47dde21de21466913e0a44754bc9324167a2c8e882c0d2a8b55b5ea2ab789850

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd9e32592b4cace45492db65cebde49b_JaffaCakes118.html
Size

55KB
MD5

fd9e32592b4cace45492db65cebde49b
SHA1

4df2889d365651554401b32db277f5982f283fca
SHA256

47dde21de21466913e0a44754bc9324167a2c8e882c0d2a8b55b5ea2ab789850
SHA512

23c8c5588ea881d5fd99f75e036801f5e17efa21efa0fa8bdb9614f68abb90217b5efcccc4dced7a6e4fdb65b7d57f029a6fcf442b45575b1190ea71a8eee226
SSDEEP

768:zLfSpHvvCIooBdacyQf0Bbuzcy/c2wRhbSFyFq1:zDSHv7o+da20BbuzZchbSFf1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CA1F311-FF57-11EE-B73D-E693E3B3207D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419808047"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c39625fda53231876242359d55f73d0202c34fef387840038eab46988fa13878000000000e8000000002000020000000dde5f317ca0c2d6231855a28c567c629645308dcbfb7aa3e2ef2bf4ce976649290000000027241321182a33337a2d95e1119965968bc4221173f383e57b270eaa3d1414da4b9d9afa91472ffa88a8286778c43b0adb368a8e04e4764c46cb379b99c3cc8812442cd61b7e834f37c592cb103f3c8b54b364f4e52b57607d00c141f44f246a0fc22a540c98e2dc5edb71fd6718adb822950b880bd371d1261cec6fef10edd37513c725299d0dda6ec5fbe9b2649094000000027d7378f77f1dc1c4bf9f5de9173ce808c60f4201f3aab27db8b5d887b22c09d3a424e94c004116d04e0d8389963d4c100ccc5b1abee1f58b836fb4636d41229	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f43e566493da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009c64b900b51e763ae43dac6faa2f7e02cb323169ceda0605001521c8bc8b2a33000000000e80000000020000200000008e010517c809fa8297dea8962a31f0c49ff112652a0106eaf2b9ef1c903f12932000000090aa0e9be5da54da55bf9bfbc3863f461e8f5446ef02658d5d58b8a7c862db6c4000000053d0a9500a103ddd7e9e4c2b054ff8af36a415f8fe1601a2248ed7c22942cd49272867d1ab828602c8af67e76f655c0c5e66b8644f63f058fc931f3887df0000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28
PID 2156 wrote to memory of 2928	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd9e32592b4cace45492db65cebde49b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
edb785b84be440cbf8e617a3d489fa58

SHA1
8ecf91e56ffc7a9719aefe4e998ac3134ad4c266

SHA256
ee483338d637e9b5694205d24776d32960155a1b471c69497b4904249156fc7a

SHA512
27ba12417bc960d1bca3c70a5dbc5913d7e5609eaf7cb12e78ba062fa65cd5945782232a3858a5f43eb2a3733a198a6ed8bea22834b9364ab3b643da8d8abfaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d873697ed7583d6b5216a52ce366c8d5

SHA1
536e74cfcd0b476b7d01553d35d300c5c359912d

SHA256
0338bee53719cdef75acb1f2dc760376a8a3dc00859c1b239ad219aef9d8b1a3

SHA512
e4f276351dd09d4f252a6e6ce00eebeab9a47add3ae1e0e505cfa5673f8b0628b02e72afc55af3ec24f9eb6d7832c45b55af5c6ec52de26bbe781146891e9bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80581f0fb6050c26db94f4d92feb66cf

SHA1
13c7a7fc3dbd37fafbc14a4277753d146a62ef27

SHA256
aebc236853b8b5addc95cefa3f8c7403b4703718f461aaa1376087a9062e39f5

SHA512
f743895cd7c49fde304d7421f61b7414b8c19c81504de2aa0536144e465e368149ad659ed8ea331718b89292b4cddf6b3edd105f626ca2dfc763f1bbdf03621e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deca3110c551ceec17707ed2d9a00b52

SHA1
ba6642e393d60916c32ded7fa93e3176e10629d1

SHA256
943d9b8cc4abb9ef96a74e34d1249dca45d2ccc55e72adb7f564a05013806c72

SHA512
ab34a895aa69f6612dccd01a5cb9ba6ce4b8fbed0e4089c91fcf4ea17056cde4ee3558cda324b1866d97a1a088f01d41407c181ecc75f4bea3116c54266decc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cf34de79448bd8d27923716491f81e6

SHA1
53223fdac1bfc5c5b2fdbf63a05c4fcae93c13b0

SHA256
d7a9a256de157f923de5625eb77ee2a3d36a2ba8b2f038965eb0b6fdf93347cc

SHA512
ecd01195658ea66646cb73100e7ae0f5981338648e9768d717cc8bbd72a711fa2ca948637f3bb20662e9de6307ffefa8affea2ce7447c63a6550250b54a4b876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f11b8e5172277326b2584a74a20a6a

SHA1
e8e119f6cadc8e16f2da0ec75bea937e6812f944

SHA256
8c620a5731ad0593328c4f8e04ee23d804322de42aec23b2e192e0943e393c72

SHA512
4899db3fcb52d7710a35092f3b67d98d97780c8333d50a938d97a83bdb51d8a8ca605a731e29b2a2f98622ed7a1d6e41580413a9b5cc835adbe25c73d36ed3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5101315b58ecd40550147befbde692cf

SHA1
1f22aa17e3ecda4a69d7957a2da84d6f9d3df388

SHA256
141da10317c9ba9c87bc4c935e8f1749870160bb781afc46e80dcc130072347a

SHA512
5a49fc39a367448cda59c496d96df18ad6b9c11f9a0adae5d76f457c779303687331d317de7a6a488814ea004fc09970d38a4f83108939155fdd11749403d4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1744d595422bf7288e280f717c6e985b

SHA1
e83b5539bc1841a85e2af6d55307f5b702058419

SHA256
71877fbc786c8097aad61cf487b56bc7232b27d46720737b22f0a27682872de2

SHA512
7a6575188ab37a1d0a5dad2f94cc8d200f99f1df89d95ba89abec1ad1e34f98e23f719542e5c625a6fae02cea252bdfe74808add0b937c765707d8d44229eadb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b27c187fad33e6af2adb5282261c557

SHA1
ee69512e8268a1ce1eddbdb05c470737365d0298

SHA256
5ea03f5516274b74bd324a0283cc9afcfbd6a18db75af11d8a3c21ee687cebbb

SHA512
5941a58a3821018e3760fa422c487954f1a20286a5d9576c5da3efe33e1649e9c8caffbafe0a7668800b5dff987a8b02fa4abdaeaf0211e803550fdc388b7aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
8e552624729f82090f47e2186d3a4537

SHA1
a0213b8c123833a17982e05b79db7b2260a86394

SHA256
9d8cba7983d648d57b50c50eab4284b61d39cd5cf2d0970f58e4794c61825665

SHA512
c8e87e622620cb322630c23911ad0bd13d249924567142bc3f7aa9b95770ed23b0f476c3338446f83ede97aaeb5921c64596b3507a129dfd3d8851d491e5a703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f543eb5c8109d33db14e3de5373963b4

SHA1
f79623d37022fe1fba07e6f105b12651702d8fba

SHA256
6c011805bda0423f200d8b93a101bba3075bcb7c4ad40870a22f0570c0f8db5c

SHA512
782669f634778a25c8089bb2b31401a2e53cec2afcd85636027805f0275a63f7d604fe85c91a692959ee39d949c70eed11b3cc03d4cc0b26b8375e9d4d94e462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\cb=gapi[1].js

Filesize
133KB

MD5
dbd627c28e97cc5bbe7be0c7a75e386e

SHA1
7bb367b5d18dd59a643a8bd4122b37a8a33bb9e9

SHA256
97c5e5f7f3c5a1b36449b765e533eab96dd3ee4bb806d0c42d33b2d1457958f2

SHA512
f09a05f7ea69e67124dc61acf324769c07e31bab781592988bce009e951480de0c7f310d4bdda3867f5900e91ffde031b48338552a47423d4e59622301bb354f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\platform_gapi.iframes.style.common[1].js

Filesize
54KB

MD5
f0d50a9a90ad59daa2f877eec130c234

SHA1
7d06b084efb04f3ab882d07f70bc2cf15a80aa43

SHA256
533e36742f3669952d3d943143d569f1681c0329f746f36f4364e73e0d5db5dc

SHA512
db48d8f4852f27f8f21fab0a3f6bc685099ef943e63c746a2ee3c470dbddae85f5e38f0f37e69f7eaf52839e697dc5e8082084bafe6a01eaf5864de795223517

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1538.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit