292f09e225a56a81cec3075e01520653505b4ca0585f4da0fe600df6faeceb5d

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42ab9c1e71b0c7d2fac7eeba6f08f068_JaffaCakes118.html
Size

461KB
MD5

42ab9c1e71b0c7d2fac7eeba6f08f068
SHA1

0952d62a6ea18115f7e6349f3cfbec0955d60166
SHA256

292f09e225a56a81cec3075e01520653505b4ca0585f4da0fe600df6faeceb5d
SHA512

64e0d4e34f0d4757296303ffc8a50296e1a2183082ef17984a96e2b46f11f2034540cda43e9a91fac3079147a74871a06087253aae55d25baff1ac1df89d210c
SSDEEP

6144:S/sMYod+X3oI+YHsMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:y5d+X3F5d+X385d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f6037f33a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A67F9111-1226-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421876137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000df6f825b828800801dd0adb4edf93dd719bc24d4e776763de73e5a832dbe67f4000000000e8000000002000020000000edfce260bdec1516d17dc2e8881e7bfb247e0aec3ca325eace38f1b669a9bdef20000000993285ab358db746dcd4f8653994775c240174dd0cd61802bf6747eccf3d3f51400000005caa177bc1eaea548abcba9475c30939df0a639a6953b40c197c63a555d1727dd4fd73d5c45027142e2fbd18f419a400b3e8c41660206d89ea2ee3c1eb3564b1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001fcc38c332f22c0af33a7cba3afd51facd66e74550223c4e2a4614463d397640000000000e8000000002000020000000fc7700e416bd2f1579d2e7da38774f964292e8da003065b5714a1544c2400b1d9000000030973f48c095805fc8a2236a9ee5970aad0b3738a49841af3f307b4cfc83d98886a98cc4f2c9f5c0221a2f2e672823bfc382bba354ac71657a694cd000fad3620932e0266b3cfc354d212f6bfa3fd6be960a6d7b921688d7d14c97dafe3b3e5ff5b59895c38c3981883edb191f794967a484bd1493548c1b6fcaa168190e1f5249a4188430084f74ec8c29dce8ba312540000000941124bc2bfeb734e9fb69e1b8a143dc89525c2827847c1d5dbec31758c3619169c32958aba956f26ed9a68d61992103272d7ddceec235614deb19e1f80762af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28
PID 2388 wrote to memory of 2752	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42ab9c1e71b0c7d2fac7eeba6f08f068_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b14047b661b75abacd84676189c6543

SHA1
2386bd38a262b3d9c2c619a86f79126ba9f7ce64

SHA256
08394a333d8a4ed2b6d995dd688230b526b29d2b29b934e29fd778506062b761

SHA512
64bb3eab5bd37e7231c8ad3be2138da54aa6a5855a71ceb06f8b3ecd29351a5b1cea20d2c97531a50a5d1ee4e74dee2139e9225f263f6bd1634f10cf55c53368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0cdd1d8501d9ffe6e2344ca62df3618

SHA1
27904cb0df0e04e39c641342339874b1e3f85d08

SHA256
c70f69d0d26e37a656b993e3bb0c6baa939660fcae3467d52eddda7f68c9886e

SHA512
dda1830988f9770fcba50b38be2c17f5d66050e658dc87632c291b84b2e15ad9010c6d38e9da9258664be6243f72e6ef4110cae3c7c3b2d82255248f5d67e2f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9f796ddfcc804af936448c63af049bb

SHA1
68c838a5828a71d9991b38a45bbaeee17597cc86

SHA256
bbed56d510761ce2864b11e819bbcf56c50e63408199140d2e390ab5959dcc55

SHA512
41a3de14972bc8310b8ff1bd7974257b8a323f681121f819dd33c7ecf3385b2ceaef69fee3aa7400f163b230c25f1c77879a773a92f85fb9c70645bb1260f353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0cfe36d5c8425fb35992cdb57ee6bed

SHA1
1c64f09e766f7f45c33b4a02112a3749eff1e09b

SHA256
d097d37040b9d5faedabdd8d417c36792ab0ba9b396c2a1174af7e800c05080a

SHA512
550c73f3d65097ba8f9206fef84ce877212dee2a397d87e385624efc6ce25eba5d4466f37b97a3266983b042278375f5965d0c3cf91cb049f3fcad7f2a145363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
821c069a51c7f73c2df2ed7ee33d53ee

SHA1
87613823a7ea7e55c26310aef83f31ef7e66d9e6

SHA256
cfc82f2240264bd74380f56d02e90a12d453ee2bff53ca23e8e12f2861a075c8

SHA512
0a949e0b34b9ae9ed897f3e8821b3a102d80395119abdba64f721ce53299aa1cc2e12732dec07e1a73ae7501f92ffe6988d0d279de377f369bc4a11aeccf7043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27dd50d6b2e336f6a69bb0bcc1c3b1e0

SHA1
72e9ebb011c2062f49e1baf3fca603d2073da076

SHA256
a5418f86f8f27e16327ae42e2c3a65d102d12ce91c536c80208927ec58267997

SHA512
936c608b3edc2ee5dda04ea3327b9ad39d7036f7b49a7bb1d7eb035f48122e0ce4effc704591e886d51569d7ec05ed7e62df7d617dc5e740812d7a08d489b146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7caa0188eecfcfba2bf6ac2fcbf5d72c

SHA1
48ea8932746dbda3a3a76f7b47a1bcf7c62a6f1c

SHA256
bf7efdeb18ab37dac2593a59479e6c9294c89ed678f204353c0f8693d6ccf103

SHA512
6077f83a7f6d6d48e2650bddc4a7c042f214065c9a195a051bdb3ed0aaa6bf1de9b85ebd02d2a45da06628eeeecbc9928d317151999cff09b30ecb9b74150b3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e186853c03eedb13252563845418d54f

SHA1
86db649097869015a2929c4ef4ae194a7012a9f1

SHA256
1d26614469daac9b20c7f0f532338b8ccef3594bf9fd5dd5dd1c976916e582c8

SHA512
5b5fdfe330c5e8406dafe93d22844219eded235d4b83db9e51c56a4386afe90f9382a1426dc747b497e2579a1909559fc14c04e12c97f50b01959f37f57e1514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d265980bae9368f70f3fac440ac0712

SHA1
5e5a7b901614ac90747118055d80d387e7d616ad

SHA256
05e354f02c613e5c2100c47e4510469d563df70e4dd46db9e76855b320f8dbca

SHA512
f702eb3e94c5de6ff3e761504c82c3321f65d8e682acf24bca2727cc5a565c99f4822da17ae597d1a1a7fecea13708ad8c51d70942dc2e43ed0f42b4aa76e025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8cdf5facd7857e311de1ef1b6b42dd

SHA1
84b2d184f423ad26e5f2fc2a389be3b27daa72c1

SHA256
9147b2decb038d7a69372d239e8aca05b65bdd7eb45de5ae88eaf88d7e03f2bd

SHA512
b11687c534d7fa18aa135a4f856721418c46e38ab5e0646e3bebbc4b89d7025a540fea4c9ad79a382aa038fe863a2f3d197feafcced0471efc0d0ef07fd2681f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18961f0724db01c0b9db82e6f6cbc19e

SHA1
f6ec5c10acd49a28c83890d33126f4104e242663

SHA256
27a91da21b2b4f9bfb01f3406234e831535b2d40f25ccf6ed97134c836a9e310

SHA512
dfc6fe35412e30a010a85fee8c6e8fad4dbe4d69734aeec1b825d37bb3f22f82b9d50d68d4d3cc573e1b8a0fc6a63a7db55b986c90cc7e69ad89c25c0a926afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
869ef282cebf3b530be432ed39444b8b

SHA1
c5b25688e3886e8dad779aa4149c065fc62a0ef0

SHA256
12c1f12545f4294479363f127a22ef8e2d55f8c21617c69af1d4d214a7afb13d

SHA512
0bc6ad8de03aaccd86b7ac7e47aada201e62a0d44a6fe36167649ea29a224af3acb3144959c8a95008abbb383dddb6cd0e143a15320b3ccf25e49e484445c0b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4136f9c043ad2669bbf59ff63402b5a8

SHA1
00a07b67d951e613b2b71d64024150f34cdb51d2

SHA256
73c24a30ecbc105317a85f85f5d3aa64711165d571eccbbbaf7a1deb6f5caa27

SHA512
39fe1ea77291594680b7a1cd27d830b293d59137d896e73e85b2ad556adff832212efdaac32101d636d381876f5be8030abc039ab82988525a9fe3a7cf303f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcbf1c158ad42de49d4f822c1d86d7c1

SHA1
14485611b4cb8c44ffab075fd25c82decd74c944

SHA256
529d76aa4fd408e6559e8252cbc73eec4ca0d794d72866b2e1b2c84bdc611479

SHA512
ebed00c2ab6d2ee92fd020be5722e62cdc9649ba454d2c7632bcc84a8b7f263cce6948859f54ee69a04545ec09c24d1a553c46e4e77925a63bbf3a22b6c59596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
371dc6889b290ea40d2fcf89deaf29e2

SHA1
dc1850de6dfc5c02f9dc8f6c59e858a0956bbf5b

SHA256
d5168fe4172d992813d9f8e8391c4f25b46627524877fcdf3404ed3605ac3091

SHA512
a447a8e073ae73bed28ba0ae244a5da38aa7fd6124242bc07d900de2aba7465b5e72b0fb0ebee6120bbf880d75fc8b038507fe4c0a1f8ca14b52e4b63ee88d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce87d4fcfb95e91fcb1c0ed83582094c

SHA1
29523a99feb28e138caa31de88327cfc60883b0b

SHA256
c3e6115f4e5048fe82eb41eabc5de76d9b934eba7792298df4546bebaa52bc7d

SHA512
d8cec01200e779eaccac7c7de2800af63ed0a6503325f22d8267ff490c1c5d81c885411cd81075c028bdd274f9c31457bbbf99cf221e26410f86957eacac37e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DAD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E81.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit