92c22b6c3797a1ea9888db9c673351b5c7aa704a931af8c60107096193409ee4

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

615b24fbd1f043061c68b61fe58c6aa7_JaffaCakes118.html
Size

15KB
MD5

615b24fbd1f043061c68b61fe58c6aa7
SHA1

506caf19be0fb338a70a6aad1fa26c7c87fd3395
SHA256

92c22b6c3797a1ea9888db9c673351b5c7aa704a931af8c60107096193409ee4
SHA512

10f6132874b67cd1dc59bb7f780813407deecfae85b0086c1406ed2b0a50759ef570731c2feb8b6a1856cf58a2574db9fb78bd311cccda8f0770082aebb9b1bd
SSDEEP

192:JuU5tMEs3Z6jB6S7ns7g72w6yg+zBv1JztdoA/mC/zJ0GZdtnqgYu6T9IQmDkDCD:7DsMSaK3MhwK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{444C4851-47A3-11EF-845E-D61F2295B977} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000004895d72fa0f0a3d4fee05b0d539a5b7af8dd6758e53712675b3da5cc1795c20d000000000e8000000002000020000000e0af0e13a18e88345a16357fec082892aed10cd18519251673c81a9f4bc20e03200000007a3fe9fe5191bb32ed217c0bd90851cb1bdac5399f95ba8b91f3b51cc16ecf0940000000856ea5a62ea69b1cf77352989e2a5fab27e4a780386622d44081d387344340b28029887dcd558b9b0c02340593834578e832ab8b294644e3da217ee1b2ad19e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427757069"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000af39444a8651ec0e18516bea1d18b638333535c7e8e8d0d65abd8d276fa8a4d2000000000e80000000020000200000009d6b299bb2edfba70d3dfd7f2dd590ba7f91c24acf63409bcc3f77d84e5c011a90000000ff931412f89b2f80bc66cebfe63b5a7c2398387e6a11f30a62de291c5fe1a21e3438ef25fced1f5a6d59d527b7f093d7a55206d0dc25821af893794063cabbdf22ead7a8ebf4935b96a9cfb1fb29de7435083f2810d979c2e262ee43c18ee846da145dc2df3293f10eafd4d12c5a5a6aaaeee6eb30bc0d9c4693fa9671a694a01e4c217a277a3614ef1280961bd827a640000000af95891364963102a29dd49d7beab78ac124a816b3548743eef59dd2897f3386432add83152cee0a34f5cf13f9318b63882976455e3b7fbdb7b41cca60faa4ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f3ec18b0dbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2408	2796	iexplore.exe	31
PID 2796 wrote to memory of 2408	2796	iexplore.exe	31
PID 2796 wrote to memory of 2408	2796	iexplore.exe	31
PID 2796 wrote to memory of 2408	2796	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\615b24fbd1f043061c68b61fe58c6aa7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d211d79a52627ccb4bc9beea0751244f

SHA1
4d0055ab30636b78890b8a00f5ea2e60efab0a63

SHA256
3f130070a46fadfdb180e83a867afcc3c37149a06f7ae546a1c6ad2b6db7d155

SHA512
1105fa4d85300d22a5e20232a9cd12cd49845cdb26bda0a20f65a40ccd02f4351772e0b7e799fa09fcc10167b57b17354d96b1f7efef68964dc7b44709f1c13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9dba2cc87f56975814b3c9ce69f633b

SHA1
01fcb5747b73b03af89b6bd3b49b625a8b446321

SHA256
fba12051ced3a9d9a9f0fad325045bd551a59dd44f0443067bdd64c2cee86a30

SHA512
d26d833cd31d48e89999863ded2b3cb087834c2bf3247bbd9e978ab5cf78f5ac4fa05eb9c365d82ba40b1794db1aef912e95ca21378150d3b1aaf3cccc79bae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a20af5c5481df79bec92e7a960a64eb6

SHA1
21238bc62a5a0d67f00d2ca15ecee9aa06e916ce

SHA256
165f9fc117aaecef82443aadf2e850ce2beb9458bde6007ac8e61948dd572b1c

SHA512
18ee7114347bb243aa5a93f19c2623990bc9a60ca444753bdd2d3cd975f99ccad28472d9781944b5dec0ac8bcdadfb9704010a3f3f9c092f5a39a474f54ffcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c950b61e4eb31e79644f226225a123e

SHA1
85da2066c059c1658ee6cd842701dc5183fd3ac4

SHA256
6862cee32b2f063c1f73373535f0fe2721f80e5c01d3177cc3a23a433e926613

SHA512
21fa2f72c6806478b5e5f95922f52b65105fda05bfc73c999d2cb6b2ba717419d6780e8e01df8d4c0f7e9eebdbce138818f4f4abdf8f44946bc2963f1d2f3f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c074e962c7379392003fa667211696

SHA1
f8947964ce17c0b905c6f4f73d5e788dff9eb0f5

SHA256
ae103bf6cc0d2c30667906e9180336e36f5e2930dbd65bccecdc04b09a930579

SHA512
bfa08e680b0e2b111106766809b6ba3f053073c53b2d59ce89fcfcdfe84f63534b6f8131220fdbb512ec557c560b391975ad32ea1ad10226a285f16a232aa44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a63f206b3b870fcec5a487bb9583c5

SHA1
296efa52b63e789d9e67078ac8c548547339a32f

SHA256
764fbf97de8f15c236a519662741f2dfcf6e3723fa1ba7db47ce6e0641a667ec

SHA512
22656d69ee510eadabf1ec94dc632a7bdc1a0642f9c67a6faa2abe83b816f261a57db4d7fe21941052fa667e95ef95bc4145e8c2fd4b178df40b7e9ddbea9375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2130de13205db7fb4e2f185df1c4cd8d

SHA1
0530803fe375ade2ae022e093e0a94f4899e4b07

SHA256
b8bda7712bfda0c840deeafefa3b48c0dc75c2fdfbc2e28520f5eeb6fa82f6c4

SHA512
9eaaecc09f4a276b24dda31d2f01086f3d0f8366391da971776cf06d487a959c28d665e6480ee40f16ef4b3be7b396acdd5784787eb4359f29cd40e494c74ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14740b461717cf0b2f7a6a60f01c1957

SHA1
21c0c83443060830c651f9d3d4f9aacf86b4ed02

SHA256
a708ad1736484bc7d203ea6deebdce622f53f1e02364596cf01e8c999a03b0ff

SHA512
d4eea536420370f909fd427853316a7ade526eb5c7b9be7501355272e56d7dd0762c57bf317d0df8a345c4a1c55b082c5a95459551fe1f14a5b6371f2accc028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd4e6726c6196145e99318aa713e4d0f

SHA1
040074f9331d4b13490b5370aa193076210b3653

SHA256
4adcdd4cfad6cc602d3db3e9e2c8d72c35a57f786efe96cf79bd5bf7bfa45889

SHA512
56f74e7bd15ad624d2a814cfbf0fee1b452ae57d6e31aa9f5c4145e17e6cc0bbe07270d9177564e8411d786e93a2d955fc5793ad57eec6e7c2456433d809aead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2328eef34be0d42f7222ac778be05028

SHA1
b9a7886a0cfbfb2cdeea88febc8e7e0389a7776f

SHA256
9a9c18360b481f9c2b18fc1fce98ae01380cbf9ad2223daeca9bb9eaa6ed0adc

SHA512
9d9a2bbbb3b41657e7289ca6753c020d2e6c4ea3e5893bc59f06ceda429623d0e1fdc09a75ab9ebc2e840c934fa1c6b2f7c6d01cfcf7fd3ace8b2047aa7bc911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
490be0645d1e949acf064a7342dd47ff

SHA1
d65df53197b70c6e7e5f18c0dd424ca5156eaba2

SHA256
482e5e0a03a2c05d217e62468003f23e40b8eb00c45b18bea845184bf9719b4e

SHA512
6349e3d2946cd9a05c6200b5761ec73d9dc41bc8a54b54a12c9ef35c6c5b47fd64decb818c8c3ba0b87942c7014d5bcc3956e5eb5fa519a0b98d551b721c69bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fda60582780b2d87da8aa50b06f94beb

SHA1
ca337b07f1edbe9569e3a1733d10b2b1e59799cc

SHA256
722424a4cb7c767c6da687d2591e3099ec55e34b59c822f30bea59be1bb0b21b

SHA512
c66657d29795d1958b2da7d14513b34494f1a383a3b119a843c4b0bc345133f6ab8f35264dbe934caba266d0f96b0a87b56b3d7cf6ee32f03b53799bfb8e098d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cec982abfec58ab5d0d805284577fdc

SHA1
498a1793ecff2094e5771fbca422b2b6663ed58c

SHA256
d696f64566fcec4885c72f2b4dd70f2620d74c3824bd349a46efb00cd1f2d8a5

SHA512
108c47f35068d66595838dd6c23be37d9abdb46e20a3a03a5d545057e6d5c038e85ecf2bafea87a30b3e23f9578a75b6571e34b7e9e30c4007e5045f4290052f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da13d55c9e2ab8963b40270db0b43c03

SHA1
68c9f3fbcb28ffc072c8a9bd4f77940de436ef38

SHA256
6d16a23569415ec03c546fb8f846f0e1ecd1a66e69b3972a507ac6254831c0b4

SHA512
f9bd874395f46837dafd0e626ba322d22b1713ed4635d83cd9358b63d370ea0fce14500374b8211c14922177dbd818932e3c2f9593d04e31b71f3143eddf5401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2386a8bd79e87578a7399edfaa3860cb

SHA1
e36cead8922f63caff6882a83062645a133f5727

SHA256
84532b5ea2d88fa421d96612f29c87af43762f14e5b7456cc336b787b74c6ffe

SHA512
fc8b1d682b8cc78d682a6704bca818d49f9fa24356fadcd6d0e63930c4c9b35fa5396b2e5a0e9328f4672533c5f0fad274667cda0047a11d8278d1ee28616ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD5C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit