263ff500de80024188d6385b086ef243a7bf3ead10093d4167995b5c73339e3a

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41f727966f7d90f570bf16da819d0f63_JaffaCakes118.html
Size

34KB
MD5

41f727966f7d90f570bf16da819d0f63
SHA1

36513eb825993853d211201e2be57e4a4963d713
SHA256

263ff500de80024188d6385b086ef243a7bf3ead10093d4167995b5c73339e3a
SHA512

9a3a45ccdfa6c21de81bc637ebd6ac6cc91a1eb07a65e0fab8e99b12e0db47aa5162fc21fee76220887beeed29f9262fa295d603005980bf5e1d007c4796813a
SSDEEP

768:po0eejeUewXe3eJeqTekeMleFSaeoWyLezeheJKedelegv4AhA8feTWe7qemeNew:O0eejeUewXe3eJe2ekeMle0roWyLezeI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421861720"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ab85d87263cdd9f5442db3629f916b7c3512be44a103e8b584f7a06423941db7000000000e8000000002000020000000de21e1556f0f9b30b6fc3b3145f3b34c1579ab6d2027e79235a2cfe02e7d87a490000000d31021d613817fd3faea126bef070c93add305cf595d56da95f86f9475352c4d79345dfa38d0d9cde0d11c7bdf56bb7a39c5b94d835a9c364a62b2f15956d5a55ef86bf5aaf27b084df66f703644c80d80fc5e881ff7c8a69791fb7d45b10e97ad7115e456734a679ca5630aad102ae54f916868915ebebd3fc7bf5e506cee32e8ebeca912e9f2d484a2c9ca9cf4deb0400000007caf188f2512723e8fd53549a9c4b6e5b38399bbeac6ba3dab50a84b704d316bf1648fb675737418fcb10d11a52151be7fc73e6d34d36e9cbb9c8b4b95479143	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e470eb11a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1420E011-1205-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b4ff80f588b9bd80edf356846e8a1485ccd01f5fe9d0778ea473d9d2f9486027000000000e80000000020000200000007a18bc68c61def772b538ed75ae4d8e86d0dced1c12c6f9d686066483088aad0200000001634d7ec0a973d6f00805dd2fbded2066c54ab76fdd11b81a8ed0ca08cc7e83b40000000e5eeea2f4ac64aeaa015f41f4e81cef1f24e9281cfde99090d61d53238fd4ecb86a7d2cd458ca8a46fed743c93f9c2c2f56cf0ca8fd3cbd55e2fa3799424ce3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2072	2936	iexplore.exe	28
PID 2936 wrote to memory of 2072	2936	iexplore.exe	28
PID 2936 wrote to memory of 2072	2936	iexplore.exe	28
PID 2936 wrote to memory of 2072	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41f727966f7d90f570bf16da819d0f63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fde07c8681104026cf8054ac03e2045a

SHA1
db4728306f132267dab1cfc27eb4e5f63c378bd9

SHA256
1f9e9dcf346875cd646586272163444aa1d6cb4131b271b35597f5b2deadee2f

SHA512
0cf38f91eddc497184d697ad67c80767eb3399c77f1a734ff3389ce09711e619e3c2f2c3c1dde720728b7e5e3113664150242b39b8ddd0eb04909d0558adb505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efdf20f548fee7bf1e61e406bb0ccf94

SHA1
a568d727133e3e816413ec621543dc591f0e3255

SHA256
8f554a9355179d0961ea2b4b8fd16a81e31732595506224e68426e8ee8e47254

SHA512
0c835f500ab841d6c3e765db73baddd08accda073f79cf7af4b7df3027c2bdb66285045912bebd7bc2b704b80511ef03fa5826b0f2fb745257815e61a35488c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63508345e823112ffaa070bdba4daafa

SHA1
33f2d8c6176520acc6179264f448fdf37d11a867

SHA256
b53b044d5a24484e810e1e1916a1ddd04fba3aa9e46802b439c1640507d208ae

SHA512
04a6319e762fd40000ba30502260d0a3a707f4f347140fc4133a83c7874bec8be0e971e193f9bb573f182841c1ac385cb8e074583f2d313610ce523a75cfc34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c893a3d3b0b4b72426e3fb502536a5e5

SHA1
58dc4c44776438cb203674621d033e8e5be8c50f

SHA256
ecbfa35805a6cab5b50a651697462843c6077a48dead6b0cb7a4e90c1f9e9850

SHA512
530a77f4ec94b0c8577dd54cfa86599499935e1153bd114d760dc94630b9d614c98f2fbf4a9b76f3f201d60c839074ded7989ea094bfd708759456ac8545d467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a6bd9c57470732806dd0273fd13cbe8

SHA1
e76d0fc8a928246f892f0b539c6b0f1211c0c217

SHA256
80862b7cfdf5e9c8d510aea24f0017596b324a9e0cbc8c5216785ef3b76511d4

SHA512
08720661e3a25cda247d28d6eae3273f7fad4a8ca80289bf801e782c4d37613e896e3f59f7c8d5e65084e03203ff03ebf75c66d038748116ed9240e7d89335e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c83a1dd1185187b0217921c08155c20c

SHA1
55e009c6e6390377458b66ac89b9e0ed9563c5f3

SHA256
7fa16a0babb69a184c0c7522a2fd9c0eb8d775b7000e3cd6e48e1fabdddb6e77

SHA512
b3c46ed80eb10887d443edf6accbce8831fc137d91dc602ab3e82ccbb32bb52cc61bd6e6707a4ae7fb9306d2321ace912fe1b3a67b6fe1ed7f0224c006559fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
251ccd8e5713b4171e485301c9b543cc

SHA1
c5d1b327b23c873d0e8922dacab6af210149c497

SHA256
798349301452e55e895c3b7a332290ea08f00f2e966f0e74179b1c9ff1b68814

SHA512
85ba4dbee9960f67d4153840a235db5d7dd5354d6742e729533181308ba215d4c23d6dd985d6f48ea5005c377000c7b15995475aaff06b1feea643d677751b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01aad5a2fed7a43bf21027633b0edc12

SHA1
39077f4f3ffe5c2a5272471bf21a2a283c9b797d

SHA256
e2082b07cddd92a81962afcf5331a1df822671316bbe1d40647d7e98403c009f

SHA512
d18f3f0183f4f425f07165ae6eebd01b8d6d066de7aad58aa20ea92271852838616f8b0b5328a56f4ffa6943294b96da422c7324aa9e08e99d948edbbf8adaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23761b90f1da754ea1040af9a69cca4a

SHA1
9a197aab879ea86510e2efb5ed95f4c53b8740d4

SHA256
9f8181b0958b87e0361b100297698d813c6739194067446bac79ffcbc1d4ebef

SHA512
0ff64defb43708cc6ee20548e8df4fddc26ddb9096f0cce3f2400343ff2abe9221af88e8276d0a3697fc603f1fe369df0b81cdccbce02699c7d588856da6205d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63d60b3a56dc92f7a276793fd8d9f9cb

SHA1
259245a153075093ebe6cdece46de2af759db2c9

SHA256
eab2e9480f8cdb30baf79fad9547ee3a87a703a0735603a3bec1d9397828e9ce

SHA512
a0ff9c74f61ab476aeb46dcf22ac0a25c456238527e73292586c9de3950f251b1b6ccdb1b7544fd6737a83671d028c1eff39046e4d8ece2da31212c589fddd61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d7650fe1f418e26fcb7858318d6468

SHA1
db7b9799b78d954f1a15f64682939d8e7645b345

SHA256
11e15e2721fcd8b16e9c6ce0e5e377bfff350f12793538714b07c21b3cab1803

SHA512
d68760d7059e55d7fe5ac6e128fe6bda43979cdd6f4f925b7829c721454432651a793a6140a89546ac9354915e466fab67e858d3bf78801153b6a15143ce7c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72f04aa75f6a55c513278a73b24b0118

SHA1
2fd0831e3e8abad21ced214f32622fc6392cc6df

SHA256
8fc1addb276184beeabade2f1693053a7bee80d8e30fbf3356e25f30e3f7fe9c

SHA512
0f0d7465fd56b29771b29b8f4a693675177ee906e117a5ceb472c1bb99294cced9fc922400664443a4e8d49691508747703fb117bca3a8e4adb99c47180090c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b524912be8fdc29d4df962ea149804d9

SHA1
bcc0a215604ed85ef174f079297af099bf621a91

SHA256
c6202dd9d2c4ea663fd1d81829a622431459d2c2111068e4bd450045df9fe6ca

SHA512
214a7acc2eef25e8107035a8186e7baa4e4f6bd38fa189e66e8060e7790af28047217b934dfdfe720b4141339226d6ce89c3f410f42055f96c553f24c5c8790f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e063151c084d887996c58669c93aeb7e

SHA1
e7e4ddd23e0ad5932f9abeb0abb2c4517a98be45

SHA256
ed2c50d8dcd4c46dcd20ab22f358eb0646c93f5a18e4f172bb9cc1c6fa756dea

SHA512
c345bcd850fe4ac0af9ae4370380cea25a6fa9c469e35a67cbe05067394b1e808b906a7bcbbeb950c8a688978d8f9fdbb09a00c071cccec04cce39a2bbb73c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01df41d231807927805bc59cbe607b0d

SHA1
4a6c4744ab34830515617caf478f345d77d12ac9

SHA256
ed15c29a0e009a656f05013bfb3b10b066e035e55875bd9b0c883175e538a5da

SHA512
c3469d48b8a1d7710f7835266803f7a74dc951d9e01c2b368cff57971c8c9c8ec66d23830bf470cc6aa8d84e92319a8ddfcdaa9ce602013e8231ee5788ce611c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a88177eb88ecf455371612478790892e

SHA1
82c0fb01d3222e92410e9a61b6852832dd84edfd

SHA256
0ab684d14105da48e4844e818b9b429d2d134dbb24906443ad8438d17a7c5ff3

SHA512
69a9119683817f9537bd4d9e4690d8b824a8e7d70c6b5d02eebefd698792be2c0ef8ab802fe91f2485eb02458fde56551bba9859451005b70c55789c821bd5c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4211.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4212.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit