ca22b96bf4aca6a5c95ba96984088957ad5532fdfc48b09b90e3a73e6b869ea5

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

625f9c01af0f05d093c1a7377231c7a3_JaffaCakes118.html
Size

53KB
MD5

625f9c01af0f05d093c1a7377231c7a3
SHA1

5dd9854e67e61793890d93531017bedb1ef36b23
SHA256

ca22b96bf4aca6a5c95ba96984088957ad5532fdfc48b09b90e3a73e6b869ea5
SHA512

095c25a0523a3f61654bf3242fb5f78e3c04eb2cf061ea6898edd281f61e3e53cdf63eec4b71eb1774c518d820850b8a3b71c146980153eeb82980185283a43c
SSDEEP

1536:CkgUiIakTqGivi+PyUYrunlYs63Nj+q5VyvR0w2AzTICbbxot/t9M/dNwIUTDmDh:CkgUiIakTqGivi+PyUYrunlYs63Nj+qi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c035a665697edb88229a036ef37eee781b35477c8cc6d2a9cf29110d5b44c9b5000000000e800000000200002000000065703813b5f3b5e90ed704651ae3187bb5eca6d4740465bfb6e71207e73f9db320000000fa447fe628b8ab0bee8bd4fa13d51ff9f59efe588e36cd2b4fbce3a3306f447640000000af1f074b656663585d6c817b664e3d34a022f2b30b256e1b812824d32fda8110bc60af09d0ecfc48e899768fce134629aee3c2942a42137942c905fc293d31e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{506CC951-47FF-11EF-B6C3-72D3501DAA0F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07916570cdcda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427796622"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000076da3fa98379ce4a6302a820b609d39fb2be6e51b5f6c6b0587ecba3f610c138000000000e800000000200002000000057b54046fe186707bffc75a937e2679e7703c63395e65a122555afb8ef85106590000000e86f9baa083d35be9506b7c0815717a48197c9571e5b224cb022627ea448b2035f489e31dad538bc3528f0550bcd09af966006f1767e9a3bb765fa8dccccc45c3e19f9b84562f0495f40b94dd03e618c83c31834171e1af5d6ec490fb4cca73da261507f8434177599f156e4c330887324cbaa6f864fdc032ac2335859c78860c6453a8c2f2d051a2f87b99feb3c1c46400000007cad6977fee63ff0c8122fb65cb3e2e2fd4d452fe9e4adb9bbb5bd9dd005428269b5d7d0da9922dd45d57ca7e8d71680bad892228a19013275e9dcbaf685611a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\625f9c01af0f05d093c1a7377231c7a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8f69e916140ad7255a784887053904f

SHA1
173db7276b8063b657ddd67734a03490c82f16a0

SHA256
9f94f1b87604721c06b8db52db88625a7585f170641668b21503b35739f9e7f6

SHA512
6cdc66a3668fe2f020ac3e96deae895e661e2013259a55f3bcfe9360418715e131203d4bc9d9594e43c730358bb1a3e5b953e854eab7263eab1cd93d7dde60b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24188001316fa1fcbec84332ac51c97f

SHA1
d47065c0e73ff822ae325b6a25dcbdd1422488d4

SHA256
4f843371f7233db199ab1d0f42bcd1a8bfe27dd8f3f374f3b6d85dd8a52af464

SHA512
a5bf9683a7b8c23ed7914f71f2af446e20592d08598339cfba97e1161d414c11cf033ca24693e374c24514bba8c6a61ca8693b90bda7fde504bc5ba856a3da74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa755f4ecf3c4b00bea95a7ff75a8dfe

SHA1
06211a45db65d76f8a2d2a9e7910bb270070fa4a

SHA256
3b97bfa286598e4074fdc7677519508194f0403badb95965b9d1c327dafe463a

SHA512
61b4ce80a3008bad35d3954e169ddc50d555230a539e6c19b91ec122469df0094b053bc906cf61452e05aaa7e75214e9a2eca60554fb6d990c6208521ffef780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b878665461005eb02b09c0945dcdd903

SHA1
e1d5c7c4c678a132fd5576748b8732a6c6bf3b27

SHA256
00005ae2ee51de6b7aa959715bde87ac4697efe27b7fd68995222c564cc07c09

SHA512
407821acf6c23b5fd3eb38da450dff8f44a4c6b52d09b7521f49f579a088a2a882131fbef57282772ed24a476c4e9e0cb28214593cbfeb5d7d194f4529a13a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01fb18b740f24c68b3fddba727f4485b

SHA1
ccbde07acbf2c7ca6fe32f0d2ce1dcc1ae52f3ce

SHA256
d415f47c103213032ecc7c36a38a35e1c0fbd223abb44919230f462b88a2de26

SHA512
c8fb83018cbce21cbf73eb48e87f4fb2a409521d28d0a087c310194ff2f7a3bb743a59ce8ff2520d12df0dbaeebdece0592a52c8885e77a0566bb05411372f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e506d2b5fbc03c467a41ccfc13f9a38e

SHA1
e17b4c2a5484f49975b886c6713ba1e7946ac759

SHA256
99fd8fad9aea42da6f03b3d9b38594a66330e765ba77aae12ccfe9910e6cd1cb

SHA512
8f82b93f99a814f60928b05c4cb7aa25d65f3194d39ca2ab5a2a49ee2e3da4d062df828400c138a2b8ea32efd057fae34d4374c36f5cb0932820c4af1fa2ef90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f8eb306f33023e372acd5d9dc8faa4d

SHA1
d7eeddf81faf1f02fc9454121713f73fba7f6182

SHA256
15ef180180239186b1bf42ce8a4914389cb491381d7d94a71be9d057cefd997d

SHA512
c96a2f767e5782356f08206afe469970361dabb60a2ad51266dfd1c2f08951daf788ed4c876c31914dbee8e036a92d45221a02be9bb07b5eb1cf46e9bd305a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b89c0ee6ed8a590de9d7283942f522

SHA1
23edad8fa572664d1c6ac27340dff2643c02b0ff

SHA256
30a9d718eb15233554245413658cf910cb63fa7a9284131c0143cce99946e7b1

SHA512
0c80b0e28b43da12da0558cfcb2f63e9488651f543831932ab325b6e45b6b6f817132518da4943a80571570c97fe11f8fe79b696ef1571e20c271f53df5b141a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
776b2c20f1b3e99c5864c073645099f8

SHA1
84230a1d09aa8e25ad548c3179e19b6c7e6f4743

SHA256
69ec53913f7e87e9c4bdfecc6ce43d5018637ea92265a37553549da57314de16

SHA512
8a1bcd51207842bf23d77f732218c2df56a36efb85ec3a7d3977c428f1192b8b89457cc067a92d73db8dc407f2c8951a145ee218c694b1262138b367674e7079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
151fd1a1cb838302c130419138f58b9e

SHA1
6f82cedd5eff1bd918e883e186bb1b21638e3248

SHA256
4bcfa70309283aa22ee13ee13e275d5d4f9a8065fa2a4d89ede5a95eacc3e38f

SHA512
b2265d053a5bd3f8ed924d09b4682b84304fa71a3dd2d49b59ff4a21691e0f742e0324fa9daca1a25d10baa04020a08c2e1233c382922b1a4fd8c47bdd9e662e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC4B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit