2028ef36ae4af64e7533bf04acf2288c170d2fe7fdd2e5f8c24212169f323914

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe1e481b1675d31ed3a32d595615300b_JaffaCakes118.html
Size

44KB
MD5

fe1e481b1675d31ed3a32d595615300b
SHA1

57b207b88852501d59e25aeee15079414c53e118
SHA256

2028ef36ae4af64e7533bf04acf2288c170d2fe7fdd2e5f8c24212169f323914
SHA512

d02e7bfa914c100a07727a772e5f4c112ef2bd73860a3fe35f9f69999d7a78a8876aae7e5ae5270f8895a998dda2f5b1b9baaaae03cb5072bd3d136740c67dbc
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2o3selgOm4UQPCRk:mZJtpselgOx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c207178c93da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e93fdbd49f1ff1048b4cc8c51ae656800e6569f820a4938fb3a97b4ae9005471000000000e80000000020000200000007f1a9c16370b0ece40370ce8f33651898002887f46f70d095f13c90c991d15d290000000cb9432f38c4e988715620178e48520ce0fc6abdb247fe22a291ef4825dfb261babe94ed6292bc8ee610965b8d93a0ac0b5cf289614c0b3c28b4290ef8b90c417bb4428cc32ef7f04e0978d2b3928e69711015e978cc4fd0d676cef44541e4c9a2754d242209ac0a0e443e6e668f741b3b5ae43a040acd66fd7b89270e3a06f99318a031b548d940971d5811707c014ab40000000679e7b0fe51804125260f38067384ae0087f7d806df87cc37796d9926110a1403eb42d87a7dbca187837b430a375358a29aa3801055ffd7ccd7b5266b69ee8e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b64aa549d47ebb7faedad4a4463a659ee5c8a53c3fe2dec2c823c6071bb972dd000000000e80000000020000200000004b5836017350afbfc2827c35373ff414b784e403b5c66e89043758ab28d117aa20000000687b5e5c99d914a532ae24a5f7168604f93b86d1ca15e0ced2cc637b668797c040000000c428d8d5c698ec144f108bb59da9cb3490bc9a55fc7f868a625da87dadc4a83cc522eca974c0d922d2d1b7df830d29b5806998bb095a6b5e6437af0ecdc916ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F565671-FF7F-11EE-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419825039"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2272	2892	iexplore.exe	28
PID 2892 wrote to memory of 2272	2892	iexplore.exe	28
PID 2892 wrote to memory of 2272	2892	iexplore.exe	28
PID 2892 wrote to memory of 2272	2892	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe1e481b1675d31ed3a32d595615300b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff4d9b2d54e7c7df9f0b364e680c18b2

SHA1
59b731632d2447dee80f68e86c2102f8b339f84e

SHA256
8981033b1241ec87249e1e1a824d16813e16062c60784e5a3e6d91cdf6e2d85c

SHA512
3240fffe962d6980c15e99aaf2b2010d886e8e59865b471b6afe29b3fb47fe665ce9d81ff6903a8d2c25fb285405c6453041e7cd25605ae427986712b9f2a160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a43ac0aa644f03ce4ac87028db2318

SHA1
20b65bb1ac9a068ce32e917307345c8b8cc0aadb

SHA256
56188ad447e1ec20485ba157dbf01212017b1019e1c5f9977f6f8e6b6748a756

SHA512
ec1dcc2c2a97b404da6593478bed6313a6d371395f96d391ca4711fd31e50b835bd3abf162b802bb29c5a4ea5adfb92d5a0ee358158629b3d552aea3d30670ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b245ad2b2f3a9a508b6e4b421e9f68

SHA1
855448f35267a6dda1a5d64309e2bfec2d5df077

SHA256
a33c8b46d2ff9237ed2bc97af83e0479cac908a3467087f3cd4cb45568fe9243

SHA512
f8b31e190bdff7e7d44684f225ab6ac77146fc38b8f17e1d6cde61dc612a33bf54a0701724a92c23acc643253ff1dfac3721a14f8f797f009bf76a4f4327cb68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea6010845d06c2855d1e3679be0614ec

SHA1
c7af32541d6a6718a47ae615da1475ea08d003b0

SHA256
b40b6073b9677a14dcdfe751283e214f6b9a88bd41737524dd6c172c3cfb64be

SHA512
635c10660b4e4f9a786b152765fe7a0d6666d08ce01b3ca0e629aaca9a7c8c8d2b21203014051b02c9759e5f63a0749c5a4a1663edcf3b747884556dc5385dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2854d9a975172cb11b3fe2328b5ab6f

SHA1
44583373cb4e9dc67f446ea913364dc0c99af570

SHA256
2e3469b6a8442ac6f90c3796f8f1e12ed91b67ebfba3768f9f89d0ec750917ae

SHA512
e898e862582821b5592bd3f24d66511259386ad7f54d528cfc87874cfaa9fd4b1af8ea97f53d48d898009107445033536ddd23a8a8f4fcff3295d6d7a0e50ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
004902e30819b00dc9507216fb2b0f49

SHA1
bc1a2d45b33e2ac18d2dee64e3e92f4d064ef62c

SHA256
b61e978860ffc526c97291ee0db391fc02dc3f70f3cfaadb24837a95d0682eb7

SHA512
7ca156f39d11900c55821d80d49ddf001e364c8c4183c27aed311722e685bbc8053133134dd5fd8befa4a639c692ea4830d1a100c52709c399e84c087fda9855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62257900ae19a91d67e551b2fa0134fb

SHA1
b5213afd86362b637b6281eb6c0d4302cc0db0ce

SHA256
0b1727770fda74f2f7939b5e1bba42e43b5d874a203c4095f1dd92424645381e

SHA512
cd9ed882d5331aae060afd4908e4a1c9701f7e95d1ee92dcdf05bf782e3119e85effd3d641dd550aced969ec71f56910126cedb834cc4f9d580e1670420048ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5810ab04497a64e44d147043ac4b8eff

SHA1
376d916e4be32c840c4115cf0260330b3ed6c8e5

SHA256
6c5f872017fee1c70c71aae90208d333b28295370582a4c018be6959f67c899e

SHA512
20e08f4010e72e691f2bb0e17dcb304c31486da623f12796b8fdd00f2dfd671c341bfccad6de0d2997c77833549c6b8fb12c4ede2673519874cb4663bfd8ec18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a93ea3d3242f0ab26054fed1be5c0a2

SHA1
258ec0629a6f2eb08b8ec6cfac07560a355e1a64

SHA256
e9ec2e6bf155aa94a85ad349f319409ef59fc4a3158d22e56f7685855bf43873

SHA512
a85ae8f23e7c2dfadbb6e7c3eb14a0a09ec9ffa60d6e6b7e954bd7ee27eb934b656105cef50af31720c81818591904d1258c0d914c06924a4e9abe4b0435246c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a747f7d7e92afcee689004cd6f5a847d

SHA1
1fb317ee4ae6f291235e1537df0a3561489684e9

SHA256
f822a80ae51ea90cae108590643a94dfb6f4921799d0d417eecb489f12d5cc4f

SHA512
901754cb650310e6963cdfcfe672005d559e5045dada6629de4e4020afbc31732ef39d048b6eef3ba86284f5043546b8330b6f53e0f6036eac9da4a6f775676e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f518bb70bbe7a367a086c8634495bfd

SHA1
c813815ea1af73d897dcd726e0199a32e82a4f8d

SHA256
cccdabe5aac96f9ba6bb80c76fb8dd0ef4c990d3e47c9ca8024c936cbfbdffba

SHA512
b6683bcf77ce333d7332e789707150cd3e65ba3af829a1a67cb1149b52395804f8bd9d787d4f0463790b2f9930ee874e40b10b060c3147a853ac4ba17e5ec559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4357e3ecdc6f6e7559b9cf0708e70af

SHA1
0f58216a97f4b95daa1cb3d5c365680c9703569d

SHA256
045ea4ed29a425f80e5e8d6aaaed165a4fbf68b20b4304b7d31c8389f45045d6

SHA512
395f8dffc3369f9cdf6a0ee76ca8c279e08596d1bd5e651de0f2675679a2f523a04ee5943dbd5be0e26452f054108301907c9f5d84a12da780242b60f9dd2b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f5a8cd071f3ccd71049a6017294c73d

SHA1
cf310e5e22d1813d68c2e8346e24a793925ad398

SHA256
4a27213ed434b9e96ca4773e866618d2304bb8890c6c3f6488e3043e5c9b713e

SHA512
c3a58f25bc89d1a6072f53e4b0c14e7a21da4adbc8455b0fad227e052f3154d846d1fa9c81a813ed65a2e1fd60dff7298115df60d1d29b73b0c828f50c08f8e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdd42cd458b9d1e89a63700eeb3c2c46

SHA1
3339cb7da6830c43e1cb5a5efe6616920ce4be21

SHA256
9141f2f2eea00b1d93bcc80a106389fdcbbb71b0c9a1266dd4800da4f5e8f64f

SHA512
0f4f459b77952d98306e7057cfdcca32de818f3bb44d1fb3ca892f011486c8d46fb5b332a426be83a1e1f074f8fd3b8f81974cf8c55ae9913481fa910f355b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AC2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit