fc31a0c793f1a40e8e0d70ff7862aac867cb71c0ec265d382672c17262ba63aa

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00075004c0ccc1dfed841acda467a49e_JaffaCakes118.html
Size

27KB
MD5

00075004c0ccc1dfed841acda467a49e
SHA1

abadf47e4e38c4d9b1438301d2f4efa39da30c11
SHA256

fc31a0c793f1a40e8e0d70ff7862aac867cb71c0ec265d382672c17262ba63aa
SHA512

531155f9d8aa9f78ff30444d46b5c858298451a0abd8aff72be8271c9db933619552e5a37a479c569f4d11e2d1d7d34771045fd8b5ca5abac85278cf5475d9e4
SSDEEP

192:DmCl7vFZ7vi9TsVi7NaNedWfOKOgmvWfz1RAPWfJ6n7sCsO66WfY1/Wfu/sHLWfq:aEfa9lJd4maf67ZL6AW9YCnq/9sUFM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d7af9f5097da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420239387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAE247B1-0343-11EF-9966-EA483E0BCDAF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000054c810a42886408e5b018101d32fdaf7c998f066d527234812831ab22fab0300000000000e80000000020000200000009c6c8f704c5c0b2e2935a0b0749b8add5601db4098ddc87262bf9797eae065b520000000cfc2085ca04b5ba7f979e588e32ecc4297464faa0ae0fa3c4faf275a77d9bf8440000000523350cccff2e2358dc48a0fb8647aed4d53b9a065ff51d0623fdf63564b5b139fc72501bd584861586b57f7c9decd5a5ed719045c7197d3ed07f3ea71799382	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000037a585b1490f43dc8c52befa3721616c5ea1a76521a2a0430afcefdc5d4246f2000000000e8000000002000020000000d6ae000ef6c1aafd7b7b30ab32e954574bbad3165241381da360152820ce9c39900000003e0e9893369a43162bc3edf257bbf2ce34a46ae71c72c529a80de381b8e38d34331a9e09bc4cae763747c509494f477e3c466ec2df2395b2785a07b0a0d1f34b42ff763273a4d69b12e93afea436c60045e0c635e33700d599a2f2c0f39c984e53c63f9f5e52336d66272fde1a17a3183dcdcee69eba8b33e56b329712455e60f4ca8c417a1f9fcbd5df495292168cf140000000d94fa0cfd79654f9603bd95f504602fbf861cb916e2094142b5e66c247e47614b44348f7da9aadd9504b30bb9d2cb2107efc027d791a7f13078ca0aed61998d5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3016	2132	iexplore.exe	28
PID 2132 wrote to memory of 3016	2132	iexplore.exe	28
PID 2132 wrote to memory of 3016	2132	iexplore.exe	28
PID 2132 wrote to memory of 3016	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00075004c0ccc1dfed841acda467a49e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6113625f4626a81e793a3e2a369502b

SHA1
4295515b98220a5b89ac0a43cd649615c163ef38

SHA256
3682605321d1e7f3914e0952768499d9a6a87b2160ab9bce02b6c9788bc1692f

SHA512
bf40a67f223e1202c04cae55724a9e3c7e299dd397e198439c883f06031dc5ff8725217925bc87a11d55323017707cd323bb7534faecaf3ed7f8fe3fa49097b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79501e714ba730bec079bcc88a29aa76

SHA1
cb760978261caf2426a7aa7ff30d3cc30180458e

SHA256
ad169aed818feba59e4ffb36d16dc27a6e17cb4e409115a2410969ac942bd2ec

SHA512
cc8514f1f124bc7934fa09d7997f6c3038274cd152d2fc446593545e74240a8466181026d6b9f287f4a7009ed2ea6f99b66e59ded600ae809801fcde19f2befc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f7d7ee7eb8546a88a643bbd7fcee5a

SHA1
54fb8447a979a3943b0784b5bbb34cbcab4f7aab

SHA256
18c9e71f8ac81986dee38213e3258e6eef323cb35f0b77bf8828304769fe2fe4

SHA512
79fcdc687f16d22725329635e25e2775e55fbacd77af211d49937da98209209f578a7ac08ea12a609f93abe69f8968d75f45608deafa7e4295015f1c1151aa18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
914830112726bcd17bdcd3699014f712

SHA1
3545143b0bcb4504678d860e900e4679df8f1de2

SHA256
a4cb23d7aaa7f3719a3403ed38f6e0dcedec6c553bcf0a1b60beb340142ebb29

SHA512
b456e01373d4ad860ae753844afdbcb42d3a0190da82e49e07b4878d7f01ec52738fbe2946f0c8e5e58da40356451ce4d74893960d195d1c013156dada3ab8bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a48dd7cda137b66c1b92e49ed2617cb4

SHA1
9dc4b9618112657cc6bb72575de64b62c029162c

SHA256
6476b04c3fa8f5b2251523a8459ee80bc6f57924c3c73d1aaa9cebb6a6961203

SHA512
58e610c3c20cbe07a2fa5cb63b53e9692febe06dd6476212b76586c4365ecfda38f86eb0c0d6a97179efaf673efc09c32cdc7b06d0ff3ee40d3fdedb407c9006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da06303262b5f7184656c0a9035ce6e9

SHA1
b3b7f110a4be8f8dcf6c874efb881072890e8062

SHA256
39908ac7e92981a42de6ac71368373c8a54f505560faaf0432ab0c9b6d8f30b2

SHA512
6b2ffaa69b90db8f1ac7d6fcf3328b14fa5dd94e4f737ae32fccf8f75f1aa04de3a80843959388267e05d403bea1e382c4f72d7427e5d769459665044d9a7e4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6af286cc9801d27a567d6faa023d69f5

SHA1
1ce672fd07ca8582dcc3774c242f5962b748691e

SHA256
2a36377c93c45ef4c3417d007db0f6c7378571c54873fca26da25c6e30cc0edb

SHA512
55ef076922d66cca5dd6461ba9a3452f18e6d3146ab961a0113c10649378f327b112d3575929e299194203a3c3b4588d64187b2b1f8da736d58e7ae3a11fa41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dfae394d4bb9e2dc3c5129e96a520b6

SHA1
229649559223d78202b792fad2bff817339ad941

SHA256
9dcb8aba99ca4270dc03530de8b5201c2802325cd7ed614bb6c2dec023cc5394

SHA512
9766e1d112fe09973d4d89ee030ce8d6f47ab3ee6b6be703825fcf9eea653a6dffd10c530fd393e0fbfc8ff56ac4cc9532ac5755952ca0274c81c5615a7cdf55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ffb0e35d452ab1a43328dc282b1857

SHA1
eca745524cebd857e57d8f515e99af0cea15ea70

SHA256
8c5469f5161d65ad33ac0a1078a5d0d4db0de1ed6784dba76a3fbc1ac6a22397

SHA512
db73596595623371988ecfd462aba0d415ff1e06e3df2c7dac347a0615b067a961847ae942fa58c6a2a3451214737f9ffb50bf8e36014d3831eaba51c06d2ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
177b3eea001cf4d7375e23e410cad1f0

SHA1
2cf9a2bcdd6ed9a6d77ff8e9297dbc4167276cfb

SHA256
8405919de315753ae9b9a6f2e0533eba22b01cbfc7ab893fa50055021de0a7c5

SHA512
39b7a374fe2495daa07a0dbbdec3df946db0a333e911eca3b039ffb946ccf86c9d6fb0213a12f5e7554fd607339acff9c43b4eccfe4e58156803660e79206eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4399dc16e72ea9f6eabbc75362fe3dd3

SHA1
89d8fce1dfc43a97dbb93eef7c22a84a7950aee4

SHA256
b7e4b8fa8ea9c73e9dac97b13f200e2557ddc81d137a4172f18aedf7560192b7

SHA512
d63cf691e8a53ed55bbafac8b03b368a58d127e5ea7369204f7954d4b1a38f938b4747042fcd88cb391728e4e4409fb8ffdad49c2418a16461c2a689fad0e97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f27a5717a52589b7158e4513887961c6

SHA1
48e4d0c06e406eee2b226a75b309c0439d05ea69

SHA256
3e2ee02bf56f3586471a6878e73de36024954001029085891d8bc5507bef4d44

SHA512
801a6b28e536ccd49504b95d22d59e05b1e9a7bec144be274138067507b0588ca5b708f318827b7708d3451bf1c73cee9f4a214fc22f735b0be52dc5ba9b1490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e7bd2a04aec49e7ffc29208a6cd34b

SHA1
ab6629c440615403b62673dbd0d5452ea7b2141f

SHA256
e2bd667642796ca4d3da190385d7855de10d03726d9d79ce0c27d91870f61a1c

SHA512
839204eab8bee2174d7c0af35d2809e72aa77767beabece42e9268de1d006751e5f0586973bf37b88740fbc5db0b46c502b6a72340cc33926b99e4d52c8a2415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d8644eec8c5feb0beb2b3574846dc5

SHA1
1f511411ad0742615504f7b2534a6efefc4ad5cc

SHA256
b0a91b5ff2df72d0c8848bd44b388b74a3a21e41cc8d6ac0bcb1b0b98169f542

SHA512
26d32fe01ad7feecb6705111ef975d1f6788c70f3c2bd544f49e276f79742b0e7ac9c03ae45c8dbcba50c0f33af104537a4f3fe96020a23c8f7808578ccd9650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4272ea2cb81caf2d82cb36debcb6a35d

SHA1
1f746f938851108bcb0a266ade7cc9fbbe63ff60

SHA256
7f91e9ccbe52203bc9309bbebd7719847cf066065b6ade12c51978748ac0b6cd

SHA512
3896d7be5d2d93863967aa71d23e554784c65e2480a8964906664fbf980151a2d8290a1e5b286d84ec2c890f6c2d852fd695126c2f8fada00b10cd7f342adc35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e55fc51ab259c94325075ee832b6d696

SHA1
00e41e908413cbaccdc56936c1c65a2f666e9875

SHA256
090765457a5255f14058ac93c6837b8e1388b157766338daac68e4f464dcf6a9

SHA512
4a5c38184fd5255615207d79ca36123f81b291cc472fd23f1d7a0a341efcefd0eeca2af4f6b7cee290a4161888f741fb04878a33e23d89ea3fe786d907826bf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a651e7a992faf964558bbcb4da6c738

SHA1
c545a935acfdaa245a88c75864dab4988c395e7f

SHA256
7d3a608f46c0be26fea7fda4406f5ed8af0c7fd1967dfabb540f8b412446286a

SHA512
cf670de2eb76b55a21278efb40b660110cd58c7699ffb5acc21564029144a474b07507fcb31d1b0f9bb8926c544ac09153d3a2ce5fae6c31a805344a2683970e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41AA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit