81d95667586303860eb08dc1418a2bcd7a071cf24a1dbace2e08c6e719ae1c85

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f650a484adc8364743e7eead6c32a6e4_JaffaCakes118.html
Size

14KB
MD5

f650a484adc8364743e7eead6c32a6e4
SHA1

94a010c407177b3780d90b4d8a04560c26acade5
SHA256

81d95667586303860eb08dc1418a2bcd7a071cf24a1dbace2e08c6e719ae1c85
SHA512

a4e3ecf3eeef4babd32ef32be2eff29ed330e7a9d88d8b888102162ce681a1ad675115d312480e727cca8ce20387c7a274428dfd92cd034279f56bd07930c0c8
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vImlKt6DvE:aioWD/ZmXg8SZQrmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419537248"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000000cd1d02752ff73eec38db0da9659c5e8c661feee4eb1e827ba8cafafd0ef66a6000000000e80000000020000200000004c272c9a947268973b32b73ba49cc7e92c328cff784c2d79d6a320bbde25d8352000000003f4adf13bda93d2f61af1e0de2016d2238f08313626eb9b4f969735b81424264000000015f2d2955197369daa139e5f2df2ddbbe2a1123d5e3fc636363370cc903bec94a81c3330b8b3e554fdb6fa5486efe149d3b189814f5b255d063f21d64402eb8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000d6f4eaeea4277f937624bf963c700eb8b10423801131aa1c38f918dc39422ede000000000e80000000020000200000009235f9216dd9998e4e12c84a52ad1e8977debe192e7b0a51db25cc41076c6cbf90000000a46bb2143d3aa00f2288bf6bf3d501130809a34d7333e0b8f1d4e176da0e8897522d3d827b0b09dc8c6bf6caf452adbb05c5c802f3c77a9f40d31c856d2211e647ba75487d5eb80b80ec6c251b3e3516b6addee6e45ad21e72acfd64ab5c5ecf2fcd0f6be78f4540b93cb419a9e4ebba9519237beb97a83e4ec126cf5f232f0182e66f0a7d0433927276cd7eb5dcd9ce40000000f8f3009df5539709db2f54cc8bc76872c00304a8b0b8d35de8980e275298d75fccebfebb10f4e3e66f92cc1fb031010795e24bf586ceb81a3b00aeb9cc6034a5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03126d5ed90da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFF915A1-FCE0-11EE-BD23-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f650a484adc8364743e7eead6c32a6e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c2decfb8d15414b644c5fed4000426

SHA1
fe43e18a17450d9bb99b990c7bf4a1be21b6eb17

SHA256
dc16820da036ea18645d4dbadfe64b49c81aedf5773807e2bfa4fc3ca186e3d0

SHA512
5ae8173c60853a9996a310d600041b4d07ffd36b276d715c4160c5830c826facef0d39fa9ca7cce2896378b151cc71803d0518240f35298a906a1234b8a345e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ae68d191366a3fe80725fda9fa63634

SHA1
1005f1b7ec58ca4997b49087960a2123e217b470

SHA256
0e6db4a4aa199263b36c4416e8489c06ff6a9be3b8298b337d1b8ef32d2ae4bf

SHA512
b3a2547b5a1822fa6b922969d4e16e8b1cd840139bf5063d8cfb47e3cc6f992d3a9fb77b947003f66b0e83b7c206a0cc02a004925dc687cba0bd729956b24d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89072f279032e9a9fcd6e00dc8dc35a8

SHA1
5b6573010062cc5fa49eef4a971eed17482db5bd

SHA256
92b04cc59d8e1d612198b9a4171f0b99d0c084db340ba410a34e8588e7ace9cb

SHA512
eeda359feb620f291a355731ec753dd73711c8f1985f75deb3a6efad206705def315c685f1bff7fdcfc2d1d539d6e2a48505e8243581d9168329e3a39f2e667f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2d0f70186679da25c51f9c457370a4

SHA1
b3f58414105a2fb1d0854792c969983ff572c5f8

SHA256
10be3329a57dbc0bc76c3d9de6c57d19b298ac4eab4980c6436107de9b402d30

SHA512
8ecce63a0168d7f69d2fcfe5cc4fc43502e0839164919952063a252aa9605778a31a9113bc070b54e091ecec8fa1264c4c015561358fe2b5989f079af8083a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a03861f8e23e5d95c939f62a3d0c23f

SHA1
c68a1da828d9b621b1497dab1df5d38426333e21

SHA256
bb686c0b4016f33393421b0f003cf445242bd06a7872421ba2850ec94c961db1

SHA512
426321c6c79862b537051d0b9a880f4e18092f0c621063a4f889960876e1fba4f38e050f356a8776a2fa3354807ec72a084ba36bf7a5aea2eb7927f1fd36ff2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
896159efb4f29fb4a41b754b59af070f

SHA1
a42617d9d5537f2e78b489bc5a2af0899a1e1550

SHA256
912b441c5c604a2b73f1f93b44928645aead34e178cc6f5095c8a8ebec6c12e9

SHA512
3eb1ce2668acc38d87789b26e35677f30a399433b9ddbd1f35faee99f20cab3a9874006e79f794dc381cd70cd6b7c1977b5217d71c1d4aff67238255638a629a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00786326a048c2379b129a658287c6b5

SHA1
76460256586f11a67b16464dc1677c917617cc69

SHA256
f0be97e39df15fe02b16739d32d452b7c85e418a56d3337f44794312f8a012dc

SHA512
43903ced08bdc8bc7302c8da71f49504f39c8eefa27761a416f89377529cc03851ce3bf20f44423960bca56bb8449055b4cff0b32dbd95421ebfe47f1a1dbb01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83c52cf48d13c3dfdd789c97650c32ce

SHA1
8745b4c4eb5fb0458e5008e70adb025d1287307e

SHA256
e8e590c0abd9e41e4c81f0f3f83251fdaeb0300737915f9eaf86929044354186

SHA512
5bca32608458be2bdfcc695aff3afddf108ecf405949f1db420ddf6602a13444cdc2712ffa443a1e75ba8139afccb390bb3d056fa15a58ed66cf238224f8cdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c4957cd99dcb9f85fe17a102ab5a4ee

SHA1
234f1e790094c3668f108a6f3990a4ab84b9a2e1

SHA256
5042f586ca17f1763961e4dac49a98a33f993c5bb48d4775f31a5405dd181d28

SHA512
c1ac9f350250eae16f63abad39d53259263bc65b8bc3ad964ee2ef0d27ff8b9ba08e7b4603220eecdb993b66b359f576be2a8372d23c5608bb163b711233b430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
220da9a2e3b6bf67429d9f9a10fefe61

SHA1
e0d912d2a6cc34bf8de69c0011f0595c011ce402

SHA256
92f2e401e86c284bea749bb2fdf5ea5150b8b9490a86956e9c70054c2b1de2f4

SHA512
96962ff55c641ba8aa10470230977d1fa7c0d10b8331f7bb5d735798210daab06479b7fabfb66a9564c6ddbaed96f60cb6195d06dea85ba38101993715e79e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84140f9dd09eccc5f941e82cc511acc6

SHA1
b16ccda107c8096b332332591ce73daee1caed7d

SHA256
003802c860bb67e67f45892b654577d0a44bd7976928d6db00b674387aaf94c4

SHA512
763c5f783f061d2d4fcbfa3a94161d1e9435941ff2e10a14a9410a222583987b5e396ebd7c023e62e61dd58edff68f88f84ea7c6ec57de2f6ee8a600903c71b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
641d7c6009131e332a7f0e8a670bcb63

SHA1
9f1f779a9f6c3b89b65365a832a4d1dfc0d48813

SHA256
fbf2c3142c27cc22606d6b24dfd83268ef49185f64e126de4eb423f8209e638e

SHA512
4b791bab731b10191f8c1fdbd74e3f760b8175e73e286d5919400b86d4cb9316ccaf765d85f344b3af716ef45e643f9651491b5af881e5a750a685945ed32359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061628ea28273639093c526d7c535a77

SHA1
3ca75bfd636db6e33b0efaeeb8b2c8a240703c15

SHA256
d8c2bc68c4f3c317b048bf0b2a07d781be6bb876528e1aa369c9ac926a10ac86

SHA512
e12a9c2cb37ede6d33424fb2cb83f90f822e3f4d5f4f872752a6f7ca9e530e75b1b01801c347ca5cc057129a18109727bcb10d6127803919376673d2105b7b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fca17ca4d907d87f467c22924e110137

SHA1
bc0489f05f4a2664458c07ed5852ec56b1de68b6

SHA256
ace280b0117d6c49711d8b299717a0a4e5f8710b0f6801f11542a16594e7614a

SHA512
66afb8afd67aa000f87bea9de07f8f3befbbe957f6aebf4f78577cfd85a520a3d8a63f27b478248df05e714f96aa8b2030d0a7f014dabf815276aaacd4afe916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02e97f71a413946ed16db864226ac1d

SHA1
d45b6d026303f01abf324bb0aedd42657696ebba

SHA256
5e036a789760f61f148380796a8c470076c34f338ac024b13b099baa4616aa4b

SHA512
f7cc9c4553e70d4ef6c8c2e567f27a7786eab0e7dfa7ce67983b82b0153c6824f955b54c5cf3112e5711078077786057b4db45b96561a25776506540dfdc14ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4500dfd96e6d2e896ec1ff26883fe8d

SHA1
d10cea85cbd3548635520428785fcb8c466a75ce

SHA256
1b45f158246c21359c866511e084be6a3b6669b7d6d97fef518304a74dd747e4

SHA512
095d1505f3dfb6481d3b83159ff37104f323b6fa209e674edc792f5aa6431dcbeaec1c2fa6911bf77f2760caf7e1ada342467a826262e7b825ae63bfccc57ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A48.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6B99.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit