1c666e539b440eec31a1fb4c2f9902f5b35ecce93349f4c8f5c46f8bfe3f125b

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6360e20ac53d6e72b5ee00cac93778c6_JaffaCakes118.html
Size

59KB
MD5

6360e20ac53d6e72b5ee00cac93778c6
SHA1

3e2a724e8dded42ab9ead136402f676dab343d89
SHA256

1c666e539b440eec31a1fb4c2f9902f5b35ecce93349f4c8f5c46f8bfe3f125b
SHA512

9b8660bf06f50cc3ff81718ed751d4d0e7d877c9bedbed4339337122cc8aef36f42e756a8bd9e0a0024fe0f4e2296385071c0283087636edc70b0e5d84288ae2
SSDEEP

1536:gQZBCCOdm0IxC9byPiMB2GP9X+NYRMsN+ula7WYjxCdpillZcTjFZyttrvi/qDnD:gk2s0Ix9PiMB2GP9X+NYRMsN+ula7WYX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AED06C1-4830-11EF-97E7-D22B03723C32} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f0f320b4e666a66c5b1d4acf2f2586faf3e6de9a480dac3724ec01f617d38a1e000000000e80000000020000200000004180e7104de7004d455dc566de6ea66c5a709a18bacaca1bf41f59d1bfdd239290000000d788b3a26ccc0575df2cb288a0b3c602ed0a3e5a880e627a39ab4a73599ae0eeaf3380dc88beac863355825e6fb66e9b8921602d17161e69c1edbb5be48a471adc9ac1ac38a44976380f7613fcfb207590bd319ae50cd0cd6aa6387ce79c309af60760e11ebd2043d2951abc983d338cc206a026ab7ea162cb1a6d9b43b9a266066a7719881f59867010854e8b93d8e540000000b165e4e2ca4af36020fd73e783ab204dfc946d3b1b99c28fa2f3211e5c869d472d64eb12900047e19617fd9b91f47bbf45d12f2f14ca55201f10ce342cd4db3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000b5650dec54a09c81233c2178df2517215af44c62c10ae0dbd8acd7ff53149b94000000000e8000000002000020000000586a4f562aa7aed8d522962254361fabc3a91f47d94c3f891012c8fb9457cdbd20000000ade7dd4f08fe96cecf755837a42178fcfef5c3a834d20a78fb9ea9936e5698fa40000000869870d912bee25f907a890f9498624ffd94f96b7c3b6497bb3f37c6f5cea81e1f9c6183a9e66f57247f16dcf0fa7d2c6a34f22b647067c581d72d8bb8e794ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427817670"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f6e3313ddcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1692	1712	iexplore.exe	30
PID 1712 wrote to memory of 1692	1712	iexplore.exe	30
PID 1712 wrote to memory of 1692	1712	iexplore.exe	30
PID 1712 wrote to memory of 1692	1712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6360e20ac53d6e72b5ee00cac93778c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cb4eb0b56698aa38e6900a8c6c9a2c9

SHA1
718b1a8b5634a9545cf789129285cfe58f8e71df

SHA256
3984136ddf7beb44d8a848335d97f835c6a733b435b0b67094064f206dea6fe0

SHA512
782b07a8fe22232c27615e13a80a84d559161b2360606a0eddce4e7cf58d718c09a2d1c999814426d48c7743e566079a5d73775f1d208daeb2c41b65f5b59588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cc42c8530871416c53839f5a52ed2ba

SHA1
ceb501d5de465d2bf90d297f9ab6bd2176526201

SHA256
4b0c951916700d4825936d02977f6acdd0e3fa5e25b7627cbfcdd3655a9de9a0

SHA512
30415085b8a8492490971631645da6e7fc0c303789e58a1ee4c1e3fac247af2c3885bac59f95fb0a06ad26d5d654b00825c248e53e49cc0ea6410624cc46cf51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9801a58d9a9fa6682beed47fa178e90

SHA1
5a116ef675dca5d998e88fafff323c8f9c117f4a

SHA256
b659897569dd2736b2ffdc79837edeedea68db6702335d763941c409cfa3bd30

SHA512
09c1b0c6ba42bf390d438226de6d1cdd6596984e74e5588e953fd8c5e18f6ded9210408d7c626f1ef274ddee08d688865d5547c01d129b51ed98afda8622e97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33a1c7d85f83679d22b07a1fd51d4310

SHA1
d31726091b6144683c58bc94a380176096ee7e49

SHA256
4df7fd88545a9080a9631265fd75035c4b40ea6c88b875665e7e08bbde6195f6

SHA512
c420bd8d5f630c5ca74a029d1f58e902031efbe31347bac0495ce15def67a2ace48a9a2514a019eb573e9a66bc6aee04854ab405c7048c457aba53de299669cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb2384da615f1f2c9e57ead6219685bb

SHA1
7ed70405e7a7fa1fdbfa89dfa93d1674201aa9f9

SHA256
36efa6e3b6829b27a5634e6e58fec9dd081dc150dbf796d281a51f1d01b774b0

SHA512
ecc95cda28046d24a1bc89dbf653ad10a71281684ea69e04b3bc6f7b7f38ec8412d0c4a7a2648c14ab33694db87a3a9bd5ef543c9610e78c9a9b5cd85f2b9faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fd6c4146c91b5fb6705777edc513d24

SHA1
c4924eda1c8e0ade9f8047e7a969dedebcd29db1

SHA256
7609448e4c2175f8da75b03eeb2a24de53e77fca8f9d2c7f07f94a25294f79b0

SHA512
b3c74d5dfacc3c6211c59867bd464f8dfd895285a3936a97de315c6f19347f9043ae685fe31ba10e0e830f08ec8bd4522181b54ac18fc4de2b06f73fa6739c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6dd27bbfa310ea866ec717ec930adb4

SHA1
391e79bfb6e88be60512d7822a596b40eeb697ee

SHA256
812fa799dae935c51a470adb57499e662e84433ae350eaec86868e57a0677529

SHA512
82c9776e86f1cf66b44e21613504b6990a96db13706bb224ec10f972270b41a1f565e581ca785f29cb10fda3424f91b43d4500a83e5b88e86dbeffb564b3c1ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1eac94ac484c6ebb9df58bc8507759a

SHA1
d2ecf2ca86f8b85897d2735dacc812012cfe7463

SHA256
2d5d043965fe11f3b771b52acb7abb9b3bc8fe827ed39ebfe6566a4a4e67be62

SHA512
61334e31e7ddbb16403b579897d03b6c50ece1e28be75e27a492bdce7a5993375c30e690cf2a8a554e5a6c152107b136511e7407fa79a97e31c56869ad36b7d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db8a6e2bcc510a435781f9f88117c75

SHA1
4f545dd55daa14c5c40b160887eab712b2153e89

SHA256
9ddf1299cb972b971b891cfccb15a8c251dc0593515092fb4774651bebf81c66

SHA512
2d1f2fd66d48960521c18b1a6c54a67e57257cbbdd261acb22aa21339fd3fb7f937f2e8a1a79b327f8546cb5c88b7ed05bb852912009d549d7e0d255822f9415

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA0E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit