407f2799751bddb7351165dd28a4664a7effcba5b2f03c5ea4a6bd929e10384a

Analysis

max time kernel
140s
max time network
143s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61ed0de18b14065ecb56ea8e1355b147_JaffaCakes118.html
Size

103KB
MD5

61ed0de18b14065ecb56ea8e1355b147
SHA1

4da9462b62ac89f41ca3b33ba85bb813810c460a
SHA256

407f2799751bddb7351165dd28a4664a7effcba5b2f03c5ea4a6bd929e10384a
SHA512

df03a153b955e36a649bdb79b57fc87cfbf1321089d08bb012b044f0d39e99ae349ef97f2ae4ab8482135d67225bbdd898a1a50c4eea7984b43842f814bc0e3a
SSDEEP

3072:UgO6en/YsJGr2IDvW+vcS96yPeGDMZuVWb85wpELwdpM2+ylQRvlVHpW5bJVmOgB:/O6en/YsJGr2IDvW+vcS96yPeGDMZuVt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000015ec8da09690fc6d84c31b2d9fa94e2bf62c3c227502a4ded630c019b6e3c651000000000e80000000020000200000000bcc6cf8d234adb4bcd75e019323cdb45db3eb86e1d7634795017da557767737200000001520ac854c9814b119ca48ace45c570f9446a3027958bdc6a2e02376f073087f40000000da057b4161de92d1849f585eea1c95d83dc7469c892fa43c07358337d44499b2e7cd2c330958f0ee71019ea492140ed0d1f9413aaedec1f9f328e23d8969b31c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000008f58e414aee39f969abe21b3f5a130ef873caeb136982aa165c6551dd2d84a85000000000e8000000002000020000000d8a38c8e059050970adc64abe92aa8811307bf7fbef3eb224b630b470991dad590000000ef9abce6782263a7196b519fc0ae16c6c1bfb2499f45040d3cad6e7bd084cb65cc5bd1d52b23983187e8afaa5d6fd84eb95b7344e9e1ecca5599d0586641609a6b9b68ed666156eeff1d296723fec3665e985f5342f7f08b0ee7f454fdb8c88840e8fa2b17e3390a5c5b808054c84c4338fb30ddabfd771131474a92f23931818900859c358a46c316382d96975cac16400000002e568be79dcaa01588f7b4e54e15a67e39ff4f4772bf9782f0b781dea3cabe06752a5fcfcdf96691d8d3e6a29eb66457e3bcf91e1e738ccf142c490993a4909c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1974EF1-47BB-11EF-AA78-6205450442D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20211ca4c8dbda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427767590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2372	2028	iexplore.exe	30
PID 2028 wrote to memory of 2372	2028	iexplore.exe	30
PID 2028 wrote to memory of 2372	2028	iexplore.exe	30
PID 2028 wrote to memory of 2372	2028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61ed0de18b14065ecb56ea8e1355b147_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7103faeff4bb179fbd093368ca4f52e

SHA1
566b976d1bb5d82cd53fb9f923908e219ca693fb

SHA256
7e099a15058bb7c5c5b7a2ccfc73a4922c56cdecf3fff63c1accf6922b1dcfd2

SHA512
333466e95b770c4ea395e83aa4a3a2bdd48260ad034a2180c37bfbf77e31b20710368fdcf96655e6b031e6f2c20ca31708d52308b7485533a4e2964f5c43531b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01896a5e03b7458258bd67e75c895c50

SHA1
34c53260ffd0406828f3d2d97e1baba21269e3a2

SHA256
82c8ca08ef85f5dfc40a567d1f6072eecce77f64069fa11206b9a3525e6dfab5

SHA512
da45d4632b6074b277cbb60838858afbf94f5b5d89780e04d8b01f3dd384b6c6557049c903274652c64e6d16c68c69666d8251a9a015a19400f24792c0cbf32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c6f60868c1fae9005d9d7d3eb5b90a2

SHA1
1b2463a49060e2c3e7046089e6aeb5a9d6c1be9d

SHA256
5ed1189c3f1c7f3940cc88709fd78a8818447e330ddc6ca1c627c6f2dbaf9855

SHA512
21fb443bf7dce53dd36892ac6e0a8233f8ae2ec892dc9bbfff1bf0834015e07937f3e81ac40a0f13aa4c7ebb97594bbf7bd820569ca52b9f7320d7666729d136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de03c9304be9a0246b67bd6d1e3ed75d

SHA1
1844a5154f54ab1170a274e981721c8e5d702a53

SHA256
d3c9c5132593bf16e61d674a7aaee54803b2c7b8486a45c91d66367b1d460f1f

SHA512
c0d4a4a15d4cde990836ce6dc7a9dc5f4a247279783b00e8d5f4ec9dcfb09c81674b1dd3e4e8c8be778e24171806dcbf246cc24385424a48d19e5884b5a06fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e75d3af15d794ed6f631fb5bad07befd

SHA1
6dfc9b7bf962b04d7e3151f75901d206fc20df09

SHA256
7f6fc83538dc4ed12095953d92002e4726917b892f2324ffc024471957965150

SHA512
9ed1034c39f7ef1134b3d091795c750ca9a078dad7bfe51e426c663e4d5e9da74d2a1837f828a5d18c2c94c084fb745895d0185d75bb0a4e13e4a45f79314da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635414af0ae68878a7bb604a6b932bdc

SHA1
6802c764e7dd9f36b025d6f2b135dba5dec273fe

SHA256
3807dcce4f2ff2c56b88f60b0bc2987e03422a2f43fe330a4283a56f39d02569

SHA512
18edf81d999e3022a07595cee8d789db1c27757cbfaa249f7d2f0a4ef3cd2ddca4a4cab4db79f7818399a69716f7f3c397131511953134f59d7de469bb35d003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f5ae8895fc1b409d62f862c9546b3dd

SHA1
05849f72b725e77c2d80feab144ad778da36f114

SHA256
f140a0f7683c5c0183fc9393dc25540a480b070ccffec3e71b794999a7bfa06f

SHA512
aa8d945e0fe7eb44f6f8788676f2d5dd4510322aa77ea61fcae856b2c5bbd91eee9daee3c0ffe59e24735457e217676d868cf02cd462bdc0777de2c3d730a09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67faa0fdf1c80daa9a075b4f3a1f2e5c

SHA1
ecd2e3e6a0e62b90cd8c9d6813cb403067ee333e

SHA256
c0f9f29ef081ff65ca253db028b3a4b859fac08a6c206772365e4b8bba64a155

SHA512
1b2c92b7312b8d654f03b2356810859ecf8d647014dd4d0e6ae44107f97e220e5708aed4fff8520e234a049e6f60ec78fc89c0ac26126e697e55edaa87125dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49eb18f47f5389358e1a877daef27c51

SHA1
28f441e3d39d5c786e7474595f3ec24715d6c37f

SHA256
4ae7fd2378d6d8a6ba4e3a362becee205ee8af28ae55aa7ac107463ac25ed452

SHA512
1a81528eb7d423f21f1ee1c1223041d21a2aa357030e38cf063a7acc70a157f86b3ce3a2049a80232012ba05c7169d052b9600cd2b016370ec73b0332ec8ee32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2270.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2734.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit