0b48916a3fb9688454b6748867f800992067a050f7328e319f5f524e9b69301d

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d98cdd902bcbc17c66aab5672d9c021_JaffaCakes118.html
Size

68KB
MD5

5d98cdd902bcbc17c66aab5672d9c021
SHA1

2110ad10c309497978881fb40938ec20496c19e6
SHA256

0b48916a3fb9688454b6748867f800992067a050f7328e319f5f524e9b69301d
SHA512

bc7940c8b9b67e919081cbeaf24adbc4e452f249fc798902c7d54ae83ebf55ae06cea2d28a43b135eb2da6de401ee38e72daeae3ee864addb21490ab38bd032b
SSDEEP

1536:+IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sz13e:n13I6Gp8Y5xBXV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b8e580e1989bc87df8e4d5060536b8e154f9c3009ec400c06052e183260d4ff9000000000e8000000002000020000000fe2273cacd5465f74152a8f76d064f567804918e713af0afe965c9f656af2aba90000000e3d9ccfed0ee7e228bfbc04d8886339757f8f7a548758b5a71f5ddc3d331b4d681eb208cc72d58b379922027ab0e60ef2c03332018c84cb1c23045ad98a656b90a8b26c330a955526c8a900da86ab0d23cf3fd70a9ad00ede465b18a55a9cf03fb42a8a68573a3397ba95f07eefd7429d92459d0cef9322d6efb42a44c08761752bfcde7eee70463a57595a5365dfac74000000099324838eb0d4764168af7698d67910f92f079e3bdc1153caf3f781411f18bb6268b7461e3fe08a6ba1592337dc2e9e38f58e2b57f786ab727ddee396ad889f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e0960c5ee205f24448c81322874b62bec3c3726d63b574b433d74bfbac340920000000000e80000000020000200000007b61375ba4a72a854fa0719e725c6cfd255a36feb34a33da15e4ecedc6461d80200000007357d0c786d34daca01d596602abdee612c3bdd1ce9ff7927894a134d56c7ee94000000044cfdc74a899684779a50f9b4590323421b6c8690cfbaaf71da784e4b57bb7bbd02905a015971fd26a6dfd0cd2b04cd4476e75849de8587aaa8d491de002b392	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c016eea31cdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427583780"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAD0B541-460F-11EF-AC2A-E6BAD4272658} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2376	2432	iexplore.exe	30
PID 2432 wrote to memory of 2376	2432	iexplore.exe	30
PID 2432 wrote to memory of 2376	2432	iexplore.exe	30
PID 2432 wrote to memory of 2376	2432	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d98cdd902bcbc17c66aab5672d9c021_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5261f2f7bdda9f2e21d6cde09277deb

SHA1
919b0615fe8ab63ef003839b2e63c14a3eb70274

SHA256
4390616129f2dd303a3e2ac9f4d78cb92fec348fc06afb4acc9a329d3b7582bb

SHA512
2b00edfded1866c8c472ae8185b172e14283ac78038957d9ac0b33eb66105bb859e7c647aae9da97c0b56a8b255364cfd692ff2307d60d828409bcb24d630299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f9cfcb8e5c56e9efde1e6313bb85131

SHA1
dd99e081980072b304f05a3134357bbafb54b572

SHA256
0617ce098d46a99920623e6ce224e6bb5d54547e0df10e09f9797f587d324585

SHA512
1bff68a47a2c834666084f83cdc125f1f649d06bd5347532b7a4d2149eab1b80b4e10f044faf032d0060286fe42c554948bc4354235060885dcaeb45efc39db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c1c22b4a237a82d26ffd164bc5bb3e

SHA1
e86af3af1956312cc7be47d46d87dcbfcdddeb74

SHA256
60910c28df7e7ab430caf472b5ed7756665a6b72d0e0a7801ea16405a210963c

SHA512
54cbf6d25e8fc40d3460a6c70b52f6cd17ed40cfcc02232e79a34418cca2b308139d27c0584bf985af19caddfc9aa1393f21c61eba58d98dca3e51597774675f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f89e38f1547f0e9d7e18d05514f5ca6b

SHA1
5424376f7adc24d1b0b21cfdbba8d7531950bfed

SHA256
7e81e7c4521d568c9ab3d1d0193f25d3329ba18243317dd00b3e8e08fc9c0127

SHA512
5ef783210d98a0599e9ca69fa74a294f20dcfdc9805b7e478e2a95890f5e0056fed64d13abcd6bc90a69be6d9b9153d46f7382b858452fef0b92c5e03397c3c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a0b2e2d7a40777ada69a25b17ca4138

SHA1
100e0f0eaf4195fe1f05941236b8937752077127

SHA256
e3208c0b965a5a589cd3641cadea5bfa0f3bf00bc9869f9e0d7b0799bf588114

SHA512
7732651773b57faad94a118309ad342f27c1b6f25413de899f45e9a5a53d44bfb02518bd204547af18252cbfc554336f51f72bc87b1250501856e6c9afe6e76e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e10d1b7d78043a8bcf68bc7e82ccf57

SHA1
14f6a32eb89d9ccb0f2158d72ca33aeb4f6e2d73

SHA256
9ccc5ac76e473bcf4bdbaf3799578d9096c99b2386be829ce52b28b0192335bf

SHA512
95047785200aedd2d46b831125c373b2b3241a7eb3f40ff611b4829473744dbd1a10a4fc5e438ab5b96469eb7f7513ec765a54221f1496670dd78d36747c217b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dd5aa7c2e61303fee91c58ee1c71d6f

SHA1
044c3b0571904041e12dd855e30f2a937fbb1d33

SHA256
51732d944f24f3d5790826cdb773ef8d19c7c994a6c0d8ea2de82a242505a21e

SHA512
04582581e4be000c8d4381aecdd2742f08c6b68ae335f8dc1070c93ecc2e9d20cc75afc89862447c661cd9d667f6cf0272847c881c6d5ac66f1145448ff45b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6033c0b667352141be894e7cd6e8fbc2

SHA1
b7e931c8e18ff21bb6e2bba56b86448dfe156197

SHA256
b2d2d94425e08f8f5771ab468c13611394a79a20ecc73d73ac9cb38fccd22aaf

SHA512
c648e467053998c31cac0537a59f7ba58cf6152063869259920b4563af7c274ddc1a5176e3d15e34291d53a5039d1a56d51a9c441092f7cee49a9a89aa087347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
210af76c626a77f66373456167f1e62f

SHA1
c2fe85f04962955e2a66c42fb72c0bfd3ce383f6

SHA256
74935d31f4384a3002d14efaca26767cca0020cfe185fe04e584fd1209fb504c

SHA512
bda6d236e0225254d7c039c5a2f4dc6f3f5839008fa4576ef44d35616129e0bda346e60bc3b2c3f88ef1706ad40fb9c9bb4db0efb18007439bdd6fd2e44403bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd6fa42d38a6d646b07370a3902d59b2

SHA1
1d9adcf5dc3b834daf6c3f54125f512afd58043b

SHA256
609b2e28e53cb7231c968291e1df6b425258e12f0cba1d61646abbea35be268d

SHA512
581f0532f35652a879d8a2a0f5921e798815961935d4992d2bc010ec4b8fc6f8dc8e6a723983b9709169fe948877b1f45428cb8ab90040af82435f6b9451fd70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d4c33f9d8be78e344ea4aae510a8a28

SHA1
aa2d9cfccf513a44c8c8a0e94db7b568733b6ac9

SHA256
885e6059ca5ac2a9af23cd8fda80c8c47b06bdcf68c5544b5330755eb25029cf

SHA512
e58d4b0a330aa426b1b8ae4c9be336dce707cdae6b8621dbf65007d267fd74c8a556bc3e68ae88cd4ee301fbee30461744e19aa7093b8852bd9b286137f9f70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d7bd923099077d4835f95c5183a6d7

SHA1
9ca2e53aa95e9b62f0dc7eecd271da20d6cdc6f2

SHA256
adf99e6fc271d2738804044968b3b25d7a2e3244541d8efa24e00984412b63b0

SHA512
8943f35b94127d51746192db310b2d6312f9f98628b5e20d0d7e2847f42ae0706288324bf33ba687848ebac84a20e6792fd069a14adc60da918b30619eff677f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E54.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E86.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit