9be94fd81fdc8d1d29f28aa98d8a0a242412eba1c0713f6f64ff46371eab00eb

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ea5aa88e1635f72d9e18bb2e552f93e_JaffaCakes118.html
Size

10KB
MD5

5ea5aa88e1635f72d9e18bb2e552f93e
SHA1

b63183df23a209bd879f116c15d397bcba128240
SHA256

9be94fd81fdc8d1d29f28aa98d8a0a242412eba1c0713f6f64ff46371eab00eb
SHA512

14e9696239e85335c0d3d4c9a6b5309ee49316dae804009e49b293059a9994dedcdc5a759bb1952e90bf8ab8c1d5c035b06659a2ca7df4e097751e207b5ce032
SSDEEP

192:SIjlctn9phIwH/3xVyhxI4UFpMKVUNOnVl4NmsmjX1ln22fBCgl6PcAmT8:SIwn9phIiSuMXNOVljsaldNfBbic1T8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427603530"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6022F21-463D-11EF-80D8-CEBD2182E735} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a91d6a41e752f4efd37f06b586227fdeaeaee065e4a0377bc64bea53058f2248000000000e8000000002000020000000bf4a3ae96f0c8c4bd9bff415b3552b2adfb5d5a46d543c5f1e7df79d2b82f6249000000018c811257d7567d0f30321a0672a2e838ff6f362e38a99ef58e10b2a878f7276278f2fcbe70340a2aacc63ea648287df33d14a5ed01171bedae15be17df94dfcd690b8bb44be47ae59bbe1d895d7a4c294cdbc6821ed43e33294c911dea4be14b61ad16ee790d28fdac8f8d58cba8c06998d9cf71eada4e2fc599f752a073f9d719d5a74d63417f8f9530496f18443c340000000b19219e76ca71f36ec6d554b539f75bce0bca4d68eff7916f4245aff3cc9a236100fce7f9ac600473ed3cd0fb638ce384ed279a09d82af56c72aa9906d1fb4ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000508a344307174cdb55cefb2177ab50cf9b99ca8362974ef21a81ba5c09c76483000000000e8000000002000020000000e414e751120348c2708b51183f7624f5dc996a343d1da26110c4f3b33a3103c4200000009e94382f54dc4e897fb5955397f8de7a6bf5344320e739c687627e225382bd54400000008c5743dd90216243cdb4b21277db4ba6039d70c13637f6f32e476004377db9ec7ecf4f5564403f907f5d0378e624d42b7a4c82aa95862ee7a9cc53668e4c78e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50383a9b4adada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1800	2448	iexplore.exe	30
PID 2448 wrote to memory of 1800	2448	iexplore.exe	30
PID 2448 wrote to memory of 1800	2448	iexplore.exe	30
PID 2448 wrote to memory of 1800	2448	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ea5aa88e1635f72d9e18bb2e552f93e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d904f8c641f72f44baa108746fd2140

SHA1
d15b8f4908d8fc44261a924eeb28f19755d0e84b

SHA256
92af2bcac9373dbaa3973bde5a3434df6e52a53afb3db7934096de88af33bc0c

SHA512
9b1b25ee04c8facf6396a039ea98d381041c18998eb1e3a4adbd62ffa49891ffc5b28edfdbc9f134bcf0ae956369db58ad0141a54b11280bd093703ece64bb22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7b738aa74ddc2da30da3c2b12c9e6d7

SHA1
943ccf83877b0dd3d3d0282aa5ee0d99125407aa

SHA256
b760fdd577201a4c8041104cbb0897fb5b83a2685cea0a1d1445119bfd370c4a

SHA512
9df835164d451fa19aef2c098699191c020ef64fb97025a94fddc305b0a19f561752ab3ffb906ccf99048bf46c931a793cbfd1236e9e073e51ce90ea4f81a576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
974c3c2430714033641f8b5e1a219d33

SHA1
65c93a5e86743ff41704e3a051d04c743d1cd3be

SHA256
9023bcd770ae12b471a1040ea98a012cb394c6b6a09068aa05e98561db2f9bff

SHA512
a8ee5df23ccd098e52680b161bf37ff78f777fcd34d2e7837f9f6d3b23fb37924d54adb986a6760b1a8642f70470bd35142e80a0e31b4a38ed7a581df67ae7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
032d911de3285f90794bf8692de16291

SHA1
41168260e44a7bc4f5a03f606b2c1c76ed6a4e8a

SHA256
4abcfb9dc5716b5c523d70f2a86be91ce56be6de880946e265975003e8126dad

SHA512
e3ad925c80b8420740d085f538421e5f37fcd6288f342ee4244320f77389fa0a042d6b766a22f9041407c5b02b58303534dc43a44eaab259237f46353cb29d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f7675e6dd65422577202ef3ca237091

SHA1
d2a53abd66d426e98aba6f05963fd5019f46699c

SHA256
08cdeb975459d4dbdc7cac2dc89b826a53361c367a006fd7973ca068d60f87dd

SHA512
51ea7c2ac901cd03228c78172aab9c0f945143549692ab4f629bf6028c428a3db58b14cb559e05f901f31caff1a3f1f98d61d5f2fcffe34c38c7e0434ca4c326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
203d0dc6caf5d9d9a6055dca6cc906a2

SHA1
6d844b4932998134c90bd60123aed6794aeeeeb8

SHA256
a46b0ab2785eba76bff616aae03043e716be846379d4da2945d1b1319197023f

SHA512
ff3192fc4f03ae5b7c0879fd347deb9fce13857522179caeb8ccca99d821eee510810cd8599adbe90f7820e789b916e2281c9fdd6d1d321a97748bc72f976d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0d74542f95de77ff5f2b80809fef12

SHA1
9b6ad7aaaed7b0d1446f91944f5b9d61bdba135d

SHA256
404fe9f4d3f5b8e35bf0132965aa6c95ae6102df424883d3c4c969661d9f72b8

SHA512
56358422c214cb9dad922f5265c3433b9dcdbfa5693182e0386cfe0cba15cdffb684457fd2c0dcf0392018af60e3596e2789d4237a6b0bbb116afa0a3f05afbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c082940ffe2c1dcdc08b3b55541f722f

SHA1
050fa93724423831f75f99cb7cf5d79d8398ab5c

SHA256
551f12aa66e6be5841e08286c229e1eb88aee21e93229895349c4305ee75fdd9

SHA512
72d26b3be72cc04fc797d5f888d51802104903caa36cc90b473f9fb7e67b25d35a44efe54bae844c2a48cd3a292ce1065f56991eef6fe71756ba4f38a4ae2de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
709e7d0459d0942dfbb6a46eb3966066

SHA1
2726245f753771af3c665aad325ecb6913978d23

SHA256
ca4b98a0cd17bfc41f8c6a05412efb3bd4fbed4afd88f4abfcd0c3303433e613

SHA512
48ca2889867b2c4225f49bac78492a81435c805086530151bdc7005a17c433b2b5a64cb51e362881fb0f86ca93ae457261265be6a184d3f9f8e6588d29c0acee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5d401dcfaed4b003e09e4664c96c9f5

SHA1
01dd5c0fa74854d1ed1f8a23b13158fd02800f77

SHA256
7da2a109ebb4f3760b54b5f9126690749a757667755ec36e86abafd15ae40d37

SHA512
2958c0f984248f299627e6959c6e360774808c49e5134feb08c10577e6c5e406702ef6bdb616809286dc267a1d01e763ecf61d2a08403e78afd050fc2fe11970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
143d1c53e5baa06c54e18670cdf877d1

SHA1
05dd0294f7e3e54e685af5e5d25a03641753449f

SHA256
fe44887825787cb46650a748a7f04422713a9ed2cc60d2a4e1ddd543e77fb9e8

SHA512
1e8d7a1715260abaf1c738c4b8d3b244f66f1d89babe4c463e9bf7202650f3b496c2cdc1129817ca7a73aae38b9db7b330e64957735e685e2b39c43faa908a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a15e670af6518ec14368283eec92d6d

SHA1
bf3db62bb2be4bad9e55678d13f9476976390932

SHA256
47c262f050b5fabdd4452aac6f8a7845f0c8aa1385df57a54e01be1cfe7030a8

SHA512
b8d01f49232d84a08b36c08e7d11e68ba239198641421efa9ee594932cbcad4f640a3513c02bc27645d6741a944a93387cd946e9f962ec8f4c168df4723f1832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8931df4f063b4fff1a973d789af095b8

SHA1
0378452de0eb249ab14e131b2eec4459e9bc8158

SHA256
fc63fb0d5c9cd4c39e1dde32a0c9b34e0333dffe9e32f3322bb5511df82e21a3

SHA512
cff796c3e4686860c0ab634f30e30563f0b71ba49a8ae82f17e77e9c0eabded5d752da4a9756c3bbac37c8f738907d185f3cbb9671c68e542ff3c8bd1d604aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9de6f48dd3e89237bcdef7f98e6af0cd

SHA1
a9eae31e81c3ecb3e400ee1f020b420de436ac3f

SHA256
b6e93a6e03d79cd8796cff27df9d5898afa02c11b79c37b7e67b8dd6c814316e

SHA512
d95658c3c3d7ec19be728579f35ed23be0524699ec75caa9d89610e12bb6e88b9d3717abfdd93fdc9d9fb405052021b4f06a1dc2a1c9a8029c15a34f75e30dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7fb1d212299590b9067bf522cbe28e5

SHA1
118cbfecba1ee4a6f6ea4a1388e77231387624ad

SHA256
3553d7b9825601286a42cafb59e576a3d724adc0df00521fdbe31f5403f625e9

SHA512
84a778dff8db008efdcc9d9a3a39f5274274207b3a2453e91202d4b7bb488165856be94652cdb5e471fc9f6c2dfa87a8df6c80b71a88c90e99f7eb73864a4813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a442ddacc032bff49fe681bf9726ac5

SHA1
d5a910e859988fd1b49248562641412693c967cf

SHA256
9e216b62c009c9a6102cec9a5d36a077e432a20145e68db807e12059bb71342d

SHA512
f4f5d66c8fb6d9f8c4467f2b42b53b575593eed2867e4a060e15434072e190940d3b63bde39fa8fc47152cd4f31f0542f70eec9f83568b52c9c1bcb9f867674b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41E3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit