6ba829daf0e107b6ffc4b215bcdffa18b077d6dca8ccf4fa495ba8584c017bd3

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

005cfadee950ed588aa30354cc7fac8e_JaffaCakes118.html
Size

460KB
MD5

005cfadee950ed588aa30354cc7fac8e
SHA1

19234c95fd59ccc1bae68c52146c4906d4ed68f9
SHA256

6ba829daf0e107b6ffc4b215bcdffa18b077d6dca8ccf4fa495ba8584c017bd3
SHA512

485c5559b30169d3bce89b0ceb31e955ef30343b0fcd002d41dd990b690a984ce0e1ad6db3bd296e559f477d6eadcc10d55f507f28ff3e93cc4516f90d5d820c
SSDEEP

6144:S6sMYod+X3oI+Y1sMYod+X3oI+YZsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3r5d+X3/5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{192D7A41-03A6-11EF-83C2-E25BC60B6402} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000002ef288396f070f5b8b23418223d3a5d0941661ad94ca8b3f64984c29a69dc1f5000000000e80000000020000200000006c7d11b2f6a42b5cebd7c0114472a7560e77b6e4592fd70737fe436c54683ef420000000ebcc4971f60bce6fb2f131add2cb431984b41f3eca2438f09e049845d111990c40000000e4cfbfa43d93f40126c715a81029be6355d08cca545502c6336be742c17fafc60346541586723e22651ed57c1ec48dfc629d067e9d1aee03cd543c27c9b9fa94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420281613"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000004fb4161099fe3ff0e9e43cf48cd0cd370000e71b51e12e8ac9336c6e7dd14014000000000e8000000002000020000000b6572c8be3df697613fb1332fab7325d22df3fde6bade019e245e124e85e1ab290000000e97f6c2c37a669f5d0a4c316d764db1c3929316acf91bfdb80781d681f33f79f086ad3d36580f60c7840aaa39d6cf3ea9710791206ea21df28e7a9db6f02c3f6e4c6908177e84e125818a978e3012116079f4bbb2ac76f26af17a8852246ecf1e14d11ab4463ebd9a3ef86f9a5f89680c110cfaf33735995b02c99fb2aa0d97a51317b3a06ab656e1c1bd5e1e15c9b9e4000000018b3c00d8c53098001855e66c5c7763f582a137f5220692bd15b053396cb1b0193219af53138be41463efcb341c851b19a4eb0116e2e9ee59bf6e61eb2d54e7c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c7c6f1b297da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2308	2156	iexplore.exe	28
PID 2156 wrote to memory of 2308	2156	iexplore.exe	28
PID 2156 wrote to memory of 2308	2156	iexplore.exe	28
PID 2156 wrote to memory of 2308	2156	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\005cfadee950ed588aa30354cc7fac8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43c2cb1f1048d93c0bbda69e9fc593e5

SHA1
6545e0f7978cf72512922c707990532bca455aa1

SHA256
1bb6d59646ba98f75fb4b1e9f44c84149af251141c4865b91727d3e581cf07cb

SHA512
17772ea5b452566323df2c3c6aefb748d6a8200da6ac79eb0065c8dcba8d7ada7f6274672d75b479ff3ac22ef90d062910c909751af60d337414371c6146832e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7165d3433d8727268210bccb7618c88

SHA1
0c09f535577e3bf32ce90f4d81c0b233cc884bb4

SHA256
fa7c8f524fc7e2ca2ea99ca49397389a3963676f71399ad9fd98c9840313ff03

SHA512
ffc4d942eb5f99bbd4d296abdcc35d1b97da8e6d7fefe607eead1cd3e058790fa096c391b175298a0698cfd6cd45aba26c9cabf8e65175b945567ccf01f0bb6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d244aef8207c41475f60b40a961f63fc

SHA1
184a138cea7ba7ba9087b3afc55ceaaf9a158cb6

SHA256
0b9ab7d243057f30a787ade835b3ebbd9d542ffcdc599024a8b69f973979bff9

SHA512
e6cc02a16cf39c2bcf93594c2eff503f5de40ac661c645ffc49087c1fc031ada588dc24e7eb95eb58665a71e2df428269f9150c697bf3640e518f930cb46e82d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be0f70a44384b2e18dc9d4e4326a064e

SHA1
1cc9bbdfd1be534fca143c13351d87d9b477cee1

SHA256
34c6ee3c55d0481fecea469e0f48e6a9b99e29525442b09eb9833e8fdffd806c

SHA512
a3242988b32b52544fb9b9d5e37c8adadf071a1bb92b8af874c620af266e48c8a7b96a3693f3070e9bfedaffa306432a24d1332959a6f428ee3a2747f0cf70c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
248a9e2926e6ec50ee119f3de80d626a

SHA1
885572ffa22350f0da93e6272e39e2da487bfd57

SHA256
35405a4b4c11010f99f3684b925f95a7aaa57eb78f25d0b3857bc32fcfde753f

SHA512
d62adbf00bab6c50175c2258fa2b75788a8b2c4c1ed962603489fec674191798cb969190f4f393eef8c96f6543377a6e34c9900f895d140b1b142c9178f8c243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98cf02afadf8a5e387b8ebc7f6c56d0c

SHA1
7da1c5c0ed84d451c39a8fca12c3fc36b714f92a

SHA256
eea09690340efe6e30d182beae940eaddef06ee779703e1dab3d8f07ec83dde0

SHA512
45980f92eb5e0cf0994bc9dca02b038025026491469040230d3429e1ccd103e9d2befd6d57c5164fe22e8519b95eb3c4f00d277ca674073074d3f8058a384c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29b481e54faa7bb38ca1a577ee99638a

SHA1
c34bafa35e33057ef8f994101ca5f76a538c5926

SHA256
94f94cc3b988fef76a2756c01cfb47f4d8624dbda4acd71a8280763e548a480f

SHA512
73b950420f082f953672c1cff3833b768ba977ab275571b2c1938ea2138b16dc53163e9c9afea03de527eaada6508484e00a60931ae28f03d4ae2a1b846a1518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d2d330e4d4a1f195e5a2e71b85f1ad

SHA1
d510d2630d687136d8c249962778015b87220ed9

SHA256
e6bbe5e3e992b9e830485c4daf8ec9acf8d76007a23f87e26c6c2d3b4c1d6445

SHA512
101441b7ccd0218be17a8532157ce68ef0988da76fe8451a4dd1d889a9f2de427d6d8b959324ff3c5345929905e2cf490c12af92c0a15d48d7faae9ede4cf139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd553ed8aa0d3ae9097c7e4988a435da

SHA1
12c01c1148e39583ca23a0fbf59d76fcf74212e2

SHA256
352daca927a54fb707074fb8c22c9c1db5a795ec30dd592a87c1fb3ed80fc50f

SHA512
1e3bd5033c777ae637c8d08df2e069b82aafd22311f3ea373d3d9659d662452c0b76195c91b2d71b024148af0f028c0b1ef80be0ab95f953e0fb19975310e072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0e613ffa430197a6697161065b23c7e

SHA1
64cd084fb4ce7f7164d562b1df42989d0283698b

SHA256
4f55395cc415f97446ee1494eafea0060ee3d51a1f21ecbd12dbcab18a4b0433

SHA512
b6cd00e33dd4dee7169f887a0f3814f2d712e5f3d7702a97b6bba1bd61223fb398b54c91efa09c10a7dbdd77193b016708ec865171ca0afd40df822627e743fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2daae436c6eb2ba6f4d6209be19a954b

SHA1
86db3f4f0b88e708a60ada83bdf383d663226bde

SHA256
4f19b725831177f4b04a31b8df66e1b73485efc2c58d438ebc2fd7db83a263f2

SHA512
01edbb78d6d870cc42a5e546b2bac82c99205c915af554be789b20d44ca0875431db8e05eaa816fb7277d191d6fefb7a6b8cf2608b40c712b7858f7ae410198b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb0422a9d74b34aedd7b165603f48d44

SHA1
26d01a3f230341bfabf086d9ac71c909ae7fd907

SHA256
662d83245ee0b6d473857541c49d849890d0229732a3d012c4582901c5b57b00

SHA512
91e3d8bbf1d123fb90a4e8932dcda40e8eb93e6c3d13fb54a178314bcbffa19e2123192f49ab315fa92ecac4713d908beeeeaa004c8e31005b92c9a704ab24d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc87959c603de4bc1162d2cde58da891

SHA1
1be3ddf12c1ce948b0f22962dba262bc46734fc0

SHA256
fdfbd6ff35d06369044d8e1dc9fc03671e0ce86d6676e96174b0daeeeff97810

SHA512
878f213eae980a7d7fc7519252228e4df8feb566310c7e1c16d20800cdbd473eec027a5405fa237e7c76be45e030276a4fed7ad454690b2f7f5115c22e456095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5591.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5693.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit