2064a7153be6d89612bf445a8d3803a9c8d4a47d0cc6404ff59cb0791bda13ec

Analysis

max time kernel
145s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ea05f892995789401f315b52ca657b_JaffaCakes118.html
Size

139KB
MD5

09ea05f892995789401f315b52ca657b
SHA1

d434ed95b106064da4d89108afa254b94c579488
SHA256

2064a7153be6d89612bf445a8d3803a9c8d4a47d0cc6404ff59cb0791bda13ec
SHA512

5b31485908fae6a032262012c090129983b780c35cd69e9e2b29cc22633732dc984728af28ae57acb750a5eeb4bf315630e155c3ade625bdd02f2efbc50373af
SSDEEP

1536:SvLphH7mukAlPFpyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:Sv7Sl6FpyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f99df8079bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFF2D1F1-06FA-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420647873"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000af593a27d71a2d16f628850a77465fbc2aa0191705f2bda9cae044c0db6d2ba6000000000e8000000002000020000000117d85eaabd3f37d42cc2b124843c2049f61690335e300464abb932c8872a160200000007320fc4c2a0af1658d3833a0928823ae0e512f5121cd30c4cb2a40f6880bd80640000000f110b474b9e83a60351ae102ae3400405585288f39534b71641e293281002c16592da1b16a0e4f40ced7de6824a5160587b140f4b90fc6ea51b729e212e8a725	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c47a06c23b6a1c830d0b3ca99b214bce0bc492867079c0927b5505ee9613fa53000000000e8000000002000020000000ec008669c5a01f1487385fbc412f61d923843d72544c6a0bd48721c81999fda290000000fed2891e1c269e1d57150b577307d3304067e94711ce9e99350632b9102a914e226c2c7ecf51538caf1866026b1eafbd75d4583db5abb1686a46df5afff4cff1ca3c853e310fa27e3f140be6cc29a496b65304f71de1f5c7a643d04e967f5f3d126fedadfa4a87817b22ac5d55f3063d9f0f68d707d825a53813c65872870f046ed593747c8ecce2f8967b6928bf214e4000000096f97868e1d23011b0e8c9c9729845617344434cae99adce727ae63366889dabaa4078dd58d794ca3a32019273a8596196cb74dca46abe5739761e7374ff9e6a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1884	1968	iexplore.exe	28
PID 1968 wrote to memory of 1884	1968	iexplore.exe	28
PID 1968 wrote to memory of 1884	1968	iexplore.exe	28
PID 1968 wrote to memory of 1884	1968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09ea05f892995789401f315b52ca657b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765e3d5ef02316113630cca16380d6ca

SHA1
e37e98fb36187db7a2e08a816cbb776dea99cb53

SHA256
065e53356c6e2f9943399078e999f900200a7bb2a403e9226a07fc81b7a73b9a

SHA512
cb9f4a011fc15965365c09cf916f6694035a87fe7608f68eedff743d23577c19c9f5a668a562e4af9d4185a60b6f9afa16302731b51703c7e7cc840392c2bf33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47cfaee7ea08c74656bb8a8c68d7e8a6

SHA1
2ce8a3ad846bd0d3b5169fdd2e9d456d74298435

SHA256
93c5a189d7e5e0103c382060afe0a4cb9c20487b9f5e999022cbfb98be1c10a5

SHA512
3d6fb051801ccb6b1025489a30aacba0ce82eb200711c6ee33b3d6335f7c083e38699a17873504b77aeda6988ded6c1f97a63b26519f1cb37f0de895563949ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a0c1f0b3b68769520d0275c7910df6

SHA1
344e0af391ddc15314668e1e5ab4f5245af8d84b

SHA256
1062006d935577958fdeb8e4d5a1926f9759f6d256d748b0145a2cdc6238e792

SHA512
ccae1f4a55ba584d75c0337880138112802c190b91d5a53ef39f939e69671f079daf0636a567ab90fee7f14980d1e4641030fe4afe831f958d18c3288c173469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
789c1d25c45ee58c72ee4c32a2a0a590

SHA1
f39b59cb16ed542ef6b258873655c511e722239f

SHA256
7b36b8f646e3e23fceff637239c06bb69599d3df993ca83a15d8d042956980e3

SHA512
92ff4c858be1495c786e826a24f932d7070d13093341b11eb3e1963fbdbd10d8a10fe55d73fb947473b1191815e7aa91921addecb280c09fa0319080faf24528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56f9fa09d75cc5d34db961362ba8d445

SHA1
48e61680225262a465028434dd06cf59f1e04a7a

SHA256
a00be74ae2b62d4c508b76e6df88c05c57c93319a6b1e9a93b5294ced94e8363

SHA512
7a53b33b01b852fe8a5162db7daae037a547b21d3900a68b8a5471223e3e82eef28fc980807e3f1269ce5e08100151128c80a3b4b2d0236456926524a5fdb900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b85fb44f42fa9277587778bbc385c4fa

SHA1
36603e8cdcb7b8d9ddda9892296f900ee08f1503

SHA256
74f8b018acbe7ae8e69d7431ab4d4c2ef3722500aa79381c883912c127d63419

SHA512
442d577983deb7c5e51f0feb66ab4ee0a9cd578711315715c9b26fb70c7ab10224fd7178d7ec3f1e920079fd4389683ea5e410761645fd7375d83815670ca3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f337dfb33079e3b354d2cb47db2094

SHA1
0e0fcf409a83694dd6d36e9ecc38af01e11808d6

SHA256
a9811a02de80c37adcb528c6f9c7ecf29984abb2e40e52365944447704a06f6a

SHA512
f3811be090fc54b7ce60cf892a5d49ec48177f72e3dfe2b313969dafe1dc3eb915d5e58843b96604640058102ad1d2b603d2d958dcab87396503a60c0d9d5ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e20d9ffc8ff4ff4bfddcfb2e62433f71

SHA1
abfc94e33878afec2c17777f572675ef7cd4dfb2

SHA256
47f3592b026c27cdde1ed4be6706aee0997384fb7c6ee2fb16ed9fec134febf2

SHA512
aa7ec3584c5f8bfdc6b882db2daa9c8fd6bbe812f1a6e84e79db6747cf3009d3a40d110fe7a41b124632a5a55d6aeeaf90ab3ef9867c45124e0224607a49f47b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493d03e25e97179f91205870105a4792

SHA1
f5c53a8bbc2d8b7bd27182d86cc0e7a459ceeef8

SHA256
14349dfa580d1a3031786dcf6f09a9e8c7d33d767f877ff78f79b9bc5e0e7885

SHA512
cda314b2e6df81aed43e5d9ea5b44fa027f0c08a4f6f20399fc531083faadce811190191354cb40e5f79f32a320a1af13d50c710a5632a7bbc544d663c13c77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cb9ccbd4fb043316559501391e05358

SHA1
bbb8e8125676ed00617736bcea5815d2028eb0f0

SHA256
68ba478edce92c3990f57b4b08590a16585cb619db0d139b12b9084da437ee1c

SHA512
71df4e6d89c11d7269261fb91efdcca1ae762e101783d513bbab8c930ad0670fe66ac3fa51433e78a9a637da82486f4747a67fefef260721490325e597c80610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23bce79f8624d4fa4ec4aa6225ba2a70

SHA1
e5c4769502384adc73a66663dd389422cde2c3bd

SHA256
20244ac18ccac1e00223c71716dd77b78797b6c14bab314570ac3edb83ee4352

SHA512
a08110df4467d8ee21634a0a8fcd65468623625857e781c271dd3304a45ed7973a246b4b0a08e09dd27db786af372fba7bf6e54ba171508b441adaa0e6e93f34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
572d29035d2cdac7ea812b64875c5c48

SHA1
354d2e2a10fca851d170f1bc2a29bfa26dc33956

SHA256
2dbeffed2273b59980747b9271e1e7a5cb412ce8038f0974de3fb5911f5ecf85

SHA512
0909c9c9227e2138a512cc38147894e22fb87b7dc875f1de09d9a65db3f0a3e3c8918190e3f5ce24124056e1ad53aad8781e22a636f3d75a8de4f56e20e869e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b3cfb7d5a869813fff65737bf27bcec

SHA1
89403a37ac561de9d7814ef5bbfbc5527aa8b4d0

SHA256
7a4d0c17f4678bec2553cb3147dceb8576d5b365c5fd8d752c3b8434e834f301

SHA512
a03936f7d9022c6dd323522dc65d05a4d89429cf71672147563ab63d60307fd290ffaadb3057dafe47546f19ec158e3cda31a03c07dd366b03e5792b27ee435f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c05e4b1d18579855976d62a95978968

SHA1
177acbd497bba5e8f79394b638321e929170bb9a

SHA256
51f52fb79d211a9d7fcafa3ffff0003a80c1b3107085d6481b8a26f183eba571

SHA512
13098eef7da86a763539be0c4248eab80868f6648259890e50863f8b942288a02eea5d7ee08ee7c558866b86f39ed6549729019260d83f865cc05dfc95163f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef36556e4b654bbafd947ec8064fd1a7

SHA1
fbaedd2cd7a637f6a3ef547085af886925116c0a

SHA256
6d47d5f5da6c0f4c98e0e9b83037994c300969f0ee57248a08ff1cf092d78632

SHA512
67f4f76a3ba4b208044e53d254aff0aff195eaa0e40718673431026e1e700f052ce2e9a0b892f6a280a5e53baaa4449311b185cf633fc5188485262d47ede91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0E2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1FE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2AE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit