dcf724185dbfed57abea07d39c030a9b5b01e8a77f4faf2ad3403a4ba69d365f

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

405eb93e07102319cb33babb8eed01b0_JaffaCakes118.html
Size

27KB
MD5

405eb93e07102319cb33babb8eed01b0
SHA1

5d56ad2f3eb655bb780be3a6b22d8f602aaac19e
SHA256

dcf724185dbfed57abea07d39c030a9b5b01e8a77f4faf2ad3403a4ba69d365f
SHA512

bbb6e704ea39481f1a73cd81fc08093dfe62b9a0a835ce4244d098047138d8f3197e83ca5546082455b6735a0073bc8644baf354c0fc7e29dd404a76774bacb3
SSDEEP

192:uwfYb5n4mnQjxn5Q//nQieONnXnQOkEnt1VnQTbnJnQ9eAqm60d+sQl7MBuqnYn5:RQ/plCy+nSQDT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70B73061-1145-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a1fa81edcb13b98bb9845f3b3c299e3b4fe62d27d2cca9b5d268cd2229018056000000000e8000000002000020000000e058e2f1f32144d03531028fa6793c726aa2949495b9448fd7539870906079ca90000000bbb49ccf52d2a74e144d81767dab72063cf38e1f58d56cb88f7becf73c8ffd8da5a1ae3ea24acec6e57511e7c9fdf195519fa23b3b0221531d7b857920d0ffca7ca98cc7bb4c573af204fb441bc6fc845e6deae42c0a162ca4181fc8e82db943f28cad3bd0a7d812dbfe854e3bbd64853de4c42a111603b7b4f385f99a55632ba4f4cb2eb19414feebe623aa407a6be84000000051cb6435535e8318f2f6182654a4cfb03e8eaf6ee8423846ac3144040c2a3c1f9a0a5d7d4323e7d9d1d5b026bec8451e49f4e84ba6765c3278117a1ae8d5bdcf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b8624552a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000926b73d7e96dae03760c749e4f9c60755b3cd1a83b62d6df1c51e5da40b66741000000000e800000000200002000000001df6a3eea91c034aa6d476b4634be81b608afc68863aa748e7b460cab361b3b20000000ae167bdf453861eff383b7a4636708168c9f26438d9c3c36091373d293fc48a140000000ad3993bd8ae44afddebae25f5958dc613bd6f4e70ea11e94ebd5d26b7a4a931011e975fe24096fd4d780662f39d0081c56d42601da8b7fdfe73bdd5cea197c7d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421779409"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28
PID 2220 wrote to memory of 2824	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\405eb93e07102319cb33babb8eed01b0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2b743d0bd2a2808e2eb590101f31da2

SHA1
5bbe53eaae63ce70cc4c16687c748b2975548b75

SHA256
c15019535afc612a81127744901387e1694a5ebf1c41945ca6cf4ba2286d4a80

SHA512
4b0862cec58cdf4dc0301bc249365369cfa87dc5849c50123d85790880e01f4f4814f538836d7c92e84c52c428a0a56dc05d9d644c121b4990fd2410d47ff809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b33fb60246458e9d579cb105ca9c07

SHA1
63e7ae0770867dcd533367b2c66b9d9f1089ba20

SHA256
fa6dac5a06986478a25366858cc9c0b5add56a83c0984e2869f3c3df4ce955e4

SHA512
a0de19bcb4058c2f0d2fc21892e3bfee2cf87da3c6a9fe5c604588593f23135c592dfc28d8598621b63710b5766c14da6854a38a7cc9563b4a3b03df7b7e249b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79e24368930f07651a597ab732a5b44f

SHA1
59584ec55995aab25d3b6df7937d9c308cb5bbbb

SHA256
c1fbfb28158173feb035a8fcc32abd63d1aa93bc6e8156affa2ba1dbe3043eb2

SHA512
b9ef8cced80c9c9b6f9c157c08b9e4fa06b4d894c181dfc45d32e3cae62de2928724b9fa5ff80c5ff452a84ea8bb6e66baff67f1835ec63262feb2ef0aab4573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eb630a45db51eda31f0bdebea514a20

SHA1
ee7a8aef426ec2bd97848dabaa78ce6c829c99a0

SHA256
fb63bb3adba96bcc9fad7bfc8480bdee3057dfc317057ea52ee57d07f2844269

SHA512
938cb962b6122c7e25f3c7e4f00991c2b2db0042ef48ae9e9d6f621592dbc7975751b8f7b4a566983c9eeed06aeedf7a8cc28a279e636807f258f7093a74f354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e00c2df5c807e0f519e8ef36c557b24a

SHA1
265a23a76d570154c4811ea93e1acaae6b8cead9

SHA256
af2350c40f4b072e9578dbe12e088568f4b1ea1513d0e326df83589f9932d92b

SHA512
520655d55397bc913aa28d8587cfab8e45c2117498b7c385eac7911754918eb2c75215459f9830c01577e92219d0df729ce3a19131989468c6aabac311a8cc83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c84053df3d4e7ec010634ff3ea35d7ab

SHA1
e7269024c4f778f3cd73b256bc0ee40ca7ed3170

SHA256
87b2628c89b0a334160aaf52e506442f43b5adbbba24f02672c5f1904eb11c29

SHA512
c3ccbd7d77832b20a56bb5f659730fcf7e6fe31b26564872fc5d174749e524d63b1e4f80f83680c654bd0158ecadd797d2f943ad7af23e0500aa455f26dda364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba0844eadb811faf6505261c9b742ac

SHA1
1dd9b0558d1b20f8ee85da8e35d699d43ad7ebd7

SHA256
75daca7427411f0e19c18c3c227375057f6fe943af202746186bcc8021587c55

SHA512
cc7c73fadb37d3b4bed8c2b9700766ba7f8ef1690933d7993bf4bd65a1210f6bd003a99f238eb2ae25c178b524ee546922898ffbff8dbc5444b1042d407661e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84daf8f3bdcbd2406b769369a1adf81e

SHA1
fdf5a9ffbda6595b01da4e6c2fc5f3b6cc073e9e

SHA256
d1145c92029a75a43adcffb07638dbba26aa67ea11f6c3e79b44a413fbf6b9f0

SHA512
4f2494b6cf21416a48e604346a756854cdf03e2ca52e925250de947dbc967c78b62889fb89cc7f0264bc78bacb546f02eed305aa67dc04ae5ca1df02114e3ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aa15249463810418b3f069c7c484d1f

SHA1
e1d800b23b29f12e45d5a085a00b56acfbe40c45

SHA256
ff0fb0e15dc1f6e496cd41fd456f883a64d7573d251eae047101600685044f67

SHA512
abcca7253c183e4e664b41f25e35be93097f843132ced8471561bf532e89d08c43c243f98fd68938bfa8698b777996ee3533261384bc835163273da18d7fee46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec8a1791355d276a6a94bff87aae44e

SHA1
6b53e9e3459da238f9de929569a6f73f58eeb6d9

SHA256
b3296ef247cad6f4fb8af476a03a5190eea62472926305588033c09cfc182eb8

SHA512
04295dae81631afe8f6dbfa65e820afdb922b263362c77ca189422d7271d1b622c0af34f60a6a16c32d5aa018e83fc68d30b29d85577cdf7d0720dde1662dbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd9033e94c107175220e3beffd10bb6e

SHA1
f54348fcb0c8dce768fcb19515b3633944ee4adf

SHA256
21615d02d6f7d494cd1484e1bbf2fafd4090eb13584c85e23f2b6c5d6ef3ab0e

SHA512
4abbc86e4641972b5054bbb927b98a03d86c681268e24744b401169560fa13b74218d327f548929f58f5b7fd62974f9bfd2b1827b41fe170a1664378e2488cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
127414f02ec784a26ccb40fc240e3c30

SHA1
5881a2b39d1b570fc946a499c1b688b0026c777f

SHA256
b0f841bb1efff140cf023b8dc92e3cb51ed7d54ab9bf6f0f1739f0e884047af9

SHA512
116668c847154cfa9e39a1f0e9bcbf915d21092eccfaae409093d250253d26cfc3c1beb817317f45f9bc21802a3deeb381ea36276be62601ebf2aef19b629344

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3517.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3568.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit