c5f5c2c3bab3db2fd2f9d785a568010504737efc9e8b9fc04fa15b2986c58c94

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42a9cd70929ef906ea77725929c3a7be_JaffaCakes118.html
Size

37KB
MD5

42a9cd70929ef906ea77725929c3a7be
SHA1

a34c756b77a77c866e7bea27c893b98cd344a019
SHA256

c5f5c2c3bab3db2fd2f9d785a568010504737efc9e8b9fc04fa15b2986c58c94
SHA512

daf56b7884b75a39c8a8ce77bc0d9c249aa668dcdc7e8fcf95c97b8c10809c064b596f8f67cb0d0a9f343a83b86d7df3da9ea85da4ff48e6783e955ceffc5514
SSDEEP

768:tge3jINmdhTqLQZAb5wXRY7Gd4e/v2NJLjrzwRbk6boHaOufy:tge3jIKTqLQZAbCXlRbk6boHaOufy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8071853233a6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421876022"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C052141-1226-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b681ca7be876b70fbc47cee4bae89b81e8d9e20c62d2223d059e3b2223620583000000000e800000000200002000000035b6cf23d82d63e721d806aacb5961636953f8ef3778a7f7cedda06234c4b5f320000000f989d509fc02d696fc2450a9049a0b048ffab18adf0ac32233c5073fbe0bf3e540000000430b9903340cda900bd3426537ad120620023cb129c34485c1a2b434b99803f5c9ce0a3ea74d897c7adc6dfec68997890f14bad98b450953afacaf24a5803ab8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d0e3a137d3ebacacd52cdf32cbe2d511b00aadd6ce7b69cc386b5b662a2a3802000000000e80000000020000200000006a9ba20372ccbbdeae4e033dc3d2bbd4f56c028bc47513ff35d3b3362f1245809000000049037d48d18e0f42f306c8cca7e5a042265b6705f5978f65be1f617775cdb14dafbb405ddb59159e61097dbdd47fd403564054e52bfd7d1785f71a20c8753f15027cd70c13b675eb57c68e5b6416af65ffad5d5cb6b2591382958f67521d00f6653d51741af7a6428e38b90daa7e98efaa4842122e661f3271752ff43c4136f2847374afc4a020d452748430def899e340000000b8545020d8d15a5736522ad9480873f0cd9a164b8a0716728e51b9e9fb34a51147ac6887d9e7465f61b49fcf2415d31376beb0f88ac3cd155fdb57e6226fe8b1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28
PID 1688 wrote to memory of 2468	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42a9cd70929ef906ea77725929c3a7be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA9DE0E0FF5BD78420146305F99A6CC5_8306BFFC79C1D511540A95B8EEEE27B8

Filesize
471B

MD5
af1f5557bbba8b2e4f4ec5fed3b77730

SHA1
a37119d233c409c9420a07f2be51f1248a3f2182

SHA256
1e685c16378b9ff900b329e818ad910e63be0183fbfd65a995411dfaf9c4dbdc

SHA512
df681544cf51f1d3ee1691e51ccf7e31e1ff6188c04ef88dd25e730aaf734190ba6a311e7bc5c21305baa6b8894168d027471085aed87288a98706a5dc3787e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e26063669f3f6b45e6d05d91a818249

SHA1
8ccbdf9fa7c09d633b25375f9703c92781867b58

SHA256
14aa41140af78425321685a1f0b2c320a9bfcc00f5597b9f4d7cc9c8c9e10e77

SHA512
9a635f7888ca5a5b981e1b017d1838c5d80a49845c501dacaaa11f7afad14d46f95a62b84ea2c9f6ca22042ffbfe502b261cc83ca9b03fda7853cb43fc25c54e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1623ed80c40081274683eacfdc744918

SHA1
c614e0a7f40b5ac8f9a9457fc9fb843f93dc6d70

SHA256
42953cf776635f51be225dde969bfb83b6eb3c6baf09c410c752bc8cea5fff0a

SHA512
2f2e90bbed3a9e74967449022f3ec0096a7aae376d2c81ac18db88c57e6715a08a88d831d085f31660ca11c6e03e298b75c7fee7e47622305071a9226e89ebd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac16b8349b0f6cbfc87a4c133dd4e5e0

SHA1
1f2e67ad2814ca6ac60e68e7ab3c8f839a8ba812

SHA256
37d5a403f635597921632aa75e5fb0f287b1289412d6e85edbc069a129652bed

SHA512
504dcb3e9725911dc3a83c935e8c31099a7682f7a71c0fb2bd8c4a16a8c05d9e6e3afa6d4055bf173eb62c4ddb091e25a89711f8ff6b048a2e94e7e87c02e587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619d070362d6354c155267380305f3c0

SHA1
16c22a7c6494bd552fe4c0016bc02147fcea66d2

SHA256
87e1b88a6a1c75136ecbe4c84a2edc6564947f8c2eaa5e43f81ff518edd2c817

SHA512
0398406c3814e908c754a226f4c2564b6b07eedc8b778d6f100f1ec0856d50333b409c7ed909a3ec627dd63148fafae691f0d1852a67f97caa6300839925cea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e1ed0c19c1087f12caee9d566315c9d

SHA1
0882501fc5183f1948fb426b2515022a5f2ae267

SHA256
181b8df41029bcb9213dd395c8bc14e69cd3c7999d0cbfca85e8388f1517a97f

SHA512
0ee7e8f699b2635d210f1d93914ca99a27cb7acdbcee3438d57d9c11b7fba37cddb92bf8967c5a23013d1d399819cbfdce256e19fbb1735663b040ace3b00b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9499c4651b5c671dd968cbc226fbcb5a

SHA1
aa76578b8da03918b0f93d6327ea1027a6592a51

SHA256
72dfeece4d49e9945d29f941bb3cd26e7ac2bcaa15e42b38639b178ca6bf7b2e

SHA512
fb853d9d012d87b3e2b10ad59948b7a14befcbaf0fd7ca2d0c7dc2ece38e5b5de242015957697a21091e816393203abb3f4470f2cbb34dbf15434a586a0a9deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12c1f5c52e9bdf3e0d0e267e5ee7aed5

SHA1
70cb43868bb557b009d5a67c4502739fd1ba7b22

SHA256
e08a9f46b441aa70c5b7ce84f1d87220f39acecdb31de5c8b7e6ed5001b30cf1

SHA512
e8269a7759eae8943d5e718832c97fe5a580bf3a850022ff5d605211fbe6fed68c90e7f1235d64af88d0c6312dac4caf4ecc0f4f7c3cb810ce817fe749c67c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
456a6f9cf67af7c4986ddb23361cd568

SHA1
137f6b0d442ff86d437a9af61008f41e63ceb346

SHA256
e76ea662f270234527e461d468a0a46d66222235d7991240e120bd5911a86b37

SHA512
3489546b5e607249a987faf58b0b41cdd5237c28114ca04bf3d14e917995f5ef720879fbe9e44ac5fb5ec6a0ecaff559541506163ee2d7efae04f877f05af8d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e78c200dcde04e42349bf68d25b13f3

SHA1
4d3f808347a342a2b956d975cb983932af819a4c

SHA256
0acf7eba6882330e9a2e773cf5a471cc298d9523696cacc94aabd0f781d1b243

SHA512
478b4751803b02082d695019a2603d2e5fb634c170fecbd3862dd6d7a833dda7b92abd68b4f716cf8477e84d1219ef263288c28c2b2c3f0ba363833d2205c2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a68b18818d0ed8216a621bccb2da040f

SHA1
30e540cebdfa71a50c39261d78314a8fbfb4a7f2

SHA256
eb64d67fe897e66698775974677512ea15d2f74e5725f7a0043f794aca51ad9f

SHA512
9535a77c0eb299b3a1cb51fc92283905bea5fe49f47b11130e4393dc73df2b5ea9f153e2750888ad8d1077f86a707d076aa980a64a758793ca05efe635aff478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9ec7d7c28bef147d27ce2606d98e191

SHA1
6b30d11ca59a150a74233f3e7e6146bc3ea5f130

SHA256
2670a853b9bf1b141da9a3db34959b73d9edfd420f5c67f02f7364d869704ec6

SHA512
877274a241fe29de11e5fd4338fb72b01f7ba857b854d27e16ebb21be6d391fd109a28e25b546982bdf97eb65c438915f35326999e76aa6b0ce765bf599c93a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae349c6c96c567b5ff0330fc703b445

SHA1
2c825a7b50305e8c5ab661dd73817e443d998a77

SHA256
b1ce5b8957163cf5729ef806040792a1e59a66755fa46b081a963eb02fc5c789

SHA512
8888fd61fab33055a914d9a059af4ba5d0f164f394297beeb32347d64034725bca6976566e8567bebc183375a746d1fc6e76b7da651563101410824fdc865738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA9DE0E0FF5BD78420146305F99A6CC5_8306BFFC79C1D511540A95B8EEEE27B8

Filesize
434B

MD5
bdac216101a867f8677b5785894d8237

SHA1
27cc1b8a84842509a1eadfdad441dcc875e9f87e

SHA256
02a04fa382be49c495382e7ac2be8fabf2c5553ddf42e8a288ca9cd7c2b9673e

SHA512
41c7162e6c0185abc406a595cfaf7537d7802def1c798cac447e235acdae23dd49b4ce9970634d1faa3ab292bf058fd8dcac545b04170309b49491031c4fd7c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56C9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar56CB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit