fbc40fe6672c9e221d3cd92c024f05a6adb9c4b6f290619988d63ec7db150dca

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20923dec4182fa7c366a11b83a148b04_JaffaCakes118.html
Size

461KB
MD5

20923dec4182fa7c366a11b83a148b04
SHA1

e4236b6d59aebf83fcb47cf4dfc7b48ce6e04e7c
SHA256

fbc40fe6672c9e221d3cd92c024f05a6adb9c4b6f290619988d63ec7db150dca
SHA512

c0fd84ab76ef422a8fadbf4173ea0b69c2fff5fc29f9e0493c0682f3bcb6400718804c41fd9f6afd83fc80beaf39789b58081317570614028e021086ba877acc
SSDEEP

6144:S5sMYod+X3oI+YaQHQVsMYod+X3oI+YjsMYod+X3oI+YLsMYod+X3oI+YQ:i5d+X3g5d+X355d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408de3de7aa0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{064B8091-0C6E-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b454d6bddfdb1941e0c7538363358dfef50f83fec3e41f9f6258bff13aae6560000000000e800000000200002000000094f8d1efa6d90671d7467cf96dc470bec9fde738cc6ddd6243045a467f31710a900000001fe6a2aac2354b33c034155b1d4af41e22aa35e3e8960db02b1764147ff617cc726d6aec834be7127259e4f215fcb7f2c3c57e6c702ac200b4ac28781338c283126bb5cdfbc011ee27506cb499e098bf5af652709803491febcb6722c5b49b7721d1e141a55f2a91f67dfa1f8cd663061d3fa9e7cfe2ed442fbd4c2cb96d89d4e645075381194533ab2b5f585276514c40000000d8a3b00a41040cae9355009d35bf619c2e47a5502330e44b4c4365d09c73e9a1fc0d71b40350b4ca1add8d08dbdbc68b434b5875c7f9723f5c48f6ccdc146a7d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421247083"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000060a6d1ca39a99a0f66f9fb555e288ae64c1227caf4e11460a1aa6614082db144000000000e800000000200002000000061de74138487f4143fe10908c485474dd14b003e2bf1d7d9247e923d3a6edb4620000000b164789096c2c4c10320470bea3bba56179b66e1edbce75f9cfb49f25d665ff44000000073998692ed85c52a7c1fe397859bb5611346c08b76c7ce51ddb0f9274d5eca0130ad4df1d1265ab6f7c1a4aad17d55c1db1365938345943cfcced143a44440f6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28
PID 2932 wrote to memory of 2560	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20923dec4182fa7c366a11b83a148b04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6421b72478e4d109b2038f4e826d45fb

SHA1
88a884ab0d0ea411d861c2442d7c3d56f18cf454

SHA256
dd166e799bb66ba3dc3c97a2368a167b981c0524a6f871b5ec3f087e2c1897c7

SHA512
3d78fc96afe053743fdd416282701c38b2720db7b64a264e02e19c733e65a20404d91d3ec4dce922bd775ab34f0675e5e4eb395d2d0d8676378a66f932ec468d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
566e41b49a952964a9eb6c9c349f7131

SHA1
5bd2bea7f411e1b5c8b0ec5f87c5daab93869ffc

SHA256
81cc9dee5de9705e12667d5d1032fb71771e0e0dd229e1e68ba8228e151e9373

SHA512
3aa2683bf5ef261c56f5faeb9dcdf295622f6fcc47bdb091645c38719308331c25dd13812d0f9feefafc510dde32e1ea907410ae0112ee9e795352bcf580323a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1762ba6cfd36bbba92c4f70b118f2a4

SHA1
ec1afb67d325aa8179e7317fd9d6b3206810203b

SHA256
7863061c07dc96ff1c8746c667725f7246dc83b11c8ead193f6140ef18571e92

SHA512
4eb6e82a6aeb0e97d7452fb84a568b9906b02fb9b4422c68f53f30a83c9ae0e1d7f4aeaf8ded90a6f522e6be6cf1e05c952e7e9297fec6008688d73f615277f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f07a6ee91e605f1fd9c2cf86a7e3b4b3

SHA1
000b3113724ff629f7409c30aa9cb15ccecc4480

SHA256
7b992e4e2a311bbd350175799e6b38fc327b01ddc4f03fbc10946645c335ab5f

SHA512
25f3e23bb2eb54c6da74dbecacad7290770a0393f9e966b2e33f2f3a52a5595780bf3a3a3f1830b8950a371a9940e104f0cc142bc3dd98fbdd96c3ab3f92c47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
067c612d3ba9d5c2e1bd1365d77ccc6a

SHA1
57d23fa4b686f04ca9339694ef3c34c1e6d50a40

SHA256
06dd9be2ff5aa33fa4c63ea08e846d380c89c2cadbfd0893f2bd4e6339988e6d

SHA512
80f54cf71c17d6d2c06f805bf2facfbaac57f0fdd47c2a91302505c729dae33aa8bf7828c944c152a26a3982f3fe10fb156e8b1116ffaa5280da8577e1bc5857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65b62c77281786e2426a94adae166d73

SHA1
78bfa9365013af8b42f32cf633ccb37eb5fe7176

SHA256
49e340db0af5d422c005af9cae5ce90f56c9e9faeaba646938d1a54810afaf6b

SHA512
b719fe01022cc7c5e71fbe8d00235d8da38f702f4199df597c03e6004ab146920fc2bac86bad9f4cc55b6437d6507324543538601798f42fe6f578c2439ea30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23c57051cd6e377483ed170479b926d2

SHA1
7a9f72b6c3ee60edd295dc652ee34dfbee08e523

SHA256
1eb8356088704ebd65763b3636ea602f49436187723a85924a6a36c47a6ef2c3

SHA512
0f729a7b6fa341be321571da66ca93e647343fe1c5a19cfe63741afd5babc11de80b8a495688931d1d9cf51b172d3f80c94fa4fea04cbcf59495b032bedfcc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dd5cba8882755f46bf43734f6213400

SHA1
bf3100632bed327c6973b874f7f1bf4123ead39e

SHA256
6e494c787ff0364c238e09748fcba80e7f61e4e085eac7af17e62f1d230ee282

SHA512
694698d809a72eb4de6b18419635f8e4d48dac6d7e0f9baa404293c57cc0080f203edc3a9d304e8380a41ccbe3752483a2442b400462dc0c95b2cde14c2f9127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b05a0127b2eac172998ffa486c43d23

SHA1
a57693e5b7c4db8fbe8260b737bb196caf7e81fe

SHA256
49c86c8deb06a2c3063d89b3dc769717bbaac10e92fb94a34e002d3fd2649dbd

SHA512
8b15a6eb6eed14f1c9f0140718012ec8de505e36d890f674b5e8d65812641257551df2dc9ea91387fbd38dc99b35a45525701bb7a12a5e6b578b7ad8532e6869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
231dd0b166cfccd4c88f22537f60ca22

SHA1
7e4d6dde0e76d841f8e310ef7b5e14c8a798c6e7

SHA256
fa653ecc32864dad34e85ba70edd2da0ac4e3e8ad56037430e6ca99cb0f76e45

SHA512
2aff0a90800d4648d053088e26921c179db48e4bb20b7abfdff2b9b659e56ac880bde4c34b60436cce27bbaf24d3e5a13d6040da7e5c726e44bcf14adfddb1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b4e76dc7cb1984574233ce9f073d09

SHA1
0f2d036ac4c605011bc456287feb9f7864df01e7

SHA256
ef1540332490e8af15b5bb3289b7cda2719d36d3d3095a70e2ddf7f30d12eb66

SHA512
7aa68eb3f60e2d7af7cd33540ef89b5831f7c8230e038be079274176ba24b1b5aec7e4cfd64ab413a3e65267c53990b8593671f4aa3ec9bc617e271080cf9f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28cab1bc7ef7da6e3b30316aaf028194

SHA1
f71e7e829692753aa53a6bfd506a8a0117b591de

SHA256
0daddf35389947f7479e816fb0cc3851a74fea9c19236de239dd9ed9b472556a

SHA512
fed4c787ac4a6b7c437ab8c5288cb03cd344ed4e15423c50c3199033b4531d43da8096daf7f3afe0cabc0181ea40c991519517ffdec930954ee519a9e52d936d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35d7d1a4576533f71a1df77a605f8a6a

SHA1
bc052064e2c38bbf443bfdd10de83481d10b2432

SHA256
5d28e0c9d01a02afa3f3c931ec6221809eff1fcdc806c5261542ad332dcaa0c2

SHA512
8b2ee3adf031c6cc66d6139f0fb07d8d6dd44cab10a3dffdf996b243dd1bd95fa59d3453122c458c31eacad5023923be11b79a76aaf033f15dc4206e5bf6c4a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7195f28d137fb5af1bfd8a66753032b6

SHA1
fc8f08fc1299dfe57b0bc90b6f1203f7909d041b

SHA256
25a56c9aca3e7dc7e1244bdc31392a6322d3bd3573aa7445fe379453ef1fa7fd

SHA512
31e7c582fac53cd6ebd3109d93e7ad4b6a065615c42a59b86779c427c864308190a499c2e76ddc4895ad1f594188fe5e4ef16df6c6826e6ed85504df7f099668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f3062238bc43d524661185860f89aa

SHA1
6a22642c72f05d8ff228ae87d0da28b74250f58f

SHA256
6e42bb6c63f254ccb20664337eab68bc7447089498ffd96b5515f807f1e660f2

SHA512
bb34f3d48d1896f1e83d30909945f0354cb18d5a440f6c3f32c0631a2a7e05df8e3574b3f97ea79e9c5cf7c8a6c32f8e85a1213e1a144cce6792b4c29dabfa1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e6b8c053e0e59b10bfe2801442eaeb

SHA1
f08bf850b0602b442f5906a5b00a05cc47a65745

SHA256
8a583304824fce5173e09eef888c220a377a48258f4baa0529d02ab7acd72bb1

SHA512
4cb6afc82ed47ea48da76dab0203898c929100ced102bffcf99db8e863f206266761c90e08c8cb1a240945e91b391a68951d5e50b53ebc4fcb46f78385aeff73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
168febeabf3868747d6ed8d500afc8cf

SHA1
0bd5b1dc4657e8e0e295ce2de3e96cda641d6b02

SHA256
e4e719c4726e922f9d4906e6ef4d54668b1662cb1dbf7257e2a179bf607d4ea8

SHA512
eb8e15eb1a83a9b32a12d0d42acf3e8228cd0b34ac0876da0cbfe3759826e1ab2f9b77b069564d568e1d34f863be828640508caa9a5a58274103e1809b6cedd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A7B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4ADC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit