6fbcd1a58c057541fc457c5392ee25240bcfc0908ae8991e900c113ea5ab6233

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0182746272d8388a244d077200d7c404_JaffaCakes118.html
Size

67KB
MD5

0182746272d8388a244d077200d7c404
SHA1

2da7bbe210c72deb3e66a662cf954974b34c8eee
SHA256

6fbcd1a58c057541fc457c5392ee25240bcfc0908ae8991e900c113ea5ab6233
SHA512

d0362e7d78f292cd119669aa9429cdb126d846aa718f73e16a63f4c4d3c5fd91c4f3ff96305565b4cc6d1f583c57877ef716ed97a931bce57ff937c4c7ee8bec
SSDEEP

768:JiPgcMiR3sI2PDDnX0g6s1FChoTyS1wCZkofyMdtbBnfBgN8/lboi2hcpQFVG8sM:J5q2TzNeD0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906da2701198da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009f5945d1df9349dd17245a4fd6790516ef6368bd339bf030e6ce07eb0c866e6f000000000e8000000002000020000000c779378b251db0cf071403335a84d8c882a2f5d8b1689cc66466a61034397c669000000067c75ea021e489664c3028fbdd3005901f61810b45a5c9931e32cec37c629524e4cc040e4fec773b80faeb98b942a3e24b174c7533ed6743f35858307d9ef950df72cb36e949a66de74bea68d61ec6b3b8f1b2eb8c49036cb7f7e4039397a8a938edb9885694cafae318b9061a5f55dd5029ba79598cde7be616ec9413a32e877a23f5fc86626d6502c93865e540f7d040000000f65f6beadf0b4b164ce9e29da9b8c981b4edf4564e0b280a4d76160b08e89dde5b0671e2b49e5be979e2f407a2a716a847caa808248dcfe921e482b593275011	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006b72b18a7e9b2a5d1f5835d214920e71086a8f36730c9d1dd16b7863a977a0c6000000000e800000000200002000000065485f919cb08ad1ded3d3a089e48042243827b770bcc1866691355caae4f48f20000000aa9a93d816bd7df22f6ee42e48cd304a23e7f397b06f3a1dc52f93ccc0f4994c400000009774236d295ab693d6b22d0de20c1fe811923b6d6f32a723f450415d2910481321f1aef8e85e6a69fb7d225954e38a7f1e61e13b65366adf8016176d5c40223d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B22AD01-0404-11EF-9CBB-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420322199"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1308	iexplore.exe
1308	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2992	1308	iexplore.exe	28
PID 1308 wrote to memory of 2992	1308	iexplore.exe	28
PID 1308 wrote to memory of 2992	1308	iexplore.exe	28
PID 1308 wrote to memory of 2992	1308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0182746272d8388a244d077200d7c404_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20924aa0b9c6e9274bac871f3088d5c4

SHA1
79a61088f577eecda0d2bbedc490d8e498f41821

SHA256
b8f8959a2debd4bf65f804dae081242556b2fd5e82a090254a588a15711082cf

SHA512
c777dea6f58c1a185d18dec6887944050d2c8e1cacc91826118a7bb09245c9a5838bb7a19c1106306df3bf50a9b478089851d7608052b1c7457f0b99003d2b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd740a5f8f03a5d473105a04b5f6870

SHA1
d1129c726589c7bebc6415c20028dde4c5186127

SHA256
58ff8bf4aedca05d88b5e30d7e87aaa1d55bbc387a3175e06bf7ed184356c622

SHA512
f818eb300f6bd49d15119671e01c69c1ed9d429e144ca48614a566f2025618fc9a65c7e17f59c646bf241f315637ab8bbbe701f2772c58b3d406b3990a25e465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95273a90e6406a8892b97076f804ca6e

SHA1
cf7b160b6857fa4fed515c835c850123ae39fcea

SHA256
5f5971690207b5908de7eb42e9ac7c2d491f4112e98130f2f065d0aba2f5dbc0

SHA512
77ab804fbcec6909303e635d48acce51a3f504bbe5ff71517c02d0c785d135bbfe40a4d173e6d8867de51c1f0d4006d96a4533eab963e5eed18262ef6ac63ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fab9c7df45472ae11bac5de303e2ab36

SHA1
6185aed8a42aae890476cadca7cd46fac8d472cb

SHA256
4ae52eb141f3f1a20e90f2d861a64f2bb471d9cb0e4b3514c956614b44b7f340

SHA512
809987e64ec85355122512fa730460e32d2c903dee6992d44ee410174344a4318d520948ccd5b002ff944c720bd382c0b8b2e3cf8a515e1bcf73b8f4184a366e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3181531835f1308be0db13b937159aa

SHA1
ee3c82e95c62b6e4c86f4160a963b5e8ccc7e07b

SHA256
99f691ec12b7832217ba19fed0b08ee3b39e30baa5518445fa0ef0d95c47e168

SHA512
21b60b02350bb11e712fdc2259e208689870021c25bfc3ab4670865fd570cd03f0162c12c483669cd1c102f7ef95c71a636fb58e17d2a308feea421106ef474e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d3cd07e56cae368a781a894eb296d23

SHA1
a92700dede6f4cdb044dde71fd2dad6dc2938fad

SHA256
a47fb6fc61240c3afb766dc3257dadf2b31601520388a5a562987b4b1b2a9aba

SHA512
b0ade652e1489b57fe70ecde28f16e93f1ed4872a9a9c94aafad00dae7dd8a728e21d5bd02013166ccace34a63a92d348fc439a09f7bd9c1495145820cdd111c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba22036f5cdacefcb9ccf6d2a722ee5

SHA1
8ae7acb92f466ac1773ee5e4bcc887e919776638

SHA256
cbfde7a0eb56599b4a8aa13a19563a4f8c3b61eb25f3c48507ce9da36d4a42ce

SHA512
17aa1438c077916b20b61ef3f0ca7cfde16ff1177165230dd55b12359807209e57f7d72139259235672ea3cc9f2058b6561095a39f19b1fc73436a4d9ca50890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a825d9bed636a31f4e557b452c0e719c

SHA1
08e187b21d227f1a940c26e10c7bb37f3af6ef4d

SHA256
c50d53c1d7a36fbb8641a2dafbc4242f3f64568c60ec6dc96ecf6bb1f2836bc1

SHA512
7771bd0c7306687fcaab59563bbba71a87957d6a8465643315f4e5ff75ffe219b4bfcbc02546f43967577049790c22fbe64ee07f5fc78dd7997d69dca9515235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94375a897d3234393cc2a99e14784696

SHA1
7662627c5ebb15837d1c8f8cec5076682f6344ce

SHA256
065e6ee2553146cf7c2445650a57353e9e5d460006597bf114229972d1222542

SHA512
fd514023c71620225ce471cfe29d4a9e274324ef7b4d7a72331992db03378ab465160dc60b18ad9bced8d664f6aa0483949d53ded51489cf79601a99d281812a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5aa8812cce52e18ea00228626ee6097

SHA1
467463839d0586732f19248a738ebf29933134bc

SHA256
5e6bdcda924d2e4f62c17751af62db718c99258324245649c1867e4161ab816e

SHA512
8268480b187f26db22a5f406dd34006098b08bd97451fc536525baaf0ba989dd33b40000fccd0b631aac8df53e8a8a5857957964cc734c0d916d9d3483c2886d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91fbca0055afa4455cec8d6e0c173d1f

SHA1
16ffe8e784e193cfa2853b752ea715018d3319c1

SHA256
f9d9d3c7c358e695dfdfe05efc7dc57340f5aa251e4ed45805cf1553e510ff2b

SHA512
17dee6b406cc39e983a21439108ace66f7f204f56d6343b5827945e3acea0e60df18f6b694a617213cd02dc7bcf018ff1f96e1de3f83b8f08fe2da46ff7b554e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843edb7aabc8031b6a2f285a31f4464d

SHA1
d7ff6ded4a8ebbd2148dd5e7a475f45de859647f

SHA256
583804d3b5448da6d647773bec01a714e256ffb8a4666c4a3408dd5698673213

SHA512
c8980f0ef22932f00d5c4907e44321e9cd04529d41fd6e85fd23791d67cfb5743bd032afc3160ffebb1eef41b9dc548df773eb0f6b4ea4b53e59a37b648121af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88aec68790c20dc535e24573bc362f80

SHA1
0f10da69315b4ea79fa3946a6bc4ea6a8ce7284b

SHA256
9234b92728ab62773d8c93cea4c37766bb50a9e17b2aac8120548ff0471c32c7

SHA512
c727bb1baeacc318b5b69c5e37c1ba3b2bb9affa8772d58afe8acbc188acfefd988ed2874bef0b47fd3335c1057364c667125ec5eb1569abb8656050ece6ceb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4382df2e158a4694c2c96f165036e6f

SHA1
37c4e6946e5350d17a0401b95c40737a6dcef84f

SHA256
74185fa5a6383f6f28f43cefe27fc16719c0233cb0d7e57f1770b469b679b659

SHA512
e73e570ae5b86d06b2c328107d2c2cca430f742aec59c4b83320ed5c2f2d23c3601d807fe126c67d2b231fbf5f8d3c4617515fe4a440fbd140088923af7ea70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f62cf2b4214b7ce7dc74a2e7dc24600

SHA1
af9a0859a02ee7cef6c3bc705ba3a4fcb1d7d6fd

SHA256
cdac446c270c746d2e4660bd21ee70f8c2ba4086b6cda366991992e44c2aa20d

SHA512
323f5132c2a0836a1a09e3dccef109767b9cbb3a71b10ccbf31a497257bcb266cfe5dd3a3c645ed74f52f90bbbc73f212b70d4eb39b2caf0dd56f9218ab3de94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e2ffb403e8c937ddd3730bf964ce59

SHA1
50dfa7b35ee5232987d12dffa49ac7d7e9351540

SHA256
c0a6ef4f1cac80747e106eccd2bd894470c2e074f8072643fe980073151e934d

SHA512
e086ff128728af0fb0e701992dba2c2873fd7b689a032c05ea1834033a26a698c9c81dc071a8271e17755cf8326aea08ae26ccae6519f56604901a4177b06b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA610.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA73C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA770.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit