2c6f13542ee0e19219f3e95b9ab7c1b88f3615f80c5ebe344d73bc3bd3b38e10

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61d4442ccb308a184cee16b825eb2957_JaffaCakes118.html
Size

37KB
MD5

61d4442ccb308a184cee16b825eb2957
SHA1

9f5767c0ea89baa24a5f3647f31ff97512076a60
SHA256

2c6f13542ee0e19219f3e95b9ab7c1b88f3615f80c5ebe344d73bc3bd3b38e10
SHA512

0f29d2c4dda303a360d2a622785b116920d7e6b89ca563168584f87afb7504b21de35221147e8fe97a5f5cb55b8135f153d461fd5648391da6b37cbba9a6b6ef
SSDEEP

768:Frbp7tiEq21ptIxuiQ2MKNQbKD/my/XwGhuWyd:VZtiEX/yQLs/myfFIR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427765893"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406dcfbac4dbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF353261-47B7-11EF-937B-6ED41388558A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000cf7961c0d26d32eddbf2960ce426f55b5f86ba2bf03558556ac822f48cf1579a000000000e800000000200002000000073bcf48a0ff719db6c7575c0a4b53abb939d53c0078117cf570f6a497698be76900000004cd53962de512c95297f328a063003972fe0cc3b39af4c0962c30fad518fc74a9b2af8282f8c14fa66f300028a4740be176d4c08ede1bda1cf70914894050632dbd6e2295f0ddd4212ff31862321764e9e98a113d8119e932669fe52c6382f1d2a263f642fc5e8d9653bf8e4b66fe27c3d445770e62c9053010f3957b0b4ca9a151a316f8b34d8a34c2533f02d4d184c40000000873c3b5c2998e2289bfffc57480bef4197d3a23ba90dede2c323cd0e8148911921a20dd69b1d59533b19e64705fcca4a848897ef78d8b5faabfaa320c07250d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d50a2a9d232717e88f63179e99405927932e97377e71a33ec2e0b5070f481701000000000e8000000002000020000000f4b2fd8ec6cf3657c3adf9019a59ad016b0336f369fb4237a7807731c2fe064220000000ae4b9a035eb1a49e958335709ed03141acc80a631c2e589df88a2012c1ab0ac5400000001c2de5fa043721966868c8928c2d51beccbc8034828aadd518dab3fc3be4f33df0d3695d2ed0f30407cefc88d1e7c1366274434c8c102a78f848a756f300f4ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61d4442ccb308a184cee16b825eb2957_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
714bbad373c875ffe2bf6132d959c22f

SHA1
61362712b0de287cc201a02cbf5932e0b5014cd5

SHA256
90d74283cba991de99ea5d921d50b13148bb9f8e688b47fb189c52554fbb9877

SHA512
c9c0b9bbb451f3edc49cd3365f1f272615d1e043e83eafe4adb017be1e8fc33406a79ec6b8d0463f2585d3b0d3879db1f8af4e460dbbb8b36f27d363afb84729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48026e91b44f0da32d973793f4c6b9c9

SHA1
ab6a48d907a7e94830d92adbd81c453e8ecfb0fa

SHA256
03180d6aadc1c48f63fa1839bd364b0432f5d3d1388d2e5bfaca60bdb108a960

SHA512
238a8f5b2f75789558ac6a60826b9061cf238818b3eaea55da39e06ce2254783f54e6470fe414f5c5843e7abf5aa02d797919d6fe34b9b2b82b0b203d6e6af25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5738688cb57f63022ef512ec21193491

SHA1
f8904cf4f1070cbae1bf81d77ed51b4674d4413e

SHA256
e2c9d012840552b167c145beea3a1a6c4ee346139275d33d5cfc92c85fb90c25

SHA512
6d7732451d448e5617d2b48fa27ae1c6a6c6fd3b0873365414924d2215f4b7a6d4bc652ff8ff8bbbfe3bcbbcda20e605fdd6081467721fdbea7938f7e15589f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ad59f63aa9ef2a15dfd4822605297b5

SHA1
81575f2d3eb5c3aec7b786fa3ef617f8bf005efa

SHA256
aa4cde1a7bab61b04a21a7cc4422e52ee26d981a34536945f032d88790ba9f63

SHA512
27db91340404a545afaf60208cf8d568f1a0c17b00d41a161829f1df4f698797c4d0c4859739e31c16cbd4ec21afc05f5bdea810a870c8588c2cfa04e370faec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26c6682f36289c4d3e014cabf63f4224

SHA1
1b99a798e5253535270fe94639f0aefb3ac17cb2

SHA256
82b1b1f3661f84998b6eacd1ce347dd254216f99e874424c2e8f755edce46b37

SHA512
12ca74bcbf5b74b0b82a3d7f7c6ced1afba4b15a340ff232a13fd89bd34c7c42ea86e7cdc9634e538e4f5abd74c368e26fbd75bcc16975c0f5d3f55f97776139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51e31e83ba2094ec1c2a48b63a0d3cde

SHA1
65c48023d23b6884261b3f77f44d758515abf38e

SHA256
a8fcdea1d035d9f0ab3d29d4beb406f8ecfcbcec21d31f271f22aba7c1772b80

SHA512
44350f3b145b3b2df9155d3b52a7209d12d9547e856c0ed0fb6749d1c98bfa4647bebad08896e6ac46c73f7664093619178d3c25a457fb74a1750ed904a907a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b2775fbe20f594f34b8e7eed1c8f029

SHA1
0cab963bd19515fd72ac2d327f894984c435b8d0

SHA256
9412a91aae1bd7cfcad106f65e09e3eac4b93f3045507eadb6afeb3a28ce6463

SHA512
5581faeb971e3ca58674b1f9a32066c5019a4c4df8e3f749ba7823d55ad999fc80365fabc7d548bbbf0cc9bc3d2fdd1849efbf333c05377ae4bb2046b98c6447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
272c26e62bf96544549983768bf7a571

SHA1
f02b12b69dab20d5030b5aa553e57d4ad308e019

SHA256
058f706ae95cfba6b581befea8967d07a2408d85c7727a1d705a5e7a21c0b71f

SHA512
01dc25c5cb454a421957fd4e14b4c59f871575b9e034335d0a5b6ebe2ec62632a7df1d6b7bbf972cdb292b8235a239aa46ce05e47aae0fd65e73cbf7940a6758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44b053eb2dab9e57db3dfba45916829c

SHA1
863979d294d38cba951b5e715f3cb340bd577286

SHA256
a3c2e168479f029340d2ba6e2830156e412bcd4dec61f4568be0cfb259292235

SHA512
36f02497279c923a72e01488b4fc595c271de37db030e6ea8cb539c77a86e33af7f87c232bfd8cf02145f41561d0ba1d34ed3acce4ef1352814a7f2228dfd9a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c07ffb4455a133908dd8b3ef26edd925

SHA1
31618ba249f0ab2dc638159f81862ee78eff0d90

SHA256
8aaec90b8e1213d07529c64a2b71df46e4410d71453a90a4354e65ef3cd37cf6

SHA512
069dd76fbda78811d02a3c40b41a43b7d2639fa7ae6fd1f3e201fde9fef817605507af226138a4b1d7be2ad6dc0a21b75a5bb0f8015276393221e1dae7937e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26d67eb88692e07f207aed8e5275bd0

SHA1
54cc4c807b526fa2810bf3da533258c2faf42f9e

SHA256
97dfced9d5f2201281d2431d1ffe11961eb8d384b89add1cd29b9d8f5e202aef

SHA512
3c85ca355e5f1bd3aefd10befb4e7a57bc78c8776711f6c9b1bbfdf8ed57893294d70377c01f3ed0afd98d39d79e090f018fd8d39c15053d675e287988ac8fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8545bb58a2fc982f6f2b7ca09dccecb0

SHA1
e26e1a03a85d491961e3ae56d6ef4ae50f49d4a7

SHA256
63befccfbd809d7c4cb441be85d672876fed848223cdcd142479bbbdde9e8e62

SHA512
d2f6187d82f24512c0631e3c0822e11a2c197682a010d1b7a488c8f283d424b06e85a805ed6554b7a880c4091273a906959bd673cc485b0aa281c0aba3a6002a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85822884dba268bb7cb0fda040d3659e

SHA1
2d940006e4edc0009b0b8d6ea15ad12221601259

SHA256
ae78a43698a131320573c1038609d03fa4796a3f6f7ef07fd0a07748cc42f2c1

SHA512
20c76c9323def30a0d67271e2cd6712d6afd2677bfd939b18f94b39ac026bc31038be5d088a5b11d54381a78ecdd5a3f48659e2d36976236f529559eccb5e781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18be3359f76d1a0b2426e46defb0d117

SHA1
bcc54d78cce158196f3af57595a3b3316e23975c

SHA256
ba1c75de3cf31a14bbb69c211af0d80529126b05536839c319248479d87bbdd2

SHA512
5858e846711a2b1e1abc954c04c488faa95a75b7b7d594176f0c58abb33e944cc41e0f6da9d2ea81dedab76da7c11bee6461e5a5429dde397af4a2e14773592f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49bf3a844e2d12367ebbac57cf93191f

SHA1
ed9a0bb9c4cbed7a18d5e652b9888b2e6766e33d

SHA256
e94e7c6133af4ef21e8a31f22f116241981a287f0d9cfd3b2525296f247ffcda

SHA512
f830dce7d07eccfa627ad699dc4450f925ef4650666022c3e49ae5c59aa24ab113dbe431214f8aff720ffaebdeb1fb94bffb72069a3121a205da749edf20b94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cec72ae4aa39c6292c0446cf1033e81d

SHA1
f41602b4c504a6b87ad04014b9b7b756759d656c

SHA256
cd69a5a6d3af2a94520fc77cf4bf8c98628bead8311be02e370d99d1fd0411f0

SHA512
ad26aa8d551b4fd6f57051d3235dd8f4dfd981471a6a3789567101aca0912d52064882e8c209fa67bf98bdc770cf0bcee873bcfb0a87ef5b9c3666e23f1c3d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef1c4652e5b7c068c8aa1592838f6df

SHA1
d63f2ec812b16e2a8021b757472a46982408603e

SHA256
59cded290ce7dc7c870e030616b8e1e844d211d2649d856ef6da5d4cd5665b55

SHA512
32efd4de6c2177f11ae1ddbd33d9e93289965848bdef269b83371c02c02d0d53158d2405ac49606ba9743cdc16c169657621a213d1f5f3249b4a7aaf04f1b700

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEE9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar786.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit