db57084ead554a230fefb16fb9eea366694b50c1929752492c2dbf5dd25e3257

Analysis

max time kernel
139s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07d29426a795139a73ca4bc785d516cb_JaffaCakes118.html
Size

16KB
MD5

07d29426a795139a73ca4bc785d516cb
SHA1

2cf96de256342d1f0e5db065526907eb5d2e5938
SHA256

db57084ead554a230fefb16fb9eea366694b50c1929752492c2dbf5dd25e3257
SHA512

480d37929cdfc0daf4d8b7272e4ac54b0f6155bb8e0599300b26d795fd38fc362fc147c66a2df7a7f867dced996f5b826e26a60571d3684cd76fa137d7fc2a6b
SSDEEP

384:LqYDLY9XYmquF54788r/M5r3WadQS3VpMzCgq8154O1aRgc19Or1USIkCXYyoTKx:L1Y9XYm9F54788r/M5r3WadQS3VpMzCF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0676a2a3d9ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004f7c7a309dfa74eed20a8b6978fd06d5341a3e5bc78e65b55b647017982294f7000000000e8000000002000020000000edf6f04397980f54725d345777328c6cdc0ed8b68b594230dc36f33ea8e48a4490000000a9dc14930062f295828b686cd5dbf615e0805176c9ec1de371d2f1e99826c4213d4ceba9570e7ab3f03dc4bc58cfb08fc6f27b426097ac5f6c982a0a9d3782341a846d1b17aa330e3993f3a9806ea84069bf83516162f1133a9ee43df51019966a6b90f5a9ec58d3f489e10273d4c7aed58e4b1dfc6e331391c615e41167ea7f31ef3d30c9a5774da829a700f85f93eb40000000b2b11c9e92a1bbf451c50c69f11d8cc434f51bf6ddaf1812d51cd9c8316c04c9434a4aa3dd499f6e388a3f0925feefa34ccab77c7a2718e8f3ac54d32c67714c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003a3974128cfecb0fcdf2bf642b997ba98b20961e1cb75668e4c48b91fac08af8000000000e800000000200002000000065d780de3a0f14d62fd79c984b9be95e13f171105aab4891fbed3f57a6e5959920000000050261d08fd26407f5bf88d2ec2e5889c4b5e930710b29592d9a91ed87d91503400000008f1e0b56f680bf45434c1bf03e876b934a0ff3e1a336deb4a3d402f3dd476796ccbd0cc9547c0f7a7dc3d45da289cd7a610d482680ac9e3b919d77f71e3e2695	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420560883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{550B1811-0630-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1300	iexplore.exe
1300	iexplore.exe
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE
1756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1756	1300	iexplore.exe	28
PID 1300 wrote to memory of 1756	1300	iexplore.exe	28
PID 1300 wrote to memory of 1756	1300	iexplore.exe	28
PID 1300 wrote to memory of 1756	1300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07d29426a795139a73ca4bc785d516cb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36ab2f8f3785c5a4cd2c0f15c4f9641

SHA1
41df4ef7c02739d2c5e2be981ea7188872b2c4c1

SHA256
30efba7f8c8732fc7a734b1959e896a193599242f267cb916090358b127a4d16

SHA512
19453ce8db4e89b90b8b77dd65b865f29355fcb69187e5b57d31b2df206616527ad6d8d3844e2bbf73f26d9575ae753862e629d1d739b703dfe0e96ca932d742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
248a15279a11ebacf4bebd8d3963d763

SHA1
1fb802fc848d405d7c058fdedb3ba6b72a9a88e0

SHA256
42f0a5beda46f8abf985f86656ef937faea9e501ff9b8caa688b34323926acbf

SHA512
5da349e65876f705e19e302be9ac4694f4e08a4c195e8ddaa50076a1affbe8dfd4add115bac165cd3e38ddc0887f202db6a62a6731642d0f78355c6d0a68cff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9025a9abbfbea2f32eee4e2d3e42ad54

SHA1
155d0abc3c40acb8b86360e24121331b0ab24b46

SHA256
9764b2dc549520dd5924842a6a3b2e21706746c5785ef443f30ede293a104bd9

SHA512
b92ba039cfcbcb54fc6ad5720849344c01feff2957f1b321952d54047b9acfd8488a36aee623c628c0134b40f846c00e6b88ca1a6583ead25374a26140c3043c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eca4e5bff8beb450ee07e891df0cc7b

SHA1
19ce77025ba454708225e70f2decb9adb27bd172

SHA256
4d55f38ecb3d77e920c3d68fded9e6bb78276e3bf01b4cb021e99973ada8bfba

SHA512
f405fda0d840368cbdeb6e92666262357772e5466e0e3e60b37adf9650e09bfac385fa444ce886731b007c898f66e1bf5faf54afb481fb2612f5a41035600203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4779f1bb889c7588be6d944b2ebf4b31

SHA1
f407b427d74ff4c19142e928267dff3cd9ef36d6

SHA256
6c658eec986a5333d43c9dabf2b791177a1361e2c7c37889ed83c5d9b61da523

SHA512
e0a46592cf2b0f85e4e2b0cc97a1e7c283b86af7356851dfdfc16c488d64c67f14ed4e11983c34ac4e07b40b02e4eb4df345a76e4d67f88157c86cb154ab5bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd2f59787dac35eaa093cbea2499930

SHA1
cb6944c9dc5f88cf3300c852ce44dff7d5b0eccf

SHA256
176b475360839f199097c25607f0a446bb7b094eedc895f07954546ac279a837

SHA512
916027f427c7d824da2e5b8c038bc48fa575e58199448947af47e3914d26ce55b5a60526c502b04c991a5dc182d674ca4f8cd21af81bac26bc3355969a7ddbd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d17ad2ebcaac90efb8c40ead8ddaea

SHA1
6bcb006c27e973ab5e4a4d547748ced9ff718454

SHA256
92d94404327a3672042b604e5397250be84506210bf516c763865ce7d35a20dc

SHA512
73ecc7d01bcf7f348365d46c009c1a123c3a557d463715578a0bae07e42ea75c1d8498cf84caafe4ead08cbb97c9af7b6d835f6fc7c71d131b02458771a02aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb733a36d42905a0cd078345f071f4d7

SHA1
afff138795b1b7e8761751b51980155e2893c102

SHA256
ee4b648a0d81b109979db3dfc98109e6ae2b31235090fd884173b1ef80097156

SHA512
3d0cd0876444fb3cb6c4eb20fb7f9f2945c309430710c95986243838d3e56c1931a4f9aa423b74c35465ceb0cd0fb930944fb3dd0651ec564da22d7c372e3aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59bba57154b50a4208fde1803edaa269

SHA1
a3618a0fea3ae9848364241768e8cbe2a60ec216

SHA256
5be4a0d1537c085fc2b1a02b98710a4d19859ccadf201fbe605a3970e84554b6

SHA512
7c8d6cb9e15a2304728199ec4ed820b13f46dc2fccd8992764ed7321ac611bc0b7949a7a70f2e74f3e1f3d5e954cfb582c595a7dd0bbefaf9837d70c8a80d43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34969b5c57a66df5dcd62bde8ce8dc18

SHA1
03ced6fad9a85f40217ba49d2739c60cce2ca51e

SHA256
939f52397440c762cd5336755ccd6eaabbd606673a85fa288afe684e052a0fac

SHA512
9e1d3f5fed48ad42ed7b34fdcc78364077e8dd039b341723038aae94e229500823f09fb629811f3959ad269284d6f6d2dece518c357bf31d5dceb3de81a1b63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04730c8a70ede840c5fa0c98b3bd8470

SHA1
fc35db7a874542451fabe388494c122c8724c3ac

SHA256
b4fa8f7c92f60a3f0d26977f4a5889ae0e03fe4807d2aed05b6f23a859ecaf2e

SHA512
d277a78dca6fa4b39350fe393fbbaa1cb31e6f86a6886a19e37d33bf4fbc4c8c5a2a60a288fb5f5655722a82418ed71055132795944843cc2be11ee41bb4f902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bbad2ff2bda5a4010d0bb9594d4b5ad

SHA1
a0540d28c9442737c3237853b2f97e9cd904786e

SHA256
05f798a22c4cbc940794a36c67feb3a17ab1b3e3a451303dd5a952a1294d70bc

SHA512
ff2d42a1693ef0990e1f17a0a62b0b4881b1ed10ca2968dba7f502186cd61d6a50c94aea646f19253227fdca124807a2e813f4f8a6c561bee62dcfb45c63bc5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30bac8540a7f1295a0a3b66c2aaa167d

SHA1
f9395ee9877ed4eebed89ac00108b96ed1529cde

SHA256
e2edf0f0eb18f5403cb885e7658047163ae42a9bea689ec75faa32d577023fea

SHA512
1f486ee21d57cebd194709cf56255746beb027267afba969cb0f1861c5faa199f2ceb4ec9e13f4cc029d17cd3b0bd5479e5192ccd339113ecde5eb5a2fde8ca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ebd59b0ec206948bbbcbb7e6f3638d

SHA1
2d39be640be87e7a9ad4715e0c57186d55ea15d0

SHA256
4196a984b7af4e7d4b575e3d4130d9ad0ea0bb2726ce1342ace3e54c68adf641

SHA512
277d5928af7e7d4be5c74cd8b3194fa80be1e83b191afa7f3a559114ba3abe2dcf1c4f53d465b9c69762c37ab8135408961e8c3f9d6ab1b12fcf75339d98dfb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b96a34b5e283913c538fe0b2eb833a8a

SHA1
59cae5c00191d976cad78a5ede87a25a422b6e8c

SHA256
b78178701ad3faa45b9a7368b9229d60954fd0611f73630fd2cc3d85221248f1

SHA512
30bf7f01726ec50deda228d065c1239b08a95f219b294d7cb3f3f1e7403348f85f5656e0a8435c58a25b4827e64efbcda0af45cd15cd4fd4ed5c40f34303057b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a46dd529576ca57cd32a3b1dbd67cf3

SHA1
c7a5e090af6d6da7c58643fc1238193fe3745a39

SHA256
08b4203a297a62cd374fb77fdd49797f2843226f0b271aa8698fc096548eb172

SHA512
2510cc3673aa3b6c76fcae3dded5a2fcf76fc66ffe06c2fc4f91b40a75eed52a6d1bebaaf3c5c5179ac5dc53e813dace7919513fe44cdbd322548fbe30619b54

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB18E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit