829c241fe8dfcfd68d90dcfcac7a38f05f01b6d84a485500075d227e7dba03d5

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42539312d86397c56ac56686b9c5e490_JaffaCakes118.html
Size

11KB
MD5

42539312d86397c56ac56686b9c5e490
SHA1

3af4073f76fce447d60ff708e39fc8c1612c9beb
SHA256

829c241fe8dfcfd68d90dcfcac7a38f05f01b6d84a485500075d227e7dba03d5
SHA512

a08a39f0476df93e67852279fbaf04a93d9f404b566dfb7cffd2dfc65475348800137d2c0ff0bc7c0069bcb3a763981dbe44067543a5b3116bd47afd53428558
SSDEEP

192:RzgdhGeM2/0/eqw4nYObU/KXaVTXIUC4su3P9WJB40OqZ:RzgdvMS0/e3lCU/KqVTXFC4su3VWJB40

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000a07d2ef5d377c48724494304cdbbc7e87c1baa2bcce7f678e0e4feeb71295c8000000000e80000000020000200000004b5f69d3307e1893860b4834bdbf873520a6f73d286fafabc368a62efe026e2e90000000113284926a41c58756cb57ff9289fe5bddc2843736ba8574614de1e146b5d5d1817d58ea75991bf46ea652ce0d8c15740a5b6c11cc0990836a7c222e8506d1d4027cd3602fcd119100769e9cf2b5a5b4e9643235cb5ee0848a267b054d6aee111266b13b1a422e9c41eda162dd6386dee94560005923a003fd2357c9113d1d5af7bdc93139ab7a823b96ddf357c8cb1b400000004522950677f62d8d2fca38fd0258fffd3f50e0253b0fe30b24833d4cf3972e31833dcafab363360b5261ca7fd59ab38c8f8b96ea346eaaaa9b3914f04b2b7b07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29D3C961-1217-11EF-82E1-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0061052a24a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421869484"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000cd559f7d7293795d5f9ed55677a58eb5373a8a5dcff9348650df2ec344fb823000000000e8000000002000020000000fe466de5640c32369111607b233c549853c14b37c3b2fa3c2b7151375392e8982000000034a75c8fe9c683b191456051be0841f4e32d07410dd0d53d0e9af93be528964840000000f543b02f872f6345a744dfecd5fbba57f40a254f57dc96db285ad75a0f2115aad41b40af68e0d3ad5612edd4e73f184f706994b8513e173d8cfd99769fca2634	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2100	2176	iexplore.exe	28
PID 2176 wrote to memory of 2100	2176	iexplore.exe	28
PID 2176 wrote to memory of 2100	2176	iexplore.exe	28
PID 2176 wrote to memory of 2100	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42539312d86397c56ac56686b9c5e490_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6574c7d2177de374c7d9eb60056263a

SHA1
952cfb53d70d1b30127dafd44f689c4387115775

SHA256
5586661aba0d49d905ace5f66cc164a5f78c8d3c84987308c70c39d38d368f34

SHA512
2ce579207a0a42f822b70395af0fa94def9183f6bcef18020cdebea819ccfa20747d16005405a721539b8371ac059a043da57ef91877e0ff267ce5dbc64c9e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1c73f15557d5fa357e2541c5acca49f

SHA1
dbb2232cab9aabc068e1be6b610eaeb0c551b9d7

SHA256
bcd2e801f7f52c66eeac5e659810268fd1d1632400649cad31b124d8dc1caeac

SHA512
64a079eba4fcf26315c358dbac5e5e028ef2c621a604c34295ff0ed65188237f9258072876294f69a57dd4a8c0d2dd416f90b47b3078c48a925725ea7a988809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6729ac67ccd051616627bd8a1825f81d

SHA1
6709b1044272941991e3c8877f89e71f148af971

SHA256
80028eb3f86a98a0d44880819faeb217f428899000c1aacc61f37732e0cfa729

SHA512
0d2e1ea534a45ec438e1a37c4ea91d363a12d2af9d6e17524f2f1c46fb71e38ffb9ec1a842dd440d455c97abb8be0a4bb6417bda762280cf8599c33e6d78b6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
700209e51dd30d0cf33523d894872388

SHA1
fbf77c1e6a15e81f1cc90bbe7ce127af0be08a0d

SHA256
7d6fa76e51762fcccb713c42e86050d9fef9f1b8d05bb5c1b4c4c1470dbf3b9d

SHA512
898d6b49f30442088242998e50eadcfa034e477214dbc3b950132cee07a9de01202230c0e3f30f7966b0763f552fe2f59a67bba026a2c9ed935cb05a7b44022a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f34091ea5a6c157ca3f0cd0083dc76de

SHA1
7bdb2cdd89352e950a8261b19311cd01f12be38d

SHA256
8300243aa64d5b042448d0739bd00fe3284116699f45dc71553b16ff8daded92

SHA512
0f2e16b8df2d58d6bb1a91a8a9b7ecfaf74d55097dddb71ac070062797cd1ac1e61bea85bbdc93955621fbc387661ee032d670585219370bf34488905c24f8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f778e8306a1e7bde72fa1ffe15a67c4

SHA1
d1af71e02e7fe2a60b9913eb0c9bf48b9cf13fce

SHA256
7bd111f8bb6eb108ef6ce6f01c5afd4f4769ee44cca50010ba696cd136f49cb6

SHA512
dc25d916550ae409b98e7804599ef0b41da6a0e9aa9fa39dafea2eaed9f3a04bd6fcbb96d8abdc3277f7b39f3daa59bb05a8890646b9a3fc20331f90d62b387c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c383f82654ffa5e2b5d782cd270c7385

SHA1
e408ddec435e204722ef07cca1947a838d21e7ea

SHA256
66d183b2957583b580c5941de9bef14a8c93d35a41dc6f2a4b7f413e173c5b98

SHA512
272ebde88132c2dd8a605092d05878a0d7154d2ceefcbea2b7bb116367af16dad78936397591edce376d4daf2fd304e50b3b866d65360d6f38882d121c55a2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a74734e30255732937eecbe94db8afed

SHA1
ce5eaf15bf14e755b7cb7dda8a661f9941bf2e8f

SHA256
8eb45cb61fb945b14444853d56ad389533d009ea39f9f7ca1070619a44c56772

SHA512
2c0118fb9e5a4921f11e44bad1d18cf9ac96a60d3adf0131477cc17ecfdc1d494afddf7b696a20fc95fd3b3cb36a38d6b3532b215b78bf95f8307724ff15a8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8867f4452823a7835db0d99a6ae49ec

SHA1
f451877412da9ae8941136a0e97193002163e27c

SHA256
dc172638797bfe6a9d2e84c077da1ea0eab01e33a70d14842c89fcf63cd70eb9

SHA512
5695c1522e021aca0c3a0569da81a3ecf2c950a9a155648590e450eb332f262b3651f4a282960587fd90b097e0ede00aca0d019b2e0c90106ff58ccc24795a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3dc1cdb4435352ca24c3d197baaaa56

SHA1
0084214212d8fdbf3c3e49e2fb6ef9a561b67a6c

SHA256
2f355631be2b082f9028daa133ee393292a2763e3e3ea127151f84be3495a8c6

SHA512
d6d72cec7f09cf8f55fa235f698d1dbf0452daffea907de62b0b21c70ad196a29569dc3fd2ebaf2ad0163821290528159878d3e7c936e472232cdb9737e3728e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7f6e68d3a7e524ae6ed280959ef5890

SHA1
1afaa1cf519da9881888ee7a3fbb9058563dc2ab

SHA256
cc193bd23ac24be5d770d55a75dd9780ef8a96d74af1765eed9ae7dc2c32da3f

SHA512
73f5fb3bfc3d37f938b8e66daeb25d777ce311a78e39404fe9c0be9eeb62ec193812cbc43fb3e92d9d1c3fd3ec6c83757af136d51fc1a8c7212fe9b497038999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
037d26c6e5221138dd1f1846ae459769

SHA1
66186329f05573a624bdcf253a79883c5e766f5e

SHA256
95e4d68b0b5adf789bf4fb51af55cccca6123fe06f6cfc3c941a6a9f126d91fa

SHA512
25ade0ac966bbc25f4f2b7feb45ed4f5e8ffc5e5face33f066dfb0475618f3f1644f27e1bf744ab9fbf48b22d44c1fada3d3a0138cd698a8854158ec027a18da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ebc2de94a016581d2040cd59ab5900a

SHA1
1285b0af441b5c72976f953ec9da3865313a2d2d

SHA256
cec27b154d340e4afd1bba13b1aeb4adc67dc9d8efec993cf93675b84b64cb0f

SHA512
0ac9fcef42eadd5c062386fe70ec88cf8ea7a1ac88c82a6bec3cde486ec5281c60f1a852a1b419daa90e2a9128c2144b871165593b5ca3657bbde6592522d54a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2fd9e83c74f1171c9e9a6f966c754e0

SHA1
31d63705f57265cee8625c95e7de7c6bc0310dfd

SHA256
c92af9e521460b909755687dd90bcbd576bc301d7ad9c68803e911259c4b4078

SHA512
3af33baef556fd4a0a8bc600da55742ddcb093e40cf30eb4135bac476527995168fdb7c263e9e1a576537bafea92ca0a58b1c1b4112d0a264f7abf20f4afd3c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c7e0b4da75d56424487fc008ca0b742

SHA1
f8dc11f827ac532e8a409318a80f2a6645ffdc0d

SHA256
cc8f66be821f383a4aa106b9e7c25516416eb44893881c578a53e22b3d183e7b

SHA512
60c891f2593f77afdb18a64c3e95da856993cc3f3a9ef427ef3da122a40d08a751d0acd61f41a089cfd9d0dae44a11be65ad52358474bdeace309fc393c52f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f70163fe00de2fd5e28381e71145d2

SHA1
7f7364da339bc1ce0672e384bd96a5e1d7583a32

SHA256
5e01ac9aeb70ae8782fda1a4473d3eafaf14d475953c1afb6f2985b9de72cd5f

SHA512
3b3d64be2d53de4a2bd78b6099821dc96529e53445bcdf031a41845a1d5c61f2cb65f09e8026b4f27f56f8a1df8ec7ac4c54b30e3f815df2601eccb476759314

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10E4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11EF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1205.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit