7f2306ebb420e77cd10e1dee5946663c5dfd644745dbd5a164e1aa7a4b93dc4e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e4c8f671ecbf600ba961189c326c54_JaffaCakes118.html
Size

461KB
MD5

07e4c8f671ecbf600ba961189c326c54
SHA1

c2cf3856bf864aa6d129bf1f39136d9ae0550162
SHA256

7f2306ebb420e77cd10e1dee5946663c5dfd644745dbd5a164e1aa7a4b93dc4e
SHA512

c60a73f5c09c78db5e2d44e9363b16079517734e97919b1178d7e5a10e49b471f1e6f5b937cc903a85dc045a4f9d1b098898bbc20d716df3a78a9fa610701daf
SSDEEP

6144:SUsMYod+X3oI+YBsMYod+X3oI+YfsMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3P5d+X395d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3073dbd1429ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420563303"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000010aadd3f49e3cfb5b72ed3977a96a862903fa479e120e6cf26654ac9eaa7c65d000000000e800000000200002000000027ed8cd12fe5ae62f0d14058c4641aed9445c51b71924b3545f2cb00c0cb13ec90000000ec24b12b1166f6b950961fcff6214fe2b28c4dc92c1b20cca086c5c879327170b152572d0974713eec2e1a6899dc809e86360c54ac198e78f6aeec9ece742c8669e555b4dfc33cd3c4c54271b47a86936825b8df020acc05b19fa70052e42c3838b392248a424e3ec740f71ed53cf5fa9349330ce2013e9a78743e113072510791f8f01cd720f57e252756011f87821b40000000404aa27a283e1f3cd2c20e963a4bc8af3f736378fee72a67a1db3939a1b9edd9c344f51c2a4f25f1fc769ece02661a71c0f116aa4e692ee0da6559b759e53cbc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F90FF2A1-0635-11EF-A34E-5E73522EB9B5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000086e90aac184ad2522a8e1c8a46017ee1a2b3835e8a872f9722f6ba61e275a053000000000e8000000002000020000000016f012e3a2877d711a9ccf360edda8d87b1a2bdc2a32ea908d5d76610dc7bd52000000033c4e71bb344d4bcc07068feed80daa69e1965d43404687984834fbe0c5988ac40000000d99b9a887a9cdd9d78867e3dcfbf222a6dd0ed183047a380ce9885a645775b4ee1c22b11af73034cc9e426c9d7f548ef678e86023222ace5112f34d470cd4e48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2744	2184	iexplore.exe	28
PID 2184 wrote to memory of 2744	2184	iexplore.exe	28
PID 2184 wrote to memory of 2744	2184	iexplore.exe	28
PID 2184 wrote to memory of 2744	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07e4c8f671ecbf600ba961189c326c54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29046626497245d58b9112584ced33d

SHA1
383802c5a8d5a35c6f1c054e3893a04d759fc7de

SHA256
ea7afadc0cba3a98c5cf0c5f7439a33d1d1a96b939175adba73800521c9655d9

SHA512
3c6fe5ea44c63dacc2baadf18a2754f888441532089e42e5e57d28bc48a392a881d482d2496e1391cb109c87d8799d9469e2583623ba4a0c2d988e37896886da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5b2fdf5523220a36ee29c08b36e834

SHA1
e1ac1fcfc256ab94bce95dcff2942acb185fc6ac

SHA256
88f1531675749d1eaaf9f7db49ed91fdb4b71129468631fae80d870d3280e6e3

SHA512
a7acd5a3ec12546b0665f4d81ed9e72be998a0027bf6ed9bb8bf8b1bd27ddc07f90a2dd871fe743f7c4d750493feb4667d38f8bc5eb1fba9638de11d3a99adfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bbb3509b6c19fe05a1b224aa9bd60b5

SHA1
cd08ca8695dae4bf2ecae895178216fcf4d81668

SHA256
04d192d0714a3b5c6ddfde803fbf2f5e176fc86415fe3255a3bb1554c03c1059

SHA512
ae1f9b30374925d75b8d6d91aa32a115a636193e9b25f44167377744438010b356c4b84fe84e10457e8ad3aac0a8d88c3aeaad5525f5678e59c90848c54f177e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39186b4e3428d92f811945ec6ae2389c

SHA1
a0831d7db1a6904b020f2d65282fdd8cc0e704eb

SHA256
d54715781c716c61c3536f694f25a63f8cdb119a2cede18b627977ca549816e6

SHA512
b534cca6f637024076a484ffbb840967e29b0ddd43bd7b105ab2eeff0da355cf7a3d5a047c30e3088fd88170cbdce68bd8b4d69afbb6ab9747251cd11ec3cb50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7afd3bd0a5579c9c816635789faec576

SHA1
0ef4664e04af0ce46a9bbe9c7e0a7d72b6f7683c

SHA256
70d07291e0c64f3619f9c54deec5fe76e7c9a7ba0b5561f44b0b3a235b263105

SHA512
d8c1cff9be5d5037bfc6747daaa5a1b20e35a620b8e699e7c67640e5e62c817526d3952b38c96054c05cf549d1b333fdc5b86ae46549cf13933c8fb11de42069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd1eb99b71c601f14e69112bf311c79e

SHA1
39f0f7123e971fa5583fefc60162275efef2dd29

SHA256
22ac409b0fd3f953594a5552fbb7b5c9bfca151f077913b50ee3307073c3063b

SHA512
cf608399cfad88d62f99db1c802e0492de7f12c6d565a4d6ad5b990a1349d43a7f98890085bba79955c2c99adcf226ec57c94586a9f37ddc5f8666d139f56365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb77ec139b1c881f8ce0782ceaec650

SHA1
d7123b43bf4119bca14d2966decaa1760fe8046a

SHA256
180d0fa5cec67b3e8de33df5b55f4afe8442592847beb1e328cbc3c5683cd4c5

SHA512
db38bec77906d9b197a3bc2dbce2d7e343c1ecdfeb9c5e9ca764332c6043600c8c2835fdaaebc590624e90a2c711bc8b21b6a13ba70a69da0a5933c0327b1426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928c15d82c1d367e26a36e16a43f250b

SHA1
6fc595bf70e5cd01282e55ae438c3c03a3dbe929

SHA256
c1c7020bcd8f41c7d371baac4bc935e53bd93d1270e2f4091673c60d187be98a

SHA512
f162177935ad19d69dbc6b9203aafa728008317135d6770b293da9626473899c648381c120cdb49d877bdc4a080b9a98d5ca6d12559c3844da66d5c7c0675cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
085f3cd375f35743e80d997579d385db

SHA1
c8968072596bb80248afeaf62f4d5a2101cc0078

SHA256
f5152ca9cadadec6b55259d5cd86f5aa10ac49a017edc1dec420b7e0cc66ccda

SHA512
76066d87e521f20678cabcb7c51a5c064ba5ac6e6321dcbc4c41eb96814d56f9de2dca76466ad0c9ada533ca38142d87da2cc84fe95727c24915c985f1c723f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ecabf1e8f9a5e2c1b086df2d70b128a

SHA1
3c7ee7b7d812d05fec54abfcab1a3f6eab864e0d

SHA256
277c4a2cc81d4318793f7a1ff411e890644c0d29b48bb5f94dc715913e31bcd3

SHA512
4111e6039bde10060756e4d87e409c46815b3471dbc664b1560c257ce8c7fdee7474c06f8683ccc74cf2b4d2829f6186f004b92e2bcaca8ba13c1d725510b49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
589c0024143890c30d3ab643dc4237ca

SHA1
d2ffa251e146040f1747fbdc77bdf2a1e8497384

SHA256
032d948c2f00e8951e9da354cc45c34af7e7b2be71a3199710544ad616a34a6c

SHA512
59f5e0e6bb16714f933d0f36b32c901f571111b27fd166b6ec020eb2648cf6cace5bafe8535de16e90145ace918741e6d4e24ee9fb252b4e09a61a68ee4cbd68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4611e4469d5e5d162d31a029828506e4

SHA1
c087f34b08e072242399fad58a95bf33df38fbd7

SHA256
14faf57c867b0217076f1c665456e8511890ac4cb85d99ceae1332e97772ba21

SHA512
bfe76240588739057087a36f49ebe4ed64fbb38d1b5f15c91456256b9f1854d1dbea936a496346c2b2e9883f47d41e4d24b7f314269af6162aefc2d2f0ecd845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1d46dd3aef48f65ff573df1fa32ba13

SHA1
018ff9a90d9ad3a23983a871ce166b0d38a12470

SHA256
f6219f10b49404ae4248f8567633182b5954fc627475a3897a27ed9ed19b66cb

SHA512
f24a63e60176c21a836b35f3178fa56ac0d63ae2179f74ac5238246fd98873771c71ccbbfc37a8fe2a58d63633cffc2cbf766b9493dddb7a9614209b015f545b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a52cdf07ed2f667413d77974e50278

SHA1
b39a0c26b9c826a3d6b275dd033be49aaae0b6bc

SHA256
5d25d27a1e6bacdafe2a9ba47c29d096b57d2b26d306a256206d311297a8c09c

SHA512
c9e1d3258bd423801e03c9f08ed8041a3e89d3249ecf1849281ab8f559dc815dd0de33b0fa1ec527c4098097f43b7de57ec0df53b4bd55589fe14054ebab8d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar62B3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit