21cf05bd22339c78399f514cc88a49c8c41c34b4a34e074e89d2757c01f95d73

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

677f7b7f924b12805f1b54b18f14dba5_JaffaCakes118.html
Size

8KB
MD5

677f7b7f924b12805f1b54b18f14dba5
SHA1

6b737268b7f015175cfaf3eef85081766c097a53
SHA256

21cf05bd22339c78399f514cc88a49c8c41c34b4a34e074e89d2757c01f95d73
SHA512

72619df5b56fb8331f0ed2ddaf51bc70aea05e5162d643383ef10e644c6a862d290e04ee16249db7b9e86acd885afb2d6db77ceccacd4dc066fbc898b1f0167b
SSDEEP

192:KfD0gs0Ckvdo0IDi6UUDFSFXYbF9kF0FfFuFCFbFFCF487/cm:K70gs0Ckvdo0IDNFSFIbF9kF0FfFuFCE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8E5A451-48EC-11EF-B5D6-4625F4E6DDF6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f066fd8ef9dcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000035304541465d7696b3462317f6a2ff7dc8766408f9398d5668b3ada6b8180219000000000e8000000002000020000000b8efaa3b5131b2f9d4c0162bbe163a865f3e2d20ddbcbee26aa17ebc43f00bc390000000a3a6065078463e7b5ea4291a8ffd8d019203792e455487c4675b1431cd56408e8c2ac52ee8fead4c7c85812e4cae4a6d0c01cca6205000291ad8bfd0fc0fe78eb1db6beb4fd092cd767ad3b87110e7cc566f581667521f08d0b76752f7bc6d5f8ceb8fdbb340472b97e2bbc952a4564d3575233e1234a71d3f2dc710e3f035910234e15e28901b35a87ff22dcefa5aa940000000eb2cbaebc220e8acc52a851a5bf7077df47b0887d6a4e6bf4d6213872af8353548a57ab8e0f373e958494912372a31d7d1a8847bc41b84c514518d8e20f69fa2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427898570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ca56bb90f043c2e4ce0c14d9dbb87882004eafe860c722d0e29e7faf22b16fae000000000e8000000002000020000000e2c0f2344825a6fedc25c17c7b57aa4f9d5cbf4d64d3d8286cf00d24a981b7c92000000039734660354cb76f8b44e9bc6d4ba7b2da4ede2db7aff7df20ba318865446bfb40000000a015a9b63be6e7917ac113fe3c9c1397f6b1ac89b6811b2cc279c7d9ca4011744f48eca1eeee4352d6c279c25be836a3c8132eef4b9c9c368fe3f31501065c0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2432	2292	iexplore.exe	28
PID 2292 wrote to memory of 2432	2292	iexplore.exe	28
PID 2292 wrote to memory of 2432	2292	iexplore.exe	28
PID 2292 wrote to memory of 2432	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\677f7b7f924b12805f1b54b18f14dba5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6d1a84daf2eaa3e778b1c081c262a2b

SHA1
8ec35778139ab7b31bc5ba6427a1bc7dc09ff06d

SHA256
b1a529477039c2f17b8c010a75f96079c16571eb4ec289f646de1eec9987ad84

SHA512
d344eb790d9e5e40c44fad5340215b6b477adf7ccee34bcaad37bccd1ff74a4f1274e1b1acae990d98adcc69443f7361460bbbfdfcb1f1f4ff229737d577d274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
759a28c6952aeb658207784c8f138dba

SHA1
bb5d2dd111790b021b6ac6a456dd73790aa0bef0

SHA256
ff3a21485e315f1216e4fcf2a070e534a0a2388f1e272da99797f5f85f669252

SHA512
e4e4bd4e038432b8aba5e62e27142f227b14739374474ebd2ea3be361b9be668920abfa092b9c9a03362cce184a7262dbfb2d637c6db04f3a3b50bfb9afb1862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4cbf15f2aa71e91c9bb69ee4812a121

SHA1
43c8b80c916cf379bc11c9bef747d785346c297a

SHA256
b71ff427d65cd0ead07ba3f23160808d6f714f8b053de62925af17a77c7f5020

SHA512
8984cc257de70f6c9b14ae17ba3246dbf64f9fcd86ee78f4de718099459c9005084381b00f56cd8ba55326a39460c7b3d5c0a3d185cc04bded153a4130a89007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e030d5530af628d6ac010b44604ba9

SHA1
a3349b026200af2033ff5bf5b4447eccf5aa300d

SHA256
a9fa76fe755fc37bec8c3fc8fb8eef3342fcb4b33c04814327fbdfaa49f21162

SHA512
ad410217f4c362b1bcda59242cf787b4ad0b14c7bf51283190c5a11d194f6f39a5e0da3dc58cc7519269493901adb4c323c810f33b4de443071d7e9388ab493a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02acdce504574d230804616af713d300

SHA1
76e323345bc4f7762b3aad87b59079b31662ec43

SHA256
05c3d22871cd8ad8200d6c5711cd73634fa1d51cb223189e900eeb71bb431351

SHA512
a56900f2f224680f109e8329a8d0430e2d80e3a32d9f323f86425a8194e48824b06a9271fa5937b1d2a1c810dcf3713e0c43b8a597de77be6c3506175d60f815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36c65ac3b640ad66934834a528ff8bed

SHA1
2083862a135c51058bf66cfe286273f5378c8c68

SHA256
a27693e0ee1ede42daa339d8ab74dedd12cefa1ec5d5b53a9e0b6b1e4a16d3f6

SHA512
9e5612c448cc2a64d623b69de8ca42112bb01962b0a3e820cd5ab8060039e75793bf6d825337ccba307830c83a6a091a444a0f8d8cbe7577e36f3bf132e2a3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de939894bc00fa73d6e23e3caa47a962

SHA1
28c55d679aca77d85f81da72ca0b7e2f94a3865c

SHA256
69d4d4b8a78c3e5ef55958dcd685eef325b6af08bd528accbab1db7dc5d73e77

SHA512
b3ff774125b64d7a8e41c91ce42002bc56fdfca8f05a10de775cccc22c95594828e338c9506d73990b37f14d04b93cf515e3b55d5d352693815142e405f5053b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9428a214458d995afd9efed81302e6bd

SHA1
e1202f3b1fedf292c48b395904d16768cd0dcfd8

SHA256
2eb907e2d9a674508583055cf1f234a05f16eac32c48f4485a71af7b4e45d436

SHA512
69e89d1bc9df8301fa9235b8bbba661ad80b4523de16387cd43eb6400f97fa7b451bff947dea70fec7f04d943516c77ab1809764613bafe75ed8ab378c581209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f6ee0fe9f52f24375a27d2c0da0a65

SHA1
ad2df97ed015feb0ff7ae046dcb47b5845c94a71

SHA256
9e814ffe61e4e7ec3b45d93892e56de5fd17f461b8a451d221579bdb4d42776b

SHA512
21a983880bc7561316f218d4ec7f09df4ef6e00fbc3dd3fa072c52ae5c60fae1851e27e7d33f8f1636f15411af770c592083793794b333fb89e94ae3007a939b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3b4e782188f7e1664ff4a2b13057a0

SHA1
8eae294806a77fceb85ec5a61473a96518b9ff0d

SHA256
bd40386a3e3014eb858f53c5c15854cda6bc04c1ba62b8b1e9bf6a0a04dad712

SHA512
038f0126f657a94c3ccda0273d2ad3f274b7f77ccca30d0415e57b3f7f901cfa507e1f88fd6accfe7541003e2afb6bd4350d9a0929682d81265caf53c32af400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0929f631d77d8de131210ae4b328ef9a

SHA1
3869b6a73f1ecfef8b3f8579c9f24170aed0a60c

SHA256
3d88c69ddb5a20c5d45bbc5e9aba9038c157d91ac995814f327d3bc7e807926a

SHA512
6d77f8fc349fabdf7ad8a30cb126ed19ec965edbfbb9258956dce5b9e9f1802d56fafa1f541c9f984f9ee4cda77350ec9a13765d2099b264cf227bc940c3da56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7f294bb173856510c0aece7ab056804

SHA1
115306843fce7d5db5259d6afb1f5dd4d301b1c5

SHA256
ba6dfbda5ee7a45a3da0097eb2cb50c2038e653677b57e56b70f73bd36e4b4ce

SHA512
d805d2e00cf42f477e46f32f2f4ac27c2aa5be50d65074b080af88ce48f2f8f09a8c1adf796c97cfdd97ce146a4cdc7ebe327fd3bb3c5fcb3727011ea6e4d1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01ce392d0bf25696d95114c33d21a10d

SHA1
5877e5242636ff52733e3540f78eea66d13cf2cc

SHA256
eab59a78cd01fd499a4667942e033f0821ae060a4bfa258befeb872b14dab8df

SHA512
23db6d90db44a0f6a080c8cf3298a859a83077c211d5f724556484119d76d8f3b307f85f2e5e10f812399bdcd9449ff59914968a10f70897d0570f067aa0020a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45bd397116a35fa8b35c349893af387d

SHA1
2154816d7539ddb733e1430b2781f017a80a05ef

SHA256
6be99c5a504a29483e7a7cb370f6bd3c58ac36e5d6c19b0c3767c5c0e63b1ffd

SHA512
9177dc7755cc2a59d1d820a63e7d84b8dce7a5e57f441fb8b715c79cc9e2c745c47d28663c1f22e4b7022ac25bb2d77abcfa4ecd31660558401544b288681f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39939ca7f0ba217769001700d8c212a3

SHA1
3d012aa216174e2c37a3ab62aba272c03a0e346a

SHA256
41e45d9121130216206f9b1032b04049a53d23d6c7d55ef4cf8d9f191cd15ffe

SHA512
510ab20608f9164de5420987558ba477b64176a8968e9dd540fceab3cc692ffa89c3d46ebec19f4251352f3adcccf41546b914e7dd1cb1c680c2b5bb5b7046ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65b4d0ffcad154491f2c7b9b0771585a

SHA1
3bc20a6d23b27d563214d3411714fbe2cc50173c

SHA256
e49564b58cf02d4744bed20dd8bc31eae18d33a6027a8daf8e05733b49e7e080

SHA512
4d1e374c706df72fc5f52a76a709452f1fc9762ad53a8c1a63092f3b89977c6199f2bdec9cbb9beabd1c7e8a15acdb7b1efbe44eae5c0240b1c4c68c93029dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA47F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit