2d83df1149ca2f764ec3297940743b2f5108fe044cc072568e45652875d19146

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0454e0a4c7075eb1da063f5991627476_JaffaCakes118.html
Size

213KB
MD5

0454e0a4c7075eb1da063f5991627476
SHA1

98d8f5d2ada82bcb445edcfb00b527ecbef16f90
SHA256

2d83df1149ca2f764ec3297940743b2f5108fe044cc072568e45652875d19146
SHA512

94406f23792a0fb1a7cbd4b668d909ee9b70fc0727ac64ea6d300c7e14775be3712947cbbfb2c22966f147fa9ff745abf7a9003858e6eab0cd92e6f7d85d553d
SSDEEP

3072:SsMlTlKAGgFyfkMY+BES09JXAnyrZalI+YQ:SsOhwsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F3B8571-0514-11EF-A635-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420438813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2172	2320	iexplore.exe	28
PID 2320 wrote to memory of 2172	2320	iexplore.exe	28
PID 2320 wrote to memory of 2172	2320	iexplore.exe	28
PID 2320 wrote to memory of 2172	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0454e0a4c7075eb1da063f5991627476_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b54b9e092803537abb5e1c3db65918e

SHA1
bfc03b1347dbc56d126b4cbed26223ae9a280c30

SHA256
7da116d7a989c571016f5eba6f70b4e63c460dc29c72d31376e10386a01af1dd

SHA512
16d01ad4716cf4917e9494e72e4bd2faac3dce90b5a4bd9695596d7fe6e775f32a8c663b65c7acd2d394c2c0272f8c5aea8657d0fb4bbb8997e646b5f0304978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e963d6b835c53cc0379342039eaaf94c

SHA1
6a3ae2f605d7c47c5db77d40123f413c1f45e0af

SHA256
388d5af8104d6207ca42553a7e166a26ac94eccf26ad5aee10be979d87304fe0

SHA512
6bb267774835b6baab15635469d3c57dc983ad3ce34fdab61cb95652ec25afbe3a09b907f395fc0a32840f32ade13289d19a09985506b66ecc1411e255b6c84c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4f3a120946c0f3e5729d0c2ef03f3a6

SHA1
9472ee0e98abbba03182a838a8e8cb569b94a0ec

SHA256
ea22cfe383b7cd7d269686369f8b02f0dc1e5c99a3b534a87c4392ffceb950c2

SHA512
9290d0780d81c72373a2734916b5a8ebc8f9fd80bf15281548c293206035bd0ae01369fde287e423456e7ac5c506723c9b23a88ed330a6e4d1718f71fcd95cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c5bb9e237912f0538d0767c66b2c9e9

SHA1
19d23c3b980f54e905edbfb42852e7d575c6e372

SHA256
6bd6904b35eaf6f432317fa2b1d46643291378422765a402a759e91c210ccc44

SHA512
a523a326ad4c76e4b2b10e183fd14caa1266e4b1e18ee0963d0ce85d02f9c15089c5bc05e8053e3fa86ee9e20f2ef2f764e50b14ec7c0a5a9d99491a6bd989dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b5579ac06cf91491a7e422924742b77

SHA1
5fa0932a56f6e2f741e2bac6569ba9b6ae21ccd5

SHA256
db6c30da4feabd8a569bcd145e1e5c24f216acb797e785e86f06d243c855a10a

SHA512
ee844cde56eeba3777c442a3ad9e51e586fcfd57a12646e83a263484ade648ee0be8775ccd34fd11e4c976f933b077a322939267b0afb1dd9246bc6335b938ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5fdd1ea63bb4bfe8a469100b890e775

SHA1
4b1e00043a6ff26f7a7973effd03bca7a9ccbdab

SHA256
349139db42aa34e3ec2c057cc3cd941a8db1d6f6fa7278ea1f6a4a0b6d1863da

SHA512
2976ff3ddf2f75cbb8c1fc1c6aca280c6df868c4c188952c7654a8c30a8cf9a0e6c953fcb7177b3ec399ede3dccc4f7e208ae0a4f9cdf51e4c9e4b18e24cee35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b43d5004fdbf9101059ef33d6e05dcca

SHA1
470f4d53630092f8b230a4f018d1300b39b0bd10

SHA256
492b31d8d91de0fdf4fa743650b4d88fb4385a4780a16eee5ed693b0d2ca4a80

SHA512
52f91ce9921d09cf5e07cb62ab5ac47200378e276242b5c52136bf1c6e8e650dac90345ed5900389193c6f2fd10f0957d8a57dabd9de92a26f71b3fee9710c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba275f1869af9efd41e7fc5b534b606c

SHA1
1ae49d42e0971d7ba036daaeea78eaf05ebf5081

SHA256
40a4cba1df661487084ca19736ed99438745325dbd55f3c0be440bf59bfe783e

SHA512
e1c2c35765ce2435376ef32e23cd8433848851998d53d316881350d1c106e8b440f8432022f5513bf87c2c34b1ae030b59ed05e593d10d2878877874ad88c55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be2bf65a20681be8890b4550b93578ba

SHA1
1ae0d42b0047a21004cf568888e9ca34bfbceae4

SHA256
410c63f923a9fae5fff2d4cd19e26052edd5e20d456d3cf1af9dd046b94d404d

SHA512
2b59a50754fa0917e1f912bd182a55b35e7dad2b435a5f36613c8147e7d4eb42fff8142f64bd4e98e1813345edf262bc33245d95e00f0345659cb205ad0df6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6bdc378bd14c6a300ea4ef4f81c720c

SHA1
ae4f6bb8f3e0c62e947d38349f87ce64ca3a98a5

SHA256
63d64ef2760acfb8b633ad2d2f1aff9fdba1ad55b5504a9e99cd106b6939f2d0

SHA512
1b0f63f579a83d159d1dfabcbf82cd984be489637f10edbf9af63c70e715ad751fcacd4becc96faf820bda4576868b44a15996767d0b8d5b78fa5482832f5b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bd626cf7eb6765f81bf7b6a929baa2

SHA1
6cc16d9606bb0e5a9d67aec18d8142b7965bf63f

SHA256
50738950e0565a403b953fad061e545270e07387b1d6c046b0837e152520fbf2

SHA512
9ed4b08eff2bf12e606164fdb7fe6f38d99f4632b40b5cfb4e1fe2e2f1c34cc63681728c93c9741a8d677e35a9950f358b786b003c8747b748c71a451faf954f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804ebc6f34f9d4272af1a4338ed8c949

SHA1
3339aeba8a7d3984b609452579df784ed4a55403

SHA256
c4bc5d910de3e11bb3511442189ece215562aaa08bc60bd78e66917da8502da5

SHA512
57c7b211cac872ad392b966f392fc11ae1634ab86c22b40f125499f323604cc600e375c6bde868f9cfb8be6a51b35510c22109b22116abadcf15323d21e5b1dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
badd6e9a0072a2fed1b8aa1070e629fb

SHA1
5db4a7a3230334949d016cebefb2436176feb197

SHA256
2b4d40fa4a466723b35870153515984d3671949728534e53135af467b81aa831

SHA512
5c1dd991676313bd65fe816ca86f2dfa907776293da2e06c278fcbacb588044aef28d0b4a06429888f9ff171b10c4f5937483bd69372ca1c0772a0dc10fd7337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94be2a5a73a9169cf5d31df016ddff17

SHA1
ad828a84fef523ff7c4b0dbd3b7a68b708ada294

SHA256
5245cd12d794530312c80df1997152d2d27f1ad6a1258655cafc608d78cfdf05

SHA512
14839384b667b2a4d50bd49c816e622dc420dbdaaa2e44cb74b6f351930c30c8afee9491b60dc76d71fb0dbba8f31c746653093eb7a527cd05a6008345bf65e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
534a60e5637af940e16c23ff31faf014

SHA1
2abce588264943f5ec7a652061c2fbf3a1ad8609

SHA256
d1ec347d3d466462e9ced6ceda2c5048f242891453bef15d4501d4e11682a6f7

SHA512
d67f05979d90e10594dca23098f792e147f79773d0cebf9a95ab4502e7f897ef3d954ec11e36d40d0a362926cd9b27c108f00b6d0245eeaf8c1f044e0d793d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53bda0233dbf3ddf64b08c83b7e6d7f8

SHA1
d86f164c21b9d3cf8e28fa1039cfeaca99070156

SHA256
5a2dea21445c220fb858a9f4521e3df8981ee6c2be658fe3e98974f3cd4f011c

SHA512
72422423d1a8afdcbeb75671e8770dd2f991f190c75f6e354b360d9834e2e14ff910b29507d4d153b9aaddd3edc0ac44beb916c3e7bafc89bdfe06c4d97d2f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40edc43714fec66cf0c3ded7fe93ee35

SHA1
e587c41f3db88b17a25c45169dff1b18ba751e08

SHA256
2e58985cce06b1c1fed1a3f3fdfd34f12ab9e87058cd89d5e0ede0cd01cea442

SHA512
7df8637c859bb7a30accdb2a3408ad21a860164d6b6eaad979d3061b1363158438061d8e4e1c84a0a39afb527eace22fa0af74115fc538fd97080d0c348b2337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6fbca3bdace92de7bcb8c24120ab948

SHA1
177d44d0eeb25460b6cae6b9dcb4b0304cd213f9

SHA256
2cb99d5cceb9c0ab93883a19ff4ebf9920ac9ed9c99b32fd0c9b14ed93d64f89

SHA512
de70c26b6b0b3b342c50394a829353d3504aab3914f097f08a436beb08591579a1d96445ee4e483d84cae8c102d0dff480d03d00ac226176660663f799c2be1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bf45159b1161acdc92449dba9e5dc48

SHA1
d09f8f97c1f13e1c82b73c166ade76bf86559704

SHA256
548fc9e79168e4a8e9e40ddce859654a3e7f126675d334d5137a702a7023e824

SHA512
2dd51e7a66831aafc35e799516d7fef50cc466a0f3cafc0765a9a3c0600b703fb4da65b19dba56f5f0cc0ed4dcd0c1c951b5f833822c1e6c4ba0eac43c7b46a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20DB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2198.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21AD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit