fe6a6a0d8a55793f68dd20bdbf090cc67b8818ef8bb1dbafba7cb1a5740f689a

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60a75669cf7cda79bf31dd621bf1e0db_JaffaCakes118.html
Size

8KB
MD5

60a75669cf7cda79bf31dd621bf1e0db
SHA1

abb3fc8ac16e870bf224f0c6631056bd84c234e5
SHA256

fe6a6a0d8a55793f68dd20bdbf090cc67b8818ef8bb1dbafba7cb1a5740f689a
SHA512

c3160937d68d9c7df1b54b1dc2906ed169dcf39bdfc419984e1c5a893a996384267030e85957b8f2d9a2803aa5dae106542af7e74bd355e8cb4efa79fcbc324e
SSDEEP

96:1wXMUUupxD97lAMdO+IvK1Gli3Hsyv13v4E5VJI3ytYEMUF3a2+pi20f0GD:OXH9pjApV0ZeAVJI3y9HFq4/D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427730068"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000774549758c0ce43b3cad2eafe5ab13b0ae4d75d4ff8f96b0444890146c37c2a7000000000e80000000020000200000006a2a5167e02dbd00a0e51499d3906f16eaf3abb0ecfb39eda2048a216283e26120000000b26c82528627a4465052e0ef2dbfb9b842384f8a246a8ffafec520ec872ca5dd400000006e3ef2fe780c86dd5735e2fc05a417b80f3758ab1fcef5557506a33eb62424f489ba6c38d6b658bfb55bb2570e4184c25b2e66d95fe6b813b6952d23266c42d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5098813a71dbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000b79779e79c096fd8586fc8314bad9347b1a143e687f5d3933e31aed2f2c4efda000000000e8000000002000020000000a2fee2f5eb1188c5c215d70efe5e74b2c67478d17f915a522e85e485258bbb8b9000000007328f8f08c0f1248226b35fc5652c8a386c4941007fa4b75e5d71e611e104ec82df1269f0f232349736e082806829b10986836dae6921a873d09e6f4aaa41c814fb7a519a2d7f87c51d792042472d3e97f2dba9cd425e04b36d8ac04a45c31e2b00cd577a8456e153f4bedebd5d6ddf29aa26a045bce81e48324c5b7a27f387601f1a37687e7c6c8f713b84f79d0abb400000000f7bd93097d7ddcd0a6a6ed85fde4105be8ecb6635c5458891d46cfda0728b076721c57ee9253d90e074cb3a00293245f8fd3a27f1e5736c3d5f6b770747270a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65E31FA1-4764-11EF-BBDF-EA452A02DA21} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2992	2272	iexplore.exe	30
PID 2272 wrote to memory of 2992	2272	iexplore.exe	30
PID 2272 wrote to memory of 2992	2272	iexplore.exe	30
PID 2272 wrote to memory of 2992	2272	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60a75669cf7cda79bf31dd621bf1e0db_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e234713bf067aae4d52ce17bce718c9

SHA1
76b49d658fdb6139e2548c7c22f8417b711e41ad

SHA256
1e247c460dc0045c9d1d0a155cd08afb8e32849552c88c74612a94c155a7f45c

SHA512
0dfc9dac4111dc9b9b8065039f2ce221180f5ba965503266574f1fd74df985f69ebed365e541f90b7798cbeb854b09b3606ec150cec3eb9eea02337fe5e1c31c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b1fe64d43217fc96daaf86cd2a1d631

SHA1
9e2f0a46794c6617dc1d98f92253ff14a459b117

SHA256
f8b546b1a7aac60486d94695b2306d6453cf79fb705902780a3ca62f8298cb24

SHA512
de448caed1146cae517513fa69cd1c62de76e038bf95312dab6d614bd2933e91580ac73440f6e0d9add291962cf644ea4e75b0663f12c067d94eb749cbb4fefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b42071cc47b0b52a3d2d770db406b665

SHA1
d70165707ad2ab9a2a816922b5101ca5913021e3

SHA256
299c797629d4c578714ae72da596610628717aac0faecaba92e02319bf53bb2b

SHA512
0460df845348ab52a20e2fed7ff6ea5e9f438778063efbac857567621fdfd0e42b05f8f5030cccdebd931daf96351e7aec438cee2b538c674d9c86eef1be5764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
692d9f8ffaf362f13dc4d81372f2ec28

SHA1
52188a2f69f3d88f4f4b65a1f523026cd9047615

SHA256
97cd3f6e46cfe616caa99ef7444862a3e6f52c78811a758855a4276f84a79823

SHA512
0d266ad9d30f592db5a945ac95c392dd40c9da315c129efabcce1adb9636c91dcfff8d4f7c3ffd94b4498a6fad60cf2d5afe94f7f1c03e7e0e6a32812061ca6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c56a0ea64d8581303de52ae7acd02841

SHA1
4349d86f25530d15400ae9814d6b590ad7feee81

SHA256
89d93942935a1e37f3da10f281ebed280eee7cd9b244dc82194882ea176a8638

SHA512
b4cee1c22975130c7a6401ea51a4ea4b2e10cdfdaa53c0d5d4abec067878ae78829550f87f81e9dd0a5ff589d3f3bbb896a1e9fcb72c44b8d4f790153ce9ddad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d84eb65c2e43655be77b945562674a5b

SHA1
3ede713d7dec5f963c20a6a4ea7352535fe132f1

SHA256
d8e85ca5294622963b88d1ebcb61d6034b95fd58db0e6b2103c50e068145e918

SHA512
a763cc56a6dd39912637882d5bc55ee93f4df9efff8a29ac7cd04a387e6229dea2b892a0d810a637eefab60a19bc3f6187c2915ace58c2a08e91c4cd1b2d4ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfc6829c020256bd9b942447d779fe83

SHA1
f25788bbe408353bef7c7b96cf0945441d1fedb6

SHA256
bb9e17982342a38aa0a45d67617fc254afac9feb9085c821ac6a03e93eca1a70

SHA512
55bd167cf6b6fe9b617a19841288b5c16191572e1393c6c45212c63ce478d0c1baa12f0031217d7c6255c243da6ce640041602169db539219f98aa15fd101d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
495d1e5c311346f07dd2aa903c45bd96

SHA1
f4022234a1b4384f2ac30d298d431f46faf2f5d4

SHA256
15e9cd6a89c76d4645f1932df6a0b4775b6114df72a5ccd46d4ecdcb0bd9d0cb

SHA512
d25f60267d19339a836ff4118bf74b8d490944b67090811daf55dab5bb2575435baf7cb7ec5cd77f6e418e7ec0e10654640e169f86a35937505ff7ef0f26c215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b6ee040cc89c2bf9e29c069bee4aa44

SHA1
4f28a8c8e4af709cfb9dea2afc8b6f34f1b825b5

SHA256
73108b81482415c763773c3d920fee8cbd0beb01fc68e0cce181c671c190e306

SHA512
a89e738992b537087288d087b019e4b9f47ab242881a867c992003f00028ab9a4239d0669327469e58e148dbf8fff3712baa49935dec9b4b707b440fa988a7f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b17a3c1e60f9cefac789e0070231b72

SHA1
cb1c3faf69b4f904ff0a2b7c82850f3c0a3d67a0

SHA256
fbba17376b6b376bd42cbb81dba3ad4c8ece666667bd68f553582f9725dadf3c

SHA512
06cb55ad13452482de547d0e5f7dc951baa0761e35785a7d623d896beb407f6c0b3b24d217eefafd453e0a38313f7d43c57573ba647370e8ecb070bb87911b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ca1e06008f458aa2840c14b4147b5bf

SHA1
b04822e5d47a3ecabd80ff62326912dcf7e58dfc

SHA256
211172542dcd55c3e8407d64a7f887625ec6c8913570a4a44705183ee0cc55c9

SHA512
0f4d66ff756538231e448a1a27b930b52a71d145d924df6af9407c12af168fa9c9e74b3817819ff1fc19f636c5e9e32f96489cc820e1b6e4888719f433ad3512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fea51e1444eda738ad3da894acc4544

SHA1
1e4ad1337d6efd90103228d5810fadf8fce7fd66

SHA256
467ba17f7fb7c028200442d21fabbc7400c6940bcf126e67fac24a231cf00c28

SHA512
79e4ab8f5213ea4da8975684c9a39e156e5741ac991c75f9866c785c145a4489fcd4a01562d730e95ed968762d8b7bec16b2488f33f5d8df8c0527d3fd762fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b914fb365f2303b3e4bacf7b3aaba4ee

SHA1
bd6188914c6a4e99c00d2b7109206191d9a29509

SHA256
1073351c4a4a0f457a39a736cdc522bae7251fbee80e523148a5cc1bd43ac182

SHA512
33d018ad9ae6a93d26412842d8dbed08788474078579c80716950fbfbc2bfbc70c035c920806bab546c26449d27b8eda9bfeb250f6d4f075bb9aa89e8ea30d59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af4313c560785c55e46c114c1c0304b9

SHA1
6649c592e152a6555b2c5201abb9e4ceb19b8ba7

SHA256
b54722e553c282fcbda89470d690e3e5a668e1d7920ee8a1a149bd13b3388b23

SHA512
b48af5e5b34a0fb26856a7a6e5de522b037a12a74b622b08f0af0e44f2c7453b7aaf1c03b62a2b9beaab49794db9d26af6307e89494adc0666ed2157c2dbe9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4adafae27025ee08c6a8043c0f4e9607

SHA1
32aff5804b9b08bbfb2a5c9e5b109c8cd8d8f099

SHA256
c6504149b23d7efaa58d35db5adbbb17eb878d6701c7089f11864c8500908c86

SHA512
128f1f373de90a80c59faca95000ca2a88d40ed6ec92a5ecad1f1e8486f713ebb8f2e597702c337978ba16ac12984dfe9d002acdb4982bec87312ec03cc25289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
595decf7e1fa9cba02a38c579629ee0a

SHA1
cc9f1d781b0cf08b5af7c4f6d26f72adc4119ac1

SHA256
8bfbfc4e9a0d940cc49d3cd83ce2a2d9618b3775605caa870b53c222948c7141

SHA512
29f4089897e6602ff6ca0b674c5a96c0bbd073fb37be98db82e31304f6ceae8b600a6d8733d9a7558dadae24540684687ec7710b6d0140aca2970f0b87e0f0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
071e062d3cd140a49345bb587f42b006

SHA1
cb5c031a607c8f995221bc09b1d7ecd3499bf32a

SHA256
ac74f7259768accc22dbfee03866aac1dc6a508b03907b80753dec459305bd33

SHA512
f5b69712328141b8fbc7fb903939c76772d389b3ecdf56970c6ab847c75f6efe5a5ce46e13693e706365553331998fb648cdfda1e81c91d3f47b925ca9ddae28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab546A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54DA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit