959b55335ee443c014f3d1f93c2b6f7a11fbc8e818b03c63af10867af061c2dc

Analysis

max time kernel
139s
max time network
151s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62122af7ddc858b0a4bad132f5c09369_JaffaCakes118.html
Size

20KB
MD5

62122af7ddc858b0a4bad132f5c09369
SHA1

bf207ad41cf45375f3a9115e5e473b8bd29611b7
SHA256

959b55335ee443c014f3d1f93c2b6f7a11fbc8e818b03c63af10867af061c2dc
SHA512

32e63611b510ab7804329a0b92520a38683e51a8f276c0ad417e97a52a6fa81aab858537be2914b76e41588408bce9fd7a5cf7c67d9f1e6741b6d0337082bc13
SSDEEP

384:4+QfPFd9QZBC7mOdMQQuKfpC5IgSnbmFe7AcbW662HJPd:Zcd9QZBC7mOdMQGpC5I9nC4vJPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002179c07bfbac5438445243fa7a36ce4eaa212e3f0afaeb4d3b7bbdf718d18298000000000e80000000020000200000003b4d642b0852a27c974db1190e476df316cb1d909bd0f9703b0c51fe8ef85e6890000000703e57465ec531b1d97d8674b4045457b343b226c07bebabae7a83be0d2842a16f5ebae057f76c9d200cbac498428c8cd122e6c400ac14295db2b23c643398224f3aba8ac2743aabad78668439762b5ae88dd3180160460f5691c08145445f5abe52924e2ba6503887cef0bbbb25e19743eba25caddc4ffa85995141aac47d16cccd57a37996f016fcc4ce29450698ba4000000016395077133eab8a1cbf98b590a3d0d037150819d3317447d1c2d4e038a2a6a8acb1781505e3fc4006fd023c9bbcee4c1905723c6747f816a959ce0d7ada81f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02f2a5dcfdbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{878F3681-47C2-11EF-937B-6ED41388558A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000003e1020de5a46afc6fce0f124f3a106cac4037d4ce4b143c7b0764a66890c546a000000000e80000000020000200000007a984fc052ba4f3d9a09e094ef5f7cda3e931f620b23cb3585ad4456934f0b1b20000000f50933c2854d4120a5b6cc74eee35dc4c04dafd420ee0167eb3b66982070c46540000000481a1e0f8e8926fc98b5d4854f6e180107be47d218ecd825e4f7cd58bd0282a7b784f638ed41368bea05bba4da967962b00fcad4a2908a1632c707379a0f3242	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427770497"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30
PID 2724 wrote to memory of 2740	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62122af7ddc858b0a4bad132f5c09369_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ac61bbce2a1d420d9b43e36da6f50ae

SHA1
08fc45c2f2f983fbc67e9dd5ffa5e0104887ebd5

SHA256
48f845b496409afd4aabde9f02d35da899f65b97ffa0e89b371a17a595aa5609

SHA512
e2331fb38032364394fc5b99b842db3c2cc6b9b423a83a58c372d4413c1765db37e4296f38b65aeb153d1a79ead7466d3943f414347a2ea7449da4b4bfca1cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f803e79ccc551e7eb81413d58bc87ec0

SHA1
6d5da94e8af2bdab772fd5c541d48d455ea708c0

SHA256
497f04abe548a47b037329e08f817140cae0d6acba6830ee50aa56545bc4baa7

SHA512
2906875613100a2f7fe9dcf9f800e979b3424a66e53a922960a33d57966cd77761e0512b807c8803da3fc28bbacb49b857d4bf4ed8463d8da7d5c0eda30655d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5242ae7f22935e27062b6850c0092ca7

SHA1
f123768ccd1b800ed021a95eeca6da4b0542438c

SHA256
5c634dcb29127b647c37df214f51b83e99e6788727def721115fc6425f6ce0f7

SHA512
bf0a34a082e8343d103aa17701c5c529442a8919481e08bc08f3fb0398be796c9aad1ee05182fe4e599897d21595a8ab8ee845dd7a6519c42266e1a6974f9764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcdc161c9a30249c30610bc2989d2963

SHA1
589c44ef83bb055855afe8be6d142170332cedb6

SHA256
8a2fcf5f52400afcff10ace5caa857a3f35e3ad31b04c12a7eea2c718b0759d2

SHA512
a99bddedc0c45dbc53a1300b1c5c62965e2a876cacab85a791dd2e73b6d7d9c55672fea276c20592595fb5495d4005b716af0c60c093a1b1f5f0b796ca1a872c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3520ff061286327efa715a43564c3c85

SHA1
21d1aa54ea55771e13bffa06968f986040d62c00

SHA256
cf5ed41f4558675685b4e07f95d60e87d30cdd11f6175ba48ab24f640850f519

SHA512
a7a7449b19b74a7211844a34d6a4245d39b6c15cbfbf0ecc479dcf1c702a2806ae04786f50bcc9060ce3add44765e83ba26803d5d54f60698724a6f69ea58784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
026b2776ca65916f68abbaba52ea0eee

SHA1
c77dd2303c8c7a7c18d222f45cba0e631779b96d

SHA256
a212daa43ec7214295b9d713dffe897b27254ec0fedbb2e4adac11ce86fff36c

SHA512
3f323f9b8ad5ad6d3b2da9c49bace78de135195db2b5db99a3745690e06b014f6bd4b6b6835e6595a3088ef5e7365cbd8df0787353e81b0664be002d5380cb9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
127156273531c09e9b8d17b6d38fac73

SHA1
c8f2b8f78a4b30111078de69ec6dea9d707f4e0c

SHA256
905363d28a568fe954942ad9acf8c28ba481aedfa142b5fb3d78884ff6050701

SHA512
a485ae0ce5e02d76e06ed156ceaed82c9549ebbe389f189c971cdcdcddaea53e3539b76b2711ba41a0caee93d688b7a84a84e3181805cc8502fbffe8db6e2ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba1bee534360d7fa9aa13a2b6435f68c

SHA1
60d2472fb6b1addd119b8abb8f4d0af89ae81fe3

SHA256
fdd997bd4e94c451a7b4b6623f516528ee8562db121f49234b025884f61ea14b

SHA512
25fc6a2428fc359ef2583df9aca403ec13d3702a9a1f53b464b1af23a4089136c327efc6ae9b693df4f42c79775d2054a9216046d8e0ce8c35f076b0de8e8f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a2ef214cc863a4600abe7607c38c704

SHA1
7ea1d1a2fcf014f849d48db8e57e0ca9fd311ee2

SHA256
a1080d52fa645d674b3260a5838b00e3c1d13f2d2b247a285c9269dc4ae1f330

SHA512
0593996afb04fbcaf09b9dd896fcc756211ac505709a34525ce46d93d4f2082faafb48dbc62ef1109a00d217eaf0a1e00d26d179a6a63323ac4526d228dc92a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a84c30cc0960c149d5f985770230e68

SHA1
f0de0f6f41585ad6c90f8d28ae7df56181ffd25e

SHA256
dae3251271d4d63ed2b1b8e50bdf979e9c21a9aa9b726c2df525c257d1d6e8c0

SHA512
c774d8ad973ecca8c57abd433e5eae99a744628865e3661c875708495bf48a8923c4188be60050c2c72519b7ee6d6afe0db4b01e688ab62cc1539855dcf2b67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
957f3c08ff45d0264fa8131be1da0f25

SHA1
27f605a628c7f27f637c45d85f25cfb2a2e7a90a

SHA256
c070035bde569c1ab7d56dc682158e579d0a5a5d1543f46b9ca44dbfe7252873

SHA512
b7b0226fba16348651d86252cbcbc0004224ec240bfd443b03370d7ff2fe9a0da6916fdad6a6ff918a00c268ac0904a14c9e1e7b4422d1de2d9b6810bc4ab9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6cdcf9e9ef0c2591ef4b3bb4a15dd76

SHA1
3b45e71f7322f536109e09a26c5c2d82cd09c30f

SHA256
93888ed68a4572b2e1e56b943316cb909887e0c69f414c1f43a758cf788f3f62

SHA512
1018e47ecd50763614f63db8f831c56e9d9d78792c5b937604ead973ffdc74f5841d046d54dce4aa3274015947f43a82b6cc6d5044843cc8a3d7f75d4492926b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f66efdbba2976fc6b7f26b6c91afd9b

SHA1
926d07f61c69443a13d94ac4d4d2cba61e21312d

SHA256
819ef9e975f84a22d059f088c856c517c700a7597afe789fc8825212ca35e246

SHA512
590e63b9020c371f6c731718049281abb9037d632011f63ac50e647e9820cc21200dfd889c969ec4b473f61982aa3d134275c87f5d84c25ab4bd0eb13ff4feac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a2a68e8dd3b4dbac006fc1f16e56335

SHA1
cf02010b725d6062ad0b30f1358dd3ebc2621a3a

SHA256
6cf3dbce4bfffdeae1e44731286dd2767f28ee1d251df7f7b7cab620f22d36c7

SHA512
45bf791752397539d454e7c0e40d75bb3e9b5f47eed011f8ec31fa704271fec23862ad1b1ff95a072e618c36e3c1b6f3d59296d7253bdc18de2b1e6e32e2d93c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bb74f366f6538587cf6c3708430db94

SHA1
581af94578c79e60f319569abaa775ab4b11e54a

SHA256
c5ff4ae9e5f15a3518d779188f77e42c785b864c2a85a00cb1ac3a959b298929

SHA512
4523a8f2f79dc403ddcec70daaccee1eaa94fe7754798049623fdc61a8bfcaaa44913aa4426df19e98ad74a3d88f08bf0592514ffad9baf1dd6070e6bb34ef09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32eb2b4119d8f725241b8766184fd7bc

SHA1
33928ec387f58cfb53534828ae157b469ad1cff3

SHA256
d02f9e0260b2751982c88a64082992fc8f0b56491747395d0fe440b412544642

SHA512
d6fc271561294962a4604cd6368dd287c82079f6e401908f6789470d6a1b9fd431bfb1742f8d466cb8349dd89d9481bb30b7d22d2673a363e966db899ea46684

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E4F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit