8841b24183fef11027ccf007b10d8cda99135931bd7379e51f78967259eccabe

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004dbca3fe23cab9d6ec8b2a83147fb7_JaffaCakes118.html
Size

233KB
MD5

004dbca3fe23cab9d6ec8b2a83147fb7
SHA1

0ade03734e7f638a91465865fdcf3b7e01f77c50
SHA256

8841b24183fef11027ccf007b10d8cda99135931bd7379e51f78967259eccabe
SHA512

7855e9f6bbeccad2ec3e68c84adaddde8e120deade5f463b983e715e1735229778c6989eba6c0d808949e0efab08afb18c02fc81ba1675bd999939f83ce417c5
SSDEEP

3072:S/yfkMY+BES09JXAnyrZalI+YAf+yfkMY+BES09JXAnyrZalI+YQ:SKsMYod+X3oI+YMbsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8075f39fad97da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420279330"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB61BE71-03A0-11EF-A7F1-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000274fb67b1e9dceb4047b5bd796762f294ac9a30f8e4397afc004595e60750706000000000e8000000002000020000000884f106726d810313a1fe1b4f937b2ea0cc521441f6b63c1cce7760175b6869b200000003641beadbce6575a4117ba5b0d0ff25c8d62015340a2580b0590b99c443d4faf400000002cc13ec28d6870780202ad27c4ca828379cccbaca6fb0c3339f81a64125fdc7141876e3705fff55d761586e510bb1b065e67653b46c1498a4f5239c99d2d8743	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000032481b35e5a138ab9278c0c5bb2ac8a51743563623446691f3582f1d2057060d000000000e8000000002000020000000acd99cb7b8d4b0d64edae622a844b35e4e75c2fde10ab14661eccb8a800ca39b900000005b1d0f71cb5377315cc8fd35126defd137e2b0755f2700811fd7e5724b19cc41040ef37cf6a2ce4ef392d1ab4eb3017527208b5c4b518c5bc07ecc1717e571380b23bf78066f62f33f878f3053d12d2aeaf036cc45277a2acb996ff9868748e12c883f9ffaaabb656a1a2e0ec538d7cc5064f3dc7e11e75d50b04245865b40add415511d1acfb336588c6cb7424371d540000000baa21b5a9ec50f3458c94a02c6b568ede0b2a15023d4af6adcd5ff5273d51242425f8498c2498e097d51581df3bf1c84681dc7eb99a7c19038b47f8811b70da4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2340	2372	iexplore.exe	28
PID 2372 wrote to memory of 2340	2372	iexplore.exe	28
PID 2372 wrote to memory of 2340	2372	iexplore.exe	28
PID 2372 wrote to memory of 2340	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\004dbca3fe23cab9d6ec8b2a83147fb7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf440329b6b3c7bbb1d6c46b2d1f1910

SHA1
08e8fd35aa43a50077c9cd2b75d1109e4c885dc7

SHA256
091ba121425fd52927cb22679c513196f83d46d5242c44e6193f5dc16fb76ce5

SHA512
2c636cf130e2f028efde061acbc2fd7fc047a102f722e3fee4a91251263009dc9502f9ee2f64131332a935bdbc99093d7c2415c4824578bb717dfafd79e04d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
424796371486cb306cbe95aeb94b05b7

SHA1
d942f42fb94130ec2d6a433bbd1ade1f62edbb6b

SHA256
7d9408b789a9dcec0bd89efe628eb5c23bee3eb46dc559652cc6f640600506d8

SHA512
137fe33327e1ab6734c2e972f9c01bfd0eb43a56f11a18f09b758593eacbe637ad49da2e3611f0fcd41655bf1a5169ccd9d909d4157e646e3cd35cc31265d454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f5131eb2757c2e0b3c864c918f54b69

SHA1
be963cbe1f821871d99c1f583dce57e51ae15234

SHA256
2fabd554f7d008679ee71da3ab58ddc919a20e60f23bdc7b020e34682dd85337

SHA512
c8523e5764c546ef719c6afb056ec531d334291e684a6c67ca38b854643d91afb28b72511d1409ab0e47121dc1217a72bf4e2385e356e9ab155bc0513aa7d4c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4249b78227f3c5d0a13d7f2e3b83d058

SHA1
281e0c5071b715ecd67aaacbfb9606d3b382710b

SHA256
d1419fa931d4663916bbeb0b0854d84cf7b269362c2b706cb26edb4ad22adfa1

SHA512
fdc938e28e2cb1d6a6a82d536e58a11168c99e2c6ce8fd3b6da28459c247fdf112424fdb9b15e951ee92629b4ed328e4077a8d91230eb00f647dd30a09fd84b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5014757969d604f1c8da0c048357a6a9

SHA1
aae9944e77110cdb4a6050be30d693404f278078

SHA256
a662d9d3573682fbaf94f285976327d180a16035e0523e310b9820b1e30e50c6

SHA512
e56e644d3df40461b2ca96222d5d1868adda0427bba95c85504ee1ad1162eb305b9e5b49aadda408811009fa97b30b3c7df15d76b777db78a42cc0432c2dab3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f88d7bd286155d88991d85ec71b9954

SHA1
415316b34b76bde61f7579686aaebb4eaf824e21

SHA256
82f53b9bfaf5395188700c7dcc1830c08e437cc3fe64660ff02121ef5a57972f

SHA512
946bfdcb620400bdc99e35a7a1eec73b57144d2b952d185fc257bd1f81748067ba5d754358fdba42a2694dd318e98c88c8a3e52cc7cc720aabe3432e52f0a81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0554472d34cb31d43bd4ad27c68faab5

SHA1
5527413cc9e7f4c481e087556150fd9c573c4e60

SHA256
83d0efefc2427dedb9c1a1d18565dcfc079edc10ee551aa77035259389ad8c10

SHA512
b0256eb06e06c0b499b3185e662c5f70d3932852ecfe4ef440cdad7213445eb2784d357c08a4fe6e116780f1061e94035da84ad09dbd77c75bd0542cf16ee741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7bc04509c1a125490397359ab5ee1c1

SHA1
634a6532bb02929e1fbc96c305e6fe3ccf05e2f7

SHA256
3a3cb4a449c0645615d5f68d4101d853d3f9c24238668fcc388d15cd5269a17c

SHA512
b18f09eaee6e836e06f6ced8a9c5e8a855964ee60574d1a74b7747a4fef96435f3b439a3af420d305996bd02b30cb35835462f4e90f6dff10d34f0008729b8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eba7a437d0f29351a92c7aade8f525ac

SHA1
670e61b8a54b30a1bbbdf11015e2af255a61075d

SHA256
6d72792be49be6f80071e9857cd8c06a6ff9409d42ccc8dd586331cf0159a1d7

SHA512
e317e3ffb96f8f0cdd07bbc4ccb331ca5b81e0ac8c4a3ebfaa33164843b3544fda6b5e8b1af080135eaf4b2acf73d0ccb6ef5ab96a56c1f7d2622c2d3e5bd268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d951310508141b5a321a116e78d648d0

SHA1
cabea1959fc047291a8825aba032b16c86ccc338

SHA256
d552f812969af5ffa312cb4680e314b86fc5a1747820b2b28695dd2aa250df50

SHA512
334954b9710ec8f958237c6ef72be70ebb152912392ba7bb599080d5c29303904c73f823a4760fe474017eb19695bf7b721627629d63eb0453a994e8293aaa66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ffa70bd3d3585011d89f0d968822ddb

SHA1
b9e2894a45cd58c7c3be8e5595ebab22262c7621

SHA256
b3b30441763493e7233f0bb6b537fae51e6ad0986858882826b021556cdcb7e0

SHA512
fbcd3fc308bbe29079ff935cd08dc72065634a35f79700c698efa1d19514abb30510b9be4da934fccde71a547c7b26bed5a92034d2d13da5c1f3f7f47d927f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df151a578b1bee6f063e2fa3902230b

SHA1
14b0973880efcff78ed3f963db8c3ccf4575483d

SHA256
bbd155c73bd7b4a7c0e5906dd324b22b16791692e9f005eb1245587d7b30a2dc

SHA512
8cca852e3ce33f70cd07f063912ac1b4baeda532551313268d760ea540da22b548d472c3f46334e9fed72d1a33188a224c2528d6bae7300ccf4a6468d2230371

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab283B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D32.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit