523f1be98ddce30b4bbb56d4a231543a86953e8757f84338a5967b254e0ff5e3

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

094dec96244ae1743697551a349b90b2_JaffaCakes118.html
Size

33KB
MD5

094dec96244ae1743697551a349b90b2
SHA1

935248257dde4c8eeb54f7ddd3eb0ac54c89ec64
SHA256

523f1be98ddce30b4bbb56d4a231543a86953e8757f84338a5967b254e0ff5e3
SHA512

d042700140384e27cc10f5332f0bb86e19914841e868e90c79edd8bc5c9a9a6e3eee0709c22ae947437e02d1b67d9755c3f40f1cec9953d0cf372a9fac3fbb55
SSDEEP

768:U0WSX2K4CnMG/VodHnoA5zMzj3EL4vUwcPVsX29oUBb:TWSXzZnMGNodHoAZkj3EL4cwgVse

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000060e7043ff5614ebcaf7d583d34f141e14c9fa96b781feca8e4b2eace596f940a000000000e80000000020000200000001862c04d463ccb30fae6274ccf7d683d26d466aa827eab68e7ff16301b630e8d20000000066fe5f3a9f4f3584ad2c267118127ac4f95f228a7dfbe8fe54edefcfd317beb400000005e69711ecbc41e3e88de008c09571496a9db373640e3fb0cb8bc020ffa154ab55d2bb09c9ea175989c31977114b26de97d7eb5d01c55f21fbc800722f22d1cc3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420623062"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{146B16C1-06C1-11EF-831B-46E11F8BECEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dd1eeccd9ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008bfc38ab59557902106cc0b45b791d272cfdb2df8615fcc4c7fe5d7719345491000000000e8000000002000020000000280cdd9a7adba08076e2de09ea6c02c2e12d261d885292d2490518e3e04cbafa90000000592305e1b246921080011ec79c0e57384e958f37eec55a100f8d175ff86b6e217463cadfce830196604222335fc497714b08b39040b06996595fab00360531a187823faa161ad5e1efce6f5c266c833f150047b25a0ef8530f876d49b85b5702d28295d0885c533369c4e9c11356244a51efc77bcfd9589ce3cc9cd9ec08fe4592b5f58f08e751edbe0e4c3d511dedf340000000b3abe415d8093b73e7515cc160f1011c5fabe59bbde128e7d63ed5bbd341fa77bc4fe4e2bd84dd317c75d51f9cf6e3a39c4efd2f6d2ab107a1d55bf6c6b638fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2944	3032	iexplore.exe	28
PID 3032 wrote to memory of 2944	3032	iexplore.exe	28
PID 3032 wrote to memory of 2944	3032	iexplore.exe	28
PID 3032 wrote to memory of 2944	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\094dec96244ae1743697551a349b90b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
522eedc8667c7baf31af8c9976404109

SHA1
12904c67496b558114bc65a9e296836b53520303

SHA256
75b648db1926805460d9ebc65f0a8711913b6d7005a2b096dea1d5a344bb8a2a

SHA512
4c20b2b4f14845ff5c0df14e513747f1dff39f28b19ae235dd4fbb7a7b83f8de7e25f4ef05b1112eeb857f8820e2bacb1de1420bbf54c8d0311ed39c03c5561d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a316421dd7a30236fbaf99434aebce31

SHA1
665dbb9bc3b9e356d04331323542f57bbf556989

SHA256
34150bd8b0f5389eae736d0328922e512843fb099061f48bf17177aeb18d9bf8

SHA512
857bd1883edc4f8051f2898c94fb6ce4d1af87f3fd976ffc5568a58e828849768542a4d7f19b4f60ab4bc43444107f49d71fb0d915984bf1c161ae65e611c3e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91423f630fe18eca57376e96aa33fb87

SHA1
e97ad6b4e8436f003d228cf63da9fe740d2a0085

SHA256
fcb4fa1fd215b9c4e728b626a3a1a166fcea39650d3f7d0cd76fa84aeb9b78c9

SHA512
9aba7f04754f90df6c230ce96ed50c5e3e9b6c42d9eeb834a56aff958f1cdcc867e7a4d3f2d9e2001efb5874d6121bf744b0b95dfb377676fb36f518f08ab610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eb000a82bb455fa339c510b25a1687a

SHA1
28eec15250fc22de89f5709358b2ddc2ae3f4aef

SHA256
84700ffb032f62c1ec9b6c2b92a3a5db1c95575eb211095f473fe8b8ecba54b4

SHA512
0282f8a50d813995ca9b8f33e3733f586a5abb6837d120829fbdac5a9e4e2c554bdd2ec52466b8890ee375101ce9d2ec5bb9e21fadda7f1f6cc49f915eb46677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f29abb31a1b8ffa9db7579ac7f7c060f

SHA1
e44496e32b6880b36f5234a916baeeef9533e4ff

SHA256
cf3d444b5dc5010e5517aad0d5aff9086440d4ade61ca4fc42142d43deab5565

SHA512
d4f3e16076e70061d669f7d1dfdd893d5252991c327582dff1d016b91026cd60d889738bc3b5db0d2ea19985cd5ada5ae5b1c1bf44966b529e8ff651c07325e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9322ed986042d5665f1d774ab269625

SHA1
5302182774a8231e15f4313c97ce0dc7fca2e31a

SHA256
955cd9842d303e9c902727bcb41e667d22081f02cb2544abf5e151f5607dfa33

SHA512
5326f50c83467feb57c24af718b77243ee494fec45887e67ed81fb2c3838a2ceb00332ba1fce99e06e71fc6d4ab47de66db981ba663b8398ff9760d8df7305eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1701bdafabc24e3583aedd3b949e50a

SHA1
abdf86dad73b083d8d88d4cf880b9663d574ea6f

SHA256
6de957a4a167ee0b9bb5e6b5e6f86569e0f86ea7bee1b411ab1cec3840b16306

SHA512
fa6a57f430d79d094a57e847c6d8b6c0dcda38eb4d1ad7026750a264f156103ca516518bc190843d8387bb25c02e4a9e4d3fc257d5a8763c1573738d4dc41284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e8409d3be0a34a9d8e59744529a7ce8

SHA1
d6912dc756eaf9d786a63db7f0e859d818311cb4

SHA256
6662988bdc754141e7fc71938d2c2b9e370d87b64499e789ec3f7cd06fee0866

SHA512
98250cc9543c29a5b4d331103612f34d7c5171ac8eea30b43ec21a17ee842c232e20420755e816d9b9be00e986d007126562e70344b8cef42ba1877f9356daf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
712c8af288956c9e5f3cc55bbbb0cdb4

SHA1
6244268399f3a9f067d6d7cff1a7384a7883dd01

SHA256
db2f9a13afb4d4c5617a4f42ccfea63f73eaf4cbf3b241d302e093b5fb49c5d8

SHA512
7285f900f720eef9ded7ebb5df1ccfad2fe21f9f1d609c49b6681843638cf4a178464826a780a9a543696d60ac3ebeb8be69968d084f2182303f8ad00627f022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ced4ad20e143d43c7d847b59559d9065

SHA1
f7e691febfbe2c0b1aef6fabc8ffde54b0bcb686

SHA256
618c4e2ec0cda1bf0594049e6497535ebeb9e2c4c1ea28e0f385f26eb76f2bae

SHA512
0eaf4d29ed8b6896f356c88712f2358912f29801f167e0b95f3f8d453c93647b9b6b1728793dc708378e02722a379911792494da4d3219441bd1973933d4b491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1bab6151e6aafc84be4fe6892f6a969

SHA1
af25f00cf68145514ff440fd966b09af786d7ee9

SHA256
a8a14ae2f218df99911f70724ab9db82261c0277996a2f8e878eb5f20bcfe013

SHA512
2017338a1a184b1772ef5b2e4874c7d6ce44f46591c31a824ee7496a648d38a8a26879269e52584f09594b54108686266aca77bad473ed4290d4a9cc82bb2a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5fdd5ea50f75214e688b8f07bf236b2f

SHA1
b4da7194bcc60a0fc48b587bb1f0f5d3a2064c2a

SHA256
62c4239e23325e7b56c979cfeaa8f9f9cb065fa5549fd216a4202dcacdbaa88c

SHA512
e0e636d32bfe41dcf7c67902762d0d4eaa52b43c6e79b56c7eb516d4bbd36ab526b8fa47d82ad575e99a63a2110138bcb473c6c68e493e704e56780a57f3119d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\plusone[1].js

Filesize
54KB

MD5
fb86282646c76d835cd2e6c49b8625f7

SHA1
d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0

SHA256
638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109

SHA512
07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B45.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B47.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C08.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit