d5910607d02ed8e3eaa7882be7d863b7a6abb06b5440b94a4d3cfe0c9b665608

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c4dc20f319b8834e2b67935cb26f581_JaffaCakes118.html
Size

16KB
MD5

0c4dc20f319b8834e2b67935cb26f581
SHA1

c8d84ca31d858409471c06026092ff90f72fe1ac
SHA256

d5910607d02ed8e3eaa7882be7d863b7a6abb06b5440b94a4d3cfe0c9b665608
SHA512

3c07727494b2807e08ed98690b8aca13e37355c40e1bfc4d1373ca1be54ac7d00c443d6a27bb34c875e91b6bdd5b26725c67d60b87e1ee3f144691ca0c681143
SSDEEP

384:qR9rY6MZxmR38ADR0/ejgeEu+UNKOuzZROButg:qR9MVHo38ADR02keEu+UNK1zZROBd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420743704"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{006990B1-07DA-11EF-A0CE-F6A29408B575} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001bff7541dff588e95cec49dbb4fa103c688e8bf5745db73a1371a05b75025ae5000000000e8000000002000020000000172d64c2639bfd40f4db488180050c0336b6abd63f53780c370ac61b00eebe7a20000000efad528d549f5dbf7e89538e4d7f43fd8a9fe139af3bec800e1c31385ca4ef0d40000000e0a091d21fc9a9cecc91201a07dba50faf11feb7d8d82504713fd7e5d318dd9cb39a4888d10d952f9fe96002a194efb60d6cf19572a8ccb366f622b1e39e5e61	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04f73d8e69bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000041f9c23886dfb74656dca142f8f86532932c5ddb20f50b485df040ae5a887fb9000000000e80000000020000200000009c095e8adbcc41158f105141885474984ece6703e2a825c9486cbf216d7d215890000000c21a500adcb0cf7c344017c8ad8411bc595057128bdc824f3013ecdbaecf69bb348f9c6f943e79e29cb9263d349a44db9b9614e202d51e6df0d5338e2a1bb5430a2b9bbcf9dbee4e19bfb00a7f76697e56644595575da2c6017f155c3d27ca78a68fe8abbd76c8870c860cc51ab332e43903c6d8a8b3567e96863a06b534bc864792b2afb80c9ee098e81f76eb9fb06240000000330289b7c066c3d4e846a69ddb00dac7e351a81c1def5ed4249522f19b8bfcd238acf413258c0d8a0628db16153df8fe63cd353096d9fe65be368abaf767851b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2820	2124	iexplore.exe	28
PID 2124 wrote to memory of 2820	2124	iexplore.exe	28
PID 2124 wrote to memory of 2820	2124	iexplore.exe	28
PID 2124 wrote to memory of 2820	2124	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c4dc20f319b8834e2b67935cb26f581_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4517e5b1bc93b315d75ba4388c62b19d

SHA1
66378c2a6ea312692c911e85456963599d9f5bd6

SHA256
5374d0690860d396aa7bd100b8141836333e4bb2d131181026ba508a674c7e0b

SHA512
a55996759130cb838f71f1f4f66c4488fa5d81736be8e0cc0041dde5a7b32375c8424cbe452e5c20bc3e5760039b0186d8bd45e22aee91127308ac266559e905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74b5722356b283b6eebe358783d5007d

SHA1
677ec8eb9aaef4cd05f982a0a2a9afe3c6aa71b8

SHA256
9d7ac0856657222c60b42f6173fa370009abe3ddcfed9f9a58c04ea458152875

SHA512
af55c5bfa45fc387a0d82bfbc8c6835ba19badb0318c9570ff314a61dc228c29960a307a2a94ad74116ee3382cc3146f847cc78ae8447f6711c29c96d9bc9add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f16bb83227ba6d7cb52bf01839dced5

SHA1
b77c6ddecf9b51666ef8e9b4bca67f26ac3aeacf

SHA256
7d3819d14c0d01d77e8d7c43780213194dcc256f0d37d50b070dc6bdbb991130

SHA512
14757bc56e28468f6e2ad92026874a0866c381ee1f1e4d424acc64147b7fed4c74a0d6300500b99dca00395a6b7c139640162d4acd2e712da3af6ed739ed15f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21cf92623e3e47e65a31f56cfb3d2590

SHA1
baa47a1bb7cacbda0ae8c0e7d3c7fe1883443dc8

SHA256
6874d3c09494c481c592a49e92946f2d292f1b30ddee519a0770fcb8200fafe2

SHA512
1aa20f8c103b9d6d60d652a1e5a5d93670c4c31f14c4268127057accbe7d5ee3c97bf60dd08146eed96c3012f7bf71809a0a94bdecff8ef9869660e221b35229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f2fb2e750a066387af5d4f903adacb1

SHA1
6f2acead027bed5c572b55791bd36f605c865ef4

SHA256
0c071811696793e832e9a4274260c64574bfd71fdc7d33c8a3d2a1e8c9f15722

SHA512
fc61376800f84c243e77e193db8403d644b29dd3616788f4e159d3c7331a09ede67319a7ac3ed6a654a4104d738ac320afaa36ed3b92aff1483bef77266ee306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e80542edcb363ff90f3804f829947c9a

SHA1
2e58af0f837f39c688e40ff7697b78c0fe8051db

SHA256
706a3de37190b29a8c088ccfeb802b8d3d081ea60a6612613e30d459f369406e

SHA512
10957e98515dab02066cfea97a02413284769235a163596a308c2f46349fd31d9c2ed0993c670d7f2f523bad7c2432d0cdffa473f81d9a6aa3ddf995714d21b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0fa7701eff6b277d90af0347e18643

SHA1
ead24a4e279c144cb5909cb4fec7fff3d368af79

SHA256
03c5d7e800c2d91cf6d8ca7e536cb8e57470973ecf7ea810a320fdc4b8051451

SHA512
ac720a674c05be33c8e5b6195b167ee0897c707e8266dd224aec00c5a496735ee9269926bd6b0d5dcd49e4f3f620b3397ee122e2c62af42f331ad8fc7b4a0f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0459972623adf6333c16763d9e17a329

SHA1
e97279b22624bda9f15ed3f8e482f66882cd3944

SHA256
e87522472b9299f8d373fb4d7a1b1295a016818e756d845ca56cfc544ae6610c

SHA512
7b395401fcb2c45f5b2d3b7ab5d7ca948f3e505872c362b2ce979499e371889f3861cf427ee1b7ad6e9fd31bd7e8cf1b11842b08812927d49563649aaa4c8512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b67e7ad139c6e8d5d133afb695901345

SHA1
8c2e805cff0c2858bf0ca4abbfce84c33dae3b20

SHA256
45b9b6b5419ea508555a9516eb7ab95dec5cf033f4c60943d711920f2556cb28

SHA512
0ce2e0767322b1b698d3c43d40a2ddff0a54b13cdbd29f5f0f9e06404712bdc5e41d7b5e3479569aa98b6b5081ab28d5e3c991a0bcb363fe26ef3aa32cd02353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31c8b90fe697a401212beb6814bbb36

SHA1
ebe56931fee273994c504a277a24422557b75428

SHA256
970c44e4c47ed5ef28d1e79fe9499b383dbcaf98e8bdd03b02eccbd0b5d07996

SHA512
47816e0e84b8afeff623f3d114143a7445b9f76d7124d76a3ffa53b1baa853a87e2f1145db6f3bc080b2162c43804f40bf09d0b555a2497f8f12c05740f396ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03465ebf11bc1241e33edb27ea6d2297

SHA1
029921642484091d1de423bf52b72599294ee5cf

SHA256
08703ae130f7f4a2841c68d4f8afba6e1eaad87166daee738dd88f87ca788738

SHA512
8379dd62d2f8cb45df61e2bf4355c4bd5abd2d55ed104e2b1bf905d1a8fa3d85ff4d04f02d22777d180e1859248cea0b8969b7e9bd9be3f0f5203d0bb85e6669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e01be29f5150805f45f0240743ad29df

SHA1
c8614c5af84b1b4b993c82353f6889c50f40110f

SHA256
f7b3eba409252774390d291e40c623689e82cea2ced5f88e47b10c643b78858e

SHA512
1ed32ee52704a31527adc0ccc1a5c309a046d04d0fc8adae2efa1a88cb4703bda2fbdbb682e007a5c9322be188576283c51ea9f6fa17e4ade9e98162991c4916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d733585d19525574a8db4877bd941903

SHA1
eec400114c7cd5cb6f6fc6e57dd1d6bbc379e5fb

SHA256
03da648ace5dfb25eebe6374c58b050eab8a82da225cf77acc528535ac496ce6

SHA512
88e1b550e591d7e4cda88fc7d14a31d4034542b3f871d868621fd2f7a9f410c3e1d7398d2337798bfa644f99b48730025ea6d0df3280cd6595cfe18d74a13d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1495c2ebcb9372a589d31f1dc90c425

SHA1
50979b24d5d6d9930ac30bd93b7036869a368d99

SHA256
9b97470625f911adce6ff20821d1fec1216557597c2133bbdbfebdfb284f693d

SHA512
41fbd159499b01be77cd9a242b3f635f624a02be2a21ef4d19a52fb86735ab3a7fdffc2474c7747d54937a5ccb8a920dfa362d716f0eabdd54b8c07e22a4b94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4922.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4995.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit