d5e791a091c67ae7d93011c59ee7b6fca6c8eee7a0cc24c463a34c0f853c86a0

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62530dc3777a5b92ce529b0a87388096_JaffaCakes118.html
Size

19KB
MD5

62530dc3777a5b92ce529b0a87388096
SHA1

f066331e864f16fae399d63d097a947b09dc5857
SHA256

d5e791a091c67ae7d93011c59ee7b6fca6c8eee7a0cc24c463a34c0f853c86a0
SHA512

e3aaa4a6fe20475beb7a0a175c9bef3c7ebbe8251cee34f85a1864691d246a2590368622c02e5af5185d0a83a6ed6173f3c108f54744ef14c79a371cc6d87649
SSDEEP

384:4+QfPFd9QZBC7mOdMsytKfpC5IgSnbmFe7AceD6VCLDPd:Zcd9QZBC7mOdMsXpC5I9nC4UPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0beb7430adcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427795792"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000a68baf1a6a5c29ef714688e745d6fcfc3db6e1eaa349e419c9fa68f90cbbd521000000000e8000000002000020000000a39ff556c5a884a5a31c3d6520b2277aa69fdd1fac1dfabc482a96139f242a219000000050326ccce5b3925c9a7b506b47b7f71f55123757f95720c3ba7ddc68b91462514edee72ef095c9a540df2a6e37335ec3d6dccc6b849248431e68b6bfd209c0598bf6f30aa2e6126d71b998590bc452af246a7d7a5dc987332f90a350004206a2659f708b0228f113e3c4c0072a5b52845442639a8b18741229107c60b58a1f8fe888861373a575624ea496c2c80be58740000000cc7fb58b289efb3b9943cb3dbbdc6c267adf95201beee08238b50f81eaecf4184ce54a8b4fdadd0593a13f4461d16a3b1d5b2aca5193ec5db1d0474dca4e1730	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B4E5B51-47FD-11EF-8B6F-725FF0DF1EEB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006960bfb08d74f06739247da4e798ad566c37d62655ef32ee0766d153d98703e2000000000e8000000002000020000000ff1f8303403e727f176b627c2af0a019451584a1736f4eb1426861bb87f5b320200000003e51080ab1e9bddb8ff9cf16d7c942c61e65c781cce7ad31127e1313a0e05fd74000000041d77c24713be3ab90892ad54a76e2b1737707a9b35025e8f81d11e5874609cbe735515f1d129af38f7e49570dab638d084daf932cabfd0649a4c097b493a28d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2756	2460	iexplore.exe	31
PID 2460 wrote to memory of 2756	2460	iexplore.exe	31
PID 2460 wrote to memory of 2756	2460	iexplore.exe	31
PID 2460 wrote to memory of 2756	2460	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62530dc3777a5b92ce529b0a87388096_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70bc0acf1c5dc166293b2e5d9af96d99

SHA1
817426d6dea7f2876ba021e9e813ee1e985961f5

SHA256
75ada449d6798aae767980f94a81cf84c7623ca6b59187354d96e700b0459f4c

SHA512
99f2c7996b92d72c5d033f347269429bd99567249525cdae8a90e81f700601b6c2e6ca53689dcf4520fa8c2da4fae8e6f9fb029b4e0c9bb3193baf233913123f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc702bb5df80810bd4c01d14b6f65932

SHA1
102d0ac9816ab0e25a500e11a5903a08ce48697e

SHA256
2ae80fd580325c01a002d32818e03b612de2a31cd97a32b1cecfe07f854333dd

SHA512
d449535113c3d2449a508e5fe2b0d41ec23297b56820c683578d85f63e3d597a9cfc51f1a366f66c10bd201cf758b5a57723efdc7ccf75f64ba48bcad4dfb023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59feece02fd2dc072cbc3ab08a7b112a

SHA1
805b865c08a23f5522b47cd252cf7c4027bbb786

SHA256
1691a5d0bae137f333f7bc5aa480c8744fa2b4e9377038b33a2bad0513470f92

SHA512
520961e91ab37559ec0d073627d5c8b50cfd221fa52d63773f12f124d473a4237d7281abfbe49c34745f04ba2420b5d9d0e559a74967dfde9c36a6aeded35574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf6e796be031a2164d226646a1079fc

SHA1
fd32f4beb5eef30a02219b7081c3b926e2bbc6a8

SHA256
4878e1cb9deb79195c66b91261a74a848eab9ef6fd5f28acb7700daca08d85ae

SHA512
16c1893ed6b5cb059b671e0933407bbf219bb5410a894ebe71fe3294a520aa7c4d257d4baca2bfcaac3435fca936f73483a559d426cb10adf7585db0c8e7f3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
430c307b24d3c087693cb971c8e68f4e

SHA1
eec916dddd743dfb10ecd149ed7393f8f01d05a3

SHA256
4953103fe3056f8c0e28a3032e296b080ccdabdb2d3b3e5c550192e1179b004b

SHA512
4a02c119028f5cb70b0cf072f757a96146100556eb52c4575784114f9c02331cec8d3e80068651a2f793d83eb0bb058d7406c0b72212ce71bd8a3c84e50d7619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e327b1105121e03281e6c7dd64483af8

SHA1
45117478b801d4f53235c01cb003d06ddd943cc4

SHA256
23da0f0bb53475203c007a872a30f945bd742be42369bb44f9e09b09f588c5f1

SHA512
81b4db0d775e5f648b4f0bb45eb5a2d618bd24aec743d8464e9959a3bcb05c42a47e0a958a2087ff8a7d4d7250e25dc54447acf49e3a1a2f42a8ea27e343b7c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc842acdc86a2ffe61459f6a9cfe088a

SHA1
804d80f3ca7f63671f99e03ca2692940432d5d03

SHA256
7f81cfc36402a61f621dad357a6772e42c36e1f39a33bbf6c5548e9138c3c03f

SHA512
a01cc702d3ac0b86c816a0113426ab1a86206e72b2fae66a9abefd5dc6edbb1f4065241b3680a061c9d993d5019f6a5b5df688075770e1d2857ca0531d4287ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a608c060396f385b880d19ac3dd9f7ee

SHA1
e7b6baca94fdc70e00a751f763e2206a4d37f1b1

SHA256
2833f7b1a3a140b010b93816a7cf0a3131ac6502bbe5b5541ee9c61374d684c2

SHA512
8a0abf712821bd65c11d071f81950581bee4b73d5ac19aaee340cea9389394416903195bc982ecbfc8f77c2fc65551f01425dd716a170b2cced439e2360882a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c363ba07a41174935f6305c86854d8b

SHA1
71cbfccd444299cb187ac5b00dcef96f38050fa0

SHA256
e11f40efaba9fd1bb9484f6ec7363e9cce6a411bcefee88e4447bc4bfaa66606

SHA512
ec0efccb1b3adf3a5077e1fa0d65e7253045a04652b4d73baff36fdef91153106cb40ca657a67148b9813d2d304fb8c211485001f7c7a3c9b9a721f97c7eebfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fdaaef82538ccb166e3f70fee505274

SHA1
94908380ec5c72020a75e59ea9a0c6af9d8c182a

SHA256
d25904b95f3f1efe08b5a2188fc180221c4413276c6eabc8cf52738067d95783

SHA512
02b747619f273356b9de5a01e05d04c85662831042ad3e12a31fdae1bcdd7833d5f38e27272d3ad6d9e0057b48f1c65e5a6b2f554488ef240ae8eadac91e0d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
393a62d7fd260fc1255c137325fdfaf3

SHA1
4ea7ea03680b3bdbda19b2b162df70176e296b91

SHA256
ec1228ea2192e825aebe4ff4cff928d11458b70c1c6dd8345683d08bb1eebeb9

SHA512
c253641c2e141d220f92126f17bfba1093ad8be8e6e560bc433b5c6b96c2232445246e7b9ce32003006737c6bedab67116e6a75c38f56122c2d1d7a5476a02f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36f10b3704b7dec5911a041c6a8ebf07

SHA1
72d56ef8a6d91f652fb486bca61d9e127ac37c87

SHA256
fae0348d0e01488371da1af345890d624fce35fd03153b93961cbb1add754b94

SHA512
2f0508142245416bc15d5aaa2cf552d30031e51b39449f49562609777c20bbefbda3f80517ec6afd891f4432a68be962fa3c2152c3ddfb28bb15abc80b460d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1585.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1654.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit