0597efce6a9c9b4a7cf8a86319672278f712dffa77e74080121733ab315330ed

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01436dc6cdc119b652201a9543da9ed1_JaffaCakes118.html
Size

54KB
MD5

01436dc6cdc119b652201a9543da9ed1
SHA1

4ed32242e45665f2eff45d30d7996fbc6b911450
SHA256

0597efce6a9c9b4a7cf8a86319672278f712dffa77e74080121733ab315330ed
SHA512

e9c242812856fe41feff7f02527528edbb9fd4ddd92b61bb7b182d5bd234e88a3bc4b0c017e7db14f3b9da18efc4905a0ce9c00abc313a73722f1abf773c22a6
SSDEEP

768:SvpIYR49z3ZNhGERUH/K/mXA/ahcKX2UBMozTEhxT2963GoHhu8G/7+LVbmIGYH:S+l9bfD0xXAd+BTEhxiSGoHY9obmIGs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000020041814b6267de5bae3aeb41f7f8f1e02be1a1b02bef3fc8bf527892b43457d000000000e800000000200002000000011b026e5bbd5ee46ce031e515811508207428aeb40dda3be1c19df315039520f200000004f3be0ea135b5c3bf56d5f64e8c019ebfeb61a3468632641fb13cc18f79ead3140000000342ab93bc08e70b7312273f6243640e449d30850bce188f7449ad306676bfa96fe639b9c0df2def9fc08b2c452e30c8a04aa4767e97367ad86de431e6f4b05b3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000da83a97fe81a7adc891d2a0cea12b43c35a1e5183ba0355adae2981452b0eb1b000000000e8000000002000020000000ee82b4531f396969c5a78a31a61564941af8696219026524f3fcb0ff22c773a190000000856caaa3789239fd773e6b78d1fa119637256c5a78930edc3a7c71320efc822d61222bb508b329b110e0cec0deecf1b90dc65390d487f042ddaa7b8c605f3db9e5cafbb8c2b432c632511816b3a1959f288b1183a3c7b6ab0c11fe485c79881dd90db1dddec549e09de9628b638ec730a31a3d9281cf4c190ba5bacfac7939d338f3a47bf893747a26b73856411c23c340000000b75aa2ecc5610e0df377524b70dca02ecb62615f3016b0a4038af921dafe411d53940f915de9e30605df8ac9b4e18cfa53bba9c7c6a71cca767263408199aeb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC805A71-03F0-11EF-AB14-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ac1a6ffd97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420313636"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2328	1972	iexplore.exe	28
PID 1972 wrote to memory of 2328	1972	iexplore.exe	28
PID 1972 wrote to memory of 2328	1972	iexplore.exe	28
PID 1972 wrote to memory of 2328	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01436dc6cdc119b652201a9543da9ed1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514390198a6ca13e6f8aeaa97b855a45

SHA1
87afe7044e055a06f5f5abb6394916aa7e066b40

SHA256
7d703e2c1092dbcf862911302c775eb2b0cbce0610402538e46586f36541a0c2

SHA512
07bf3ec3f6ea6a66a25a02f665ce77bbcecdca1cedda4bd9a602f2bc2b98ee6eb5e3137fffeeacf4844a0941a7a6f28fbd06f88ed4dd758753814fba3f851a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ce8bf8a24a2615e1164d5e92068574f

SHA1
cabe01c0b57793d10a4a1c4d70d7a70ebaf49fd2

SHA256
8dee0b4c564b4ede3c41b4d12b36330e48510dd14d1a8a616b5963ad6147807b

SHA512
06c224d4db850006c5c91a1449a2ca272a7421e3b668ae1b446ad9e91523b5487545fe41e08ab8dcd1077411ce4e7dcb4868109cd6e149b5f30441fad51e350f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c98701ec8226f4fc48abe63435f81eb

SHA1
f7784d7854ce6c29a6aa9ddf2e0a3bdbb0dfdfcd

SHA256
e8d1ddfe3e31d946ccf1f4f1e0cb7048efa51d81eb9f20c2a0bb97bf56f85930

SHA512
d8c8f86a866ef0cc05363d9732cf29a41584d899e3fa871bc4860c95350f71d54b3859e60462382fd20a36f877882acb02059ed67410ce87b8b293268ce1a3c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2826f870ca0126dfa98db53d9a526c

SHA1
9a828dca7d9819e5f519faf61d0714fdd5468ffe

SHA256
2356c65d886d7f4c9735f4d9339a45cf13c33b30bd45000fc3c103d7d704e657

SHA512
72c074ea2d4f8c1f14fd6320ec192ee412cbbb4711e25c3f349430659cb2a1226873f2f26b06264cc5d8216234959663808b8116f301def9bb9eae96d27a8f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70b0630df280962c1a425ad237fbc16f

SHA1
6acb303e4bd4c7c7cc1691016adec9ebc7a4d8ea

SHA256
53f38118442516602264929920bbb30133502cdd3ccc65643a4f6fa5ebc603e2

SHA512
1b72fc9ea07708f6deb198846cd36edd4c61503524ca57443f8c9bdf87f7f597a621f4f96bfba3ffdef7493bb2c6aa397e0e85e211e9a515b28793cd72e4a647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1541ba25124016d7b9721860b3b4986

SHA1
780d183e70a6f3c00f3833ecb3055abf6527971c

SHA256
7e1b7d254ec75e0498c53ef007b36c9449e6d6b40cd27572e7bccad006203261

SHA512
005f140e8071bd5d5776b0860cbdc8f309f410749789fd9777d424b073bf1018141ee7ac18c52bbc381e11d152ee5b89b9ee1808f33d8b1886f763b1ad86b20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2c4ba39b007c5ac3c4c1eb0fcfa8c9

SHA1
c4e72c0e1a8c488045777252d9f3c8e82035e90a

SHA256
6ea62788fa1fd2de24bdd3b5ff104785cedc3baef1db8c97534a13999ab6c5bb

SHA512
82d203fab72d55cd24a5124ed2485cb03ecbb322deb76aacc1ad1f426fc04b4d73a5e0c116ef3f3ffaa6b57a8726dd2458a4d67676d23d72c98c969ad36b5058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43acc904934f224110db0fb75ebefdff

SHA1
98511262f285b62dc461493b5679f229486ac286

SHA256
63148363682c9f3743f7a5f6c04771d4f1d10f947b18a9a66ff472fae95dd4a8

SHA512
e8c069fabe4a2cee13abe35aa2cafa1079918dd28dd92ff8b795ed9c1d29754caadfa58824ec04a922c6993b25d735de96b85466dc2d4427f21fb604d0302bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5514d807142cbb683bd7c276018c5e7

SHA1
c9d7f6850a61f1faa82949697200c77560b26d09

SHA256
409b6826b284b0a5e01e7a1a7bf436dec27564a9e1e9d5ef5b00112e1ab9a7b6

SHA512
4437d2495ce2a4449e0d98c0682f4ef5448dd9caa9cff98987fb2900f9d1a6e1231309843530032a53edeff4f1022e819f4ffdb729cba6bb86481cab4c8a2ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39626ea2a91348dc1ec48e94db77f6a3

SHA1
42494b8f0846843cd87dc71e06213df06d192b2a

SHA256
9e11f6080155592464e68ffb7eb6e9e06cdad069d52669426a8794dabba17610

SHA512
d906683a878a96c0bc8a23a4683d87af4e52fd8eae372df1c396adda22b108625bcc64ddb7d076fddf2af1bf414aee93555f3fb1e2e959e185f4eddf3ae8eb73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb48c6448ab2b028efc5ebef6b722ae

SHA1
b9664cef45669b98e0161b779ac1ba771d0c73f0

SHA256
77451c7d0063ec29d993597d6624ba534fba805d423c78d386cd23acf6c3ed46

SHA512
5db4db13e3b1345f8f2f4487b1c8ef15c86f33e9e2f7ab9dd8a0dbd064e1c0bf8dabe0c9d059807a7a1bb08ad81b457bab84dc7dce8207011cbdffca31aa2f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d8f76530a6ded94aa16677de4420815

SHA1
1fc7269c52f5f602445a9a1f79a7d0efc1c10380

SHA256
feddbfc0fd57b91d87e12a6132cf7844ed2c7861388db845f9121cc7872e0cec

SHA512
afb24de52f7ac37700043afd9ddf9c2f78a76fdbcda8fa6805099c45380dd49bc3f3272a06f45324de72b993c3095e73d53b69216376addbe78d7d59915e4d4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
161352ba35b8f3a03e489d331d170cc7

SHA1
8aded393998359c688e1279970b3e046ec412d95

SHA256
6092815a7089774638d286e008b38627640cc34db8505403f854e0cf04f8654b

SHA512
57e44a85da58e8830311d029a1cccd0cbdb7842d3563feee2182435dcb2aa2f5fc258387bbb469447fbd83b9b18e21a2f16a3ab5a6757ec13dcf7ab6155c3ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4afd58df1849943dacdcf3a0ecce548

SHA1
ed2299ca73589737d23c4c217f28d37af1884b86

SHA256
6092de06677b2c1f545e4517bc1e4921e6265383c3994ddbeb17af5492574845

SHA512
23b74a01cb852d6a30bb3004f1d3e953af21305a8ae2b79977a0d388e0edaa11637f80f8e1948686c7c9a65d9e831b2c110bb4db01ef1232e6e75257d0570e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cbefb581269d520b5e88f9786eef1ce

SHA1
10c7ccad5fa6b5d6f70a030a028048336c091eda

SHA256
cc86433b120b5c4824bec2d5f13d0080ed70f0bac1992b43ed3717906a3d41d7

SHA512
6248b866e30f91821ca1e05fe92f9d1299321783c719608f7ef793ff8cd3cde66847b92c5f6ad18acf32f1555a2a2df473953cc462b02ccf8d67ca60dc1346b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab280D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28CA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28DF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit