
PID 2836 wrote to memory of 2696	2836	iexplore.exe	30
PID 2836 wrote to memory of 2696	2836	iexplore.exe	30
PID 2836 wrote to memory of 2696	2836	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a4d84e08c006668222fd28debd924a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a8e9ad46300ed9b1d85d6c36bc1c96

SHA1
733e45dc39ca6a6df2658ff3e791414340b4ad85

SHA256
a98c4c0956989df14f32bbd61f5de78a178c38768585915f3a0a55301da018ff

SHA512
83e9cde9fd18ed8b1c727c861e3336004bf7ba66456acbcd3898c83c862ab64d65d4447b41aecbe95ab2a85e99e20d0c834bddf68e2024d86dc58fb727d1fc04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2337c9f7a4f9a954ad32a83dc33d86

SHA1
515d407403bacd9caacf7c1d9a7a66e2f5726f79

SHA256
7daad88747ce2813a24627a0efac6651a2669d1515a188c25e1db6551eea6685

SHA512
63872b4f35b9a8c38458242d6ac549efa0093448dd8d360623929038bff977170841c58fe8c57a70fc8a7a76dbc0dbbf9b7487b0374fd7a1be4625abf6b63e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1f46a7537a9f38ce5374efce67352a

SHA1
2261cf237ac43d26f548d7d4b8053616b49e7b0d

SHA256
6fba0b4866865bc774925f693f3c8fcc4b4862d05655c25550c1fe04e3896552

SHA512
1e99f20dfbb9c05f0cff378e147cb1a1d131e7be28f3c451d47ae1943c0af442e7113b777972370e165984bc67ccb8caad61f404153dc8c6db22cfb685f26b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98523fd6d38769b7fb3c052d9e6e29c1

SHA1
95a830061686707f48ab0dfaf823fb40282a9f3d

SHA256
5acb228b7593bc6f4de69d97e6f2c53f44eb276e5ad402f2aa74029cec0ad2cf

SHA512
78cdff5d3e2d269b733f6f986b08f275a514b822597198f9d51eb0891c5c8726ea337da6e6a1b805263d32405d274ccb5d6a80d70c1d97b1bf4b74a502f380be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8a5fc76830d8a84880b64564f458756

SHA1
26e9c8ace3db96ac662327d8574e25ec69731be6

SHA256
ff76669ab15fdc890a654e04dba09daecfb5040af7ee41e745c85ddb91520c16

SHA512
fa94220ffd3ee558367b12e7e1ad08470e0f568aff930ef026459a146815a8c31e5cbd6128e8dc5000fb380d7a95693de2604d4014c67892d31c0d5b2306b14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8932dd5e253182abc51d7e983483f6cb

SHA1
14da5f39460ed2eaa7966a6d3cf11bff77b09e14

SHA256
b9ab373aecfbaa0aa6cd176dec48d5c8a4f95d2fcd40556a2fc2df88f1b18856

SHA512
de1a1063e54b3c166bb1cfa56bc5ef1fc56d676d42d20f1865561d72242c841fcb96d1cd8cf5ea61cb62129bcc6366daee82a7c44f87efeb2e1fb5345daba236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c11c2b94a69709afadee49436a6342f9

SHA1
bf2ecdfe6db1456d1e022ae12d72115b022ea5d7

SHA256
66e6b0727935aeb8d6d6e6132e3eba7bc46f22cd27190ab8a66bea3f49ccee56

SHA512
160fd722b7b6ea0aae3f33479a8ae9e76c4deda603a1be7ecc69e478fab9b182438942c0f4b80a34b9cbfdf861976638850f2acaf80f978e03d005bc60e39423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95be7cf43822792686ae682cca041cfa

SHA1
bcb6f69359fc8c8c0861d3818a1756acd832cfe0

SHA256
2df41eda106108d497e8bf2e1a6a229183b7c58e20ce8d2a1ac5076bce3c9b74

SHA512
498f86a0fbde0f7fb9bd4a365960ecfef1b6b9ea866170069fdcda344f0366e91fa00d922af846e4ee98f182caefce3927d47b7f2ceede6ba7ed3ba14ac9dee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5c4a7cbe22629e47090d0dbcb65442a

SHA1
d5b017c233f7fc0fd958a7ba77d79bdf036e598d

SHA256
2a1e6823bc40602fd4e77404a8a9911e759e5012fcabc0e4fb1be0078265682c

SHA512
f90a384dd1dbdd0c4fce2daee3893574e6208703be77cb42763b6bf9844d2782d2dbf5e7068a1035492363ae77968e7da69abd7c785b610ced3ab49997d30a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d11097971d3af46a11a5871743dc609

SHA1
4eec88fd27ca8b9b158ea51764cfdd5b27468e38

SHA256
8d54b69692ce4efc53d7b97cbf0eb7cdc144ce8f14e617f467092736ea6d38da

SHA512
11538b5e4e104e0f53d91263e4bc1513ac49c53995683bf810bf82264368772398fa5e760f72be2c78ec374f0234f7e0f7b3f4f67a57fbab116d810beca44ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76e876a6ce4526ead598049550e20e1a

SHA1
ab0a1fb7ecf76de1027b34217f1e0c7b9cd160e7

SHA256
28f94a152daa325bbae051c4f6c8d983ba7f0009a2fb7cc3553dfddccf484dd3

SHA512
11f68ed69df222610e4bb6e10e828cd7f897be019870ede56d5f80662da2100e996811912b03a04788f7e67844158d2a26b95888f65011cd62f8768f700345f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFFE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit