622591b9c55fb898b87bfb53a912678d8923f17c1c272725d3b76a8ea8bf9bf0

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00402449a661f1dd8ba014ccd16bddda_JaffaCakes118.html
Size

67KB
MD5

00402449a661f1dd8ba014ccd16bddda
SHA1

186a0fcfddb5622c38c360fa4dff1f2134d3d029
SHA256

622591b9c55fb898b87bfb53a912678d8923f17c1c272725d3b76a8ea8bf9bf0
SHA512

79d0623bc9af310a7b896c15cdea94a943fe008f2ded34e01a3b4edbb79f61f31aabecdf5304fa46e5c7e2c8ceffde99173bffdf04150e49b301587dea914cd5
SSDEEP

768:JiVtgcMiR3sI2PDDnX0g6SL+OdoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:JsWV6TzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42DCB9F1-039C-11EF-922B-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f9d618a997da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c5faea32e02166d643623a56d59e97d067b48da1f8531c5b7e31b042ce4e59d5000000000e80000000020000200000002dc301d9bd55adc890a37d00eb4797bc551c23f0699a24a8eeb4e95bccd0596090000000476a9e4c1e150537a57fa9018522b652827966cde875c47e86ae0da3fb23f695191ac042eca2fc6d607044aea494da9a3b38495364c36ae833fa6e6559d778a42c0247e2a04207bb09bf129d556b660c1a720ec257a5d24173a92627ec825c31f3619796b7c834df9958c78c252f9ce9d5c67a807feb86cfaf5e81d447c682af187d9202a49efaf8569aefe98d1a865040000000fb394740bb925c05f2592e1fc810f59b8e77f08271f0ce4324b0b16c3539fec392d70c0c3e0fdc2f2cc2ea01e3b46661bbc4631f295d3131515a5c15643bc3c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000bec3e80aadff40f7c730bb8a9c3b1b2affa3c890f948fb0f3717b7fd6a63c233000000000e8000000002000020000000401da8e383c19ece6b5af6f174e252a04af5cd5e49bed03dcde2415939612c0120000000ef4f9d4ea27c52cab2581735ba98b971051851398d85161b8e653e9469cb1bb3400000000a5297acbd112603c435a807cc05d103b69fd41948ff3bc90dae697911ca7f85c11486534164a0686366111490f8b49435b58575a5665b9c2d802d3bc416008f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420277385"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2028	2400	iexplore.exe	28
PID 2400 wrote to memory of 2028	2400	iexplore.exe	28
PID 2400 wrote to memory of 2028	2400	iexplore.exe	28
PID 2400 wrote to memory of 2028	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00402449a661f1dd8ba014ccd16bddda_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a295ffe4ae45559d41919e46e423ead4

SHA1
92d6a1ff044e06daa69be42766ffb79a1817d648

SHA256
5523da7c668c6b1137b01b72f40c08c6714b563ff2f42085ed238b98c89dffea

SHA512
3f6b5ae4b8ef23e24cd8b8a055771b1f2b0ec6133753fd40d3a5bfd104aded98aa64f2db22bb822d4e44045cd3f7fbc0ded4b825fa065f62bd77093cf3b6d559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1849ef2111c4a4fb7b0d7c75084117

SHA1
2d7910167d3959a86a9310fbad111696d12d1bf4

SHA256
f20a98b5c823dc837b74340ba46dc58e0e03059d33e4e96750afa5567edfaa30

SHA512
bf497ebd216ba99c2300e02a27697ec10bd87a4baf6200cfdde44953e5d25c6738b08a26c3d5da123515c59fbb41d7dab639d21207d52177cb59accca3619b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80549a22c419e5f5ff9dd316acb5d63d

SHA1
a6cfd5238e59ff3090b8fbbf93433e854e224998

SHA256
7340aa194160f9e481e5b541fe7b9a7a66f3663476f4f3c642922a00d55d5f6f

SHA512
f600f0224b6632fdf4052e15c8884dbfb45e6c626905de523fae6575292d9fa2b6831f8b3430742fd2d9243ac148c8b03eb2188a729aa45c1c263e71afa55406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7e4fe1bdbb11a3b0b665503d8064e52

SHA1
2c9f5f447bb6eb34fc51b59c95b4b9285dc90e64

SHA256
b6375a319919a94470a704e08d76b6b03a6ff413ed726dabe874d8b77885b723

SHA512
982b190d3809115a08933216412ea0055d3d5e332edcd5f8e9b613e7d05f250f49a03e900255a2b6e097abe6f0e14a0b0b5dcda6a7309426424e3d443538ab5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
073f8e77bb920c858a0a6541b161b87f

SHA1
fceb9a4c2733aa61a95be4155061351b490eda1d

SHA256
7fa16a672eeb8655790b7216caf7e208297d0ffa72a27c39dca97fd3754223b8

SHA512
3f96b1683910393d4421da409879b28d37f0b0b72b1e894d70168f6a0b1848f673584fedd938cffecd3f582c854f35eb3aea09807964d99532247ea4a30ec837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3324f58ca6357c84e31da97dd5fc19ec

SHA1
9fabeebe9b6caf77ced82034bccb8e142f585cc2

SHA256
7daaa6c1e2d5cb70f96dca92f24115f5825fcf3145b20883703ae5628881f27a

SHA512
43eac78c9c59c1d1c2a7dcf7f129347d063e46f54d59e0cfdd5e2c7add15b64aaf754f29ab36145dbee9cbe2a0eabadce62387155a246a1413c7102fa5b6800b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b3a54c799049c9a1bf041317318d710

SHA1
c2c0957c67608192a8b6af4a851e07dc4882bfae

SHA256
42332ca07c7aac8f2dd9e1b0611af1bab83e2e1794b95964284e8805eb3e3bb2

SHA512
05f3d82406def94673c314a15240fe2b1dac44f66cc7ea5de15cd5f940a4dbb94e805fc8bbd829372c3561dd168ab0b98cb6fc636a06867bf2974bfbfadecbd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c07b3f5bb9bd66b1d94f904286a23d26

SHA1
1fbbdbb1736e806328c40f7788b055b9a48ea83c

SHA256
87407a4289121389e6c73b9543d808cea056408c5345639463eaa8559608e35d

SHA512
cf7268998cd5c9bbe1f7d0394622fa0fcb6ef80932789504a4ace0d11763e0b17d8afe6d4f6b3a463c924ba03de39d4de077cfed39ed80d88fa0fda8d6ff3b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
100cd220f351c42220534779997ab207

SHA1
384054980631506f40adb4816fcf341af11b3992

SHA256
6d289b8a48ba2fdf88a96a49b31db0371c0b80d25476a0b635e1a401fc2dabe8

SHA512
d15f1e42f39815fa9e1398047a10915ec1202481f5b8b621f492fc41d4ff1fa8ab9eaf8d7627b107196bb2dcccaaefb44b1aa6ef26e1648fdc9fb88d7d4d9786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c44fd01411f08c54367dd12821ab3c

SHA1
02b8eeeefbb6876e5cec5639e12db820377a66f1

SHA256
4f4486a5ce3b2b8ed731ff5457fba30214bfe50680a815a046b161e2c42666a7

SHA512
d7bfd6fbbf5837837a1d67ec4cd79d40245e950209c8abcc01b9eb524f8611dac2a423e1cfe8e025be6b24121ae481694a079d01c6070f848f5c5f349bad8898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b84e80b4b234b2151c396f799b9ac6f

SHA1
d817cc9396e1c852ea56e4793aad06d56edaee22

SHA256
d5b4754a5b3392d64667f8cf50e3f00d527aa7a3cc650ec9f0b7d9122e6c22b4

SHA512
633de9c65faaa13b67770416d2f4a912d5aea241e608b4e6c9c8ad61a96e75ca442173e5c712cfbf1233faca6f5a72300ed78b7f6f7db1cd09dc59087de9355e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d6f3b06d8dcc0909615f5d5400882b

SHA1
2543e40c8ed570d9990271177580a14e7880eee1

SHA256
5e781681bb29b7f0710d9cf21fb8a2f27d7fc34d525bb150864a02820aa30dab

SHA512
b2a58800a196f6651a0c0425e031d3ec5d66785bb597013320edeb87f4676411b4f87acc897b2aecfc530193e7b99fd70db4aa2fcff35d09ea5ebf11728fb4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab232D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3049.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar305E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit