c39261fe60064064ddcc40f41615fe952bc72efea20450b3d91ffafa381284d2

Analysis

max time kernel
137s
max time network
132s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d53f251f371c6d92d3ca376f7f37ee_JaffaCakes118.html
Size

7KB
MD5

62d53f251f371c6d92d3ca376f7f37ee
SHA1

3592aa82ee9afd2e1a623c155d01654d8e348110
SHA256

c39261fe60064064ddcc40f41615fe952bc72efea20450b3d91ffafa381284d2
SHA512

616e824695c570e0610bd6ee64dee21309f98d3d5f446bb1b58f31057c94eb91fb829fb59cd8a41b8929054e344a470378a7e4df5447661cf3141ca6d1c09f74
SSDEEP

96:uzVs+ux72WLLY1k9o84d12ef7CSTUBzfAWRKxcEZ7ru7f:csz72WAYS/nxb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000333d5997aba5cc93b4d4d5aba15362074f6901aa29276876168ea2b523eaa06d000000000e8000000002000020000000dadc85deccf0eefdf4ac246dbb141c2356cde8a01416d9f5d6af6fdcd24442ff200000005543f9dbd7aa1c345528f9bab0772692f1e923249d5acdb6af77db493275a23e40000000f070a0ec6cbe7c329c1cee30788f965b7c3e7d5446f13bc967a4b3420e4ed4273cd89fac877b3ea1963385786bbb5860c994c96f5836295b5517b64c7199ae24	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000294256a81e01c47ec068025ffaa9a2ea39562c8d36b736ea2eea0ccae91436c0000000000e80000000020000200000009b4690226c2bf8474f4673cf62f27bc11a2594de2ac9f00a5b71b893244552a69000000060a6fa6a1d6a0acda2e0897a533948c208419fc795d4b73ecec298bf5261a193c164852ce6e8e1b9a990a3639e0277340aa71a3b76eb30ed59a09b91dea3c94c5b1ca6e259412555d681819ca2d976ebc06050784430067bc17948eac3d98070a2224f5c62076274ee74f4926df928fed4f022f6fac1ee065e32e9a6bb30e9c7dc93de09f0bc9a84b99fd3ac0d723ec4400000003270e99dc7d86f4eb5a6dab83f77a4c0b2456011ac96838419c106e7d726e56da7e54af4aaeb7f3c29440bce6add58aed1022bc0d091714692eb1e12a3222934	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB86E191-4813-11EF-B6C3-72D3501DAA0F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904628d220dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427805484"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62d53f251f371c6d92d3ca376f7f37ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab2432a6e4b60f6db99dab95c32655f7

SHA1
e7f224bdd00fc880cd77ce715379fc94b04f36f1

SHA256
94418afc066d23bb7d1d71f7435cbb63ea898feee993868dde99d8ece43f100f

SHA512
97264ae0315d5d5d3a4bc1a674c52059d0ab533f1241dd83bf7af50e50c984bb248ccbecbaad6eb263216867512ba65f0cb5bef5c1403366c3a8069f775e76cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e87ee9dd08bc86de4000e5ced63f97

SHA1
99e094ec65a10216bbd2567c82e446fc0f44333a

SHA256
907967c5f81c53837fa0a8b5fd3a6f368ace3acc029f034c7afd33b1f6be68dc

SHA512
44d715843e6c5ba0b6f921ef2319187261b6b33f3288fb215ddd47776513f6ebc774f2fb90f71762c5ef410119849747062520cdca99293a9835d198551ebbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b5bc79ac6c696b71841f485fc7bb964

SHA1
30a62aed31003f2d14c93083d1a4c02ed3f0adf6

SHA256
09c996e547352fa6ab69fe7e94688bb456ec2d5fdde2c43ab4f0973f84b57c7a

SHA512
fcfa64afa4df61ca7e4a94c2cc544df889deeb4147a06154461809da199bd531b9d99a8fd2a96001b2b9c9b1579008ab68559d7916543363a7d84b296d976434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e67709d29f6ee3bb7e9dea9da96713e

SHA1
ffee64f2d556a02e9dc51683f0b5777d4ca40aa3

SHA256
39fddcac2548c8f841023fba78c7df97b384bae14e8f4f366924d9fc88f77247

SHA512
584ff091f1be963c5d52621524c0bffa27c75cc5dfc94b68d3db0d44da9e5b80c2d8f53db369c92c70f1434cc9b9075eb9954cd61074ef4f4fddbe1eed0086c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9c00052acf689e062bdb62df902ee09

SHA1
7e7504c4f94073106aafa5439aa828c7705b958a

SHA256
b5a92423778920871f85cfb29cf7308b44421b6f74b589c714603a0685545bb5

SHA512
4119023d9113b97b92f5e25be822bcabc424aff7b4274febb448a0fdefe5761c0ce4bb3a2d05853dfe8c19931a9c7757a0b830ab4e9b1726ac136b71b99e46ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ebb0b12c00143e0afbf784e6f56a4e2

SHA1
d7d7215f8945c65457e73a18a2f2e21b0048416a

SHA256
7e936073b058e089bab885ea688312ebece3327036f554bf9a961d38f29c3642

SHA512
53d2ed2a8ea3593404b5d5910c1c4ab46f89d6178a9763ee3e2bb758ad7c2996e17a881f2e3921bf181e4d352d721b848984d693e1bbd602a50544e692d394de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e02b17fd92e8dc1c6e4fcc95c3f6afdd

SHA1
63f095dc499aa9c5343dc95b91e43acf8319a1ba

SHA256
27c81accd411bb4e2e5642ecf7e31faa8d098beac88d124cd0ec8c7486cf0ee7

SHA512
65f0e9cb3aae5899b343fb6ca4c99d45f814537c43bd1e33328f7db8b14ace8fb48054786e2abcf3147660bfa5aac3721a27b0fa6628a32502192ffd4613b7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efe23a53dd971792b8d2e74593b77d47

SHA1
634705cc924f14c33450412251e382a0c77f2fc4

SHA256
8c414219359741bd021ba8fe18cf7b861293b88fccb5bb1ec01b27dc79dcec60

SHA512
0c99955eb3b3fd0992e2f05298ee2f12fcc3b01de371d2bd9d8af961bc2ad3ccb8cf7d577e39ef43404d059ef25cec346844b5d2018b4060efa248a3113d69aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0c9dfdeb6a2e596a312457b00889803

SHA1
f49dde8f977329425c3410fdc4b7772b71789f7b

SHA256
2a1a123bb1351a9d7481ae7353ee266eece5ff6cf0dd46d9af32492be7c8f494

SHA512
2b4aac139f4da3825680b4f5e96b690f44abe613b371a1210ee05db1013ecee0e615b305ef50e77d5d63cd4aca8bcbb06b8028527a418386472a7110ab391a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5db90a70deb640a19ddce443111e6f43

SHA1
148485c83d2963bd155afe3c6e9178527262d638

SHA256
39cc7b39aa273f74951d7825f37777c81ba3fdc43bd1a8dc5f77f0865f878b67

SHA512
c9f26ea8ee7f772e9e5a9fcd179f5405f2d9e649d4c490635a834c635c5c6509bc2f714f3f48d74f33bb59b6e8605e2b7a83c903b7e9ff3e59c58fc3f9259656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93bb342778c645c1969fb8bc6b7d3ab8

SHA1
10155e810c7cb7c35f4a7570833baec1253358d5

SHA256
0e4e1254d429de797d2af804d0793897dc5c6729bf2395b9d6917ce05935a0a2

SHA512
51cbb29ede6cf34e2df97a4124f3247b55d713d72901c1e468a5d22f5a2d3dcd1c4ae6c2381e7494dee62c3791f9682281c56f1a86ae1f9c0bc5d3758b0c8283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37fcaeddd5d0b41abf1f858b52de74e3

SHA1
3873f317a2d81d2c348bf6c55b3fc04a0d3f646d

SHA256
85ab097f039f81ed46615080cfd6ae468224150ce034a7630d80a5488c2f4f79

SHA512
974bfba5a10a34a9abd0632475c815a77e800a12c3f0f36a3d1bb9700dddaa39d593d3514ff74fc38fa9700ea6f8840e9fa0bb85d8525ff8160b5e496d297f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8713ce25b181c1ea4581994dde1045c0

SHA1
530581e8891adf10d008d2cbadccfa8c4ae6263c

SHA256
18962cbd7815ffd80498818348c7e5238563355cb5a4a710a6bf880860c99e54

SHA512
365730936cd2f96be4420cf6ebab5affbfa6d7365c7f1bd970ab63076037f0f24be0f8b66f863dee7c434a3d29ef04f0fbe6af56bb4cacc43ccb7ccbfb963439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee2dd004e2af7c506ac524f23f02dd8

SHA1
eff4f8fe0731a9db95ee916f422a9a379a244e99

SHA256
3637359ec47ad4cc634bcc2f5d9324463888aae565206d1f0229fbcf57a0b872

SHA512
5849140703944d00359cda58c1a12b24a3384ee9e90d7ed66058e930a2099eb77dfa09245d9bccbb04c15dda8859e780a00d2d456a65889dc2b6001f3d748b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
712da90acba024edb8bf8d2ebf10067b

SHA1
9345696b3ba97737d279f440caab82e1f32ef1bc

SHA256
be0b1060b4bc9f199ff7fdfea6a958674fc891f9ef8a54dacdd87786ddd14fd5

SHA512
a6cae202a867215e1d9183fa4c646acde96b56b7eb931b0494ff1e637ffa5f4f4166ceafd57e2a3833b5e0b9fd7f65086cd023797556769ea875bbde0cdabd81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit