27c4364b22ee3ad4e75bd1afc1260c321e5cc9b964047e6765cbd10979232820

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

080a0b85e33b05c1a33f3b94a392e255_JaffaCakes118.html
Size

67KB
MD5

080a0b85e33b05c1a33f3b94a392e255
SHA1

905959c52e1b9244d817bee7693ae1abc1c31414
SHA256

27c4364b22ee3ad4e75bd1afc1260c321e5cc9b964047e6765cbd10979232820
SHA512

4a78bae88365f0acb7d9ce43fddea5993086edce35b2c172e84ab12bc07d3a596ec15ddfe8e0e5c89f3b9cfeb6fcbfee1d08c9605ee5a9ddb066f36c8d5624e9
SSDEEP

768:Ji/gcMiR3sI2PDDnX0g6sU6e+oTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JdYTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B95D7D1-0640-11EF-97A3-C6E8F1D2B27D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006e326a70562386faf42cbec8126e98cab8d23cec18b851ec9017f250a2ba263a000000000e8000000002000020000000b066ab22b9593fd3295c67157c69c722a9cf2d2e0674b952689b99dd7166058520000000c5a28edb118dc26840c7dbc58f86d83ab550ca6c3cbe115a1989a51b2c26517a40000000760f67bf81a3af0d42aa18edeabdc3aa1b1a6f23c7c9032ccea9298487753973a9762ae00c9429ea0a4ba0f6fee32294f7b094f62667504d0c0d446ff66d0f23	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f83f504d9ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000cfc43c7fc668c44cae1f4772cfa9bc5502ac724b2e5c7b2aa80e31dfb64ad70000000000e80000000020000200000008a9af858d2b900e270bf5779b79f0527ee6f7d2dbae7c181d15d4dd17a181560900000008a7d3b9c13fe283274b7aa5eff733b43dfffd353b6699006c1bf479f01b2e4cda58e314cdf193ec8528b36451d8c17a29445a13e4c10f0d331bc0588ad00004aa541c09eb12bc24cd2c5d192e6657a11970169aeeb57d73c8237f430f003049dc22bdb01f067e3397614c8043bc838de30b23b4b347c1a752d57d53149e9d9dd6a5e98989e27d0aae656c4261de3622c4000000035023e64a73ef33c68cbe4b0eae3decb4e895ec96cf2eccd76f7a9a97cb4bec40d68a95873f856435df25f7c3c02b0991f2885b37b8991e7b8d6eb39aaef8c56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420567820"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE
1088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1088	2176	iexplore.exe	28
PID 2176 wrote to memory of 1088	2176	iexplore.exe	28
PID 2176 wrote to memory of 1088	2176	iexplore.exe	28
PID 2176 wrote to memory of 1088	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\080a0b85e33b05c1a33f3b94a392e255_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53a79a93cb2e5dede9123e4a36ab7838

SHA1
05b8e2b59aa98aad3d35bfcc9809f9660384f881

SHA256
e26c34e878f185ff94c9a327d1cffa29dc663050a545ae7df33364231f90ab62

SHA512
e97aa14e70f669808ba0040ab9fdfef069b4538b523fc11cfd4aafbc2e0b7451fa5f7d1a5e12bf27d89f268aa56b3a80c4a0a33e139aa9c51f0567e388aa4c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b67122dcad4c4d565b9e8006792a6c

SHA1
b227e099f14f6b5aec83e7f909c10040b2af4c6b

SHA256
6b9077665e365145fa6f4fb9a42b1928701cce4f8675d20c699339976b06acfd

SHA512
efdceda0c32bf7406eee8b0f7c06ad9fd04f4e816a2595c58e5599cfae998ce215fdff00931552de1759bf4e77616f242bf125cd17ea2c4bac3818f96f8d8418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0bd22a8242874a0698903a276ddf7e9

SHA1
b9ac9c9481432221555edbc122c19d86d451f061

SHA256
a267cfe0d9b140790cbfad56483d98942d0a442cb2c2ed5883af732575d3afe1

SHA512
539813abde4605f56b628cdd3eb4e54df0661be705011597129cb18a177eccb2a5ba02eee6adc5b93a7a7d050c441d2673f2f895e10a7b4d5aab546e4e19dcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aa7c94ed33ff0c7bb0d427a0b96675e

SHA1
c59b0e80239168a254791fb63509afcdc9934e6b

SHA256
43483d4dfc8a4ae624027dbaea12d73ff8747eeec132cdb5d0d034d02f038d2c

SHA512
75698f33f6c87d513e45abcc1b2fcfef30c01156a38fd890cca74e4f272dfa7bd63e8012760f494627634398e7a3085ef9211e031a222356d56e63247eb918e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79dc8f0ba1c86fd18f7d05dc9cc5cfd1

SHA1
fa663292d54448434b3fbd51c40de70fb9485102

SHA256
2ab2458432acc58eade1eed0f04e5b0e497cea744da74d82ebeff4412694af4e

SHA512
c162d978eaccce5e1cd479c6ef5b2181bd2c3a310ee5049a6429f56a2b237ac7a7e05712c32afe0d6e8b3577ccf8907d367b6336593005be01b6cac823ca27dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92dce212486dd77897124fe06112720f

SHA1
7faa372646765649e948a7c3d69eadeb74fb8315

SHA256
bb390b348e3bfda52401b0f86b0d0fcf2d25af4d71f914740c6a31161382b26e

SHA512
1f02beb0cea81fc8dd8e378460190119150b58b301071d4fe64732fc3657f475be919fc1a4d190b36ae51e985f248b1569f10e5fda988f6386fdfe8393050e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d006624fa96e31ae88dc7467d8eae69a

SHA1
b751e5c061be58426eef60788c20bbc10eedabb4

SHA256
2d2c61a9760f4e2574278328f709b1592636a442c698a5a9bd86fb8f4f47952b

SHA512
6e33b48fd37a1a4a621062b2c3105eb8cb7a32569a71dfdbf23c7efa5edc52d5c1636af410916d96f1cb1493d5dc906e3995f01a6b4baa1897a22cb1ec9670f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab86959576dbe4fd56c87029f07877f

SHA1
e1ae85bd75c9356bac4899b0336aef8ee0e5f3b9

SHA256
b97828ddb3cb3288d6c56365b7ee49f51952708844efffa665c724d1cb58a987

SHA512
fd5483559b127e9aa0064e600c561666dddad3a2f8545e6dd2fb83ce1f9c8b5dbb746bdc8ffb1a97b1ecbd1f8cb807be4c36a39bcb2254b5134112345324f400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7584d05de15a227969a26e0ed6fe6f7c

SHA1
6837563a93b0a23414c07795c16d9bf39c386604

SHA256
88060e1db97e932f9ce627e5623b03efa72fb71e13626c8722d107db9368d922

SHA512
3427a43509e384023efa142396a31bb09eea2bffcbe191fb35a05a5e82f026c9c5ee79bda4a399db50d89a9d03a587d01cf83c3f6bfd2303dba7513d69da2a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019a438acecbb8a3463d6ff247ca202e

SHA1
3c067c46ef3c9fb7576a552b2535c708995a5827

SHA256
cd86dd61b2d0118f9d1a889bd37d5cea26eb3e65e644a82e18872675b665d696

SHA512
f6f0666f3ff6f1ed59bbe123064e28c08199e454da8c8bdc0e734956e5ead91bb1fb91276b367a1c8f3698620131a9858846a5f69c6fd59d77f1364efd9b0d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7710768c7b43e6ce0f5f226526708613

SHA1
8617face152f76a7edbe42a9a0ab43d3b5d354b2

SHA256
f1fa603f4a4cc277860826076d7adc6bd0a18c1fccbc64b99d0d220fd481743e

SHA512
f372ed50a8449e9a7aa8f769ff29bb2cb977da541e5263675775870f726f251c89ee8d282bfadfb11ea238d7e59db78d909cb2cce725843792c53ca1d1250961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbcbeb69d3d026f4f37c27689dd0d799

SHA1
6ece46298e8c58e6f435d0ead23d4c0dae8dbe09

SHA256
865510c821240bb6c24e3cf44a9129d696c82aa5861adb0492abb2f51087439f

SHA512
45601d82753f1ae80c90deb6ba396ac7e40750fda2d03f8acf1c6a277fc5390c97bf37f17a26daf04dc544e6b80e83c3d26cb2da640b8960c28234c45362f872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daa26493dc3ea10381315156f1f4518b

SHA1
ae16a1568ac5d73bac7b9f71d72b1d4285207596

SHA256
74aa61692dcc7fd2adcb81db5e1963406508c8c8fdb31263cc67d98df25d84ba

SHA512
3b91ad5af1165f4a4813dfa5980f4263f2cd5f44e4966eb10a6bdd35f7246f13c1a9a12125debd2845a51d46c9905414df2da044b89de37b229197f35b7ba004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24370fa53359fb8a81d2e27e74738073

SHA1
d88cd48d5bf3a4b3a64f526dd357fe50dd76dd05

SHA256
656ed04c5efcd47b9e8f7ce784b40cf93c208512162534f0b2cd2dba57504d9c

SHA512
4079de80794386ba8fc9c10817013c524f2fb153f8544fb5c3a108496385e261576d4d14d6f41b6e0008a2b1f02efc4f5d63b94816c19f989f57222d25b7db80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c76280dbc8d7907959f79269887d4ff

SHA1
01442e765401e3ea3db123e4a9e0b6e9110db9a6

SHA256
61a512d1c345e28f5ed83563bccef43fd7d7cdf9d0e5eb2257322da1f10adacf

SHA512
0a8347dc252adcf5fb044e35795f2ef43a79fdeebfbd5dd8d2fe9220b40790c6a41512ac2226144c2bf289229198d04382e5a1b9a33d158464f5725ea777d254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b73c5c114c59c6a0f16d3b60aebca06e

SHA1
144c573b44108bf9b8c958c91fc08a904a77656d

SHA256
886d9fb6a51e40ce33a50b8db5197d5a3805cd6b5d62e00182f3d90467a0d8e2

SHA512
038d06bff54405f50ddc78a7a45c3e37d0337199305fd5fe125f4f70013ff51a02f26097375162cb8ea15447f1e6c457015f1ba3630e9b70ca67c3b01227c384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c78f8a6db96fdb4b950ca776cb838b05

SHA1
3a54b795e5e4f166d3e0136c96620169419afe32

SHA256
553d1652e57d0ba95a31b77ac213d67fdf97326284330086eb18482230f3e786

SHA512
8867afd535cf95772c0cc7fbd768f5f2dbd6e3194114e748473bf279f2cd849fb83cf1b6345c4b8484e247e7fcec064c45b5ff2f8a381acd9c900fde1877d6ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D3B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D9C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit