e150e042d79ab76b3e7ea0b593ddc6c410897e6e301f924d3b69bfc6e295a8e9

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ffbd29fb5e630aee9b658ef5a63321_JaffaCakes118.html
Size

20KB
MD5

62ffbd29fb5e630aee9b658ef5a63321
SHA1

1a20e7fd32a34d06bf0ea5ace92b251a3930cc1d
SHA256

e150e042d79ab76b3e7ea0b593ddc6c410897e6e301f924d3b69bfc6e295a8e9
SHA512

527c439d0448e818b9bb5988bd1ccc6dfdfd01d7719c6ed0cf3f63c33b5022f614fe3dec10dc700bf7c9895af07d6357e72362c58cd7a94069391f340470c2d1
SSDEEP

384:PwFiKwMcFF6FxUv4WL36DWnVrkPE1dwS+1Q/zjZjrL8yZKr9kJ:PwFiKwMcFF6FxUv4WLQWnVrkPEfwS+1o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02AFDA51-481C-11EF-A248-D2C9064578DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000000eac29afa2a1182bfd89779d48a161db2aed3f24f4197394908ef58baaaf1b2a000000000e8000000002000020000000827763a59cae4595ded38c3675505b828089aa57b418c9be6adb959f6b46ecc02000000004cd627024632f15451432e204da074cbb5bc78e0ff9f33108caf4fd326cc96940000000bc6d6b15b3352751404cac9268d6b20a7b0113c129cbfc0595c27ba15fb3c9d32438bc45b939e290a8668d2757561898af408674a75adb8acf16dc2e5512047f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b93bf13111acde27d82ae11db63029441dad44cf9f53ce04bfd28a4073f86e64000000000e80000000020000200000006ddc887f55f130331979602e05f981ec1aef162a0ab49f578fb3f6b57f51706a900000005ffc8baf111e5eff877bf51199ec4d81ab9adfd917b4ad1ec687f9000c9ed8f86c41660e75aa69907e803bc222c4f0699b5d8f51b7cd9b3879d11430c20bc9986cf12224268459365e88723ef16bfc1c6c67b8afbeb4d93dad0c8bfd57f5978ede5951e5b610eb40b5fbde745efde1c9a7dbf70d2e3118de45fabc1484d8f016127cda841b472b5713576020c911e8ad400000009a2ca3e5ef568749d026dd2659cdc606bc6d72862ede9ebf8329c55612748f7896019d987f953d71909810e1bcc07ad9adc20137460ed65002e72a5e72c05dcc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6053ecd828dcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1504	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1016	iexplore.exe
1016	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1504	1016	iexplore.exe	31
PID 1016 wrote to memory of 1504	1016	iexplore.exe	31
PID 1016 wrote to memory of 1504	1016	iexplore.exe	31
PID 1016 wrote to memory of 1504	1016	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62ffbd29fb5e630aee9b658ef5a63321_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd979330c68e9bef753222ccb749e03c

SHA1
732e41d53901cb5ad01a780f797f665eb296db4b

SHA256
de2f669e8c6b02ddbc7b152aecca28c030f02f01c3bee48ed746e28fc2c4d76f

SHA512
7d3371ac8df469d00074a992acd1420f0d562529aaa6c124d4f5c9543acea48fa91b1c6bd29b46a7d94476ef89e15945c670d265d5572a696acfc6d437087929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b0c533fc2a3dc55cb4b1094566a727

SHA1
0fb866d5ad09d2830c0ff904bffcd4eae43724fb

SHA256
2c449cafd17b37e4e18cff3c1f1dc17f976518820f36c5fae1990d4a48442349

SHA512
6717778ddaaea2575c27daa316d4a16e169dd92090ba0564d81bf43526ad990ecd39f40f77286b2fcd687ea410efaa1df6789f8e6674ed5e25b87a08b2c38be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aad73c518b16ffb44fb7d34de737e2c

SHA1
0744078c075fa25ca96d2208048a730474684ed3

SHA256
ca92185481bee940fcd07a11290209da2078bd883fd3b30ac4fd14655b7f6f5a

SHA512
08ffeca5f25328e23a8832227176ee57edf6fc359f1006dcff7eadb7bd6a7194e18e837246f09653c1a2ed30f31f8cc8415db15848bcffa52ee033fb6958c583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeb6a42fcc5e1d141640f66729f485b4

SHA1
c4edf6d791ec634a3a3cd505f6afe8be398b488e

SHA256
225438c96aa7db81ba7dfe2f7d555f248017a2e963183050cb6609cccad881f4

SHA512
44750fcda688faa386b45c221402dac7fbb0e291d54e2fe26da95c6c8c618262804418811cea46e21893b1dcf10e2890ddf526a2c0dda06c99b3c31cbcd66a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
501a2624e915180b30cdcd319566050e

SHA1
a694dfcb6077e3e76e30a4cd9f8c8a221af27587

SHA256
e3b16b855ac16a270598c4cf12827c53b2b484cd11b9d38a72827c9b4abc04ef

SHA512
fb9b22396071a3fd01ab50c02935de32fcd2d1c0df37835b3dccea31726a7c761655227b6ac62f9a193e12a80693db4e4ce04bed81720de5f45d0d98fd063e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdda60d832c33fcebce2c7c8123027ca

SHA1
995bb6a9206b0f446d4bb61d4fd6794915896d9b

SHA256
013336f745c14e3959685ff2d9868f3cd35582ed2436045a266e8f46a1ac0e17

SHA512
32e4a0a3c60ea58d370e947d825f8cbdf795ba6d87b6a63a589fc14cfd8ea095d459f94579b0af2096808001157ab22679a5fed037c2a144a0c72e30c048845e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2659be60c5ace44d098b4f648eef486b

SHA1
0de4f96bec9b48959ed6f9641e450d812ac1ac38

SHA256
d5b8d915fed78fd4c8152069ee3d032112cd74727c6d6db9da78ff42e8b7c30d

SHA512
1175e46f7649903ab3d32d3eb8fc1d96252b75f1374a7c1f7885cfe3393517c932bfa52551aaa502c31fc5e710863b3cceddab756d107c410567046a33c24e8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf1c72a9c572643b79360439f06e801

SHA1
db877cb4b6a5410e83a829ad7e00489e78125783

SHA256
507b83d6bc46245628b5cbcc8f44706268c5cbac5774643853a650a5e0c9d91a

SHA512
2e0fb9758d42cc42c857549f3991c1a0bb5bc4d47bfe9c43f6ee7803ac5dcb139912f32228cb157a8bd7152cbf6feb3187e8349428d920d4959e43f05e23ef03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f010d3906871563c3cbcfd2c5ff6bce2

SHA1
b5682ca19513f2e7dc86661a74ea16f19a94ea12

SHA256
2b380e4327c867fd119d12b95fc3b7699006755f939120f712e3311f1d674b70

SHA512
919e13f56abcb80c9e5499a376d3647a0b4ef1dee62c6baf3bb0e2b8732018185eca41d245cc6b3c5cfd2faa4676675f3a9e79fae8aa08f95392e671a1d563b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2AA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF30C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
db693c371cab4f5e57743fcfac2c6151

SHA1
df5e3c6ca32b40c18c0df6237a1e81f0e54bc4eb

SHA256
7d3d03731c57a62ca68bd0bdafbf45b3ae4d209386fb2ea312832438bac5a1dd

SHA512
af70c46f0b7f16d811de969f7ec1f0bab41e7d91e21c77e0a12bc8ad602543cfc89d680098b35643dd921e9c71fbdd3770ecf228a8c642bd20858e810b5e7104

Download Submit