c2995084d5f48d5b86bb1826a469eafbc789eeffca3706eabfdd8ee08d9545e5

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65354c3ce943f20d2920c482c492daaf_JaffaCakes118.html
Size

46KB
MD5

65354c3ce943f20d2920c482c492daaf
SHA1

d3a8b8cf32296198d4a41c2dc57f5b2259849214
SHA256

c2995084d5f48d5b86bb1826a469eafbc789eeffca3706eabfdd8ee08d9545e5
SHA512

5ecb2305077080403bf3b993f62d2dbce0c6bcc066e1361676ef4df7d716172bc5f05eb3583b64c0bc41d216304a006104983bf91f2a93fa8b6b81f819e536a7
SSDEEP

768:oBbNGyin2f/Dgt6SJ5V3I7Vct3Cmhz51S2x0BZ0GItOsO4YTVdehVfFjBTVwSFAS:oBwyin2f/Dgt6SJ5V3I7Vct3Cmhz51Sg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000002fa343d4a8beb1022c535f239192867720863bdaed194b9309881d492d1610ce000000000e8000000002000020000000d1ce8cf7e9aa57adf7dfc8c8285eb4dddacbacbc4a04217c18c8ee9b3b1e476d90000000a5b56f2197d27849966c992db4fdae8e1ccd20664e82f325ebe7ab6c0962257875d316013c6a38d3abaff28e59b8d418a4c5fe43b4a993fb04e337a302abba3e4d9ee7ef69d36c9ef0c672b22009ec0e3b5ab9edf5efcde43f2dd79a7b1bcf6a2f57c9fe29ad13e1dc744c80716d38db6d4a889a9efa18ea655853616931de81081d5638ddfe02e5e68e9c594eb39c6540000000c2c1073a085e3707e3a8d5a090fe80cbe8b9128fddff7b7f07d15c9b9ca23680383aa45a8d2c0c07763be5fc4a728c1405e96d2a158feee1bb78c3b483cd9fd7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C49BBD1-4887-11EF-A669-4E18907FF899} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000193a4e87ebfb9f064cb79ea95f34bc4a75e36240c6619564bad38cba948c2f17000000000e800000000200002000000023d2a9d2b5b1e59d785aa589dd36e7e74e93bff9b4b5d53cac72d86d3970fe3a20000000a64d3cc8c2de0c9c436d5a52e24eef6af40bee2da59c8ca75c54cc10a5caf5a440000000439be5fd826447c84791367de4fcb3ec47f1cec06934a8dca8f3ef56a66f4caf4ed2fa4f94ae4a549177ea07443123c148eb44967a0eca72c30b2e596f7c345d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a6ef6094dcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427855115"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65354c3ce943f20d2920c482c492daaf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
254430a73e2c0ab5ed4cc696296644af

SHA1
6eb4b772b8d56d3bb5a4fa64711308836308adde

SHA256
596a1aa085163227f071c9cb8fbf8d3290b3413a1e648803e1a60aadb0bd958c

SHA512
db3d48a214eefc3feb2f2b42b60f15c96322556fd2ccfbea4bdcb3ea7b9687605e1c993229e6d5c83aabcbdb4a76c93aa1c4d15faf03a69ab46a9111d6dc8fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc8a854a8ee08dca1f932cdcb17a627

SHA1
9c89fa0a7a6ff11bd47136fa49a436d866c920f7

SHA256
89df9699255b4ff3112cb99ce684ead693770747f15bec4d3c50db231388362e

SHA512
3d93a089c1c9ffc2f4372468442d76a61f9e1a72df40bea00b220a024d016331a8e9d85a74d522f212cbd9b57c5f38dbf4112178e6ec86af78440d28312785c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b4e68f6a2b44f11dc9780f6afe0bdf6

SHA1
10747735eafd2daff5ecf0cef6608cd76b94e7ad

SHA256
071912ebfde2d3dc9dafd2e12cdf3589c9cc2c2f625d2e4d8ea61938f5fc8aa3

SHA512
9544c6a946c65ac0b4c1058193edcf7f5a79c5770e21319007f2ba063d0b0782de6ae55154674efd30648046961069e61e46d718400d0259a3d16bad7154bbaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a986204d15b6e7cde00b64b4adf8a7c2

SHA1
5e0eadf970321ff46e85c95fabe945076aebe810

SHA256
2864e4e95ca0c9f2f014e5bb4af50e8d2168abc4549fe11a085e8b7a6b2e41f8

SHA512
ac192caf7872e4f11eb39673f114e765eba0a927b17f369e889cea615edb4478cc010e1ce9d6f54d5f0708796d051a8c5132a97450a1c180219efd9b593fef89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbe54a9d240ab9d039bfad93ea9a831d

SHA1
8ae62f0df0c7c02653262674faa939e6c2e14c67

SHA256
94d9c461259f44b89d1ebc08c4c52d503d215c269a78e6d383365e75be3ee922

SHA512
e5348781e1137cf8a8b866d2ed081764dedb7665b052d60cbc45731d89b77a6e63661884a3c8472548999acd613bc308de42d9670c75a0dc3711e163137d764a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
827dfb512574907ee336af7350c23c1b

SHA1
3822e787b5711592b77c688c38af26fd25d078f4

SHA256
0060628780e7e933923f3f419b61326a7420bb15f01daff25b9fe76fcd0d8a95

SHA512
c992bd866cb03f6d77bf9d8bf4537260954a0e305ef4405e3a05b6e71223ba528ecd8a131df976cc4dd8eb33893f7f13c930eb59fe8ccbd8996632ae2568fb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e095b62814ddf1d54cf94fcfe6ab39bb

SHA1
ddf2b9380d01d4677118ed052f1da12f9b6da8d8

SHA256
95f4c4ed3d7f90e4ed10ebe6a7d0020bdfb41eec1412af7741e3c1befa76a3ac

SHA512
07b6ac0f043c8ef1f44201ce5cd958cdd1b389c20d41c7a544c0bb5ae41cac268eb4c6c36d1cefe186182466ba25b699eb96d7f301bfaa4886c642214e818d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea9fb33bd629fba4379204f1a17eef7

SHA1
dac3cf0fc4abd87cab11712022af83cab323b1c9

SHA256
9ebfa7e91cca9a6f66d6faddcdcbd1ee8ceaee163e9b546830cb8a8cc062680f

SHA512
2ead873b3f4fdb21db2a59fae8cb6bb00e829ecc58911112bb76805d77a742e11f981b518b0b9307be31f4c1ed730057f5872f76d345a2ef1a2c5f5c7a7e5ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5d972d5f0372bddfe4ee155f7c65367

SHA1
13c6b56b10e6b340bce77cc97dd081cdac0e609f

SHA256
e431abc8b443e71a43e900a570e60f3d395d393a4ff943b136b2f848c17e598f

SHA512
e13e96f081362e87cafef0f4997870144d304f6bb118dad1867d3c19d0e16819851433ea50813e877bf4c3ace2fc454c6b112e227c62f8ed4fda9b6b417455c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22d6439d7a5a61e7cd70071dcdfd9bab

SHA1
241f694c4ef6f6bc94c203b9a2042f48058ebcff

SHA256
d32403f259f3f6690015ff2f430aa59eccc6e909019d38d168f26e31aec4157f

SHA512
b727d0f542439650a126872f1b21b61c2a1405fdd547be2c79aaf01281b91521c50a51c8e2b83d25aaa64901b99111a33a19e17d75678d3bc0564a2b8d2cfa7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
897b13f6a0ed6ae7435d9f22821e2628

SHA1
af5eeb26f3e08fe3cdf648789efb226358463f89

SHA256
aa179d13a7d0cba518c9604d214fcc0779d8389cf198a01e8f30d4b1bd00c835

SHA512
50580341ea940da35e573bde120c529236a2ec56b038fa9abd43ff9c63329cffac5296d85d834054ed79a33ac9dc2cd0b60be56d4c6de4ee27562b984bf83f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab80A8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8118.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit