97c2d92af29596fafeafaeabcfdab5ae125ba90b81ae2255a32e4bbb579c07e4

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61c12729094ab0848440d488da957c23_JaffaCakes118.html
Size

53KB
MD5

61c12729094ab0848440d488da957c23
SHA1

0a9b096c8a1d5b5cdd6d558f7488f9129b188cce
SHA256

97c2d92af29596fafeafaeabcfdab5ae125ba90b81ae2255a32e4bbb579c07e4
SHA512

10ee6e5ac4bf5c9a5c4745b676da5fcee35312dc902e528749397102c8c9fa1beb8df5a8d3db9467f05aabb11a68d2ebce364ece241b47ea17c13066b84ea190
SSDEEP

1536:CkgUiIakTqGivi+PyUwrunlYkM63Nj+q5VyvR0w2AzTICbbooFo/t9M/dNwIUEDQ:CkgUiIakTqGivi+PyUwrunlYkM63Nj++

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427764747"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402eb1f2c1dbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000a5c695bcf2862e4936e59c00992536658ccad0c6e12f72d2b052f625c59269ec000000000e80000000020000200000008741669b2063a04beb5513cd21bebdb57e8fda3fb6d6bef19484640c16f27639900000000c431070edf9ef07c3c1a53734ae1cdea2d6fc30be6daad47e35564e4f037fc5362591de66e14c62ace19bb8d43909df82ca9f674de7155313f07f99c6e2aa247928ca3c88fbc575fb435e0f80e5f2055b0ef8e985bc96e9e0151738d34a49feca7305681692b86410525f9492e1f0e1874bba5bb2d552230901f10de4933f4e41514b9ee64593e94c4c871d5a29542f40000000a97f17ce54d01e2508adceedbfadca908d3705c58a6eb8e09f4eec09cbe10ee02cc8efda84c276a6b3d702b650716a7481054db66c03651f63e3fd0900c53dce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A0DCF21-47B5-11EF-BEBA-E29800E22076} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000016fafc755b6ef2265b9c943add3844d7f9db43c53f10b5c998a366dfea94d236000000000e8000000002000020000000c98ad9a1acd0a29c85445c257a3147be907c196ca1b8141504beaabea3c6341720000000d6635e67d93c5453db51928d0899225330b345485e59ebe057967749f0132f5640000000325f8500f9ee072037286c5dcd4d5d85bf1de32f326ce43e8cf5b084c1ff17b2ca26963300e0dd13485e1232229885a5ae2ed0e74acc6235d94854c48cb00ab2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2344	3000	iexplore.exe	30
PID 3000 wrote to memory of 2344	3000	iexplore.exe	30
PID 3000 wrote to memory of 2344	3000	iexplore.exe	30
PID 3000 wrote to memory of 2344	3000	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61c12729094ab0848440d488da957c23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3767408ebab304d36647559c1b4f6f49

SHA1
15a83be5218c9601915c91ae932c565fe82adf89

SHA256
9a694f43c2fb94d5bde1506d219e4a3b10e0eb5a2ee5d6780f48643f26825b25

SHA512
7cb5f44dc6012de74301a57fc027a939777aa070713cb590dd65a2750368cda936ef3fe3b1f48d93b44fec1acb1d74273eabda67d03d89ff43026e3ec65d1c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b740ab23c100892c976da7d42674f734

SHA1
87cf953ebbdf401f1d7353774b858d42f6f1ae03

SHA256
281c987d3314868364f5adabc87ab68ad59cf220f8165bec6c303c8d216bb444

SHA512
b2a2b9283c9a86bb67d4cb029e4dd2b11d1cee638c1d9809ad0bc04970f479943ca68969d120f9ded9958781822b2b2e6852967ae86103f0cb27dadb9924ab21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a01bf621f51eac3622aa7cb7773a52f

SHA1
874510ab95b4ed7f47defffb039c2d2ec4f796ba

SHA256
ff00d66a7efb57666ad04d4fb007cd2a12a48d9078403b137e409226e9543f33

SHA512
671e148488fd6417b7620d6e6d6e570dfee288593008286d2cc9589ebbfd6a855f0fae65451c2605968bd051c9cdde9907a43beef26886131f09fb25eaccd771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17fa6c2e780068646f5a20d3b09bcc25

SHA1
c2bd56f7d2d3fd8d76facf3421fa3249300b9698

SHA256
94766919f10b44856e33a402473c72c71cb49adc0ce0e0dbe13228b9b071cf8f

SHA512
9d2b47c7bed6118c3096288981b930a80f84d29d987fe3867e68ddf729877412109dd79fb1338f530dbdd2cfaa65ca0fbde74ed230b3e81f487598697a7a3174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f1c50f19ee5f3368827b6070239c8c4

SHA1
955859fc39083c08b06d060f4c1836f12d3e5bdd

SHA256
fb49b06b867cffc89c6d66acd233029d6564acb727162b13f073fb88cc1646f4

SHA512
92498e6997b3ca2e9e17fcc1188cbe81f1cad337035b64c46cb347568f3b0a16bdd01712ebc600abb3392b4a5c0ec54033bbd6ace772fcf503d6ad3811d62204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
752ebbd0c761205a10b1b841859f7bca

SHA1
10a5431022c3a38f1c56c7332a954e167e400303

SHA256
1a4ac10eeed74de5be9c9ba123dbe581fafec8f71bd3b391e8c49b6cbffbedc7

SHA512
10420aeca5aa13243cdc984532f326ad6798b3a4fe564fcdd7cbba5350d91f7f3eac510e68be65869475b71b35a7a241c444fc3416e32e8c092a2026edc68763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a537e19194f1d62056e5cfc0592cfd6

SHA1
98071e71f2897277b584d7ad0a56f9ecc498f016

SHA256
f8fa5126b79ee08b5084bcf30e56f5da6fccf75e286502146548cc22893f8d7a

SHA512
1b94b70070f8f9a2a6299aa74f66a3f9a54b087a24ef4946ea1502f09a28b87c388010711525f6d40ab836ac72b68bd238ac01b8dc5899e981ba66da5faf2a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9948665d27636f0d3ab2251356abc4e4

SHA1
e34ce7fd07399123162242fe2d54db1df9c536b7

SHA256
6b220907a2bf989d454cd7d7a97e42733dfeef7ad3f0b556f3abc753577d32b7

SHA512
0b7a0b99b565ef538f89e4c2eacefb7677a55e5e7aee1e3fc8769249bd13468d32ce761ef621dc9f375980fe18b31a6cb998ac8f4f14a2d6ec3a48c90cc186e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa2290ddda6aff6ea56b341e3fb4b4a

SHA1
da0a04bab0b54e0370de0c1d0072ad1332788e22

SHA256
d3a1e8ff36affcb58056cd0f2460d7313b252971e83a1109e1a7a7c6e59d44af

SHA512
fc2eee389278c0339343c9295d755cc271c7952c00ee58ed625ceddf6aa143386543ac6a1e011be5adb9bceea1f2f02cf20b0bc7a8f92f171295315e564216ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e5cd0027ecd7794e2c457e1c56a1a7

SHA1
09164e2a00ae8b6746c22ff4f4bd4e4be4930508

SHA256
326a8d1731bf5e7eeeefc5fe59179438bb1306aaea2af60c69ac914206057129

SHA512
7af625abc3a7052abaf4966a93484bc596147d1ec9afc776d0faf28160061824735975e533e8ed35739ad6a9e3ca2c8d8bc9f4cab8a32a852c0310a2cb881594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a03b3032be67ff6448ff0d663214f1aa

SHA1
d8c3735288402c9d14dfcfaf92473e94c1f8c1b4

SHA256
af3777af460cc2f23af51d3cad29fb2804deacec6aea847abc9d1cf23d5c60f6

SHA512
fbf135f5a9a73aad56443009f9f364caf0b1b8b9a8ef9cbe34988ef2c4c7c259a95042beb2e7ccbe5374edf4c98c5d17c15795693cc46d25c2865f53a53c463f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
474d1d6a4a1dcc59caec1bb6fb7bf5e6

SHA1
46f7a52778af1bf4bfe4910a76f47a40a293419b

SHA256
1153949a2fe074481fea631b3c679c588cdbd21b469aaa870b27839240eb7155

SHA512
347323a4dffc2cd4217802482c94f9c748ba1f313d2d953bbd319767639302abfc584aa7ca8a4e78c793f23906b11682e42a34a439c7d3faaf4d9c030017bcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA5A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDADB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit