562cb9c282b81e47d008d579bb8d851e12d56fc1e9354512c5f3f2271830a3fb

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4399e1cc987aa6b5f61986c96e7ecd1e_JaffaCakes118.html
Size

177KB
MD5

4399e1cc987aa6b5f61986c96e7ecd1e
SHA1

279232665627638d80ee84aa918cf5059671e481
SHA256

562cb9c282b81e47d008d579bb8d851e12d56fc1e9354512c5f3f2271830a3fb
SHA512

b66c3569aae6f659ea775507845ef855bdb5bdc6f8659e44ee17fbf7f0fa42ac8d588e25b066295027329959da1aee90c93f20f6c53538eb61cb0270cd37b3da
SSDEEP

3072:S4mPrka3QVy9ntBzUBNwbuevli54QHaTbpUzQK6fIQbPfQI564eI82pCHJcyfkMN:SVjka3QVy9ntBzUBNwbuevli54QHaTbk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003f4d112eab533f07dea3a24954c05a901604d9bf79ba5d3803d2e0a50f368845000000000e8000000002000020000000a347e60844efcf46ffa1066e9a2622409633544b68a1174cab28fb8b44bf166c9000000036b5566354c1ef98aacc6db6544dbe7ef683cb6285fc88268f142982cb2d17d2029bc0b16fec5859244c5e4c0fdfc2371e184b608d24e78685e9e9befe7cfe3db96de82326a64a126e219bf9c8ae5c29987326551fa27d66806dd1a73348197d9156ff06d79afca9edb1888111c541728c080bf495c960f3f76c03455e8a084f78e3bd2ad2ae4d45e832b53b7af8ad33400000001d6fd9e9793de65d0bff16322a15ab0b3b28d3bb62492e753385770947dfa215d4c189a6d859c08da9f46143cfe353ae242ffe48a1be6354bc17a079d0d1a6e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007fb97d49bb1f598ec5dfdfb0fe458d4491a8cc24cec7686c1da2e763df05842f000000000e80000000020000200000006bf5613a463404e21679d02a55d0f7f0402072dc59072752a3e53885e8b1c6e420000000284f04fcdf29f760d9409c8f700b4b68ce9b19dfe835fe3710f8b2f7a703408a400000004cc9e9ea98ba3d5cbe05fbc5bd0a37c8b45a4b0f2ca8f0a26aca749772653f3764a2aa3223ed6b0e766feac2114ac5d3c9f51b3e92544bfe0867419bfcf15b36	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421891885"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51A790F1-124B-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b5392658a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2496	1888	iexplore.exe	28
PID 1888 wrote to memory of 2496	1888	iexplore.exe	28
PID 1888 wrote to memory of 2496	1888	iexplore.exe	28
PID 1888 wrote to memory of 2496	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4399e1cc987aa6b5f61986c96e7ecd1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
811d0133889a40f048671c1cacb7731c

SHA1
486df5e915ba21f0d962809c60f55004870f860f

SHA256
82140bc9c1f7cd23c25787ab8c48e221d7339d355e9c443b34bdbf74ede1adca

SHA512
1b916c7691b264d11d2694ab3ded77883abc528e0b192684264154622530d00539e3025ec43a94b54eab3fc90eb8b783f979b73e87e87bbe5ca4f00fe6b40c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
805dead0e14cc034710dd30cc745c6f0

SHA1
bf9707d80b045bf3aba2e66b380d23d068a62944

SHA256
695a507e0b0e9dbd7db92f67b3b7e57228d42fd425e580a1de2af1806f9ea907

SHA512
cdd16ccf14dcb9624d5787f5d54e71b28aa3978812ed565eaed47319c752bded2cb4e0c991b2586f94d87a397f350af3f7a2375f1aa02fe6d8574f1ce30dce0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
288f8bacb532d29757110857129b6411

SHA1
c1aab73ca0f5b68ac025afd37e86ad24e0faecc8

SHA256
2447e9adc7dbf98256762adf226435795f5dd553808940d22ca17fd3b4fa7e33

SHA512
fdd6fffc92d8892019e49e211426bd19c6dbc6be6318d58005a16b42beb0706ae80a215877bdff0aa4f829d979eb0a80e841e6b4d5d61aca9f2807a3194eb9d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
021465cfdaa087e751385ea228b684d7

SHA1
8f640a2fc8d67f9a6382f58ba4ba43e8f6fb5adc

SHA256
2593dd0157eff1be434c5d63db9cd43e9c3902a037503baeeb01142b0685750e

SHA512
c34687adddd1c76ca8d9d079cf0dd219805f5ce63870d6ef26cf5e479f8cf56977b00985199a9993a37fccacc0b39c44361429b2254fdb4806a40d7fc4621b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7699b873db8ad826a265eac4463fa760

SHA1
dc9916890120baaaff0227505265c114a63fed3f

SHA256
5fd5630f5332018d0d5cbb1a5102d97232b5ec927f033ecc2f6fd040d2d1681d

SHA512
66574a22ab33d7c13b16c9b69dc7fe262d8e3fccc3a637f3ac291574b1507bc878463851abb6a532308a68c506b66d6cab1a01d1c059946a4cfc099d253a0b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f572d3f6aeadaca3be8132ce1408fc10

SHA1
01cae28cedf0f7a90dafadb9f2950d4c135cf23d

SHA256
a5a322daf571e9a274124d07e9f371f576a4f2271318e5f37ac0a56a73ee5a95

SHA512
45c3964bb79c9f06d891fa01b81fb85d0d31731b2ca5d6dbb794d1fa6d498c9bf3867ccd54814405e42ddf1ca0918530bcb2ef8cbccc6d6360a8886de2722fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cce8785e7e6ce7d23296c58c7476f5a

SHA1
93ba0fb82f4764b30c08cc2b18c444ea448dee25

SHA256
cb5b05ec40c13d00e69b3112caf0d9f4f613f6a297a292ed9bcd805f62025c74

SHA512
7e5d23bd1559374882f2d68464caebe503b80926aa6bcdcefbef5f0f0ba4dcc60cef71566668b7b7a8609992f3205a5d9b0c4ead78b07e5883750f4e23207c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bf3bff1adc8afe02473884fef54cba9

SHA1
6b30553106dd4cb0912c3166f7bf9bfbec84f1ec

SHA256
679ea62601ea1fa710d7a3c4e1a8a28bc704f09a0d6e0e0c34647c78a3d2b86d

SHA512
71757f098bc9310c5669cc6c66fa3c7e3b9da0bb35df578e2e57cab14ed5fd9639546657fe95194ea47ed6ce3a2bdbcc8c5fee22443b4344c03b55744762868a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e9148627a3656a53ce5d1adfa5ae6b

SHA1
79979b98b8b0cfa2a00fe78f516b9f535286f9fe

SHA256
66d42fc133f018c4867f7e4281b208391ccbfe14d6d8758ab4df81b141e94768

SHA512
60730bf3a53f0d03ab1fa755620271fad1258535df9e58cbaa3f39e1c6992857083ac96ddccd905acc8170b53eecf6fb7799aaf86e1de5af80269a6986ac9f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b6e1339d33a7a66d87ef5c720ee7eaf

SHA1
b8c2b87a27811714c53d4d617243f0e485f6bc33

SHA256
67a6fed63bf60a28913daa76b4107a2e7248020c1b7b4109c31e5ce5fbc24c2a

SHA512
b899e7127b99f8af2d375d3e4502b36b0bd1606f0a261dd913ca267c87aa3b1da4db508dfce5581b6eb9d799e5984632ea69086ecf9c74ae23794ab3f1c842c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f743ab5f65753b2520a0d77e37ba112d

SHA1
48784eb10cf4b1db2d30958e3aa3522599312e49

SHA256
0354e4c7cb5beaf1fbe27e4a0a80e993691e3a4ef860e5b976598d7ab3986a7c

SHA512
1167713407163b9e21bf9a07c250a9f71c2a56ef0c8b5bdb7e34d37918d026e0583e8c0cab0d9a980874b344ba2e77f1062a905ce61c5a915d38b7de92cee9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cda5c2ce371479e6ab3e7ce98f7f436

SHA1
a977f04581d8478ca97ff50856d62662ad6b724b

SHA256
1229ba590a3955a164df3e2c0a687cc03d4edee9e6f4bae8f6570afae5c74414

SHA512
2e3d848664f5f5eb808c061493dafdaf4cc3c9876671753d7e11ee772aee450640089219409716d6fabdd86208209a3b6089fd84fc3125926b1d0c2076333cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
558db25926640d3fd63f6387a844e544

SHA1
74e5f93278e2ad7b0793c205c431b51ed37e2e97

SHA256
569a20d33ba000b7db3daed84c75c6c862b7aaf78022f11fdba335fb7a2e6053

SHA512
2ca5b4807d35cb2ccf5fba259559322335c234570755353756f3f859e8ff31a1a9be5d1b9c0953532eaf6f445ddbaa4d2f9b4d5fc4f98918caab048fbabaa34f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FDF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40C2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit