1ce15e8e7ac09e3a9b4e5c8c1512176ac2d7ed4c2d97ad759c6b534a879e6521

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64b49586df8366e09dce2cbda47c22c2_JaffaCakes118.html
Size

6KB
MD5

64b49586df8366e09dce2cbda47c22c2
SHA1

4e2e0942f2ba392756a9f9e3f406410bd5974fc6
SHA256

1ce15e8e7ac09e3a9b4e5c8c1512176ac2d7ed4c2d97ad759c6b534a879e6521
SHA512

f3fa744ef5aac590ef0b8f225c51697acc84e31f5b4dd8cf8fdddd0b852d963ca698bb92dfc023f53627219fb28a306436b9d3a5b58e7681668313ff7b9416b9
SSDEEP

96:uzVs+ux7WOLLY1k9o84d12ef7CSTUSB/6/NcEZ7ru7f:csz7WOAYS/l4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE847731-486E-11EF-BD75-DA960850E1DF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000000b12e2bd829d2ceac68ef820fdbaf945be341378e744926769acc66a5e2deb2e000000000e800000000200002000000074b299e94bd022747e4996bb7840b1a84edcdc5d47c9588912fb742ee987363890000000fffa2f8a15253ed57c4fd66dd6d99bcfd13ec356223295a0ac05c1217fed35a2ba160d41cdc81e6b285b4c92751a35c6b278850f467efaa9bbf5a71478bd2f7a4b0b4367e67ffd206e609950679d98e1117cdf76a421119e329de2720d86d2547d6e1cb1c9863e165cec7a094926a65418bd15244c1a9723b6eb7ffe5e3b38a5951180b3f9cbe5dd66f6170c8bcb04db4000000023bb21f3bafeb9aa892c09778f8ce07573c9cba43a9f919c870651ffaa0c124efb5c43de8f81c3b71e434436734d5a2ef705a8cff617f9b8d3b2f4273f61c2f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427844436"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000098a7d612b59ee1987e3723ddb154fcf2fa1e36729dcc946081a0ea7b439c7d99000000000e80000000020000200000008364027532b9be50ece85138a823db4f4b5fc93559fde43f685235c3dc4466dc2000000092b398fd994a130d2fc5567e15b32f5e44cb777e2f08ed05c3de00e13148548b40000000a83fcd2927ae250fad653be9f51c7516b20b9d4d0ea14d9951583d8ef150f826c93e525e14a5f27bad2145483adce42d3de0ffdd570f7be771a2770b6478fedd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b7b39d7bdcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2152	2452	iexplore.exe	31
PID 2452 wrote to memory of 2152	2452	iexplore.exe	31
PID 2452 wrote to memory of 2152	2452	iexplore.exe	31
PID 2452 wrote to memory of 2152	2452	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64b49586df8366e09dce2cbda47c22c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb94ccc75822659b08425a9334733d0b

SHA1
844f59e0b8a198bb43dde1a205cb31c1eef9fb02

SHA256
276999e9677e5464fd90df153545278138fd303e03a43f19ed47a531edb66de7

SHA512
955b35bf65cd14ad7bef4c4aec2dfede7393eace2a87db74f8ce7221a3fa421dc54320c06c202fa567035a645de9d0158c78d2918f9f80737b331d7889363417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c47812d890ccd73c931a7e23348cfdb

SHA1
6e537bbbafdb7798ee96171dfa5c7da462a95fde

SHA256
dda35f2aab3941083832020ceef3352603984f6d24caab8e82ab17bba494034b

SHA512
76c9c3bac3b1118fd6d71af2165e0586dbd72030ca763ab4648217673004c1c8a35201ffe5e76ac375d9b7ff9f05b08edcea34c2809aff73e867e11074b3f9cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
214a829d6344336c832bf6bcf7c1a5ed

SHA1
c0755994cea5ef48f2e8b73af917c71b236f6afc

SHA256
d876ff62eaea6e811c06735719993b37919badab58cfda343d53bfcb58b89f89

SHA512
ded4701283de06b1b466ea4b48b060f4b384c669120b79d960f24098a9394bb0187da8952b82f5d4b4cc96ddbf9c10b8043e4e0f21cfefdd178bd1d50acb2694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66d2c7ae81647e516b90f87e6425fc1a

SHA1
f55671b0b07a63997d803b9e9fb4a39f9b1b4930

SHA256
27afe08cdbe1bbc8c74c058ef498bb1f8e478ad2219f9081bc972e93931ffe55

SHA512
dd0ce90171fb7c20322149239a706a1e748ee0fc9085f46918434e7063127a3e66ebb11c86e7548114b1f6d1e1fc8f7298ad149a280e832f82589837bd59566c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
503b649e460cfb84c94219b4143f0ae0

SHA1
e4eee484d13317abec96e28429dbe203f4f82f19

SHA256
5e8839d08130d5502651915b09b5bfeef4e28e66685de640b2ed06071bd050e5

SHA512
14203be76297576ad022a092b5adb7c30144803faf920034ef91d5c40e9f4d8ebd2b7238affd418d9d9a3198df7442799c4b5c98f1be5be4797502d44dabe244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
673e3e7dd5971fc2b3b784d7c279a394

SHA1
b8a57ec3901bb071a04d69e23435beb4ae3bf24f

SHA256
8fa5f660a8005c1bea5dd22205d7728028f5f92a08017c349ec0f35f4298a8f0

SHA512
d4d81bf399bbb71469cb727c3a13bace4839df50ed6759708b93f0d00bff65406705b6af14bcd8d0b59ceaab9693afafcac0b59ad33e4e16ea844c1c2e8fecbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
224f225280e5b40cac1f467491a903e1

SHA1
240bd62d11d7b1e1940e6876efb065cfdb777b6e

SHA256
05aebf4d3d43ed21ec0b95d68b4e5b2880b727d30b5f79c8d28e6bb215d4bd17

SHA512
33126695e49cedcb72117f82157ab48b07da625323b49f1e7b044ecf4ec881da235673398e1df74fa9f419b651d1b57c676567d19cb917c45dac26bf0a8b94f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2371d7e13c614298e4cd309a0534d1a

SHA1
d5e34167cc3521d5cf9a11ef0aa14d055582e1a9

SHA256
80ed4c2d268b6d12905c479844d8ae24718cbd6b1e6e882168c4aca2b9fcc33c

SHA512
0ac95c49cd3c1aba04bac9ac13033dbfa4f7b7c14f744534ac23ec3199cc136d14264d8b09cc51e6f9b438526cb2e023c9b637cdb963db13175c6241401ac2e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7696ab99494aa035563ac514bc81a61

SHA1
b452a1edc2a65b8f9c2eb6c7a4ccf6a22ad462c9

SHA256
abfa50693517db07a8c36191850ffb296dd16e81dc84fa89ba45c872262bb957

SHA512
a519f04e4333197533ea3af6783f3e3278698915eab810c2cc0172228ce14ca44536b47724cadd822a2f45265688f922373e3c1fb82aac0e5efe97cfcfb339f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60c5db55b067460844dc25145f745a75

SHA1
f5a5b3d5e528c9981de847c6724a650d3a8c9b58

SHA256
acf3afa8d69e12972ff5db1ae6cf7241e6520c752aa4dd3701f7f173e17454a3

SHA512
677cfff8872956716c9c1746164c6e3a0434e7d318fec47fd4851ce8478288682f23a27ad478df626eb85b70faa22c6a9fea0633f14926d3f375dc35dd9bfeb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
096af8d7f00f5662b21a5662307e52a3

SHA1
9f14e1f3b1f591bf1a5823ffd688d6841ea157fe

SHA256
74391561085c0c7acf1e9b9d93213239c6231714888c534de181e8101fbdc507

SHA512
ef60853aa265f6368ac5fe44e280864633ea759fa28e9b8515b9204d5d3f537e2828b410045f51e82bc5339c2e826a55ac2a9c96f125d57c183d5ea9d1d9045b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0023f82cba27a81d04a568e0faa52e9e

SHA1
b5cb1fc4648b6cfeae271381cb78559accf6147b

SHA256
7d7172dc5d4c886b17ddeaf8f435cf12dc817fc1eb1a2ed591fe7e586ea1f8e2

SHA512
b599d1ee1d856d02153912e158c1d0e5acc74aa1e88b33a329261fe360cc743b559e68aa9c5a78c067d67e51f69336a8dfb46371b529f2c9e6f57467cb7016de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e69e203246b798b6ee627ea0af24dd3

SHA1
f7ca8a08ec78e0fb2721db5a9b8afe4395dbf587

SHA256
396c7a0dd922ffa5936660146689035e0a599dff67309e83b808d3f691ee19d9

SHA512
5c6c9a88998f5ec63f6daaba8ff66702ca1c7f4961c6566a82a4a6da6df0633bf9f577cfc67ee0011be1ab42d7a1d6261ec170d96ff7d047ce83fd7e635fd1a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce66d986c5d82ddec80615e07d21f718

SHA1
a0973ae97943b5934b2a1dd5bde1723bb425f7ad

SHA256
f65f6694b53859676ca7c81e782ac142f73fa6b50fd8cd811a9bc9a1d50c4648

SHA512
7cd31c7e9c4e1a61a8bf649c860de9d126656a90ab085af3589e0f9d6fdc1cdf23ebfa37e2dc181f015b497515cf9f924f584b90d255365ce2c3d90e047b1c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a67a0d8146e5cbe570f1da5499b3968

SHA1
7e49f5a188f36813a71d6d259eb6d84058da34ce

SHA256
d4e453b730d8b3b76d67c390c715b738de51020b588026787d7c2cce03de8760

SHA512
6e3c6c788eba0704189acff420e00d1ca5d47885d4a3fef59b3a5d41aa06b25f2eca458d11fd3b4397456edb5ec4d6014fce5e7fd38293506c331c26a8b17663

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A7E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9ADF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit