476bed8576a63bc151b62c703df4fa6e91bf6a7b936d5cc347817feb982ff5e5

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af190b3ba5af65592887be31c2e9090_JaffaCakes118.html
Size

53KB
MD5

5af190b3ba5af65592887be31c2e9090
SHA1

e30b4c2c153292797f149290de152b27574f8b25
SHA256

476bed8576a63bc151b62c703df4fa6e91bf6a7b936d5cc347817feb982ff5e5
SHA512

11fe0f8d7f0449d11cea46ab537f519ff3db10d6991fd2abd4a8c0efe4999580a486e5e35fd5ea269d09099a37ee7c9e9e1cfc20c6961dac531d4b74c207994d
SSDEEP

1536:CkgUiIakTqGivi+PyUArunlYO63Nj+q5VyvR0w2AzTICbbooD/t9M/dNwIUEDmD8:CkgUiIakTqGivi+PyUArunlYO63Nj+qj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c1f54416c5e53e8bb1f1c0643a05edf2b132733ed46d37a59bbf83a24cd1555a000000000e80000000020000200000006ad85023d233f5e69816cd33725b00446f7682542de28484f1dec7f03eadc7f520000000d219899414ce3794db5faae22337f74654fba7ed491470b81ca9c93609185ed64000000040a23c4fa3b081ac35e1d2e487e8aa469b6f619535393c831a429450af1fc5b0eb7a8070e58af39b44b816953829a26bdf31acc7ee6d9be35b0aec20656a348a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000bb70d46395c4c444e1f4c077a8abec412b03583fc370ed03ae9e6cd977177f3f000000000e8000000002000020000000673510e2018137f1f4edca83561223b9d55d1ba44843177e0945bc0b149acbf7900000009d1d1858a06b1b696157f9eb1a9e18359e0a95701d7e1fefdc20013745533738d7b84de3ec7a0aeeba32183c67be0382013098930a9d6eb6662c40005862cc0a4b4ce6e4598decda11257b3e3abfc2070780fbd0ec02d2416f330e6391668d2504af3e92f8f37ce7cf9333e3440a1e7bf8f728581512cc1077c96f3d1e87be1280e9480a186668d413853920c137d8a24000000008aea003768d1e8ac7bba34d8287a4e1f8afc5dd97bfe811a3da933b6b6dd28bb20a54227b5392e9a396462ec5e71a14f3e6eaafe015bcb34cbd121af6318782	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a6e178abd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427535179"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3887891-459E-11EF-85EE-5AE8573B0ABD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
588	iexplore.exe
588	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 2816	588	iexplore.exe	30
PID 588 wrote to memory of 2816	588	iexplore.exe	30
PID 588 wrote to memory of 2816	588	iexplore.exe	30
PID 588 wrote to memory of 2816	588	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5af190b3ba5af65592887be31c2e9090_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:588 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09d3b73e1535ce5ef6e1c279511ba123

SHA1
c474e80a708b7ff08782f24283212ec53256819b

SHA256
7a43bf80af76dc499bd0c3e3dcae7c798914c8b043dc51b83c869d081736b29c

SHA512
4eb8c036598d0495e2287fb91c30b97febb4aae999360dbb8970a63fa47923103b6c7522dbeb2666bfd4ab72d675befd4ad8c49d63dad2f2da69fc6d482bab7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e24f91840ecc981282fe6d944708018

SHA1
f54815acc1ff3e8976250e643300ec59378a4ec2

SHA256
60b0ea50acba7c6bbd026655bf62fc046dc0db91de3352b5f888b5dbb8079554

SHA512
f926190025a1d0f6c27e40aae8dff81b6b158727c9977cc8be55a69eccd252b5eee8d697a394941fbbb63905627db79b9ab281d27b6497a6338821743ebca9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7355830f2be04e223e3fe0f5879274a

SHA1
744f8fce405645402de9c0a7fbbb94d022ac72f3

SHA256
bfd006c1744d7420ff2a3e081260b7dd7f6363034cdae3742dfad24103600ca7

SHA512
f7148cd2cc84326aae1ca64e416f4259f164711846c328cbb2cee6009e323907c7cc15c400f875da228976a16b4168082872e9ed340ac78d9aaf2f3656b90364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d2e041e5722b4197b2f08ba1b02358

SHA1
e192ce7d5cd7401d40c1f80840fc4b1172c25172

SHA256
3233fab206e79683ef9ec0cc3e93ea119936a0b85a5b522cea93f2e9b125f73e

SHA512
4b560776fecdd8b02d023a683d0058d8709612d2a8115a684c43a7b1da076e7fb8452d1d0fa1bf8920e44d565af23c8c5e0c8c69356a7c5db19e1c03127a5adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52855b2e610b54269135ef17feae32bb

SHA1
e7627ac1c6fc3f1cdec8aec6695ebadd574b1dff

SHA256
09d65bd1c0915f1826ae1dba02c5d79f89b337a23e8bf0516461180a629922eb

SHA512
e7c3e2c8cc15305bd6c4c78a5d106c6eedafbc7207c07b0ad682dfe4b5de57fab46fb491df63616328e4e79751e45747010fda25efc978c4bd31bbe8bbc47958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16b3300b9d23b4150fbec945383b30f3

SHA1
458b061139f1ca864175a9d03d655900c3d3c7b6

SHA256
204bb522bae63c96a79053974563eb99dcceb3e2e0a18956553207d735a9400f

SHA512
23d54c739395b58e246c93f22c9e3bec277f26a5eb159abed69a6ad47100662e94be4653c0871be62578cf5b508e1dea03407d87dd0421dd75ca1da0e9361c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10c0822c748a6856728a51ed7a9a19ab

SHA1
f07d33c1983d0179ea60e9b67270fa92d941c3fb

SHA256
eb568448ca0608977d1cc5923c768262d47fe696e3e43d7b64a05a0e61b77b13

SHA512
367a67eeae569cb14051a2024529c6abe2c473134021115401df80ab9753dfe4ebda2d5f1406b70f9b8db83af6dcbe794d55f70dd72fa9837c139ee37f72edd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ad7d80f2e947f1233da094f56b2c5e

SHA1
f6c7b3b1072638a85ef44356d371a58e23404efa

SHA256
50cd95ae4f149ef94d9d1cb827e177c1a551d2b8dae313ce40502581ef3747a2

SHA512
ab8eefaa39d1ba395e6e4a6624682e114662e5f53257375e2ca316c02b04652e12557dc1b1969c08921e5b8ca769c0ed26bcb4d63d725b0c02753133782216ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192f52abd8af7951795d3c79f0ad44fc

SHA1
400a5a79ba0cc948495dc2f0dac0775514829532

SHA256
bf71e5d0c6a1ddeae1b52cac85901ed18f52955589c4df6da295040b638e23d1

SHA512
ec468ed67fb553b2e3216d832c5550a55abee8fb9e4fa4d5b533e53b5134b36479feadee0742a9f40a8fcaa00fc86af351768b483649773638f5e802d3b34a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1288e03486e678accadb64ae6301870d

SHA1
a2a8c60dd03eeb7853386961b6836296a99226f2

SHA256
3690435cd830c2fd4631747732109b32cfb79feae86c9855116783355ab2e67a

SHA512
ca9dfcb0ab2bd42ca787adc00c8569baaacf84995868849655d1fdbcacdb25df888c11fa3b3d2ac0b3c549567a700bed458e0561288baa7a36967f311a97eac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4deb4183dfcbf0b224c86cdf2dfbf75

SHA1
63703de680092391578d7f7507dc68a901c76cf2

SHA256
46584e64fd23af76bdd185da12cc189ef0cb30f7201e420a61d8302226776ae4

SHA512
1c1191724f4858d6f7fe2b774c38fd4a47ee02c536d7d3d4af4da9b68fc5da9c345b2164fa4ae0e2cb60ed1d2b95b7d8e877ded2217c23d0b976a593cc3fdfae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62a3b2ea6e4fd8ad8e9c07aba558d5b2

SHA1
9954b2f18298ebb3b13b12bdb41e82cf85b363b8

SHA256
101dede4c2bb3f32b71d270688a25ba4a3d1e022ddec0d0748cc9fa6b873711b

SHA512
a7e5fac97486381cc2789f820d411da9a8ee6bf8d2804dd8c7568ba76bc4ecd0c12ea1fda208d43c1939741746b854287cb3b17cdf29687a226970e6f6778fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb7fb0e51fbeac505f554960da15022d

SHA1
b406d0f3ba70ca53419ad4fbd30237ad8f6a57d6

SHA256
a745e8f5353c5a76dc81183a7002d626b1da73d1562feab7c2b69de9ae88a308

SHA512
6dd05e833fc86184bc9ee1e98abca2c95c41ebbc00d318612836c470831d1af728b1dea8194a1fdfe84f68f0e42e43c079f3b96899588f640ff11adf2c48612c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c7fcaff875fe080a19f3887db043d5

SHA1
7e697b2fced28718090d50260027e869f7526f79

SHA256
6a7dfddd114ca3eb9c1c34750efded097e85eec02ce9f267bfa22058e8dcf92f

SHA512
5906b8e03530159e8a68704175fe5832285ac2bcdb7e861292123fd89b25a65afa7b92aa36fc0d0e4a8d0672467a861e13271928531cf5273d2a2051f3a28f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55680e1f82a659a9c77f22c57a0e6d29

SHA1
36af7b52934d003c6c5299f369df9d7149838f4f

SHA256
4e7077070150b24cb3c0c49077c5a1806b26d36c01b100f1fea5535a7b016886

SHA512
c711ed2aca8eea43a4b81b2545df3f3536ddedd7ae90f69b610304eb57a476a018252911ac62444a15f59d41d770d34a0457e6f2c3f1ad9363b38779e87b170b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d0f13e2e43ff5b49d939fdaeffbe15e

SHA1
e936589c2dd0e2d3432ca1b4758a94d89dae9b4a

SHA256
194c9fc6325405cb97e5dc656f4e2bd59c63c0dcf34a6008897413f140f98bbe

SHA512
422fc83de9c0d17b8264348e0c4d565b64e78ae127438f92e4866cb65e3882d26fbbcdc130992414de9862e8c1852cf10570ecdf9102bf0c58fc6e5849296fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9678.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96E9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit