74930f630ff8528d83a73ede10b5f5fe9d8b02969605e94a2d1628ce6630d576

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

005250a9b298f82d6d9132cdea5ee8d9_JaffaCakes118.html
Size

48KB
MD5

005250a9b298f82d6d9132cdea5ee8d9
SHA1

19471561ec2fd45377fc035768cd814f4388a7e2
SHA256

74930f630ff8528d83a73ede10b5f5fe9d8b02969605e94a2d1628ce6630d576
SHA512

842407e40ed7f75ea856ee5e3cbf585b4f9f1a20bd0b2c895af05038a3c60785292ce66e290606700f4b721bc69d97c290da3aabb5de122139bf4c906bb43b55
SSDEEP

768:egOriWNcaSoagG0b6X20AJhFkKo3Oe20Ai+KMtUiW29Ni:J/Cb6X20A020AzKMtUig

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c11163af97da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420280083"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000fe88ba3e4a19afda73b459429dd4e12060b2b4ff6261bf68c2f0715122d58964000000000e8000000002000020000000f0ebb51685a4fab9f65363e8a3a2385de8dd71630a159890a47d52f0781ca64b90000000573311614bfab7f9f2f3c040e8914fb599dcc960c6acc9750a682abf76b1ec41efa1fb75b7f74d4ee38146646f0c17aa67aa0ee82daa948e09630c1fb3e1469b866fbd5e846439f3d8178ee1a1c63861f57b432b38dfcc8623dd14b6e8b3bbb1f1cca70f1f1a1f89d229bcefc4f126712d63c2f48fb1732f8fe945838f1844c1c435583dcad2f1faed131e87213589de400000000f6cbb893d1023bb32969e316a2c8d0864ed0503a47bf4f4ece0111393c91e813fe6df10a66fd3eae4c4415d53fe254475eb57bc7e70cfa2ff9c8240c6e87550	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000740ef0c5b35eb27d264fc30287a419ff8a1d04fa65a0c856ec7da95607f68ce1000000000e8000000002000020000000d2f355a21de19c2115c9e74e611612e2d1e3ed3a1e0ef92ccaf5a74d36f2ad5020000000898524dfc1dbcf0e4bbeec37d6dd040caa7e9f44afe93cdc974feb8c69cb1c0f4000000025dc33297ab67780e85816e3a8bb24cc368170ca258c4e0c852c0faaabdcac6d9292557a8abd48ee107865bf01b2ed1f350ddcc2b6c04912c5b71c1686ff18f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8ACBEBE1-03A2-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2164	2172	iexplore.exe	28
PID 2172 wrote to memory of 2164	2172	iexplore.exe	28
PID 2172 wrote to memory of 2164	2172	iexplore.exe	28
PID 2172 wrote to memory of 2164	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\005250a9b298f82d6d9132cdea5ee8d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
62157377b2466befda9ec988b5e1a19e

SHA1
fc3905dc5147971391252d875ae2c38cdc67dfdd

SHA256
5ef7675df551d2cc5b627da581d2393fea05a6117c87c430e74caa70c713f0e5

SHA512
fedf0a40d603f987e172ef8856f1ce73b7e853fa34276e6fb6b44cb92f00f23a97ab9399f5cec8205c1f6cb814af730e2b35cb688e404316fb4e82d080f9714e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d6dcff199f930d7d45e3831e488124fa

SHA1
d9697b38d9b78a77bb8e9bcfa75387b697c4fa50

SHA256
7b12b4ed9624e0c971ba4a5dca0ce8c1a934e9c5e76d23e862412cf116fb9e1c

SHA512
1192c2d32b7400fc42fa595b4627828c2a84b5ab6ae71720ce40007b7dbd547a82973763fe71338068ca09bdd4674f6d9be730735f55e06c1f2de066db051266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e769515eae18c02a27aaee934fc8cbe6

SHA1
f4bf4fd2d4228e03848d80501fed940ef8bad4d1

SHA256
127a82edb48e27e9201e113cfe0e7c54a22b13d05e96ee474ada9fef21ef0dad

SHA512
5bd4119c3d37a45ed2e783aa29cff5cb62ef8094281142d0799af8c52e644e4afc2380fb00844df6264121e78bc6c6db59f6957735e02cb6689edc3b7772ee76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06c336c61b0c83679f49bf0a653aedaa

SHA1
2bca735c97ce38d82b523ef6ece94453eee047f2

SHA256
bc327a790a4510dc3e2dc05e3bb6d28ad6766ed66798555f7b2256481dc53d63

SHA512
5d93a51196f38c94d14d6420eefd08cd064da0fac7a4a705c17b3ce029e8046332b09e3c57eacda788034e920bb01a570eeabcca31680952697f980262e4b33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b55037045c35af05d8361748b68f15

SHA1
eb09a7113b6ccab824acdc9c6463378b384dbced

SHA256
e08865122c6ab7d2ebb6748de02854a01f0ea9b432b64fe976b909e4b597b4ad

SHA512
471b0fde55cbaab141d8ebdf93f67704ea501c3729ea622b6a7ce1a09506d25d2aad232bee3ca20affffe4999f7c9a5bb3f9a7872639615af374b7872f752cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f300431a29b7a869a049e8ba3d31dc90

SHA1
30680ba6c115fda2ccd497bca34dc0c64327b6fd

SHA256
73e2d0ec28a04a0dd02c662bb1fc089d0e4467f9364ec8f65f479b8ea0aaafa8

SHA512
eba3e4c480c4902622a11c63afffe2b39f07c4890ef856155766648b8fb3959d9839b368b772ae73167fea76bae81746419b5d7117ea80ce468cac30d70bd942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0705bdf83fe4ba5dfa658525a09e7654

SHA1
e326039ab1acaf1bf2679289f5656a97cbf6d73c

SHA256
9fcf2fe13efe7bc50f0445446bf09edc636e36397610a2703561420bd5892600

SHA512
1bccf9c0f654e83b2cdfc1afc0d4bbbc00d81667ca7af67a657799f39007afea1030c167aded355e192871c6f3b4763da2b1e2a6766604a65f1fcfbf7d614b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a675ad9d820301ad2054246caff5e7

SHA1
20509ba1327b16b294d03956722d83cc94952923

SHA256
e18e4b83a7d0058af7721d7266f3bc6dac46b3293599aa33149e9dde65486045

SHA512
e5f12bf924d465a0f88157ccf0a4ae3d9825d770c6df84e96e8e2ab2d3865271ba742cd2d03941b19b51dcf3f952bc5c1be609eeba26d942c8d5328652efe0d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3889ce7684049fd2fd9c4da571fbc275

SHA1
ca39d262784a340c55129dbe3a510826be6bbb00

SHA256
4737f0f74f29adc6cd40236329c4a89efd686bde071e82c7ae3f6e9b82870548

SHA512
466c349f61a25bbeecba27a14534b9213b57d80971e5ecfd3d7ee5d33ce33bb3a09031b8813302f8434f7b49a483dcc1468f3c4adc5dd693bf9ab2ddf91e7c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3f810b39c3029baed556d71d5866307

SHA1
c8c51348168cd3f4b9cdf22bed5e2641ea547fff

SHA256
01940941a8a1a9e18e3ea3339cae136d030931b6eb838e99349d2ec1e51b7d38

SHA512
b5cbfd04d5f25770eb40287070f1dea20024aa974b9ccd8ae1395cf750f1c5a7c153a7c2e5ce74fc1544f38450e6b3e3c6d4e0902c6d2f9335c5a2b4e3879e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
bceb365da92de5f97369b6df3a1a2d05

SHA1
9e822b11ee0d3287903004877fdeee02bbdc3f9b

SHA256
ee44fde2b743a778c37700958f588b97f470a74c0c4e0d9af01fa6975d33d334

SHA512
bb5d1e5546e9790dbc1b7c041f8a1c22aa6eba1958ca187cadb8eae0e5d6690deb9a41fa2c29e4640b6a825154b1a5d7430148b21aab79f8ddfd0c9124c72264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
416c86d2d62e0c0a58519d413dfb2dd2

SHA1
5a078344da5ebeb1d93a0a60b7809773bd98712e

SHA256
6aeaf3d517a684f55160296631573f5bcab9cff62c456f67cd22f6a2b475180b

SHA512
84742bc8d2243548874812fc840a855a08e0bdce7e00493ebbac1a207d3ca9703d51e3173cc57ecb28d61ee58c61d6a386ad3cfaeb38c5b4f79d6370174644fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e414b45b103b79ff7ff73fffa2ad6729

SHA1
a507c769879424321b38099c153c6b1932af1759

SHA256
f27a21a3084e19399ffc3350e0045385f42e1d6285925994f14cb6481a0d7218

SHA512
cc27a105f23444287b14309e24f123eeb8ae6f0ad3c98b5ae58053c11f407d966bb7b2f268fba93ee10a9f5801e5bf492c7556d503195416e4bfe2a8cdece31a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC054.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC164.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit