62e371cb41268f13074d8422875f7a4ea6fdf50ce2de3c8f9959139f0f4d574c

Analysis

max time kernel
133s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6505e3a2b87676d0a28b5fedd7123f3d_JaffaCakes118.html
Size

122KB
MD5

6505e3a2b87676d0a28b5fedd7123f3d
SHA1

86f8a1a6eacc53982fa3297a5f1519dc4ea2e553
SHA256

62e371cb41268f13074d8422875f7a4ea6fdf50ce2de3c8f9959139f0f4d574c
SHA512

92c804fd14c888762d2c3e6f67b4615fddbd661be8547442a3bee928a44a66a74e592913f8da31a97b675dff877e035fd4b794b6a38cace1d120fa3686868796
SSDEEP

1536:CEVdtmcz9oINM4Yd5fj4oL2Qpih4ZH9B8E12D6CrH:VdYcJNy14CM6ZHtGH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D889F8F1-487F-11EF-9FF1-E28DDE128E91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427851808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000006d207ba4bbce443617eb9ddd86be814cadc8e1a39d21d2880c1771f30ef64855000000000e80000000020000200000003563dc8731ae76c84f24aedb56145e3e481eb0af094135d3ce5e48bf0705625c90000000eb1a21fb9c56fe38c5395f79fb523d09e90c3cc0329a6ca914533e763970d1528ba4e4bc191d3ec5e3f11299f1193261bc672e681bd531a511a584cff6acebae87868bb7f54dc96a0a3e85f76b5474f5932ed663a6f3d944fb759d4b3cef15c8f69f3a650813558ae14e7b7f9c58a3956c951101d6f23b3e7dc15166dcb7fd803d92b4734ecba5add27735c6acc6037f400000005919c6e88174e8bb8b6a5d235b917cf278eff4a7c52bc9807aa909d181d4d8f78fb2b9ea228eb385083754c6029836325bf0f1413d74c63e76f4c211c249ced3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002b478547c7590d8692703ee5c370b32e34b5ae4fac2aeaea3108c52d1f681100000000000e8000000002000020000000af62d228aa01380ca5359549f3227cb1f678cad0df95970d698504f94c507d0420000000bb493d9bb4bbba8bf16d840b7ea8dd3e867fee786027d0b9d1fa7752e9aaa3bc40000000d492f5c5e7bc2f6bbf42e2c65a91d71330a2aaaeb6ec6777741f4f4493da4d88c012a84f2a60bc933dea6530bf3df2b02f69489feaca33d70a3b8a82f62e3d70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b882c28cdcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1476	iexplore.exe
1476	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6505e3a2b87676d0a28b5fedd7123f3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17b49042576ee67300daa628509ac040

SHA1
cc3e1b16e039244dc2f7811b1dcd58602230968b

SHA256
566549f478d194539be07f63e9b049175ed4adcd9f0ad0a0b790a8b49e458ed9

SHA512
3edee9e4e2e77a4f4b84966dd461f9062fc318e5db708dc496803b8379a01aa1a603c3c46199a88e25f9cd038aff39a429810ca2d3b251c9ba58feb282e0d6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db0613e6bb9b21f280f67bc95f6513bb

SHA1
1acde202f1e83c3850acc6f723a12734f70d6509

SHA256
22c397c17aadf66f1dff9b0b94a4f76ccb83025aafe95cb0ad651791d6de154b

SHA512
005ce029328b3a14f3efca6e077e94f8090f3cd1561f4847bb8d0f72f2eb33d81045c17ddeae66194792e81aa641f7b46eba3dd82fd736f4c6709f56b72b3e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5d1bda791bba7c6c3e4c6960ae14d5e

SHA1
0fc66ef913a1db587fc9fa8bdafe52123111ca59

SHA256
a37c767cab809505e0782760c4254f631608471ac0a1244ceed00b46b496222b

SHA512
04dc5d751e9de2db855242cf24df94331e8319c810b47235b813c2356062c4d76285b1fdc01e74187a81a60eebe876ebdfb044c1cd70dbc44f89772afb892af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daf8fd245ce096a4c2205088d4a63bea

SHA1
a503e78d0e8f37d6030e9739c3c2e92a17b11e3f

SHA256
6a797f71c44fc62fcc29ca957a5b5c8d87c8baa5e7826bcc39ad842774d03b61

SHA512
9b275cd3ffce6213ae5877a375215dda5b2c64e84de7e33469ece1e2c0855d18ff896577be749e2a424ea510a062224861bbf158fe549e087023a8b8d9dbb347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a89bea052179ab60ff92310bc686d5a4

SHA1
30cc4f38c2b07d291969c38806b46b275d09898a

SHA256
8c4c551a3d70835be634a312d778662d29b4cce22b6d951b9dab60e1021ff53e

SHA512
8ac0b24f22d20104504f257d0f985aef26f9807a84a03b568b16ad9371b3e5e8d4ffe73d2ee3f8ae893bb2a88adf4b63dae7a85807899284e8c47325b946ff80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a499a1f363ec08eb7136b89bb4b50092

SHA1
cec174b1451331500dfa0f16db76468ad0d5a2b7

SHA256
cd6de288ce202f8b8e21bcbd343158a06bc2c024772ce0d31658516b03bdd2df

SHA512
d9aa030ad0fc6af96f6dabafb0e2ce93e9d137528a37c235df0febf9f47d1d8dcaa803d70c8b9a8fb2575855625ebcef559966219406b9855de6f3628deff804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c581b3dd9cb05ccdfac9ef8fa160d87d

SHA1
0b8c6063de767a1ad44fa2efd45f5f3a7633c658

SHA256
e40c964c7a97db661611916a4fdf31306460d7aabe2048126876f0ff7440e0b9

SHA512
01403d41d32edb4aacc2d41f033a6bb3c9b0f3ced40add3e98382f0bd12f72188961a8ee0064454f21ebb66a9e594a5909511430f177f2b71f70ecf5bd92edb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67e5b9a2f5bbf2b3c50db20481702b70

SHA1
a2a53ccd7661791679c5b8c290a6751fca4690dd

SHA256
8ba5678915977651c455515716402dc1d2b6f3d32cf9eab329030107a9ea2a4a

SHA512
548d74e6d138d50175e7d9b4f1d4d8afd1ff0b57711f44c5fce928dfa2c744ac4a3269ea631b79fd554ae128d2564fe4a96f3eda3498f3495c618960936e5c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40b0be1954f71f77d04ad01266c9ba19

SHA1
90069f939786bfc2a26d431eac43372101eefaef

SHA256
59410a099b917f8b6686e3053aef08c3d6ee55fb41f8fcf6856ec892f887f216

SHA512
6d2653c1e2bfe6c17880c7449702d40574922b5d6edefd27d1e2da77a2fff7a40dc03671ae5b9fefb9a611e44d36347a6851fe77c72dd94191a99708230beb5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c6b9efecdb096759359ae6d1f5ec00e

SHA1
a218c0a4489101a32880a6cc45661902d47881bf

SHA256
b2424275781dfb96b1959f44c98fcf1b8d13cabaaf5bfe4c4cc421469590a138

SHA512
f31d732a46b9d71bdc9b10190465b916629be90e57b4436fca4e95bb44d290a8c8e73f312b1fa239bfaf11f4ba0f27b8744128e26ea47fc3a452653f273a4343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f19bc29595222bc18c47144f1ff4ee

SHA1
e5f68f556f565593c789610b5b56a778b4acaec1

SHA256
9f7a02a178a59080065745500eedaf5732c45205daf60b3e823a85948ac942bd

SHA512
222cc14f3755d6f382123f5062251f453b310db5586acd3bb97457cf1a0b6ea17afae8087137b6a3872471f0dbf47191ef1d241f12809249d28f5fcfa44b83bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3726038932007dc5a8564f1227c9c7ad

SHA1
917932ca71f22715073e0d3b7ba6c24090563fbf

SHA256
f1a3a2ef351b0f5311af23a70f69ee0099f7924d51a7bd07dd0925b7f314006b

SHA512
3a9e64ddb28dac6d26382ee2db3a0919f683645e01e47c09d7c5c74b8c82ef9ebbe705d4d87db39e5b1e5a8cee65e90aa1fccb029cf2eb25eb6154c596806581

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8BF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA8C0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit