18cb26799aff267f4aa7619a7c7ae33cf53897d438cdc4424dfbbc29bc9de909

Analysis

max time kernel
137s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bb7a6c547a47ce7348d3b6bac5cfe42_JaffaCakes118.html
Size

12KB
MD5

5bb7a6c547a47ce7348d3b6bac5cfe42
SHA1

e7ec22ca3f2969b8dca3f8e1dfa8c871ed5a05d3
SHA256

18cb26799aff267f4aa7619a7c7ae33cf53897d438cdc4424dfbbc29bc9de909
SHA512

4dfb7a6bae78fd1d7e2e3adb75bbc644bd0f87e435b0560330ccb37523b5536974a3f68954421fe44e61b24d11168a679bccdf89379394a0a29bb0b6e119460f
SSDEEP

192:2VQlIsr0KXyJZVC/N5Wr8k/w1wvqyIBnZvn9IuVC01SAuBuLbdU8d:sQlIcCVGjW9/gcIBnZvn9IuVC0SAguLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1041c6c8cdd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f70b3b0db4c5d1ef558b154e619e387b235c76768882f4fd42e8937b26997b9c000000000e80000000020000200000000a85da472c91d52285dd631906b090510da54a2aaf49a447d694224e0952f084200000002476af20339cff83b50ceaaf0aa187a14728b9eb61a6c327b4c04f45eee24be840000000639c40bd0997e840ff2c569064592864c6e228717ec3ceaccb2442086652e784e8810388c75cb35cbec848d97caab912c57ae1ba18595c0261ce7db2120907b2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f0c8bd8cc1b80211b96b009f6f6469d8f0c82f66764a1cc9349cc832257b94f2000000000e80000000020000200000008f68e2d739d0891ad0b723732cad5da712a9fcb211bdf980a4fd1fbe4941828c9000000001a4633edb9566b1a0210c7020740062eceb6c02845da2bc3097267217d458a29bce878db032dc0032159467cfdaa0f7a0662f83c8fe24c85300be10fcf43c3edda8555be467b40dedca3e1dcf8cad36636084069216e83bc048c021f803d9faccba56413c442fd9bd3cf10213351631d90fdb91d256ad2d1d6991b3f1f748c05d126dd3f818072189d94b3a0277e3ee40000000b06b89f573e9e25343f4d2d50fa40f4e81404494894fdf867a62fc530d7f7c38106044c6e6e4e93491a8a3fc9931e54a77540711317648aa1a3ae3cf375793d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B45BE771-45C0-11EF-B557-C20DC8CB8E9E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427549812"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2792	3020	iexplore.exe	30
PID 3020 wrote to memory of 2792	3020	iexplore.exe	30
PID 3020 wrote to memory of 2792	3020	iexplore.exe	30
PID 3020 wrote to memory of 2792	3020	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bb7a6c547a47ce7348d3b6bac5cfe42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d070eaa23c66637b717f90aa2bc284b0

SHA1
c73aeeeae8da442554b62097a3f4a60a29387dcb

SHA256
2f27085e230f05e02008ca40a6c12b4b00dfee2a8e8ea45929ee7ca0341f6b44

SHA512
25d4f00c71eb101b93a18f7f8f40baba61772840cb226209c98ba574abd2b63cf07488e25d7e69a2609a459a4341730b21a0034a4c0e9f3d3b0505d8e03d382f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b1cf78dd7e65c44f6720d71162a0a18

SHA1
24ea9164b16a5d05e2a9387dbdf55e65a75c667f

SHA256
8d1b7e1db8fa7dae259a5e4c99089bb7b21b18fda6dc35134a4098ff6f1a0f62

SHA512
cba5cd9feeb53f2f22df483e87b6ec3bb01072e5532dbb601b402eb0064fc814a910b2b8d3069cfd881745a34b94cdbb4da7d40aee26d996f88fe36679069f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ce793f45687d5a0a85a2337ba8b6c3c

SHA1
f191e488c5cd0affeacd96b5399f1c60af0ffd54

SHA256
1d18a02a95ae93abd73568427ae0e1db06fc771f097a780ed36d7e5d0563253a

SHA512
e1a93883ef6b788a63f0df1d57c9bb93cec9dc75cf37d95e115085f5f2fdcc67c4743bb3ed4554eaefeb904851d151dcea2e441c2990b07a7078539b96134e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ccec2630d8cacfa3928d9e8862471c6

SHA1
11f0c35187f18b70a9a48e39f48afecb9a9aced0

SHA256
7fda98b6829e5989d3c1071b5668e27ac1862fe82a85b80dc1f6208a6b2bdc3d

SHA512
f5f42105b094543ca9a9392a64b5a4ec919b89c6e45dc549e8811988875ae820ce7d4e3b6cdfad34716afdd5e71886b3e749ff5bbf38ad6b8119dbc9e18aa42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81df55ad9db2ac6356935c5c9ab7b2cd

SHA1
e84e78735112d66a422075178ca77cd497048d06

SHA256
5ebbac38a3675534c0db475eb06d3b6c65d33626fb9a0f31e2c06bc8d56ef000

SHA512
e7a50aeea00769597c9c302d981a78e99891527a164ebef1f3de0272104a66fc64b06bbfb347bd75a07aafc116744ee8453649b30fab9a8fbd4b374dd483c9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c2431f6fd67ce776c73ca121a6e6994

SHA1
456f19db82c14c37b0ed15df345f9832683a195c

SHA256
7e0377f828cd2184c0b7f322455241ea9f7c249b201ef447bc68bc96e4123b69

SHA512
bf8ba82729f4e8df23039e6f36136c066bd9ceb2dd767e8feef7c2f97630a3c114fbe228d4ddb9b29af48280ab2d2ce0b514d3504384b7d7968ad321609fdd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16dbac8da781c319be51d563e3a6fca4

SHA1
86f86340168028a3c17044126b0fe81ae35a3cbc

SHA256
0b434b3b35060071b7a384ae8217d02b8b397143f112b04071327a0ac4fc119b

SHA512
ed368582b90926342ff4b9842de330c2cfae980831117ae81370338b4649c4212da6c85f2a32f4f9027260460c9ba7e3f66b76fe663f139537af7954f51ebc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28cd2ae1dc9170e2f6b3543603a8f849

SHA1
8d0924850b60b10aa9777bc26fe66696eb420840

SHA256
85431fced483a334f8e722a7a9b8f50e802aef0390fe57ae0d426ae8abcb0a11

SHA512
da01c4f2c68d911a9dd67dfd273d1018c5356881c4bb181e5f8c3e7ba12724fbff485b42672a0778084f18625b249bb608d293c2ac959c2d755737789d9ac0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae0c5ae8fa24585cbcc70edf837577ac

SHA1
9c9582f7715377b12e1b9ed90e31e43a87b813e8

SHA256
5c07f4f07120a29383623e2005f9e82fccb55085d2ad1be5019eb9a4b881ddaf

SHA512
e13b4ab50fbd0075b83592ff0ea093d65c37229dd0a0965ee40a97314253a8f9d431eb8c8dab62280244a7381f42124292e20acbea4cc92a7f753fea04f0a0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44621dbf0a2ea49fd727a3891379be16

SHA1
d2b3f46a0a71f0567afa92521bd30219073226b8

SHA256
51087f61c630fd5ee6c6423c058966b2f249b7c24502fc9dedfab003a61eacda

SHA512
2471d1d9bfe60d8349f0831a4da82642d6fcc5afc0bf87084a1729cf6d79fb226b247edcfee46c3fbfb6a23a6ef71b7ecb8951f772f8227ffd33ab0e0dfd3ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7332e8a17fc0473cc0639897599b95ad

SHA1
807f8ff37448d4a79eb5e77f76ca5737da96162a

SHA256
9a3d9325d2a93ae013d37c78a5926290081b1d1f7bf07b7e0829874f7c4a8d10

SHA512
fad3505d40483c528a54c8c9298f9677ccae9b9d836f3ee97ba699e64226a5dfc97fe7b026e6ae4e613827e1615cba7203b4f584b18159bf97d8e2d4a1e9db3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
475185c4025c4ca035282d534f90c798

SHA1
e2cc380b942d6f38468234ea07281f4bb5bda5c5

SHA256
d1649e2d6d3770d917535cd7957820d8d335536da109050d8fbb41dc106ef6cd

SHA512
2d1039431da5be2e256f64f6382f08d353ce48278eeafbf55f9f3a1280327841c2a0ea93c39ab48ebda51c97e4355d18d33e9a587c25785881133d8a6189a3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccbac828531ff671196a39405098488a

SHA1
c21dd68bc0c34f64b81e2c95abab7f322474e052

SHA256
9370bacc32c60c27a2b615c25d334e8521addc27ca10ae99471f36086a426931

SHA512
080e29a8f6f5c295493dfcaa04bc46f141c301f05bd5e6f910853a45b8bb424bec75fc422d09fb9cafbe06e9c8c148f6835482f64e71cf73ce4692c48db10f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e333eb2875a9b79d4ade0e5bf9fc246

SHA1
f6aaa92be6d8d1044c12bc9351052ca7d52bea0e

SHA256
5eb77c4c4c56319f790ba5f0de43244bf43c63ffe24dfeee7a05cba7f4013da0

SHA512
1020c31532a6e8bc8ca322e91dc318d6c626984a93dc46ea5b178c678ddb068ad5ba7233154df0dfc34fe776d2f61555b561e25429025dd3660aab6f5ac2217e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd6288b648e7c889eb7a575c440bc83e

SHA1
cb2ee3da16d4534984c8eab7e1fdb1fa49da8719

SHA256
8fe7566e7f963b42c32149c46843303b0b951369b4aa842f4004a07b13796903

SHA512
f9088c2b52230bba6dd3afea08cc69f955e0e5bb8ee1a4da19504527e628d8e3edbd1155623e612345656471a595812b92633ff0c22d1bd9e3f7b3c4f4c25b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ac38c1b7adc7c90e1bc7acb19996ce3

SHA1
b088d32530c11ce93cd146e30ea0be3f30b99a0c

SHA256
a74764609d87b02f3d2a2cfff0233bc349af95a96e37840260ce1f12f2bd4211

SHA512
0369538144c7a5e1d3b6f9fea3dd93623d6bed8ba34732a4ff29255fde0dee7cb29657021cccd25db8fe37755c3e4597b4aae610c90f3ac6913c4e2537d0f0ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab342A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit