39698288c1e6cf23c1e97682540a77af7e972b3eae40280845943dc90ffe9499

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ed04555c24342fa77aa518a0f9f47fb_JaffaCakes118.html
Size

25KB
MD5

1ed04555c24342fa77aa518a0f9f47fb
SHA1

efadb03b69b4d6c96a80ec9fd0e3fd78eb68aab8
SHA256

39698288c1e6cf23c1e97682540a77af7e972b3eae40280845943dc90ffe9499
SHA512

df8aff98df84efbf2a58d6ea31d0eaec919f8a8ce2128be03ded67c72cdea6914ffef937d36357c60d44dd1a2a68217e67300e7f6a46f89d9448e936ff72acbb
SSDEEP

384:hnA4ywN5pKSBeztvukeKXXTujwCoAQ+JLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:J1LWtWkekcpdD1k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104ebb51be81da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CB3A3B1-EDB1-11EE-AF23-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000c9221f174ca542ee083af9576ceeb16086732f4d2a14b23bd041c3b3717aa8c3000000000e8000000002000020000000eb35893f66335d00c223ceaeaba4a6e1d0dd03c446759b47dc5886bd3c63cc04200000000a4b8a38107d56c578808a431f85636c358c854740e144b70d74bd12859b123a40000000d36bdd8e52466b37813941d896eff0de6cbac2a482ec10e3f5514775bf3e0c864f9388398eb02b8ab9abbc631ee8a56cfdbe89ce89f4ed7719656955f18d7d10	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000dd68cd9dc6cf603e80e95b341222fcff3ec671497c60e4c89108402d12a94fc2000000000e8000000002000020000000eb7ea510618936522f87b70ad8327d7823b53603ca5cf6916afa0d92c4de867590000000a4d416771bf3a0c4aac8ae0c979e082c46bd0d9da6773846b67ce40ba616fb3bc1543195bcec4384ae5ae12f2f66734a888c626938f4a385b0615cae0dc404ecf720617c5c8d730b3f881f7c9e5780a314e1a9a2e4ede17906962fcd0989bd596ae11cab0827bb06650c44780f5c2ddeb8b45d732928908ea5aee34da44665ea52b009a1aa40269127caeff93d15a0964000000029bb9b2bae6acf11095963b7c819532aa6e9808e6b2e31831bb465f5638570a2eaa5227c0ff26f3174643aaf6bfc6ef6933744a82116cad68d15f790d590dd72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417867574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2904	2204	iexplore.exe	28
PID 2204 wrote to memory of 2904	2204	iexplore.exe	28
PID 2204 wrote to memory of 2904	2204	iexplore.exe	28
PID 2204 wrote to memory of 2904	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ed04555c24342fa77aa518a0f9f47fb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e1bc08660380a2b3d1836e3764a5356

SHA1
0206372649f40d98274e454c15b675e171aa30e3

SHA256
67d2e86a963ba0654285c12d997f74455c628a2201f819c722b8c4dc48dd0819

SHA512
247fc26250e24563bd5b7268942c8b733e6d7401cd11df77661a4c5c7553a23770ddab0bbd730e6c3e24dcee9563921c269b7ca1da596a759732748e2989b388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e22c292773dd2ed8b649da38e523b4

SHA1
083dbf8acac4644af201d52d4fea64bc87b18cda

SHA256
8df2d7d7130dd93388b17c8a64c0187ce42995b47457c1f2b3919ea5055221d9

SHA512
a86ec4a127f3d8cc9bee15c04b44522464941dad17b036945c0c89ccea186bf5ec3bfe037f2bb8305e498ff80b64e466e8affcec4e3c46d139ec76f4e43419a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
926f5c45307e2e6804c3bf82c928d23f

SHA1
6be1121845cbf611741e9bae95d95409e16b93eb

SHA256
1da4cab233b4df27856f0f9c5bb29ff80d369a1b85d3fb7713be23a04f87101a

SHA512
0d00f59f88afe71a62808fe509c2c8e19f5d10cc14a21d16b433a804ea602cc65dd25d4c543a8830b0c23dea9b600fabdbfe5a69e3fc60c893f0dc0709269351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4219fd064058ee747ef965a7a21365de

SHA1
dc0b298fde211eb96c5fa44ccdd9be3056405805

SHA256
d570236c278777a22cadea2330ee69b4846ea855a799308e9c301f26d29dfd9f

SHA512
bf3f20926b1873e1f76280d336266c218f0672e4e57a79983691956670099606590cd58deb8593ec65153f623f8361928e1add7d85949757d90fba17abbd987b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d3676260d0f854f65e2e82b4cc1729d

SHA1
3328a2ce63dfc7a4e402cf4865b45552a88c1a3b

SHA256
025e60c2fc249d321612c5af7446850ec46ed1f3676ab5fcdb82dd7e55432b60

SHA512
cf9a55ec44ccbc295be05faf9c31aace62550e7502bd517f2edab24c724fbe08601be2f76eb8d5d3f4368ab4e0ebeaa67a365e067c0a7842079478a5ecea8601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9d2779613fec3f0ee9ed6aed6df2f6e

SHA1
34c6bc79078030746b843fa94cca3c03a750e23a

SHA256
44cac81a5c935d4addfcce2c8ef2314b5aadd7c80b3ff626df05c6cc003ce34e

SHA512
30e3f4f46359a2c7ece0d292b129f1e04e30f16af5d2749cdc0359d0c217b1e104c80a3143797778d0d9c970f966e8f8a43616f78e4b1771fe79728a242e32c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf9ca4c0c11509fc15f17b18bb4369fe

SHA1
02ae2791d1587127f34fe130b37632fb276875e5

SHA256
2963bd7181a515f68f6911462e92f6350f670ceae7724a0b232666dfc71238bc

SHA512
73a72b38c15aa1733b63e6abf88ed81f1b91134e7590c021c83cfd949abf60e22d73e88f7ab0cc49a90b31313810759574090769ce77e48c786623d9f0a2395d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede7485ebd9176c7b202380e72b825ae

SHA1
33404f0a31cb07b9c4bdc9bdae48d571879a5a9b

SHA256
9de81726d57d09007c0e6d385c38965afa980cbc308ad8dd2e8e5209c580922d

SHA512
4ad127998669972367f18d6be88501b614068d2d815e0580b17b0a871e515438fd960e8a4b7bc55ebfaa30ce0b08c9e4a7155c5fb0f2e4acc1dacd77be6b64b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497830a5a4512b82c852dbca2c02d056

SHA1
04de265e6d05d02a8c1aed9deb77025811d9ecbc

SHA256
119f0d6080c1a14134bd5285006698f4b0ea5fffbbeda863b05cb3b47e3cf706

SHA512
60233c3db7817bc3f24edb60b28fe6c1af34d5e1d04a88bf61dff0679d4a76c867a5f035224e761cc9223fea23b4bf62005dea7a7d7de73ff2f0bd2aae608487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e86490c63012f614cbee21b01b92fe2d

SHA1
4120d48204d7d6a077fe9430ecec5defab07aab3

SHA256
26080242b97295955e474746ca20feab8ee71c9194b1792c4879fac2968faf4e

SHA512
48df9f9dff4db17affe0090fe5f6f976a4542a11a82c48e64bd8a741190672e626105ed2e13d5a5b471bdd1efa2c67ff98cf942e0e1975e4abdea388c8114a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8287e2348c0604c69b41021e9c4778

SHA1
51c62670cc22cb1d1e67bf5caa63d29106ea6ba1

SHA256
b61ada808f2d3ad9c630e0838deb1e818f86a222de7f78e8c4137bd985649dbf

SHA512
cd63b0b08aef23b51e9b66518179eab4a34979cd6b3e7fc956f7f74c8154de3a4550caef6122a313633edca77bf4bfd0ec49e9ff50098ebe55d549ea63806bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed33d00b2ba0c05aae74c9faa838421c

SHA1
4defea26f66836a8b2d5f8b95347b389bd7fd67a

SHA256
883e3020c747f86c1b00c8e2f7edb8279376bdc2d83f9c97aa50e8b78fcba085

SHA512
c5dc57cb5b46d894b7ec31708a28bc81e3a55e6e5ca73a12e5f1f6348976ecbdc94f970e4ba19924c40239253e779bc6241150961d6bac034cbb065f643a80a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13468c629031efbd3fd249bc11da9be8

SHA1
e65e2a5c0e91618683be03faa3126ad41aa145c3

SHA256
8674c56181bc6baee1419f02f86649b4a33741bd7d91235999d413c0ffd2c1ae

SHA512
43799c6a018c33dca28851100867660f8828264fb23732c438b47c8617371faa7c898f61bf459b0e1e77cbf193ec06101998e452f63205875882077edc603a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f6b92b170e0c0debffb998eb4e93df7

SHA1
282a20e548d675f3bf82a90ac6b80fa5c4ae1fd3

SHA256
03024eb7b2a5d073f98282eb951d63e39bb0a711c95a34af83d4c5520ce53f8e

SHA512
ec68c7176cf5163812dd43558ca592f6ec3155a148cc612422cf44499f0c19534d0e9e720db7b18946da6b6a19ccf24a2ea996a761abfe9aa84695f84969a34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7b25b9370b648c7280bc21f6e2b0540

SHA1
b1581635f748f6bd173a9e90b2c37cc6b449d92f

SHA256
9997aefdae982369dced614f756f42d85f3543105b8e52cd0e2a367a938e6bdd

SHA512
4410c63ad45fec845f30d8c3dfda365e17daae1099f93de5d0ea27b1988b97831bf6b613d2e394a9ff06003b9416116cfea5614e839bcbf450b7aedf52456558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b369f1a62b6a0121d88c86f885660672

SHA1
db9e2966743a565d9c35429e7fd3698bd26da6c4

SHA256
ab6ccae0e0f58134baae9cfcf5aa44675df7579f1d3206cfc66bc2c6bbc40302

SHA512
ad81f1f063dc4af975b74602f5a8129a43891012f1e52e51bb7433f79755b3fe7a4fe88825d573dcc4f129713ae7ad150e36a06e036660fb119766b35f2b4cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64AD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65CF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit