4bc7e51fe67cf63910c4df05d2c17fa78eb2407a337248b26c6dd0ba710e7315

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

184d16f2638c67b851818ba0ab641e17_JaffaCakes118.html
Size

461KB
MD5

184d16f2638c67b851818ba0ab641e17
SHA1

7565e14035f7133c3ab9ecd8caa09c75aba3cbeb
SHA256

4bc7e51fe67cf63910c4df05d2c17fa78eb2407a337248b26c6dd0ba710e7315
SHA512

b2c59ed39b6d28cdffc222f63a5dc8b233f6db432c66acee401fde33b496d3dda674eabff75ccc9ee3dbcf61485dd9effe3be260db15ff5c0abedb853fe05977
SSDEEP

6144:SDsMYod+X3oI+Y9sMYod+X3oI+YJsMYod+X3oI+YLsMYod+X3oI+YQ:A5d+X3P5d+X335d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421084836"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42F19FA1-0AF4-11EF-83C2-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000037a3e8c49b9283ee144dca499893d29b098133c1f987c40da4735f40ffbd6051000000000e800000000200002000000056f3e6fb1049ec48605aa03934d0982e2c827703cac0bdf1c3bf2e354132656820000000cea9e33065a95078b16cb4b9ee8af87f86cd7ddbff8e1a7f0bf7deddcd9f99ce4000000027f1d7a74e3e599a2be98938746fd3e0c7bcd212dc73be0c958be46191a123f5d2ea313b815ff5da3b25a35135db61daac395638ef16fdb10db553c97e290684	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fda01b019fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000225ef9244824bd1d82150ad90fb4eae6e91fe1da2c7b28a71b063abad4fa3ffd000000000e80000000020000200000007c929f7f278a949efbb9fef64bb142ea8cc1ec6e99e8332a609532a0f5bddbdc9000000017b13d3b4722907153ec2d2df6a12fb36f9a4c82da2ad9bd3656f636ca11afbf9347ec3714416b134fea215813189153b989cfc8ec2687352ea297c507647c3a86bde256980e43edd796bd09d75d31378c05eadc311eb34ccf5874ebdc29266092fcd9ccb6948468fb12a9bde50aa810088e0413773b6de887b25e736de36a60231f11734416fcd03a0342ef7def67d1400000005c48099685a096896ae43eb3f5e1ed1a47abccc0861898bbdfc13ecd8100a70389656bfefe4fff432ff7424a4ab789e0fc76d7a4436b09d6382f2c7222645887	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3004	2212	iexplore.exe	28
PID 2212 wrote to memory of 3004	2212	iexplore.exe	28
PID 2212 wrote to memory of 3004	2212	iexplore.exe	28
PID 2212 wrote to memory of 3004	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\184d16f2638c67b851818ba0ab641e17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b138256f287b5ebf3d9b03925da52de

SHA1
022569507e8f54bc74ce53799263717c5698c5f0

SHA256
a391233b4feef1125c8260db63cd13f43474eacbac8675f1d64ed779591dc57f

SHA512
e7963c6ecc87eaf037d7cc19e478a45ae0e9db61449dc935eea731fc23113d44444b4ecaf47ea34ff62429a30590e5e7c15d0fe9e8ef06239adbe31a13ef6262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e0b4236f1a907991b6c8de6dcc27fe

SHA1
8fb1b6de3c590716988525645709660316a3cad3

SHA256
51c8305228642f8efd482ee180684b3278bc68ddf95e9b8335607d18ae90946a

SHA512
6674ef13dbf1dcd99b0f6c10fc745b588bf74d5c32b68e053300ea1b7c8f167637abf9c7f95629059a0ce95db246c0d635a10c6b8ff931154d0539bb6d09edc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
177517a46cc2a25a3d6301af221e6847

SHA1
fed94661f35b57925e1ad090942faa9a9f228133

SHA256
e33876840e0f8f02483afd0aba9447d31bac709d2a8c64c31cb123d7cd5309a8

SHA512
2915cb0c6156b8a4b03f557cb21f2fb49152d5c5271148aaf894a7ef70690686f7e07bbe9cbea99b1ecd99aacaa9b2e2392900e651f304d82b55c8de81edb9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e61adbfba5c6d38d1ea3eadf25ad4a5c

SHA1
9322d0df9d38f08c73312e0c43e58818da089b34

SHA256
0b04781d6a6bcd405b93754854fafcae4040826630a509cab7d6c2645fc1d8b6

SHA512
491539799d9f004c27a1ee0ef7db755bb9b9a839e810685eda553a226e1a8f542a2eb96c8d30925889ac841db3afeca9eff502063ade2d25a2526e6845ff6f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a37d6e3c106974e2c524e1e0e738d663

SHA1
edf7b11c7d9cd084f6b8cd568bb42680fdb22173

SHA256
771737951ecc6c61611f492d34ab116790a55328a5d8846a07d8d8de71d63115

SHA512
5c0343173bfab231b1548349ec0cf17c42daa0b7a23d24ec77fbfd50b3a1602bfce50094dba8ba869148469d70950f4f49c5dc5f70cb61212eb07ed1f2e9f54a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da9b6aadfbab3fa4ae30a8e655033346

SHA1
4f8d53ebfc518a1a9bcbe5fc0c1cd33257ac6f6f

SHA256
e72d975f5ef40da4f3853dba33cc9e7b3c4eb43197518803465fdd3af392493f

SHA512
176324bf8a610d690a3c8e31f5cc8ab059337f00f799ef2b3d27e240856fb31c1e604e36723b4b5b830af64ccf11b59643bfa52528f1e94f7599e25d0f0392d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b1eec2082285de3c4555084f6e26768

SHA1
700b6a3faaba1f63ff083cdc3e0b29108bc745ab

SHA256
71b788a60deb234156d9f36392641fd5ef0a65894f92b7185aee27cfa91e5ef9

SHA512
e90783eeb87879feb87ae834db05a11d09938f0ce5d953251d2558d7f57b3d34f0de01bc69038b052e91181656cc7eb7d69cb5d7d4c11409f9488db0c6f6174c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512622085c426e02dfd7b17442f5cfc5

SHA1
f81d616a094cba5e731f92236d8faedbfcb739f4

SHA256
013732f96038160a4d381ed99efb9f15523059ab62fd53cab918082fbdc13025

SHA512
5478c6c7f5d289184bd5105e6fd67bda1a7175c11fcd244836588151d52cc2073ed79962b18a81afe44953d75f1c20698b5f4ad8aa9c26fd32129eb3184c614d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e250ba453adc02f2fbaeb57a01d4450e

SHA1
eaaa88b564f43ef39cb0400d8f08db850833a417

SHA256
a9f0e23f73efa063a7a55ce14cf14cfa84fd3cade3da98d5a7ae074d6c46f48b

SHA512
1618264ab973cdeb7b5f47dd501cd408a2f9247388cb1dbe11c031a910200623953e49362343a48f07734ad0f07eea88fd0a25a3462c9772048306a600cb77ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2bdce0dc1b7d2b7f543cc3c33015cf1

SHA1
f5c1a7ccb3ae01ba6fc0e5a5fd76f06cf1a99231

SHA256
95602c3311fe0d5e623b00cb6888afac36a5506e13f1ca7c3d46e0dc83914fec

SHA512
ac59e94c3dd52417ea7e444af211f81aa1fe97ee89010ece1074f9a74fd388ff2d831abee3e04ae2b9f418c6cd2ee717ae17f51b4541e485f0c5fd64d0ab0bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a78054abd24d9e72762beb718ca940

SHA1
30f6cef8a7fc1daa3284d6439015bd2b8175cff8

SHA256
9ce6211ed944829ba77cc5e7c7119e6faa47510919bab75c608cb0b1dfff589a

SHA512
736910291a32f9ff4746deafd3513a9aa121f7d73838aa5877de5e46df3229c0c3d8448a21382417ed59ddb91bdd43a115703f993f634722ef6e3ea2c269888e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9caac9be1bf8897161b5eebc7e461466

SHA1
bf899f63c21851505d57311171c85bda907dd049

SHA256
2a14cf1eca82ce1d751cca419988c74660062b6f26c5513c7d7b921572eb02a7

SHA512
4ce8c4e279bdd481444ed85855c952e318360be203c4f19bcd04ff16847cd900cf774a9c2d01587f375bb0d852ddf60ed8d3a69179c860f25b53112dabac2c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b21ac8c3598852f761e39d20c03ec9c8

SHA1
40b4308ca5082af15a75ae12dc9f590b0b141a6a

SHA256
a6c9a99e02e3841de9e3af3cefdc02e30cf61abc1cd9a9a2d87e985248d8fca0

SHA512
14066f107170ea4c6185731d364629e2d21b78a0e5fe5da9bf6b3292ba995d1514edb9c5bdf7b1e75e10148a72c1422923d2ac0d18198aa8e36f950149042bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c015fb16c1ef179793273deff190cf66

SHA1
a521c8c8537f6283a44990f53c30ff3e13098757

SHA256
d1cc3b066ee7256c21d0bc02416179738a0c922493a0859490a400b1a8c10d72

SHA512
6dc3397d72795a6f21353703310ea67b0c3e2137cfee10b2a92dc1f9e81f656b3feb017ce6e844f3b479b8b9513ddfce1cb28ef0908bdab9dac962d394a2d0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcfebe6e9bd60855f1bf6c88337b5662

SHA1
71266d6dc6b82d71f02bb77fb9a924b4bd3fb28b

SHA256
306fa36d58af465aeda722c0a020164c55bb77d05adfec148f4ee86020f1e1b5

SHA512
4d2a67112af54c7486c50c292753560bb53cf231f456cada5f5521f196bbfa26799ef06fd56f5a69ce8a593f66d97bef2e0276a7d49d85ce80efa1ae8db047c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F69.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar506B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit