aa555f46a75bd4f95e3e5ac766c3add2d3a3316323a1dd6bd972d824428e0ca9

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6259d6986041ca27f86e8360f12f4d4e_JaffaCakes118.html
Size

15KB
MD5

6259d6986041ca27f86e8360f12f4d4e
SHA1

7a3366220b17efb491711b4e8b2043850309f858
SHA256

aa555f46a75bd4f95e3e5ac766c3add2d3a3316323a1dd6bd972d824428e0ca9
SHA512

f851b64b7c4095566ca39bd3de0d3f7d9554cb09c64e549f3347988cb86ecda7357d5f4eb007d739b1a814f6c73a5b492b9cdf85510b5fc733bcdbea473f7fec
SSDEEP

384:eUlxzCmrw0OrOI5cg/3tjN3lDngSHwMuQAoJiphJJ/s4:eKzDW/31NxnnHm9LdJ/s4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000fc8cb9624febbccb88457940f83420800e7afd308c950a9e0f86524f344ed460000000000e800000000200002000000034d70d288b59942b54cc888aba9ca9491a8cd99ebe967186d93817cc659275889000000044f587b668a84d6478b724ae3e90cc60d5afff0bba9156ee404101d901e67e0f1b041c9d1c384fce0660c7f0025f4bb9b25261036266af4eb4964c20ee9b1aec7916942c3e211a7a9218ed8d60150e82d8fbebf6f026583ff2687681157421c65f20fad95b2917d617a9d87948294f81c42c54f7bc1cc0ef672a5037f864a790fcce5be88f4903db4ed68ce1237f1a65400000004ad377cc387be42794dee3f01016159f41da0420638280747c3fd29d3babcd60dae1918e823d8dd83fb103922c1d47c48be665fb28d6194c6f58511de59e49bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CBF8211-47FE-11EF-B5D6-E21FB89EE600} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000003bcf963ad33b79849d293bdcd854f384964aa543f4c6b71eabc9cca1490fd4fa000000000e80000000020000200000005f311f7a6fd3ce398e296d4512639520b3312a10d0a17af341fb65db1b2047a8200000008803d725a9a6fe073edd16e58950f0e75acb64ff201dc341f28bd6f3c02440b740000000c0796e8ce0a5004c94f1a37bdb9d9e331afd2ebe8726c830b0ad907f52b2b015562ece86809bf9805b1090a01cd1b7c150f8147abc5245c5cd60bc2203008e01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c7a5430bdcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427796229"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1728	2704	iexplore.exe	30
PID 2704 wrote to memory of 1728	2704	iexplore.exe	30
PID 2704 wrote to memory of 1728	2704	iexplore.exe	30
PID 2704 wrote to memory of 1728	2704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6259d6986041ca27f86e8360f12f4d4e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4da7642efbf7a2a20df0ea12050dc20d

SHA1
3324863e7f29d060e53c40e906bd9c8891de8d29

SHA256
526814667c4677c1796fc5c48d22f1c191f1233ced5eb1baaafec695ba91a156

SHA512
337684dac6d4388f8190040704d711c2bb8708f8b10c74c5b3eed028cf39a8bebc89889dcaae0753ce5517353937128302e1ebddfc59262e3bb468617929078f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c852f0d5250bc543f8cd51c03ec0b516

SHA1
a7987a41b7ec3ac3eaacb59cf25f4966a150d5b8

SHA256
2ad2ee1140a37a11dc34e441c74a28664b30cd6c72d4bfb29ffe25d20ee57973

SHA512
1aafc706d34242989ce7503bd5da53decd2bdfa0d4b921accd6f68fbae195fedf054b6e8e96a822e95bb100352e164ae791988a73f8a381c5c6e6ebd87c5ac46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9576b8bd594f706f8ec657c1f988a8ff

SHA1
3ad31a37b7aaca1347554238ae409b18460ac9d1

SHA256
2eb2b44dd52c8249ac20266624fc9505a971cc88ab63f87ca38c266bef831d75

SHA512
a9831699b0ff3d9fb64a5c219fd68e3569f4f6ee294bc5a640121782b1fb3409adffdea95e42a6616462d3dde240d8b7acfd502cc1b61b50b979d6044de08487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d35eecdec48586e1b1b2e3c023bb8e8e

SHA1
3cf8844de7c9df9dc951d5574f015ff5ba9019ad

SHA256
cf5ee26c5059c381fbf3bcb28c7e8cdda3b79cb3b0655dab71ff75734ee67e7c

SHA512
be115143664b1d7f2cc42b06de988cab8476f2aede1844c261edb5a9815c8ed4af638f02b0b4597aec9065e0f915917201a18ec51d7e5d07e7ee8835b3a8d6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9832ef5d30dd793ff370ec73d3d595bb

SHA1
906b0563dc3c482b17ffa0b964a024339d1b6c7c

SHA256
9cd417d0be7b7d30a3ff3f669641a6e59dcc8d924e4d03ad0b04ba00b228e425

SHA512
47c0b9b924f836fcf2274d2344897962d46f1e80cf82c9ac3ed230287a0d849be7a5c0b31bbd92f7be8750bf54ff19b1b5f509d1cb8856e946880693da68b538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9953e06f3e445d260cfa8c20fb9081bb

SHA1
918b1ffbb6f7bbc216148a76c4ea8ab2342f1376

SHA256
c551b513c3752be62636e2feacac394a34f3e76a637748d94ea2d75367d9f4a6

SHA512
0440621f457bb67f274aa876ccc432d6776c55fc9942416a2b1d714a7a277b673caf6094ffe4b618772e662c2cf0d61a49f6638cc57fde08e5cc1b291f08e54f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24f688e019316f27b8ee767a5f2ec02c

SHA1
90dd43d45c4e84a87d03b74558772fd8687c45f2

SHA256
0ffb44197a4c5d95905e373c90c817bc4426a77301942aad5185e1fd5f94bdce

SHA512
a933666d52f9e87b9d0ba7c67c97564c97cc2a6cbc2be24d15feb9977c653af0981296612da421e5ae9d46c566a9df32208983677d95a36d751bed11b3d85255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43f7168b0ea43c8dfb6c76182a211680

SHA1
192d063e5f27fd61fa5132604f978a3fd2af8e7d

SHA256
6512ba221383d0de5e1d9a57fc026d37d64a12d2f5e2f6641d57f7b409c5a92a

SHA512
682f901640547b08156dbb2a56d014a094456a93720761b1b331a87b5b47cfd493d50b8cb78ce4c2d781a3d208b6a975b8d7ae31cc630ec1540b1ed2107188e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6a53f712e414e03d895b8c41990ac10

SHA1
5a712d43449c49eb8ff47fd0ad227428fcd0606b

SHA256
2484a1a524fe64b2df5195fefe2ebd0d1dea94fb28f5c1c51faadf3c6fb02fa7

SHA512
d4c6286dfe4298a2a77f240e8cf20fcfe11a1a60acfedd4b79dcde923d946701bc66fafb57159e79f6cd2abd485fe7c86e056827f6ad22bffea8034d06203171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e2a02d6309795eca60ee68f226292cc

SHA1
1485238b97415e343b2a9bd235a30cb8121645a4

SHA256
28db114b54b98dd2c7b47f00b6032e6fb4cd65d22ddc72278863211c846e9f8a

SHA512
4e91bfbef9374ee1733d5b01d79b0b8bb444a40effca82f8722381f6bc3b05acd7c0e420f818746a99db4607995de2578acfefaa9f7c10e8ce5f5d0729e6d2ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
974a10214520a972d37521df84bf6109

SHA1
e0b69af6470ef0da70281148e2e5a7d70a952f0d

SHA256
4e8c069b3ffb71c84307dc7ae1645bcfac15e9f681dbf546ac04fc6529340fc7

SHA512
83f66a8c81b3b018ea7893a1f249561e2d71156b13fe5af073f056f523544d9f3e06128b59577f9a01cddfd6823715a2d48c53c9f7cf6c34b696e50498bee474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130644060c221b9047337a895fb326b5

SHA1
87824c923f8d86c7c99bd89dcb5b845a43912306

SHA256
633249c149e02a79d312725a195f63bd21255fb5f305603531444114cd5bc2f8

SHA512
840aef672eed802b72115930af377dfe9c283e9573174ce07d4d9ed8d31101925470064c975e17f2ced6b4132ad124741a15520eec2f7149ec703578885abc3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD75D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD78F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit