f1fe82448f82a1f25d6063c1c4abb73f46a6f5d95a84cf42486cd0512bbbbcdc

Analysis

max time kernel
144s
max time network
137s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007b3ceca0207c412c455aab71154c9f_JaffaCakes118.html
Size

36KB
MD5

007b3ceca0207c412c455aab71154c9f
SHA1

93dfb3c1a6a4f72cb92195a109fe180dd51a009d
SHA256

f1fe82448f82a1f25d6063c1c4abb73f46a6f5d95a84cf42486cd0512bbbbcdc
SHA512

2dc99e0d6bffa2f57882ea66223849bb2d818beaccf51b3c8a5b0e1ce2e418e6605c33aade75611d7506765c8ce9aa3950515bd5b5166faae3b5d2ccce880ef7
SSDEEP

768:zwx/MDTHxp88hARdZPXcE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRJ:Q/HbJxNVNufSM/P8wK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420285908"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000871a288e9e54f925c7358c2f1a236f91a3826ab80cd3487ffcd7a3f825056906000000000e80000000020000200000009051d8feafedc0334493fa3a85ff772d04e2e49e137550057c9d4f70fa0ed8102000000070ee8f74ad3a578835cd035b98bc3505fcf8012d8471dd380fc997a9b4258ef740000000e501962f110ad8ec4a22fe2a5a3e08daec2172010c23ea1fdc43aaa2e7b602c2b811d755087ebf7b865c82e661fabb44e258335ac75f93a94a6eb4c710678a39	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16C66191-03B0-11EF-B33C-C2439ED6A8FF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000cde03bf42fbf922b2c2a56e5b8e9941c1970d186cefa02cab8ca6d08698e5e7c000000000e800000000200002000000026aa7a0d1ee4c6a46cbfc5eea2014fb7062ffaa8d0c9816dabfd4d61413bdc3690000000058398d1a0d6459263ede85541349371c4466bfcb889a772c48bd117f9f2af95ec124b4b215c22a7c80516c6d60b1537b37e9912b8a73871f14f7ad51cedf67585a7908991d93f89fa794cb7924fcc098241c65b1adacaf96c27c6f5da4593280dc38807be09bca81fa8f253a366be984a720ec221cae5463b633778a9f51e0fcf361135736ce320b57fbfeaf25dd0d940000000487c7b0f0e8b21fd664977978b733fc52d1e31344cde1148545020fe6a1d7ceaf1c4042be1c36f47456e483ef0ee31525f2ee968758a4b836da65136ab4063bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904006f3bc97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1708	2632	iexplore.exe	28
PID 2632 wrote to memory of 1708	2632	iexplore.exe	28
PID 2632 wrote to memory of 1708	2632	iexplore.exe	28
PID 2632 wrote to memory of 1708	2632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\007b3ceca0207c412c455aab71154c9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f8096616dcf640a952e0b56a0711c98c

SHA1
132edd6be092f20d71fa19bccfd4748af4e00394

SHA256
546da606e33b6e9fba14341249f8042de14b349bb16bd76ee9f56428dacc2645

SHA512
0e71f81b3ec51fbb142a2487117ab3b87f859512ad16dd0094890ea35d632f9d7f1306f0f3872bb34379d01aec0f5f8121135cb471c366d01c3fe90d15a80434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf90500c499be9d0a9552f92bb8a4fe

SHA1
b53077a472f8bb41ea717bad3bcb2430cff9408e

SHA256
22f741231176ef704f430028ff2e7627845d22b751aaf7c58164a21ebe96d506

SHA512
cc4b1f4af67ced3c4af6684422faea16c8244948731d2cb47220d992712f65988bef93528c116f61fa0d60ec5808a9bad80474cbd9f38a86a8223bd22ebd0988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db3e9b454926f3d59ee55562753ba35a

SHA1
10e79f9bf2763fb6c1374ec17f232bb0f757f809

SHA256
a0f71dfd9eb2b0ea02984fdd63637f57e9ecc540daf87fc1dd0f11df6301d466

SHA512
c2cfaa6c4923e4ed5392d6c7676a388fc8d5e37315aa5dec527b33277cf081a0aacf47a410c093f1bb6c68a02662b8c06c19eb6d45fc33edeff2f92789ff99ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f287f8f650709800b7e83ef9ac7edae

SHA1
e4d6997856bb58adf23c2b0aac176c00a5e1fd2e

SHA256
e59a2dcb2310baaa7c80896c7e1316e952e07aa1c13f05b58d82b360c8fd72c2

SHA512
5590f7301b89c7a7232e90f2cb08db065d8e24a1ba07401e73267350f164f667affc7b899c3491588b882976fb910dfc499ad7275c845cac8d5f17764c98a981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b754916ff8c57c24a9c65ae0505f955

SHA1
fadf5a2ac999d6012763c73586849651a08881e9

SHA256
bcf7843456d98f9b20eb3f21e989363c8c31d3129e3bb915f095e43e9df8b7b3

SHA512
cf907b653a83715f97e25c2d5efffe417b9e3bc9b23242371cccb6cbbe95fb3a356742a59bf5a98373f76bdf034475f45de28fd72425d00e9dc56fef18ea0eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fab1ad59c328c2978027c6cb959b82c

SHA1
ddc9f371b93592a56fd9dd461274ba43f8a98f74

SHA256
e307833cc781c5bc3fae697d4dbdeeb4ba2b1ba447229625d37f94a7a0897da7

SHA512
41ed63767255410afa33659a8ffefbdf97d56a4e33422c047a9b7f9fc45e813ad41dd989c21a596feba2dac0ca2bbf350a444225e1be886a2743b8a990ff1c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8983b8186fef7b5aa9fc0d26d21bef7

SHA1
0cdc1ec68fdc9141133254c282ebc98f141b9b84

SHA256
27e2e96f77b4c1bb8843c2500d3d98d4eab8f5a2902de2f8ed034c1771981787

SHA512
6ec86fb5312b5a60ed5af127130a92adef104df0f548d2844433962bead34d2696e0859b9596b5a26128f51b5d19d396889fd6d1004054c0e669f0b47ceb1477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e1641568fd7864a1a81d01ee1e8854

SHA1
475d64298eb0e23fd2bf6a0270c78f4c78f74b51

SHA256
99a7d2cc3317e43842aa1fb0c2280b821fe3c307833272536526046b5f8eec6c

SHA512
d8da840b30e0f963ad16c5557d227ee2f3d8c8d040324efdfdf1d78400a61b9248cdb5206d6b722c21d0aa0c17ea6ed852f31f44ab4cb2611990fff85bc4bfae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
144091de91bcbded0506275d74429e14

SHA1
8c6576dfa30f878883a81846142b03b461b3ec8f

SHA256
8060f6d4b91a829ccc24ac38df1ed487e466c91a6a909933e8d240fb4c157404

SHA512
3bed84c227e447eaa66218c0c10e8c322d5ae96dd04503496d48b345c776d394122ad1f753d29513ced86771df867b203ee2bc207a190dd409c1416f7f9645fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
feafe953b84bd6fb531196f40e9ae326

SHA1
c9a424c3ceacb5c771852cb6b9b5ae891fc5cd70

SHA256
f2bc70ea80dc9c67347f40c445028841d751ed781da9b79f2ed084a5c8b09c0c

SHA512
915eccf44069a5f59755e581e88e8337cc30b741b61cc3d87c1aaa691457ebecf4cd9a4b3054d2dc0a64d17dba24d7172f847022baa80d23beab7948641a1775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce1dc385bc9d795d2d86fc1ae8045f0f

SHA1
668dca2f8d07e1e241fd9ffd143dddd0ecce9248

SHA256
c2c270b57c1dedca58b30e7b912ef7362626f0d7c7826d5d2bd0f45b0f2bd6bb

SHA512
8d2da8dc3b545e3eec1bf89c7bc742f813b17edbbdd183e02c473377db9a280f89d700b5b9aff29d1e90e6bfa776c14e587e831574055038ac8b669294c802d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc700b3888c6a895ceaf5fccee58dcc4

SHA1
942e4a63fbe20c101f8f30c3aaeaec3b4dd0c050

SHA256
b40b7f06c58bc3c10ffc826c1e7d65ebeb8903e16e0af4d524ea4c375107ceb6

SHA512
1dd8846d511484a80d2f62ae56dd0ef869cf1ba33283c997e323023a9ecc44fe41f4495b625c0de254fae62cea0018c47e53ea8b0a7603a0c60028e2bc2ca68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e07187ab0a345d7535ff5dffc6eac993

SHA1
317aff757637c650c638b970da1f34ad503ed620

SHA256
590aec07034cfa2a41d8796db43a26d902925e840eafa3836cdd4e66edc39da1

SHA512
c25f3df3188742ac2bb1a7e9434b146182c54af66b6a49ca4549146c182d1c6de29d6e9bd7b05cf1420a72049324cd1f84225a04d18a81a030735502f563123f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18C0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B53.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DAB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit