8bb936ae2e2510cf1601c319d1e7cb0b0af68931a8f9a4800a1f60c679809ad1

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0143a537d2b5673d2f9b907664c1b568_JaffaCakes118.html
Size

456KB
MD5

0143a537d2b5673d2f9b907664c1b568
SHA1

78a6a597d467707cecb57c73def9cfc7328889db
SHA256

8bb936ae2e2510cf1601c319d1e7cb0b0af68931a8f9a4800a1f60c679809ad1
SHA512

31267f05d5ce7fc0d2b7e23ebbd3a624b10440541d54ba56faf4425f80d4823e84f6316487c5d836239ac98bf852bc5eaa2a8f6d333eb6d2e0bcde653780ae40
SSDEEP

6144:dsMYod+X3oI+YlusMYod+X3oI+Y8WFpsMYod+X3oI+Y6sMYod+X3oI+YQ:p5d+X3bs5d+X3eWF15d+X3u5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420313675"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001de5bd2bba99d46afecfe9760974865995f3a55860fcfe8fd81ab28de4d67ffd000000000e8000000002000020000000a3282c67fdc53e2f4d352c50f5a7f9d027949c4c30f50db4ef88cc62f68ae81790000000c7299f224a1d6123b01f95f57744b3d418237118346f6b43a6004c8502629187cd0cd36d823d9a959bcc6eea07d667aca4d2a8048c0b800f59cc11a90a6930c97fbd24ad147bf934cb5e1ca5c3cb434621be875a003b4d8451068b0f8451b27eb87eb8c62ddf52015f30759cb03fb686774651bb9a79f26c892c974a10bd4f399c5334331bdea5f8f15c27d758cebc2d40000000b5e7b5d69129dad43ef04164921f036df697491f83f07fb8752b09176c937bf85054a727e3c368c59309a90c64c3e1efcd6e432db600dd8ab369553047c4f4e9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008b665198bc1f8bece5e4eb6033e705b399ee8dd5ab91c9365db6c0c1e1af654b000000000e8000000002000020000000228a4364eaa65fa1cb61b5a41e80038f773f84d88ad6108b6b9639813ec75b282000000098163942c49bbc5aa99865b49c79f45a065771a3b690640151970f5410e4928d4000000032f53644305fbe023672e64ed7a45c592e953d6daeb0860a3b1ae63a958476d05cd8f8d091b80b81ea80e2ecfbf781f710fbe9812761ca79b1d79e5dd63a90db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bba197fd97da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C32190F1-03F0-11EF-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2500	2012	iexplore.exe	28
PID 2012 wrote to memory of 2500	2012	iexplore.exe	28
PID 2012 wrote to memory of 2500	2012	iexplore.exe	28
PID 2012 wrote to memory of 2500	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0143a537d2b5673d2f9b907664c1b568_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a36a441892895a0961a3b6e9e70bfd

SHA1
d08c313e2851fc9dec0bd139a28882b5fe2d4ac7

SHA256
fbc2310469a27c33a40824cc92b430ddb7762bf92f916d1b00a580c5e569baff

SHA512
ed0474588718dfa9ae7276820edb0dd7346f4a5ac78cb5b97a6b06d8c512790f6ef4f3424c7ee7d8546b9904a96deb4426b62ab0ca6c1613e898085176e64560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a9d46dc00b5c7c6e08efcda0df5cc7f

SHA1
a621464767f5794dbd73310a5f51124e79df18c8

SHA256
a9c89cccbf11887bf79795eb837ec89dd12ee0a7db601a48957a12d6bab802fb

SHA512
6fdcb99c920d002acd74857567cb437d0f2be412dad67f0447131a78e5488d545cba87ba2856682e47e47a101377f3ceb6e2059c612311fd1fc2327681cbbeb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818811181555004469547d3f0257231c

SHA1
9b6655d961e31d492d72eb2ac99d859037dac991

SHA256
669d6942e1ff355f1ccb2ebb96e3767cc3cd2f1174c3e0549bba3b27e434dbe7

SHA512
d6519fa4bbd36285f7d47cad43447a5c65c7447b2013c2d42bd076f63ffa74c65c0501f5897216eb23af6b2c2c3109952873fd0a41d14a18b91196a8f3c0874c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eea456e7485643d31b899a343b652f55

SHA1
2047d5daad95d3448561bef48e75cbef18af2520

SHA256
b7df3f52ce705bbf655deb456cdec85837c625563296fa15753ee181bbe11e6d

SHA512
9735627fca7e48ec407fa291226f7f01a0cf8bbc4476c524dc15fa3832f1433e088b65716997e24bbd4134d2a0b6fcc269b23a3ff0c3e2d1b3fe80d45c9c3725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
004e97bf27e64b3f8214c632c8dadf9a

SHA1
7476326679ffbd94bf8592d092bde246403ed5be

SHA256
0478dd15b71440581b5a7dc27e536b4b763daf360cc07d4bbbd343766369696f

SHA512
daabb8b64f9bbd03dd55b18f9740222d242e2212aa64565869efc28eb11a650e03863ffb515fbc9c3872c0eaa0e453629dbc2b9fe44fa00ab3b2d76a5ee1092c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88568ce7773d8a8f1a0ae852b5e33de6

SHA1
073fddfd48065da8b9fb75d5d939933fa32cf53a

SHA256
43ab8e06762c239ec6be794fe93353e0bcb0bf01b79a40713f22ba59d24e62db

SHA512
54a75af71558f4c607291a9f39316df15fdebfb094ad8a06668bb4c33d9b969909ca86ca9d732bedf015b24df98b2e0046ef351dbba77cc2a8fe2cc5afffbbe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d5e112d1d1ba22bb7bdef00a8849560

SHA1
61adcbeedabb12b575c74024145c740fcfb8da1e

SHA256
c7ed53f2f4367960225c77ca768432dca73ef99de1676762f3060f2d8e5b1c1e

SHA512
aaa6bea88e7b65a4aa6423ab11b4be8ce001eb79cdf732b56b288842a20a4822ea61f466ea416e0d22005f2fd23d7ef2c199bb511612461665498bf85d3cdef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd94ff3fc268f98337d9b672b3f4dff

SHA1
229112c22c148adfbd032897e15da139f057bb5c

SHA256
24947d77e6fefaac646342dff2405edc3ced440de785ed491bb77d64af8480a4

SHA512
3ed53c6330f14b7c67a3727de12e90c5de3a0e8ca58c8376c5e5c8fc8f58d27622f1d992cd7e68c4bb0b247cb3bff934e99e7ec678671a9213f3e07d912bb122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc85410de40030de6da58d5c88c1a64d

SHA1
ae2102142974f996ef8397ba115b11cb75d865e8

SHA256
b1f784001d2793cb73a0a4a8e77a2b28ba60dca04077ff60649851d8157c96f6

SHA512
860d5dfcf694e123d33bde701432f778013a185e0504646b4f446243be12c33eaeab4e02b6999a538011d05615f3cb488521c2fcb0257877f559293b88457700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2131d06553cddefc85051d315f536ad

SHA1
4f9c6689c8087b0c6942d0d1ce8e030406561f25

SHA256
3023331ae082d60a9b33aa14e678ee27416aee46a8f2f95c496a9d85b2c18c97

SHA512
cbeffb5fa89beefdc096dd7ce70409b9fc7062bea0241c250cc68ea15d9918cf9eb6688f4b79e2434a586d3659e4f9f7468d0facbdf449204686cc471fb17e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c09e1e33a74c074baf84c52171d40433

SHA1
365cdb9a09cc0cf71af19748736baf9da173e8d7

SHA256
2443db0e809e54ccb923389b4e243bca28114e1b98a441c0398c46afbbd2f537

SHA512
b9201c7f208586c1edb2983d1bfc8e347ce4fdd6f6c61bfda168775b1782fcb83558776c11b41efa6b7f9f48ca944e91048c93b4fa4b8c130d3679d0d2a0ca97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f67cf44e02929f32d25f6484ba7b99

SHA1
f770e43a858b9b309c6394d5e862897528b2615c

SHA256
b51d8ae0c5c895004969cf075c7b8ec98c8c22ab61f2709a8b5ab257e4b3e26d

SHA512
3b0250ec8caafa914c92a30b9c1b09618a3554c35237005d41336a9fd1333fa6ec0879ae43baf4102780d405138908235b90a7a609c712e89b69ea1750b62bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc99b93e169906de9e14533141e0d54f

SHA1
4642d283277dde29367e1ca4182ea0280a7d077b

SHA256
10d8d101edc768bcd3a406c940daae1e0b2c145778615aa34a412806c253b82a

SHA512
7b7fabcba0655c481f56a0e88f8e9e9260d2bd9b9e0a8044efa72bc79245e9fc75a7abac4474cd5c4fec7cffb05c3fa166e9c5b7431eb1ec29d17f7f5ff25590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84cffeff15eb048b20f263ec397b270e

SHA1
b514c2ebe96698d636217b952892afae8144a11c

SHA256
c60b0cc7ebbfaef5528522d70819e08f7c4c4027b533c802b1021e0ea4d550d6

SHA512
d37d7297181e5c72296601f347d10e1ae45df066f1556b292405fe64a62c6998add1a906f66a643a95629421edcaf8736b0e5696b7748877407db0f4c76f3368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7064583bf6a31a567cd56b6eb978fff

SHA1
281385c333844e6529870ea49a6edd6e5390ecf3

SHA256
217200f651f35a2a6741e634777077b19cc09f9315e3630ec580f790e0dd31c5

SHA512
ec6f7246a4e9fe999f20189bd120d523f6a2d2f1240ba2f9554b1aa2e2bba158fd8e77bad9ad4e85c54e0b4baf9d87d7f677d80ad60d94ece587f1aab11e8fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d0d45a19dd27a60f3e6e7d58780f177

SHA1
79a40086dd98605938b23163f5f7559acf518926

SHA256
eb1fabf65556cc2eba71d6e1410e5c8afd10f077bc62291082e59c7946e26124

SHA512
0177cfec498563f08b58d4774eb9a31d472442e63c9046e446b96c128b68e9574b326cd35e77433b634ad6d91508e92c987b95ae03e857fd908ab9731c64d611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8c6f2077be0b2c4ac88b46070a3d17

SHA1
a0c39a2765c307f24dcb432de692ca64840bec88

SHA256
ab69c66d2996ae3d0267fe452b50911dc0e49ab4fa613fb2bca42d4e68a5ab55

SHA512
dedeff25b0b169f7d267f952efc38d0eff6d079060107da5eef8d5ed5bc2715e053719b34a95916308143b1e411307194f334716b5449e0b1f776969e061bcef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24C8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit