856aa51ee2d4b44c0c77d523c25fbee6a90f19ebccc4c70288630c7c80724e63

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c152c70b8b5be476c972bb3b284a55a_JaffaCakes118.html
Size

71KB
MD5

5c152c70b8b5be476c972bb3b284a55a
SHA1

040f728049c17939bfc67ce92f58684763c04725
SHA256

856aa51ee2d4b44c0c77d523c25fbee6a90f19ebccc4c70288630c7c80724e63
SHA512

d201afe971fb375d08d864092ba38ded63c0624fac58f6a938c524fa9dbb0cc445541f903b72775e0ec6de68a887e1f9c2ac8295584584cba3ff917a63514502
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcNl1HAHnpLUAWZcZ7quI2p:sIOpLG2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427556625"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005eab3a71b92be16bc06ea214a7423647a6287fd47f6fa58044a5409a3432c81f000000000e8000000002000020000000af22adcce623cca8685a1cc64b858c71359a2f065890f4bdccf50913583db16190000000de1d6c4423dc237796922b88368262ddf903341f3577ee8e113b9b9c04927a5daf60f18bfcdd698e4e105c9e685d7d42863cdba424ebd9acf9ceaf2d7a811d9e1d44c377bd20b0a8e783863a3343ff43499c71fe6ea4d8fcad285ebc31daec5926bd457ec421a0e26a40c2319fd1f3aecf7b532b9700d3a1f4a9b026f406011f51df3702bcc846f19bde7003d63e533a40000000a95d7a11256c73eb92c432407bd4ad512d0c2db4058f8e58ac572a9369d670a8c855dcec0e7902f9ac8c59f0b285fd0c340bac479a4ad705eecd7280b7870ffd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d81881ddd9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91CCD8D1-45D0-11EF-B961-D22B03723C32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e12a7965702fe971166e6374f02888d47a392a85764886fd4f34a376580601bd000000000e8000000002000020000000a7adb2b51b70144635c3b90631bec41e1fa26ce7d84be712e7a46329cdf00a3820000000da5033d69cf0f4f315de28f3a3d7a0155dba8872987e7f725abc973b183c083c400000005a0a0cf6c5dd5b9310e22223f111933adb528e23185f252ee4ead5a4d301e60f5e86b1066b61f70cfc0f55cdc903544817a95f09abbf97f8068dfd1a499e8071	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
784	iexplore.exe
784	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2440	784	iexplore.exe	31
PID 784 wrote to memory of 2440	784	iexplore.exe	31
PID 784 wrote to memory of 2440	784	iexplore.exe	31
PID 784 wrote to memory of 2440	784	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c152c70b8b5be476c972bb3b284a55a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd85fbf2667bc69016b99d5655e52616

SHA1
61b451eebd611dfd0a9bd5f37602d23f92061dd1

SHA256
19ce685678afa9467878f903b7a500e6102636bdc80d52e20d7c80925466ae9e

SHA512
0c851a9f20cab4a09a0ca8b20ff74b7aa8f4e7e57e42578df0f559606177a8101497374444a6084352e73fefe02ae8135369187844e63f209e12c9f867eac2d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d3f48fcb5672419728985bfbaca23a

SHA1
04a45a3b64ece0053e4d90d4f168a4df66128cf0

SHA256
6f4ab79fab43fc746a2707833f092b89da1b29d64bca2b53ebf1ff414b5916d1

SHA512
6b00bcf9877fcdec558b092bc51598b11a78b239442d3bedf5f240d6cf512e05b6a9a344a02b97932d4c9cbb5778c9f9df4900092febfbf088daa401843971dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32440e0d12d14a3230b1ae32df5d0dd0

SHA1
06df7ce73d738c6755d4b612106cab98f481ac45

SHA256
d70ba0df7f954defe6575e89abaa077cb2ffccca29b4ddf362843c9e3bc3c7c6

SHA512
83732440f642c2611ac6d22355b900310f73da6c0bba5b14a0a53a54ce4d9f7daf65032f862f43588b8bdef57fb151f1ec981cc4689f626f5dfd479fe401ac89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2d670c4d6720d7dcf4088346ea09c8f

SHA1
fc331acfd8faef08f24dc82d582c2f6530e06fec

SHA256
8a547f59eb6780312344344329a9ee733456962168fcd7365861ea41407494f6

SHA512
984e5d8670977540e49a359079d2b4e4b1755d116188b6d9d21478adadfc7c52f828ff79888e4d8b27d3132c65751bd828ec8002d1faf20bb45ba766b4add460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a1d95496fa6f7b747bf4a85ecebc5bd

SHA1
989159daadac3b201af8048306968127bdf1cc2f

SHA256
d5830c1bea3497cdb0d17fac02140e4f9a05e98eb1a365634e48c836deb3fcc6

SHA512
bb8bb777e7e28bd2cda162af25dd7ed08ada45b2add4cf1d27e45238d41a9bd1c66ef0b3abf331df428cc1ddc40d9c9d51258ed08b0374c69f4995c48bd51997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39dfa3a8d4c36df4da812da70201f96c

SHA1
a23872af8de5fc23543bf2f66e47ffca05d6336e

SHA256
bb4c460d550654d0b1689c81ab534d942d998adda3dc337f19d607e287edb87b

SHA512
af61927efcac11ae133ab5458fa4ac1fb055d615e591a310553f7e2471e2d2fafbb3d694655807c25e05d33389b80fad2c311c5a2b843f6ec1b4185648608b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f03df579793b30882a208a44973c36d

SHA1
4723b5f0d8ac3bcfc6d20cc28147f4d537194fca

SHA256
c4663d8618d4165c450ca67bd3cf93beceab71ed574b93b1d955d7079b2d4345

SHA512
5125afc55e162a2b3e3845d0077c33cbbecfc77acf9911d16d70d32fadb8deaccdedcc37340cea3bfa0eccde8088b8c0cab5654bccc1c1b61cec1b0012aba9c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6e11f975248fa44536feb00c056d17e

SHA1
52de573c3d998e20b7fc298443bbbd20b04dfb3d

SHA256
6d98bb64c0f4e8d20f70b4d42048699f89fcc0c5c207732aa6bf56c037bef698

SHA512
09d711bc4149d912147b61b95e67a9899e773feb769a50b5958e04b8b43e795480a1d36a69734a82c8a4a516cdd8b35a543f2cf9b008fe2b981405f9cd42f413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e6971f0071ad650d6a7bb2d090ae92

SHA1
dec208c596b8a8642a3bcd5272d8a9b807b4bda1

SHA256
0a41c8bdfde8219b65aab423acb932ae7002c3c646b148754c64bd35e0a17625

SHA512
214096a9f2032a4540693558d3a5d2e83d8e2c539b80238dc47804dc17559f8db3a943e78e251a8692f222d5b77d5332ea9049cf4b6acb161ca28adec5b7b37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ac3aa00349f713c20f49aa4ea94239a

SHA1
cbbbe4fe26e58a0ce70e9d8cb4d3c81a5a48c94d

SHA256
cbe024b27ed1a5a44713a6f304f1e282b9537a0ec0fb54c4e6df6c81ed27086c

SHA512
47e3be8681c9d1446ea63e64070498e46afb0f24556aa4084836031469dddb9aa6cad3deed325e1faebb2b5a07312ebadeb4c353df3d06b7345cc8953eeccd1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fcad3912d3742f89923f824e2866de2

SHA1
9a5f4859133a08e951c8ff24a899d773972f28b8

SHA256
f8fa42c7a0c106eef679f7c08a09ec5170de8eafc2dd193843571950f2de9daf

SHA512
d203eda1a561b41c6c8fd3c6204b1436f951c65c9dc6971d825da48b6e39b442ebc4b9e356b241ef77a82cce3d06d36de393d56648d7417072481b7c550737b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc1843537b868c3506948de5d1581de2

SHA1
1d5d0a5f3f85d270491c66f60e645c4ff4c01f57

SHA256
beb92ce48a382875465f899f8682d5001e996241fcd643f49372cacccdfb66df

SHA512
50209f98c3d6e6389a3a03d8326722b1f1463de0456925edfae972eef62baea5afb1ab45bb49224941c0252e5a836d64bd8e36657101d49c875b4c06963895ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efc67ecc9ae612705c31b8aa1052751c

SHA1
5990ce3773e1cff83fbb2347514a4c4042aa7230

SHA256
2aa25447281c6e27c9ed07dc379b2337884d9abbc1d5a599ff3c1283b1f8f12d

SHA512
d41e41ed4142146c9df3677e5fd2c87f7e754c9cb944f65369e2ad7329e46849620d1fec8e5ff7ab5b16bf8f6472a9aa46a7692e6c0829c865ec132a11159d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c9f788c92a27ca01ae35b6fd10e5575

SHA1
f792cede44df417193ea0cbcce45ab3a0da88aaa

SHA256
2bec520a5c08886f1fe7dde800c2387042cce91bf371826228d6d2812d3dfc78

SHA512
ce687ae18c3116dcc96f1f62c3d5bf257bb7c85718beeb6962fef27b3161e07e02fb8559caa0b68dbcd044a6213cea65efc14a4b066911b772b0b03a46d71ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17fa5b33131564fbf47fc2228feb5961

SHA1
b83217f94875e1f44933751b3782b94c58eda4c4

SHA256
be565e8c03e2b692ff6c3ca6bdc535f0be4cbfa7c9129ff7f05e4a739cda244e

SHA512
4193ce368963db7d07ab49192bdf26f84f907a1e8942d15629f18e43e5e5dc26f3080867308468c1384a0a11cbea29f2797269bda1d7cd4a1236eac78d78bb70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c2be8127324a0b7e6687e1d3b42ca0

SHA1
67b918ecbcbc7d86430b1eba481246eefe2a64b6

SHA256
5cdbce053a0effd6a821df8e1ad0327ed5fc5b2862c14ac8fe064c1c39bd7153

SHA512
5a8fc3d7375319a8fc57d340e6465d3ac083e30a04407fc1c41f40b3c69862072f6113db24c192799945388617d88b638f1d2cb442dd4104d9974aa9ef92ee51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8493ae84d6cb929e141c0cf86fcb3e6

SHA1
d262c1f99f47502ad1ca96b9c6aad9d166bfede0

SHA256
64c30382dd492b7427afab7a61adbe538633ef11dc000d014753109192f223d3

SHA512
0e602a4a705779ae74644515b31f1466232132c9f1866205ebdbab0328e8be49e5d77e60a644637c559f43800f68501a3f379db3d6e2a4bd51eb978f2fc27df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A4E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A50.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit