15d8d36bcd0dee794edc8351094ef8b6e62a2e8258117c7bdc134aa9f21c4102

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

67e649b2e3653a62f07e86f0760c6d0b_JaffaCakes118.html
Size

10KB
MD5

67e649b2e3653a62f07e86f0760c6d0b
SHA1

a04f812610bc5e152a5ee9093535fec7c2ecba64
SHA256

15d8d36bcd0dee794edc8351094ef8b6e62a2e8258117c7bdc134aa9f21c4102
SHA512

8ef9b1850854bd494f7c75067213c1be8b34da8daf98c4817f1e5568075c6cd4e25e0818cc9f956b8d9c78db7b6e0d13d159b3a30183070b25fe437a5453ea29
SSDEEP

96:uzVs+ux7n3LLY1k9o84d12ef7CSTUVzfym/Hl5mX1mtTBR8BqYEBV1BBBoB1aZBl:csz7n3AYS/bgaFlYqDlWN9okYBb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38C84221-48FE-11EF-9F10-6A4552514C55} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427906087"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001d28e570dbb65aac79c5a4486aa013134e0232608bf0c059b67571fac204dcd5000000000e8000000002000020000000c0a607cba8bfa4e51fea9171adae5241ccdf0393512401673b92bf4d2e26fea920000000b9d0a33e02904e6063ebadcd300f380435823aa3bac8d9ae07a9a2848f43057340000000135065fd79806805bdc0dddb30612efcf5d62859e21570e65956e8000bbadb889e3387cc47a1d91c9aa91fc01d41bc01d948dcc0ead8cb219fecf7ce06a6d20c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000008e71601990866edec0bd8f13da879363e7c89c27dd41fe6073d31d2246b19d0a000000000e8000000002000020000000b61195103a6d2f595a72b051d71d6ddbf6d54834808ffd37a0fd5e3c34f6075790000000592467755c748a941d2581d7c1fc0872c4eadbbe939ea2ed1769df6504ff38d4fe778285604bf921d8943e5b79b1d2018415da9d4391ae54488f294cf674b0651b7290dfe5b79fe0f92dbcbe36606dbf598969767b545c8f604fe0b2b0f2094336e1dca2e9eda26b188119571906c3e74763991569cad86a6d0edeeb5b6d143aa645c02c760ba322f370831b22f55422400000004ffad61b9bd0cdf252ba3ffc5706f20b15fe9fd444b840229296d7487f9e38c9f434f1064b40308e1c1998c4604db1a59aa1d739759500ff97b64e9e8040c5ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d3db0d0bddda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2884	2096	iexplore.exe	30
PID 2096 wrote to memory of 2884	2096	iexplore.exe	30
PID 2096 wrote to memory of 2884	2096	iexplore.exe	30
PID 2096 wrote to memory of 2884	2096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67e649b2e3653a62f07e86f0760c6d0b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6bfa08b6e487805247aa9c5277c57f1

SHA1
b0da48040bad959dffd6d4ca821421b9de056ce2

SHA256
cb1b9960100543384b58b550f47bc242fb9d308dcf6eebf9b2a7cacf3c01897b

SHA512
dc84a702554061092a68d738d3e623c6248a560ea7b54e7e68296ea6e92814ba4f07518311c84c25de430585125f3c3e3400d641ba0bd2b7e8b5b133b209355a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68eba9d6dbc117c223a4e9c80621c2ce

SHA1
8a7afc91ffd10171f0b7f3526ba0f10331ed8d3c

SHA256
32d52cb5fbaa3781ef5a6a524d9214ed865332824ad79422ce173dbceaaf8b7b

SHA512
b5f802fad2b109c320d071254986755266b3af2b1bae0010e3194c7db3d0c57cc2b5540ad52888576bcde8e4ddce4405847fd4d5f9a739e143a31aaa66cac1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52f1c7070e51ce5a0c64a6a5fd63169b

SHA1
16402bed4dd265667a3a0aba3a0f2716cd21a7e0

SHA256
3470cf8143b246ac2bc36b0f375656cec9515f1f1bd9994140e0b61388359910

SHA512
ac03f3ff94a19b7109fa3e192dab4b94ff9764b1194ac2f26c74d90e7506da85405dc7ca8768688e0e0ac22ea707e6bea6822fbc34da629f71fa5d9051c19ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d64e91baa4bb5d4d61b40ab958999dfc

SHA1
a9f3316c03b8aeb838266b661f608f41c746aca3

SHA256
161accbf18147ba908836dcda76dbe36235a5a971feafd9d2cf21eef9ceeacc0

SHA512
8ea4c5fc8d022a81bfde0658fa1555f137e7e2c7be95b645ecb70084d86d9816656a28b7ba2629f4a0314ad248726862df03fb7e68dbaaf83e7f16097fda6343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8fb1f63e5d9441da5a6ae591178d37e

SHA1
67d09c22cdc62504e5f61f5ef2d723af0238f6a9

SHA256
294c15a6adc3f9b07e96a278cc72cbbf131d18a849923d580a2a40a813890e02

SHA512
dc32debb4e379a6115a9063d5d90252d9d2fbcda751a54d1bda39c18f651d7e48c753a9aa346a88b0f3530c213e94158220c88861473eb376148ffdb41a7d2b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4394b18f580b422666a3ed662674899d

SHA1
b845fd70aae81907b0aab2875908f87845dc71c4

SHA256
bc8c3e7068a30e15fae8988b1cecb508f16c267a4c6fb8d5c9d36168cd90f61d

SHA512
58d2abe42cceb86b647d09f92e0f4121f5f4a89865c9494b7242751d8d1c6d95144b3303110b5451c8851682dec8d8979af27c7e498033430ed8cd05f6028344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b52f74af28473e17ea7dbed48e5e32eb

SHA1
211c2949fd66c49e157986f1a4216692df72e04d

SHA256
924a1089764991468308f96a707d9fbce97d44a2f905b59703a7006b3dbb81e8

SHA512
ba2967776539e7dbe75699a2381922c7dcec9431fe8246b6603d0890404ddd1909f0288b4b1e346cefade87a86ce1b23bed6e2fd378997678c722c706e5193bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acb0050a4f01ce3dd3dfe026335e6c85

SHA1
bc1a598aa2bead06928f71866877a72f4efe1a85

SHA256
52521d2534c16d479a1f3da00597a9b8b979107d115e37560c4dfe733bfe148b

SHA512
1471e569f630aaeba09b1239ff862787c28c7ed994a4209b87136e296e09c0d9ed931143b77c3b70e26658005ffbe772a448fc23e1b22366c0386e1040c27bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7f556e0709508f4401fbcf2c33ef81

SHA1
1461e9637699a5d594b128cba8473f2cdfadcd97

SHA256
902dc4546bc38ced6110b15593069c05f5f0c952f7b55ecac1dd590976e91b54

SHA512
d348e6c62dc41348a3c8874c56662eda928473a3eb9f13b6c4215625ae55305e26eed991135ea80d6d4e9e70812f3354a72b089be9201470c03193d5a45bdb8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2619ed23693f96f438503e3f0dff6bd3

SHA1
c0511588461fc74379a5ea1aff4388ae0c1c1ac2

SHA256
773abfde52e97a3928d3279b029d0b287cc28a28e6085b9fec49c56ddbd8c39c

SHA512
04f4af06c4e13b0075f59b78a59b37fcc281d29fd20cfe7d8031747cb4423ae7b389b06dd4f7195ae0576bf6f281704c680e5ff2747a72d954b14293e71279d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bc6aaee39d700087f620a059b5468da

SHA1
c38e1c836b05e42942b23d22e28388700b7d5400

SHA256
42be1d3e8c4001df24b4d726ad9258a58c03b36e6aa858f609ecab65d8be591a

SHA512
3f75fc20f4210cf5fd03d7591cfd4813b6d18f2293b3d599c249dc7d6d212b55d9bf24fee34885144c96e8ea4b1d7591d8e199c6ae44eaaaa2219a0b540893aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f7ab6bd84445fa8c2f95353f15e8f9c

SHA1
1a9a99eca2e08665700d87498629bb78b378fe1b

SHA256
1bb60ec15dff5096b11a3d6d50c36a4938e459721153d9bc4a7fd42a4539f8db

SHA512
f198305dac16b4f8eee2664be99826906006b1ac159b459d04332e4e25b66372963f0335592067b373d3f01936b647a09e21766615a3bdfc5b3a2c5a3f594ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cde76dc7fb364112aa482ffede2662f

SHA1
1b0e8357517270957deb78c791097012f0c7f9c2

SHA256
16f077bec5a43ff410059e9ca00c66d3ed0d427bf55eb606712925b782692b90

SHA512
9f9ea8fda2bf1c010b8857bf52420a769f7518e0058c58c4004633b80cf541ef3b151c06cb4d839135d0bd843bf4d6437c222e4ee9c16d8fe535485f4d557641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3af2228c9e5828552070aa595bfbf95a

SHA1
30094928afb0fe3d99faba682383608922b8420e

SHA256
3b5c7f0dfb647cb8935dc50b160df4e517ecb483599adfeac266158122c42d4d

SHA512
1359289e0621de1fa994104f491a1a8e4ae97e8d4548541c5606d5b5c8061c950c9bf71309601990b8814449d67b777280d891ea074e7bef523795acce750c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab398A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A48.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit