c1674391145f9d7c9e9ca9fb3a0c1691f366aaf56f1127b43f178aac687548f9

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

669430a649a8354b21437ec1513fd6a0_JaffaCakes118.html
Size

48KB
MD5

669430a649a8354b21437ec1513fd6a0
SHA1

f42a5ee5be736351acaa02a6359a2fa87fec8dd0
SHA256

c1674391145f9d7c9e9ca9fb3a0c1691f366aaf56f1127b43f178aac687548f9
SHA512

fe0f05531716a642375c8c9a8ac14e29422c1d24d3e4b323900128256b5c50a98eed675158374038168848b2844d0d3c68f4f2d0d3fed7b3f373d7e64177a78d
SSDEEP

768:oXySE2iR2CaeToTeGLEmlTQ+tUD6Lzs2j2uqKnmnzvaifOuan5o:mTwmc+qz9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006293ef1aeae2b65ac2dfbde70b5639a00b70b7ee0ac5364d286a6cead5a0e600000000000e8000000002000020000000ae066dcc563a8091e8205bc578b83b184d6ebe6d0e9f597069f20fbdf928e162200000008ce0ae738cd9267640842422f3e07468e0a2f4da886859d46d68d78125b30dcb4000000001aec4fa7793afe9e1795a6d5977ad79489db4ab4665029d42c9cf44d3d3843e8588caeb17138ce7f0e7a8b3b30ac1e2735265113098b0668776f9a147706342	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{655AE711-48C8-11EF-B170-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0cd803cd5dcda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000005232c682fbe5b511a313f7ce160fa3e7d03df0bad7251df6ec7d5190a725e25c000000000e80000000020000200000000bc2106b055e92adc92178d24bf4ddb31748dbddc8a7f3139e46eb2af008d89e90000000e64431a819cbabcd7b6713e823212a03c8a127e1de42cffb550535221e06b404866a5864a3fd5c508cdf0ff3aa88d4216cd4b85457d219c05e06afe76710950ed20227ba2d4f574166f86484eede0ee8119b7b5555fa084a87d15d715afc0d4eebd6a2926634f03a87baaaf5302cb4f9a82ed8c932b2ba8dbfc46eae4447c212fe3db287f80ec0bad22660c2148c3d5f40000000d911e4ee81a356f85b40bb84e7488b5d8a0a0611daa861fc847e59776d96a741a098ca2d42cfdf45777c7a1baf16392f001a844505dbb4346a9caf727aca3c07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427882977"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2820	3052	iexplore.exe	30
PID 3052 wrote to memory of 2820	3052	iexplore.exe	30
PID 3052 wrote to memory of 2820	3052	iexplore.exe	30
PID 3052 wrote to memory of 2820	3052	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\669430a649a8354b21437ec1513fd6a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2edd5364efb14adba2e9e0aa082ea069

SHA1
9dc0a65a05a5d46469f6c7f9991a8b99a4f6676c

SHA256
3a9a53e38907c7a058418c9982258213e74d759fd95cfd0743f09b29bb79757a

SHA512
af48688dc51c8915f84812804cfc76b6f6bf24b9b3271f84e75f463782efe2018ac79c49d92c5ca53c4bc9eeed5353ab58227f83cb089c3a9d65d23c8ef91394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a42a4fd4e4420b67d06fba8a0b95643

SHA1
c3b8dad2dd5e98ee6afa7069a4affa8d0785343e

SHA256
993d4486d366a47d1c92e7606a69d37f047bdf65cf7f08a913b29523e1b28df2

SHA512
117be76ab56900fed281a0a1e49e2d8de7a784699dfc5371f9401411009c2e9b163fb9ed2c5f4382302a706e392c56c4cc429c3edc9d390e5a7b87eb6b3650d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cec8a79c2da6d720a4aaf6bfbd7ca250

SHA1
e69d6e5a434c18fd996a66fc635994db0ae9cb2f

SHA256
249180682e167adbfb7b45cc3e8b4629330e2a6494c65e25af68bd50d6ebd078

SHA512
c2e3f339a4d1a36913d32bfe9abcfa67c839166f3d1f44aa9d760be5b0b9becf35b81e9945bb8c9fef84236e2abc6da7c14070d8cbcdab55360e4c6e4d23e3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75074e4012e5b99dfa544d46e76914a9

SHA1
97ab719e3089909268702667ca5c143c9338e91f

SHA256
2feee11201fc045711abc8a182ab0cd8830b7f043384e4dfe92f1a38a6edef39

SHA512
0988647e4c5b05fdb55e9e016a67cf0c0201747b80269ae539c9bfa09ecc20925a5ed97c89c71959fb8c50bb9be8817c47f4f205f478cad8954f1306d9722bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1df19cad5523a5739aa3d2205f6d808

SHA1
2320ff347335459f0027e0e499b4c219b843a193

SHA256
c9b81956599be662a02718c995d6c0a5d184214d56ca2e0ce8f6ec8277d1248d

SHA512
99379591fe3d9bed0007bc627098f16cd661705aa4423a6758150734ab94a1926332a31421a03e854d4733f504f46ac90164dd3e45a4161842d644cf46816452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
972d0bee9697691678ea7db8bc12631a

SHA1
79cffbcc839545ac5ab34764af0b5b0523b09032

SHA256
42747249317a393746e91eb3079f69fdb75be46bdba6a90bc85fc28e2a14766f

SHA512
b48de0cb7a2f7f5c7308ee6c124b6429ce7787e9119ee0b870fb17b4217a85ba2b21690893846764ca07dfaab73212c1051ec097956eab8ab25c2c91350b0e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36ef7da3dda0a5d291374820e8f7f7b9

SHA1
aaf7406d7e629ff09cc464f42e2868a41e4b4147

SHA256
b7652ac7d5b97b4d5dbc7c6568b22dc99340befdf7fde5a5d93703632148021d

SHA512
7d2bd3d3639a98d79804f1cfd6407810eccaa70221f884c4ec4d4af5eb52a3201c7b3dfedd0c1719d20aa3c6aa9e72ddca4797ca38c9a3b01faebe21205ec2d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a29a408f6819e8c9f8e59f2da1e83781

SHA1
abb42f84b3c21d3e376b44b196e476a5416fb2df

SHA256
ac8612eabbf58ea8394221a19357080e43127fa822af863fafadf3cb270f24bf

SHA512
2e843c69a07d7b0d8407564990dae83218e69a86bb8c6a7a2dcbd7fdfcc44ae9b13935aa6d2653f9145cd33c97b1ad40410ffcfbe907bd3021f9163bb9bc9e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03b6e11b387b545d8dbccb5e51c96c91

SHA1
e6e9ce7d8e60ff949f37fdc6848851ffb51ded02

SHA256
52fae03b8cc51d5f104658bd16059e00e94bf42e7df7f90cd86fffd44a413eaa

SHA512
2d3aca9e281c4bbb155c7a53d0e3d5b21633a9496dc56fef537708fc785a62ade3d77af38541e03720a96f5337451a8a7ecf54c738446e1760230342abb0723a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26ee91b59a4b2b1c660c19a30355d789

SHA1
b5341682466e3cf31913bb6c8801ba729a3369d6

SHA256
cdc3d29a2af25a69b3fba43b69bcd6ebfbad1c947b3a0f253f387b1409d5292d

SHA512
4bcdfe792188b2dc06d4155dee746660d9b1a3c233fe0e9fc71841e1b8f70534b5a57d02367e519bf0fa9034135054543cae7163053c7514437c7a0556f3403d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7ADE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AF0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit