ed83091d655750870235f088afe4664ca3769bd83397e4a1247cf53d8ff80570

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

631034329618cd41d41cf8937436ac08_JaffaCakes118.html
Size

30KB
MD5

631034329618cd41d41cf8937436ac08
SHA1

1fcb4fa9a78da4bb436bada13c9faa25feb4df9d
SHA256

ed83091d655750870235f088afe4664ca3769bd83397e4a1247cf53d8ff80570
SHA512

239ef25452bcb8ee4a5ff6ba9cc92a6087e0234f829e55763a5b4c4a808b5c741259419143e78820ad47dbdc363c936a44c919cfdc7de7d06eb20a3e46032a4f
SSDEEP

768:SL+T0ctl/cDE5EnlRYI2KaWe08hJVzYRU:SKgctGDE5EnlRYIzaWe08h7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000a5190b77cfbcd25fe021ebce7d3deeb82b70207b47f1bbf2358626c643d6e802000000000e80000000020000200000002b1f491d496a17064b4a49b7cab098c4ec8bec5134468d789ffee2d88cb9df0e20000000b8d8db03dae06a349dbbe6a9ccfc76cef2f028badb17ece643413c9af33b7f1d400000007d8681aefdfaf66fe0d4b8236e81dfb73fc5e6f8e639a9bde3a238710afb570fd23b685e2aa8aba155da50770187391354246ec39f7bf04b4595f2bd002a4c2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d43210a9ee6645ad58e75b3eedf54de79007d0d50ebd11a74f16edcfce0a17ac000000000e8000000002000020000000fd8589ed48120ecce89cdede560ea75acc309db89a5869a11aeba23206d5e6ef90000000705ff6f195197c03f842b5a0258dd78f4b0072ad3694485d2211daa2d869cf34cc7d9a95a4b1336a3b20d77f55ded6b8ad18bdcbf56c59fb2c69e26c6443aef8c667289cfe3dc5ca687d8b7c3ed930100ac7ac294d429f6aceb6c58288bca2462f0e70d7c7790765d9eecbeba395694aed44bef3d0c31c684bd8cf313ce5d5f3cca4c03537ae87ffdcc9ca935e2224c140000000cbf0ee55d76e083a4a589a5cb8fc2485916f020debef7405b73df706946fc93f820ac151c49cec6344612db73561d541a6a04578b341e87f7d9288f634af4540	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d070fd462bdcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427809968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D5D2B81-481E-11EF-8FF0-DAEE53C76889} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2540	2076	iexplore.exe	30
PID 2076 wrote to memory of 2540	2076	iexplore.exe	30
PID 2076 wrote to memory of 2540	2076	iexplore.exe	30
PID 2076 wrote to memory of 2540	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\631034329618cd41d41cf8937436ac08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f666963799a14659694dcd237b21fc1a

SHA1
fdaaf23109ae648f4fb24d61b5c2038cad6bdb7b

SHA256
c77975bb25b69ad7f651031e01b48194a2a2d347d00666c494cae2dc877f52ce

SHA512
51308e3b330c7c849938fc0e8403a145b8e7b1b59fc50089c165b76fbcf68592727969521a450042b54305fec65542829e8c76b3748f7675dff0719f554c5ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaa80e4f40f6bcd29d61c868d94daa8e

SHA1
19f8a8faca7afc2a72ded55cb1df44539768491d

SHA256
ed0df7e9d1c36a0e5941e2f7f775a343efd0966927dd543552886fcc548b6bb3

SHA512
d8a1f0df7e4f76d7dba6941936dfb962db202cb7e47097e52676de264e9546d996681dfa42082c1979466d89e534c3d85fa13fff4e6fe2a4c55d32f031b30991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af6dd11760f5da6fd87ce8c74df607fa

SHA1
95a805c42abd698f142e1d52adc9f4ec12848930

SHA256
5e5925ce058d08721ad62f1bdfb0f20b355979c849225143c648143bee4839c1

SHA512
66eb68a801eaec9bb8c44b640f2fbc3535442756613ed8929a5fa54d5d3475e96e96030b30a01e03a24c62ab3ddf68ddd687e53663362d4746d2fe46e6c9b74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
175b4405ef3e775b971b199791b5de3c

SHA1
16dc064dd81c7b1996670bd24f4bf7bc040cc5dc

SHA256
3fc367e8aa4a42494f96b2a7bc86f2d633df38ee529a8fbb1c11692a01190e60

SHA512
b26cee2c66ad37f00f56429f52fef920705c6f65941f3d54ef5b6ed13b263121eea8a40456967f32edc82bdc45eba5df0abf1b715575a8d3a93ebd3e69a7c3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef8e564801cae9b704ec9fd10fdd60f1

SHA1
49156987bab25c34e205ec00bcba089c89560055

SHA256
7cb9fa71915772ec77a5007a6a0eb35a22f2b4ecc41d5678338a8d4974b25af3

SHA512
f48b1e294cfdedad2460a5f1f5c044b4423f49b85330f59a157b2cc8dc1a28ced08f7115d8351fe2fa7c2d46cde896d5670778e176a4e2ebbb236469be8a979b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d1d18f94a8f9c4c391c67936f2a02e

SHA1
509d6765f706414245635c990b2045d358654fd6

SHA256
356feb9afabe79292a929fcba0018ecc0b685fe5fdf827e97cdfd23f4e59ceea

SHA512
4e374a6939d1ccbeb505b2ccb45b46e1b713d51513f0fa57d4d11006644d80e77e7ed4333af4ca337ae38608ec5ebbe17db9405fb5d0194900f993d184640cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab63b8b61950fb114152dac34f2c5a00

SHA1
5bbc77317f89e07cd733e933f04ca54ad623b787

SHA256
c79c7afb5304e6b8f4a4b367242fb8b913e199095281c2775d45dc2597e5609a

SHA512
100589eb9cf4f885eb066e0af42230f2b5cec0b09d3c4d9aeada06ffdab3453f9e6de21244c8a370bc212bc7ec04a4f9157175297cf06ec3b9c0034ab3e61109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
753db437ea6bca8d4890ed03f2d470c0

SHA1
625686cb210ba257601e3ef16a9d2633a9ef60e0

SHA256
242a8d6949d8e06db9243185db7d27ddb1e8d70cdb22c7d50a4cea935ea2d394

SHA512
d3e0a150f881f20497b6eadb2c025334a70ba9f2c4baab57622948a4f16b9a99eae0296170d4444477414efd795380d3f2913908f6795a59dcec1c843fd67b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40bb394d6418959caef8e89e28cf79c1

SHA1
7c775b1caf84ce042b487c430ecbfa897af978e5

SHA256
2b5534e9a2bc968407cc6cf3dcc353c3712b50821cbc41e1b7cddaa386f96d51

SHA512
b3373d63e9b677f8b5929069863912aa218f891824bb12579e7fbb96efb661bf0fa5b9959858ab441657f49feea130d105b44b55245f387479b19ed15e4ba30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3d1aa5f666c68a751e010b97362fabe

SHA1
0ca886052ff55f1e9749b9592ac41ac97c2b90a8

SHA256
40cdc4aafbf36c42f9ac705e65252bb77d12c34e4c87bff1d5e1363fa637bbbb

SHA512
f0a98222990bfa06390b66ac708c375bfcb1adedcb9052d1fa54fee30e0536d4b595de014552bf1b041f51aefb32884998e23123788c151a9265015cdfb75fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c3b4388573abe06a63ac4a5433f5587

SHA1
ea76fc84b4077fc7898e3b834ee8f42e59d690af

SHA256
f57808cb6f85a0ad0d67d104a904803990cc3564b08bc310a1705969228f72d7

SHA512
6f06d288734c86e4c3568c8e2e517b75686a51ab71f98f4d47086b370444e38ffdd7324421f9584ebb14519984ff75744fcc9f27f0bb86b4ce1c021284898268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
718c5e347dd98d131da1a55f3785906d

SHA1
db800b11c8587b4a3c38d099b5db9c38de58c3b6

SHA256
b686ed8c54348942fee5ae90d876521ccbecd16e48948208ca49517bfee2631b

SHA512
dcfe8212d62116ebd4ccd662316f8b3c24af1ed591b7cfb38ba9331d5a4678be6cd92b67b996f336fc1d6afebb4fba58e44bf60734bce088767a5d3262a38181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b37ad82b11fce5709e24c0276dfe9962

SHA1
f20ebe6180a88c920e8cd3ddeca9449f0a56081b

SHA256
473e5efbab4b7da69308324f1ef4e9d81162e758286a704e6dcf44358c6d166b

SHA512
2bc47a858e368e4b6083255dc9664548079ce7aa9f686af157fbdbc2ea34cc4bd14f0578dd4b1074e6c4570039f4842312afe0149f3613f1d6f820565978fcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07dc39e5a66ea1826257e2e327782850

SHA1
3a08cdc65539b7c8999aadab4dff48ff517f1b51

SHA256
377da8c8cfcfe8e0f5b15caa7209b40463458b8686bfae09933fde695e76cd23

SHA512
9126dc0800535ed25b8225ba31c65ecb3c1eeb382b5d0f42bc21bbbc527784ab29fb57b653d57aef75d5d6ebe18c7c5f38ee68085e572f52615a8b1339160a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eaa6cd2c066c72cf6a7f2ddbb5a7efd

SHA1
3af1811dcff0317b6ce441667e550bc38e1fdd3f

SHA256
b2211e945e0ae34c387ad4fc170daa78855ce0010a393974ba23dddf09b04d83

SHA512
ee2c9308df188d297c790b3ed07e63875223612dbc9f7557b10452652448503ae0df9c9cb7d0fb544465ca6a4cf1ceaab4a887c2ba1a43fd91d39f4b1311e626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d08ff978799e05fc4460f3adb3978a5

SHA1
dbb929c6ca593ef5a74e1dd35abe647aec08da9f

SHA256
15e2f65f982b54a49dfeeee86ea76303e07b470df1bfc96ec21721b5d64d0ff3

SHA512
2238db309f05f3c90c32e7ce1c5bfe6910787e4c58b346fcfd7d2aab96fc2b4f0b746366904d34de68497b98056d1c13386a813aa1d2c09768eea3f3a954d641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbbd7c88972cac5a43b2bbf2987d602a

SHA1
3328a2a7d074e82d084423544fb25fb1accf10fa

SHA256
4bc2086b736a08372059c5a0f1b483ff696c78430529814796a07b700f33a5b6

SHA512
115792b78a705736c0b7565b095eaae0e72cc5383443e4ff58df3c066b6bfd3e6e587d5a341e0a30a781fabd528e111bdc7fec8c5339ecf35a9b1ae5f0818de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC294.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC56.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit