96738bd0dad74382f9c21cfd3c72f193ee543aadbdd852964a2c5d4859ace333

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6268763bb1c8c1a273c215211a31ba1e_JaffaCakes118.html
Size

3KB
MD5

6268763bb1c8c1a273c215211a31ba1e
SHA1

69b3b6ee46ed659f792820b29161c9d5b7636910
SHA256

96738bd0dad74382f9c21cfd3c72f193ee543aadbdd852964a2c5d4859ace333
SHA512

cf62b050513c1761dddbdfe0d22963edc3d28e89eb704ba5cf5c99054fdbf132c1ce39d571c76a605c6eed335285600e5750904b64ba3360205190b0e6545267

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000091664a4f621ef2fdf831a651b6b05e4437a8e2aea2b9dc7ea0d1e6ccce9f309b000000000e80000000020000200000002fc0c4ec3ae92eaedc3d55531823964becc43d215d85cfa5ac6bab9e0c7c555c2000000088aeedfb2df0cbb529ead94d533778bdb406d3a0440eed110b92da1b4e2c8e73400000002e3d78270488524494a04b5409a13a14c490cb5c960af5a218323747350c558b00ed596a1e490fca08fb678989c32c4cba261939f27fe6c82e1c2463e62d832f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427797132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50abfa4d0ddcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B3365C1-4800-11EF-B82A-724B7A5D7CD6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000006bbf84e6220e79f43266870873f338da0839df7706d5100cdcb8a1ea3c7e7710000000000e800000000200002000000071206e68b0d3c808de1df4d9dd40018a8f2c45563635619bb18108537002d1f290000000227ea43470375fc50f91a0ce9219844cd444d97d2a320adf203ffcc269b8e7f90aacd6a9dcbed05a12f93b9437c7a650ea6646fbd9b76e1b93177ce8ad498a089fed1ee55a2ad63b79585d5e011e75598825e50a066d0fe688da701850a5ee194e48ab38fc324dfcb817754171a53cc02b93a2912bd1d8ca788b8fdc7e95073b5f99c177f1f95e7254e5e2af03661f31400000008d64ef7f79c491faf557dd8510b797aad63b304680766ad71090776f9ba5ed303696318123cf5f8a7e9c900a4c4fbe2144398748a43d8de0f40a81f6b0f8b312	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1912	2528	iexplore.exe	29
PID 2528 wrote to memory of 1912	2528	iexplore.exe	29
PID 2528 wrote to memory of 1912	2528	iexplore.exe	29
PID 2528 wrote to memory of 1912	2528	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6268763bb1c8c1a273c215211a31ba1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d7d18e9fd116d15577288c9a2581b0c

SHA1
5fcc7e2ceaef5a914dcc315bd48095092cef7017

SHA256
cce15009dc4f168695a971a4344d4f37193854c88e3c0a210417caf18b54e1ae

SHA512
d01a017d683cafac7c0423c240518e713bc41b23e8c24e3466aebed06c337d7d4d95b84f7d704eab8e9798747f0cb8727dff5248af683f10e51cab9d6c720cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef6ddc736537c34b7d6c5fe928dc8c78

SHA1
dd7d4254da791ecf03cc94c3317bc89f8c37eac9

SHA256
7e74ce52d634c266da6a0d109c62f876dca265687556660ed5379f8a0d0f45c5

SHA512
6a394f6e2fdf23a3b488f6dc9a330fa2901ee5ba42b969d7ce6c0dc28fe0074f4a26ed9b5afda572712e0aa2ac3df61990bc301de3fb3ee56572bdcf2223099b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff3e6abebc3710a8b50aec1fff4a2213

SHA1
901f401071ee69351a062af74dd966576b516ea1

SHA256
2954479cf0390e11b7f90ed62daccf8ea41e8f6fae57209d268f0a587944dd52

SHA512
dc532e7f6aeb6f32bab5cf311cd0eea302ee69db6f75c0c3b2a190a5890a80bfdbef436036b784aa89dccc0e6c4b29801337552de7b735663de6f13d39171842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb5fc7616bd8d37b22eb4d1b177a12ac

SHA1
6087151b75118bc924ddb5583ccb3f7ae6ccf12b

SHA256
39a9847be43645d57165ab6a3bbcc2ad42a42d5dcc0b0a52cd5857c0b7c29d08

SHA512
9b995229da9fdd3a5ea7d87dd67c1328664c886ba781269a02169cf1ec6c5377fd09378e63dabc7f6c4b7a44b88269dcdb554f00cf0d4d00bac9117f4f596581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6c8f4bd1af2c6420d82f1c203feff6a

SHA1
3a42155827a8fde30f3088aad5bff7e1538a5078

SHA256
8d79b4026d2a6258487e21a1b9b6b15e0bdb305f973e10b2c39e59afac3e1f02

SHA512
fce0ddc321fe4e538d2bfb99ef0be251623df457a79d29ee3c2993a149a62bf359d8b4c29e89812d703fdd134553c44dc0b46f09a05ceaa68a091bac52131fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c0b5f58a62513dbfdde5787bf31523e

SHA1
e78d78a9e799fbab6d713fba89063e28dbaa2957

SHA256
324a078fd7ce8ab1b0229225ada9c5b54b105ae67d1a4c253db602b0e56acc12

SHA512
81f1c6413e219e4720498218b61ff1c6f0028b2d03650c1a59730e603dd1cca1a11d1830a0356bb335d708a213aa5ce854348a544a683e0a178c5f656b74f4a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a42928b42a4c739672ad74e4944a9e8

SHA1
c8ebba2da696f6ee806621a3eeb14ddc964ac76e

SHA256
4c4edd4f38bfde990d693ea94f3ee3861b23fbcb05dc519cddecc79e2c8b1073

SHA512
7615164c38a514f9e1ce9a80b3032a6d6eb75e9b6be2e45d020eb22d4488e62036a5c4d65a722589baf57c4fe7ac9613d1b9dc9ae68b5c72e60db01cb357d076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a6238255a15530ca4f9767534c77a4c

SHA1
f711ba97c0cf34d818f0538ee033d8f351fb6513

SHA256
3d8184bca875549bea295c802273ca342fb5417ff8f352a2db4ae93cf1f1c36d

SHA512
cd71f2ac3d1ac46a7589a22bdafaf9fbec117521e6609c54a760ee95c8f2bf26ca0075796ca30595c2b8b9faeb164a8bd33c34e11e70c5d42db5decc6d37ac6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02cbaf9b7216abb0e3c7c7cf0c8b6af7

SHA1
f6f4841290db0a3c9eee03a94e7c018ec5dece0e

SHA256
e6f7d193a4ae31c7eb9de2a86642c2ceb85f3b86de69e6d78915c2e8ed2f1081

SHA512
784d0c85718b65b4b409407f733b01ba3f210ab1f0d68f6e591c9ea4798a2d1933dd06fa2a10c1738343d5c37ae608480b5dda35426bbe020aee04081154703a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
149260c9c9765e5d1066dd472905df18

SHA1
bcaa90272dcfdbf2efdfdb041b71c3088227fddf

SHA256
e5e3538e524fc07773ae8b3d04972e58e7763bdd35ea5faeea4ad131781351f7

SHA512
0c0cf090e08d0f1cad023e2e1f6affeeeb0861c44ed7d324c8ec1539de54be33ee897fe8a0cbf4d25b784b0acf4abe432b4e66c337260ef61e9aa84bfcd87683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e315ce8b4a5e77da76b7b288d707ff40

SHA1
323a1cf4cc471712d7ee00c20119701682e2d381

SHA256
7d37d8e18195e65b51af728687c49d328111f83a214e79dd107f36d9fdc63d51

SHA512
aa4491be8d961545ba9b57988299adb35c93600a4ab0b22e2010316b3ff5188b21fe68e3034efe081f06676096b5e4ad497d8d897d97791a646582ba37d64926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cffa416532156e1de949664e39a03524

SHA1
ab6bf1cf3cae8a780b9bbac387ed90d748529f84

SHA256
9185d5d11bbe8190ec659114dd9bcfef444f23ec8e5e891940c91ad06fc58bf1

SHA512
6113939f1c499f7dbfa99f29b487c41576ba71325579e7aec8dd97b32ac28cb4b174cd5ff13e4c0a6301362b46a9fec3aac2c6b7a948c72818f53643a606ee93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b23ae860c3ddceb165966f779b1453

SHA1
c449158976791a9366bb4d18c4b1741640cb4443

SHA256
1f91ca8426a8ca1ca4c7f8565f4fce15c3ad0139954c8a10fabe175bdaad081c

SHA512
a35bdf1f45badb39b3282278d55f05de4abfbdda8ad37a82c5c2b16ffbd1cc6696f58c6329df62caee318c3e58ee0b66ad456ede696fedb5482f98aef3dd1fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cc704cc257ba9b7e1d7e6386f9af845

SHA1
f2b1549cf0802fb72e8bbe8fccf430b8bf3574bc

SHA256
f10f307527b16cf9b5477e3fad30571a10fab9c1538b9d2b5ed3c515e7bc19b5

SHA512
36b5de9a6e283dec94b567367805ce9a4ec4276734fae588dfe116b54ebbbdc3b435d9d28574b9b00267c9c449a4e1d52caec42754cc98abd241b9a2655d98cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3BF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5B7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit