97e8d44305cf66a6fbb66cb7ba38a5fd54d9c047f25c06aa26412940b32a6c40

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

637903f1d81b90269f20fbeafadee932_JaffaCakes118.html
Size

12KB
MD5

637903f1d81b90269f20fbeafadee932
SHA1

876897050e78d693e451c20a6630cb7a70ace525
SHA256

97e8d44305cf66a6fbb66cb7ba38a5fd54d9c047f25c06aa26412940b32a6c40
SHA512

9bac3f5690ff7e647610ee11c432ef688dcdb77e9c5b73026a2c65ca2cc0df54367ccfaef41e5af89b9fcd1c632e3d52d66adbf1f519796327a4e3bcc1c8dd2a
SSDEEP

384:xM/hF/GkjPDLmx44RocXu6GHnXdRoiHisXJOFNNYrVOFQbF2ixxspUkKveegSY:xMoocrwndWFRVFMTq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427819685"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f520fa41dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a94f989fe62a0d9784c61169354562b632d1d5ecd6595e19722825dd2d0239c7000000000e80000000020000200000003247cb889c85187322329ffad48092e3237dc81042f884a0f26e81a5e670bac5200000000839caf7d93af5f07fb797e8e0866755eccb729320ba9ce067f203980a5dcc1b4000000009186cdd09dc473e277eaf066d27612283c6109f2fb7a4da7270d9e00630e7cd8809d60515536a24864d74650cb14b8c479e2509f4d9e44e0a45847beab37166	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ab64a78a38b5b02d693408012a22484e880ee204f32cac4bd210893a93a49a48000000000e8000000002000020000000dd175572c84aaab9cbb6083679d431a11d2f5ec482ad343ff9feb98bdd9018a690000000cc73fc6b0a38f7cfa7eb7e8f92af58553102616f6e1ff01d258ade8588b38ac7d62d9ccf92c2e1998ddb993a40dd596732adff9ac9d4e6fc9e4f897390f7f106da1669a3e9bfb65c473b97ace5da7a8746d254bf6510912937efcdc06e090be7a642c2dba6947fc8c42efb5afce6b85696491a9d09773e370d415b18380b421f6daab793f87df0dc7288adfcca3e6195400000006212e9e76bad0837ba6d3eab0f707d44cc9cba643f849c76cd6c97410a7aac6e5aaf626ab11574fdcaffbfac41c8e70e2b66b0f84a9d441642125fd139bcb156	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BB599A1-4835-11EF-920C-D692ACB8436A} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\637903f1d81b90269f20fbeafadee932_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f9ba17a3172db75c949cd9552c709cc

SHA1
17f2530f74d2e3a78c7c23916aebaef02d4d52d6

SHA256
047e7d67749cbd96bafa5aee2d5d393ae55f77009a8ef1208ed8c4ddda0b5795

SHA512
5f2069dbc43e4fa0b13f9643b888dfb11bd3b3dfdb4c36085c61d6ba3b5c4e6a9b2867ae2d558aaa0f8aaa7571f137cd09872a80811572b5a32400bc763544eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c7f787680c24e308a8f8dbf1c56e291

SHA1
722c4d1c6a75e587d7f0c03c98ca948a355e6af0

SHA256
9fac67e846470c457885c1f4bac9d884a2b5840d5bb9ffd414e5e2cb2d4f60ae

SHA512
a0818c32b81a20109d989ca00d283b185f8bdff59490d2b32146c83e2f4df14fbada54eeb87fb4023e7e78aca468a6d0d84f34cb07bbb0fad9b567a49d82d40d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3a5d813b27893ddd30325e2c0221b2a

SHA1
0fdfd5192926aa572c27f6b6b98cf3a5a04b62ab

SHA256
9dc3965349776e6d5c9da0487091dc09a432c24191595284687d7f7262642166

SHA512
8699fe1a6663c81560a802fe570225dd78bbaf44e4b8419dc983cd61ee9f2df6f898c022ea3da6fc01b79e1a8a76b1c5deaab2bae884b70e418340521c4e8903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0bb1f5f38c977c3a48fba742b18a815

SHA1
25790bcc81fb6f64667ea8d3a80179e202697c6f

SHA256
de4c30384ab2dc41b17c430694974ac6866112fab86407314cb8b3c1a1eaa8b7

SHA512
4f8d4d5b0c4e95f93de59261fec19aa87c099d8ec1c08854f201740c599f4886731d461ea0c5d5af0e74ff149737b9d2f4ede47cb5411dc632478f4c33b17f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e116f0575848fe76f16c9dbffeef9c1c

SHA1
e43aa3da83208b16a312e406f492f56153ea9023

SHA256
9ed8ccf7d65f8510ca4d6dcdcba9736a60ed69209f9b48cca3881befb563532f

SHA512
50b3d7dc2f4e74e91b5f34da16d8e837bd8eed9537deda484b9cbb285142c5e236d1d2116d96d44d2507a21e5cb0f44695331943c187b2d0b2d8a11dfb7dd6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d2e24c8aa53e7edc8666d502d6edcef

SHA1
7bf08ac102696593e9bdafc1aeb7ac2a34d6fb70

SHA256
693c7517d8a44388a6e44462cc2252427ebb25a5d519cbe8f31085eea5224aff

SHA512
486c181b03e5a2b2f200c409f717729672cbfb5d5e26cfd1d5a9f6d52bb26105c58a8aad68020e06bb154ffbd0951a1209db47c6508ec81b198c6c46a2862c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
859ecbeec0c8bacd79b1239ae6600038

SHA1
fac43958a89826a58677055443b7070f3f0c7119

SHA256
4ddbd3636f49a8cad6499b72813c18ca5da7f33d9706ca19ca07ddc19e5822f8

SHA512
f41b2744500520b2fba3605bce14e4b1fed34ee4f4e7ac725e626b02c9c6632d8809cd558e343fa076279fdc44dad609bb61703b564402dcbd412d62c7e8865b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7a290d8d005d7b0b178b6550e1b3520

SHA1
220fd9d08b822bb349db57a11f74fe011c2609c6

SHA256
4f749eca84ad64adda1d16229c1c1d049fa3af83de1179d7ff3ef5a7f3e2e384

SHA512
0dc514c1fcf894860b5790da9dd167b9e1d8acb118fcb401bfea5ecd9378c9bae23a0153dd5438e56ec4fb64d5a406dc7d75408650eafb364a8fd127d07c47ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b3f8b673b9ba385b078c2222b113bbd

SHA1
8241d0fc06ffab82b0e3a14346e84f6d7b5e2956

SHA256
16bc1ddd53b394ea55ac9c3dff4bcf6ab0307002519d0f3cd6f73847420c2397

SHA512
ffdefb6a80cea8b055fcba5589dda38764f5b8b0d9858d89240b8dad3e96b1f087c09706beacc1fa47399f4ce697fad77b183456b4c756d171c31122e5fce927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff3962d332a9940cbabe0df4c553b8c1

SHA1
d88e74b88272d94514f4c4d725ffabcdf3696a43

SHA256
a91b2058974de42ae1914b7b556a769c74434406fb29f727ae0072e287866d24

SHA512
e04414224222cd44d9c61bf489f4e1a915f39f1a92e4ee283dfc7f2657de95246c266baa824d767f831cc300a26bc53ca0b61daf31063ca41bd6dd99a8ee4239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815e7525fbfaf5183ca63c3dfc43abc9

SHA1
889f7cb7cae094d728006b166f95d138475b8059

SHA256
4868c0143107158867145c812a0e813a509852c5784db1cf72911f8a5d02dfa6

SHA512
f87be0bc5352f03c8d0f2ad39b860936492234c7c923b2622058704ba6b09b691508b61614ec595e7436e7474da50f08ec54d3c07ab2803f74b7cd74d44daf45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b4f681d471fe8fa08fe5a77e757172c

SHA1
ec453fb50e7cc7687aafb8e0193f1cc9e14e505a

SHA256
f5a6755c3e3054c14eb451c23a0a84f567819c9204b4a93628edfcc68ef7c25b

SHA512
d7af28c3bb5874289f467ce1efe3daa9fd2729f8ab07136faf20e4e6fd8930ad820e5539e8ec1db4fa65c46825383afe1577fc0aa4ab22ff6ad9093fc29e3011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9431ba4fb5a65440b9cbeae572e031b3

SHA1
bdd841563f3568136e8e3725823dd0a429edde87

SHA256
b4372f82e09d0725595f24220b30793d259644f8732c7b69f7a1ae438c305a6a

SHA512
76d7950900e3b4484c6be381663a51abb0e7f512a5cbac2a2e819dabd0549752dfeac2ac6d5c10ab5372f168e712eb1ffed57ffa86eaecbb74f4c8348a8dab1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0df00929a4049b0ef3cdc1557db7266

SHA1
e14b8adb3626971a5ac36fcaca27c22d5f5bea0c

SHA256
8e73f33f727749c6fd9d71b59178c5d88c1b904104a555669acac42e8e01b4e9

SHA512
2ea6c606a6d5093caf85a4d307306849fc6a83db89846126dea83fb62cfe30009cf4c6c7d953f9e452c846dfee36f4321f59e5fd98955c50c7e4506520ea4046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\button[2].htm

Filesize
168B

MD5
d57e3a550060f85d44a175139ea23021

SHA1
2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

SHA256
43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

SHA512
0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit