92f6d8b5887deb10f480a546123699ce700256b8a93acf8ff5ef6a5c03f51770

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ee4676581eb83837522b8c3fed4305f_JaffaCakes118.html
Size

15KB
MD5

5ee4676581eb83837522b8c3fed4305f
SHA1

2ecfe75bf99ac3cd3aa47d5d5fb36df06c38b9c4
SHA256

92f6d8b5887deb10f480a546123699ce700256b8a93acf8ff5ef6a5c03f51770
SHA512

024613cac1d876c3e2650065fa10742d9947da24dd1c019edbc9313b4603359fdbefba76d9f6cb3792fa6fcbc1989099735a0eb41ecc4be251fea73a30bc70c2
SSDEEP

384:7xNqqRo/Zm046u0LlV8hdGzESdE+OPaNRr6Gefh70P4SV79zmRPjL:7zqqRWz46u0LlV8hdGzESdE+Oi7r6Gen

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a03a2f24131fb9d6d1d289d8e1ad47dcb2966019d39441eb16a0d2953a823c9b000000000e80000000020000200000004a249a17e752d7b9ae5d472859c4761f415884fbfd3c59d24c8a2c59da99681b20000000e8b2a6dbf37e11329e3fc712eb1d121624031a02e2f91e813329107f555f801f400000004e786b549e52ea3f8804edc03abaae3a8db883ceb520927efa71beaba8e95f7f24a8ce394c344cc0ecfa92e1b62df8d2a0d5222823662d98d3625e998d38ad81	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427608596"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a049216a56dada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a4fb3d289ce0fbe00dfb5fc981fe4f352367b2cb04445b1cd4eddf08fd72e329000000000e8000000002000020000000307e0522e556814757a8a6a8d81a520ed06866ccf20a04af2deb686d4cf7c21f9000000058517f4f805d8dc1d53c49b3de1ed1869557156dae0e12ab934c60ef299e63c2de28ab811a13273f7b4691cec28cdebb1f5799b1bac189f6ac6a3d2eae39f92fa0860d55d803e826a42913121abd9b5545902bd73d371be91d9075c0650a28a4360b7f01bf8ceb15748c267f09aeb56f2e2bf3288b0c6f4365c71cd8561a6af900acbcf8c9ba234d093372b61b5bf5c84000000090f1e7818db33d3e47b5d0b8cab77bec1ca5d221118d1b1f865652241cd469402001650130697a3793363326149f125d2dcdb42f977cedd81d9fe16ec7c11c44	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92ECF371-4649-11EF-914F-526E148F5AD5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2696	2692	iexplore.exe	30
PID 2692 wrote to memory of 2696	2692	iexplore.exe	30
PID 2692 wrote to memory of 2696	2692	iexplore.exe	30
PID 2692 wrote to memory of 2696	2692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ee4676581eb83837522b8c3fed4305f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
153fc7d328280c413d12603c0a17a212

SHA1
61841d1a6db2f099933d772583792ca532c362d8

SHA256
c0f4079287d35665d2eab9eaf6947687eb8068ac89c5ade96e2f4919481d9d6e

SHA512
d9c4e75b452910a920591dde703fb85820e87854412dba5c643a90f9bc53a3c2d1ea56117fe5cca2ade6af034ed4a58431e9b5517a3c5482dcfa45b6be68cfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
106009cc5f9372ca6a0289339b39da77

SHA1
58a19f9ff14cef8e790afa5db44621092db31cbc

SHA256
286cf979487d848e920101b3c4eb53c53793e6deb82ec864465416a7cbf62d9b

SHA512
63323839156a47a9f79116f479af41cf3f38ce4faed4e4096b22eab04a2e439a4a441d63b9b069126a5d9dbf6ae243e28ca5b84f45b32ee4792245b997a65908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6748816509698f30281aea86391a758

SHA1
8840de1f2ee63f7ac6825f94032bf6f697d1e5a1

SHA256
05b3bf5659116e3993bf4c1457b8bf10219e60a43867405d32688a700859a476

SHA512
97db28ccf530e3f844f9a06a0b1be18b3cf8544270ca5d27bea65a1cea6f6d3bad2cd63a054faabc560ab93bb4fd096ae54ef3b52e5aa1c8ac1ba462ea0d4cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18eab2f0ced6b8ca17a8fbdd667b3f2e

SHA1
adbfc8ebe0aed692c740a0600bc20a72b090842d

SHA256
ae37b4ed3bacaff74aa33544c74c7b6f880c017a0e0a564a18081d0e982764c4

SHA512
d057774b1687b66bf4307f5e89ce447d45d11b860a8ff76d93ac99dbc8ad7c88badade547997cf2341670c8057efa76968686889a44f33d56e0ce78b81bfb22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1476953ebf53944d8d76339fa5842935

SHA1
6d1084b259b07663877dde1c33427b8b1a331767

SHA256
abaef5a68d894ba8536ae067a470567bcbddfcf74c8f99cfe1d5ca235155bdd5

SHA512
e53a2ad35719a9fbfe7dace4e4d305ed4556db0a7829b5c93a3ff955a694d082d345dd762152392809360c63a3ca85f4ac44119627ced80bbdfaa8726dcafcc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d44598f0a60b2a06687b566312a2bc3

SHA1
64101da8058aa8fa3c389e627c89c9143cd4d8a7

SHA256
3478bf5ac293fdcc175c25b2df782d6c190674ee1eb6e0a24ff819a5d2ca977d

SHA512
c63df91dd0c5ec93f0114b8aa54c95ab75aebe2f00c21059bb3db5c2d5027e4ce3c875bf3ff379eba2ba358d3216c17f2b49e3f8189d0e4673e27a1f87c8725b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eaa627662f1e0ac64edd71499c6cfb5

SHA1
6eecd118a5ab56854f206982c1741ff3914b8781

SHA256
3bd50a93f5519d20dc1952bb70e28f772556732c1cee8479edb72fb7165ae5b3

SHA512
3dc0f85611a1149fc6081a8c0d26a5ff5984c67e1fb002b0739ca09bacc08ffaf434475296fcfbcbca00195aeb86057c6b629c2898bf72b98764fab6e3a7040d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21274394aeb4ee455a9c55e1e4539b19

SHA1
c1109a4a7e3c5c0d0b0b2b716cb934e55b6b1331

SHA256
3a08861f0bd0b9cf83c1d6277d093dbb8452dc6673621faa1c219e1fa1ef5325

SHA512
5da3806f461046fe18eb963c8d11a01d69ceeba20bc22f8434fd18beb729d7179068be1a37288394a6245c0c7f900ea1b880c113c5301bff477c3874a01aca94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7012e912cc849d90c5c6877e3af2a531

SHA1
a0ed3597d816dd410e423b28c8f276b13e4ff53c

SHA256
63124a9198d7dad3f9089d04d9ec66bc7e0eea5b18453efffd0b02e9190fb42c

SHA512
33186cc836970a1c90488053b60dc7eb17ee9d8358c442d555d671f909f86548cbb867598714ba81ec828f2f783d068ac70eafa3c889fb1fea98c8fbbe02b5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42386556a8f18497ff07497f76c55cd6

SHA1
c4db7e0175ee938f5eb937470aff7fb0679dc973

SHA256
ad5a8fe6ffbc654a0d9fca78a6022d86860606ddb77e718006f80718b3fdafff

SHA512
d7bd5f4f30d7c3af42b8a50cdb268f2a9b8047ad9b1688d770c3bd9660e005c92cc8dfdb921f4bbe480d70158b4ec9af36ae244ba7e95b75855b7e487e0836a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63e0ce466e4c7c0d2c23f5704025d03d

SHA1
7e05ebfc6fd4d151dd073b3ade0f1a35c10c1c93

SHA256
5420c856133e383e4d2b65dfba4abaeb64d1aa8c14fb88908b965f3735df259f

SHA512
d242e833706edf4052a8d12b49dce403fb91aabd1ae185d4b8ebf85134343850a98f0d47592287880f26dbe5051e55af3de7a1ac2bfb0d2b4e8b5ccbd02c6d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8a0e018a77190ee15dba3777fea688f

SHA1
b02a8543449aec86e3d8ced1d9c085867ceb54e1

SHA256
ad9df89c9f19f18ff22aa40f1c4ac6f9f13eaae4d42b2b3beccbe7f01336292a

SHA512
60d8418b0a9bad206756c15add09b96ae52ca2f801a08da6811e3698a5a09d9b93ed3454ced11b0fb37e11eeb23c1835ca1a621190b64e52b0e65d5b4444e3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f32f0f7105e98b5f698c0e64a051cdd

SHA1
5df5028add30e38a1ba6319ad4f16ec314e38b83

SHA256
a228f27d2ac21618777cbb02464644c106d8339cd286f0bf42badea05cd2cab5

SHA512
2d3247c925a83a8ecce31aa3e36a936a90339c8e6bb86776341ec58b790182161e077482b2629a8b8c6a3ebae58742d5511870e46f917353328b4b5dcc4a60ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdafb947db4d6741569141715a4f6697

SHA1
1c160f5339477004b728f8db30a9c7253492a118

SHA256
3d966d6c756460339314c62b6ef15cafc75cab4d03c113e491584de01d164079

SHA512
0d7d6b25e2ce5685d7db4320f9ecf95f0cb586153007d63a4c16c5df55f8e15bdd7591133fb66a35123dc571731ecff3ac46a375d94d2fa6c42aa92b85d6fc5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9856ceb8b4de225e48652b6eaad13032

SHA1
2d114ab617c01beb2bbf5e0957515738b28b0a56

SHA256
4260afed5266dce90ff7214e0b33fe6083d8fd9148838124cf7134a85cada919

SHA512
849f8e4cb432ff7894931364d6ad4c89605be9da9e70e83cdb853a15b94df06a1fa7a7a1d47a1ab43b3284456c8e589cec2d4e24b700a569127269f094215cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a36c57bddfa4693f20d1ab7ac5bb5a2

SHA1
96c1e2733b0a356d9cd7cce64f7adfe6b39e69e4

SHA256
03b24c2a7b1f7ec0af13e8688b7b4d2af7b72665410bad604ac0acc2bfe35616

SHA512
f23f767276c7082b4d24f3358033ce061bcadaff53d81906a9b76c5eadcab2e53bbfd571388c4b96d4499d5b9388cebc81d5230bf62f9f181379223959465bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6B13.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6B95.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit