091a4b519abe832ccbbfe45cf85a2b67d346f5ad47886d1bc11a9edbde1a7904

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c9393060bb7c2a45fd306c83515fc90_JaffaCakes118.html
Size

15KB
MD5

5c9393060bb7c2a45fd306c83515fc90
SHA1

6850b2ef180ba0abea5e69049ce876991a305e08
SHA256

091a4b519abe832ccbbfe45cf85a2b67d346f5ad47886d1bc11a9edbde1a7904
SHA512

ba925971646b14f094f3277d174a4984cd4c843cbba2ca77dbb09c986328a0a1791927526ead028f23999cc543db3ae677b7bcdcf9cfd298324ce256db404446
SSDEEP

384:Ojr/RBg1+e1BH1Y1e1/VGcJZ4vtSBWu3KP:U7Ri7JZ6EBWkKP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000008ac6134ccc81aca3a6678d248e0539f4583bc0f19c8b16a53481333200657c14000000000e80000000020000200000000c1420998d2b0faf087235083d4ebe661b121f9d6b0eef306fd8d82f4115bdd29000000078e22298a69a8bb6a07147f99184732d8de3b9b0874e0e8596548a488ddea852e3a3cb93042073033eb7425f0a8f401f6b62f252303bd1748a0ef49c5a4e75b39ac560a75daec27882b75676c42323f76cba02f9150f3fcbeeb2408312ea42f864ca2b87a867927fc36c0b99d468877c70e47a94f493ec5892e932c4ca8bc49ac2b6728f547b5cdecf6757e6841493134000000070913df913405b44e3f863504efccf562dc8f31c27771b1cb5f8d635998f0e8514c35ff493502ed9ed464b1fb52cea5b8168e5c428291b44b439cb456d00645c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906d543cf2d9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000036995778e4d618f2a13ce39a85d062aa0a059127db5bd087146ebbf59847bf55000000000e8000000002000020000000a858e974d646920862a1067c704980c42128643fc98c835ef190cb69847077b7200000005ac68e08b3b3f1a808376913f023e8a2d6bf7fc31bca4b4964fdb4a964b2a9a24000000014cb79e8f44492a22d800e6be19a27cba73b7fd60bafac2a3212c126f8e2580cadac50d586acf4683f169d1ac82eac1571fff8a3d4ee333d0e48886108518f31	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427565574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67CDF951-45E5-11EF-85EE-5AE8573B0ABD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
588	iexplore.exe
588	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 2816	588	iexplore.exe	30
PID 588 wrote to memory of 2816	588	iexplore.exe	30
PID 588 wrote to memory of 2816	588	iexplore.exe	30
PID 588 wrote to memory of 2816	588	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c9393060bb7c2a45fd306c83515fc90_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:588 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66863182cbfbb53b14ba3754ac656b97

SHA1
b59952623b9966d9f220b7b72c14f00475aa80c8

SHA256
0329b9026744414c853f741b620cde46ca948d91695abf537d2739819a151857

SHA512
677389f5d52e09d0c0c42d4155a8117f39ee2afe760c0b4e85da5776528037a07e9e22e2b87dea5086f2785e0fe830a04e8e9f6b7ecd7f605a199edd8adf388d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
182fd4dd4143518606171c9c3a120956

SHA1
db42ac508bf97d4ca07d6a8555997a60343cae07

SHA256
d1c59a452c8a9fb62d02b9dcbab8a891cf7f1c0e9dd5d7d5e0bd4dc609d8d51a

SHA512
36494cd583d2aadbf35a6ffd2f6ead5527016e14c7ebca7202a5e9f82a1f7d1da593ec822ed4e257e6e129b934b46c630ed601a96c0c8765e4679716567648a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59cf2184624081ac9f65ab019b6545a1

SHA1
4971a52cbe2fc5998e6fb282596b474b4aad4472

SHA256
0989870503967948dc538ed789e64f1d07fd104cba40171fa24931a0f84bb157

SHA512
b2e5ac1fca598c7746828936994b2550ca6b76e7be07dd804ac3742b559f30fe01bf2f91472836f27b3ec920303632adb3ca3b89b0d90648eb611945fdd65338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8d280e76e0924257011918947c874c7

SHA1
eed783cfc5a8b1242fab55c08538893079cd6a1a

SHA256
240af59bde5de0895c8853aeb799bdd8e1ec02ef0c7b1fbfe3acb97f0a2d8432

SHA512
9ba4001a2b020de3f2ed548bb2a4ed68c91489adb1ad9bd9c61e94d186a7cda5303fafd85626eeccabe2449ea3f603669110f09f345e100cd50107ba31637e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c09ec8536e8c96ffe0a304d0fc63209

SHA1
5bd1fb5593acc71417189266f6837cc8312bbab5

SHA256
173a5a54b8a9eedab19cfc46e8d473e8b34eede8fbe433b3c71c5e2647c7c413

SHA512
79bb3442bba0806696a000d9390aa432427ebeaf33919e0c4a2d66bf44a62e0b4113cf38ae74719596e83796428512e19f79db5d7e77c515c3c7826a04a5ec06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b33bc0a2aab082ab3468bce1e6e8e4b

SHA1
a9c6782e93f84bd6d5c25542d6f82c69dd25d25a

SHA256
b36248ab3172ed9962a2b7093faabfe1f4da1ba9e7e080e406d814b060abd21e

SHA512
5ef03fd198dcad45e604aa3bdf9582570fd57fbbad76f84a1ce031d124ee41730b63baed37c6f84e3c23a6c9cdc007ada5364c720990299e38a6900fd4a508cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34917645e345d7fc3af3b3da357f9fa

SHA1
845877fae64879c02f1ec7bcd1da65c4f83d5105

SHA256
796515d0b40f93c6c48bfcd74cb44823aca007e856e0ddba69a910ec16a39ac3

SHA512
f835337af83611ae1cd13fb08a9b67cd3dc41ed04cd6d9e3877b5e1185861819a5ec880a97e0e8c637f35ee589033408bfa15a42dbeba157570410d37ec8a008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ed429a8ec220a8c99234f0ba4e4c250

SHA1
d28d40d87dbd5a9734d9cacee1986a39480625e3

SHA256
faa7ca6d632d27b31fd5db8c84de44626a5c0d705b2fa013d5d653c16f5d350d

SHA512
f73ebd142b8128e6fb30ab0708692ee0c3f45e172d0e0c82271507994c96bc3dae1cd7c73d721f43e6b31e975dc85cd0c95932fae3214c1d62c6857a856e690a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f706a9f91f74f53f5e4e820554c7688

SHA1
03fc4bfe4d38cf42b4ec1d03cccef348abc6f276

SHA256
92879d74501e95ed16cdc7b35663bd068fb2117bbf5991fdaf97271dbdc26ff1

SHA512
4838edbac6453b422732ce6b65547e413230320e52afd6b511edc5ffcfd0fee67b25333d148aab157cbf5d7bd992376b3dc7c7e46e8c863d2e20145ee833246e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
657888b988ed3ced933a3aa9e0069a97

SHA1
b9f7193314336912b5d1078bc5a9c5dda13a1700

SHA256
69f54287c316fcc8d5ace5f7554adf91e2e824ea44448738f4331471e36d0014

SHA512
226bfc85f6497296647bc5d365db51f58f259db432442919d9bea9d7a9621be1687d4c9b798191f4772d9ed4b58fe199cc8cfb7fc2eecad73849e06cd7d3e033

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9965.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A14.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit