69bc40775f20f1363ddb594ce40eb6c48bd78b7920b2735e50c7aedd74b5a86a

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4820a03fd257f6a5b8ea51cdc748fb54_JaffaCakes118.html
Size

33KB
MD5

4820a03fd257f6a5b8ea51cdc748fb54
SHA1

0cb642ba2dffc399415aba53e2c2b992f7ddcd8f
SHA256

69bc40775f20f1363ddb594ce40eb6c48bd78b7920b2735e50c7aedd74b5a86a
SHA512

94b5a65e8ec78c3df5eb8c71512e79064d95d6bf0a88a3aacad846e7dd62329900b751a2d79b04e69c4978891a0bde442c9db908739162f4913ac6075c885aa7
SSDEEP

192:uWg7VQhy46Zd0mlb5nhkzlnXOCQ667o2fenQjxn5Q/X5nQie7gNnMY3nQOkEnttL:mnQ/woFgxvFwcVC4kFZUUgOTXj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421970468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48BF84E1-1302-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000080bbf4f348ef8b2f945eaaf450d5fd7fd0a7412077b9668bf8657243a605c8f2000000000e8000000002000020000000e5bd8991ec0eb6c8a12cd6d11c63094a0a38149abee4396a88b81eaa3a977fc9900000000e30d11117f5e3a6e5083216574af13ef9e7c7f20c64789f2d2467985479395bb687ab5daaf1bfdaa66889915560d599f576da81ac4761c585720d4c0fb70b27ede093ffd2c623c2b46b4c317be421f2ce17aa8b9d43eabe764e2069f65a4cf01bacf5ff5468a1940655c57ed4709ae357a31bfe3e283efffc3bb21339896d9918ab4b6fc2220e24453cb32f1404401d400000008f889c15893cc9783f695df9325ff39e359e88e5385ac03f7a0034f5378a496aaee9b8764c5cc6017da769e17cf73b51a02f331b1cedf44a7b49e621c490d381	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004916a1c363f8935687eaa6ff77122cf2ea24374927c3c696db1fed055e86a15a000000000e8000000002000020000000365af0ca16c5d095e288eb38c8e34271f78ef8ce798b6de7c387003d40f3018220000000a57d6093c748797f9cf318897fc1d51a7d5f6e4cc4e112f4712a3b5dcbca7dcb40000000f281a8dd0f1e2a44cd1bbc97adb7df4534742837e6608c1f6aeedd010217cf3dc77a15814360f691e9adea496a8c24f9e909688145a3780b1a931dff128aa81c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ec721d0fa7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3032	2424	iexplore.exe	28
PID 2424 wrote to memory of 3032	2424	iexplore.exe	28
PID 2424 wrote to memory of 3032	2424	iexplore.exe	28
PID 2424 wrote to memory of 3032	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4820a03fd257f6a5b8ea51cdc748fb54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c62877be9bb620a730e65a407fe56986

SHA1
faa3f898fee88ed1d0cadbc69f41faeff2676333

SHA256
56886417192eacb03ebf5a355d7d00d88a8f96eff5025c04f75e50d228f7cfc3

SHA512
62fcc786f230bbea448eac984a6b5d1c0b0b60a8a88ef1a7118ab1e2ab058507d36595242a49b50e40de91d575c502fbc1b74317e0370e39121ca828404e8ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dad0f1d5334fb3a091b1a4e36e0f1c2

SHA1
46606ce9caa06637252cc7cf916bdd3e972a1d07

SHA256
d15ebe1330323ef5840d4b49ccc7dd4da7a071ec9b5b00e9770d02489ae2e040

SHA512
cb4e74249ef09186d626d9084d2307c12de2a794da5a4d1154bded6f238d44495fb2eb7ecbd6e4899a38feda591209c4f9af33e6c94602b442e4a29309d4ada5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba128fc48c94143bd990ea232557c690

SHA1
a18cbf1b7e1682c44aa16b23ed8470be3da3d3c9

SHA256
1f18bab6ddfb1f6bb943480fd0885ef95a4d1c89cce83659b467509fdc8866f8

SHA512
667160d51138c630a5608a35a9edf9d1d1520cc6861049bb0592160a086c849547047ca781b929e7982e107e2b0ba0ebbb8adf6f49814d5e1c95a193f3f7666e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1dc25147812d8f35dca47ac4263e843

SHA1
77bfd1048a7b179ac3401ec21b56ede88e39edca

SHA256
67b4acfb8760487288040bdb88b8a0ee4f409cc38f4f34e16793dff4bec2d1fe

SHA512
9c161ba5cc3db5dd9b265fb08c939f16c71f7e05a8643320d6783280c89326ece829611cf05378a158e284acf8a988c59c92ee50f1bd94d23f2021f58fa555f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c5fda3035c5d35b4cc5a5c8bf1badd1

SHA1
16e99497872c349b8f6cfe8dfed9f62aec69ab5c

SHA256
c5ee42628a6450652d8ae028d66f3e428fbb59ff33ea647c67a569f648521acb

SHA512
553ece0d3002a150f00612b74f2d1911f6a7a15c3dd9889cbedbfbd315c1940dddf1bdd2b52d48fd61abc5918b6f97d993d2f978851b44ef9230e3794857b4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f97e5ac8e9da275dcb883d3af980ef

SHA1
58d6d626d13d8a8929d5b945d084c6e0dd59ef13

SHA256
3ef7a137c09166d48b6929ebb929d6b8f78bd806a26cb023ee667a5070a2927e

SHA512
0eba5930ede64f40c9bae98afe2cdbde5620dabcd25ca800cdcdcc9d7640c3a37d495ecc2212698732dd96a80081b077c587805a6c5ab33426d608cf09112b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2307540eb68ccae8bfc18c5a22b906b4

SHA1
a4af35dc68c000ce8ebe07a1f5fd557a8981f69b

SHA256
b99aa446cd1ec3e4b5e1483982280fe885d8730bcd68164b9099b28fa28cca8c

SHA512
8150e5019cca949f42a8f6876972a063703884144516b4c6872660b123f5efc512fbc8a76f9f4e221f547deda44f42d72ad7ba71e652c9fffbc7bda4223ccd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfdcdbbe841053d0c281ef8e1b7f0c75

SHA1
5f25c575d5fb448658b9bfc93deecfc3f70db098

SHA256
50352dd65cae07998e77505ede67ccb4f21e3609aef04da04b9e11d7db5c0466

SHA512
61bf5b24f55beb7f4e1c7b4a61c51f2a440ecf645725ad860608760b4122c4faea838827678fe1ead8e262b509973324366ba5699415b6f99122107a2435b0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42f78802a0d85e88d2c20978a90a489

SHA1
3e4f9ae41e9d9595bd3116782a24fc1005a9cf2e

SHA256
a141728bc069c0ee8c2218bdfb0d7b37f1740ff5b9f63f15d96bfc6781465a61

SHA512
848bf48edd2adade8b578c404ec8add3ccdbd82b5a1a60159a7e7450db800832c2037aeea24afc70c21cde600d42573e9985a18cc826d72cf0ba9c35b1dbfaae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b97e8e1c9532af28c3cfb37baf9860ea

SHA1
3a9088aafd2a0080b931e9d3692d5caf1d5f3161

SHA256
1324745c7700a2fe73c608504e8c0bb5272e36e8c5d5c9c74e7be7d430cf628e

SHA512
52029a52ddb2efcd7af88f5bcea46b535e044de2c84cb4fc3c80f7c5bd9d7e5c672e4c27a3c6b98f4a4390cf8f3eaab2e5e59e9329c5b1f809e54cd3a03bc2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
978e72350f5773fd0935f5302ac4a118

SHA1
04640ebeacefd3f726993c59fb3ed12f8f504469

SHA256
954c266e7a87564f8007cb313a918616debaeaeceaaf20475286d97d731e940d

SHA512
112e4ec4193126a202f01dc89c9120d973c1c6d7d0884805a8babb38395a61cda4266deca1c7537882edba4fe4bd8c5f13723458253e21c16328c56acc786faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec868c1240046790d9a6528ef809664e

SHA1
94f47773276877e2a35f7762473f85df291950b0

SHA256
4ed399d56906011f374856fbb6bae2b60f5104d65a2d7e30b06caad04f649168

SHA512
9285123763511a74c1cc7dffe03e2912c1941904cc8363e9a32c21ca6058625f8a002ab5ea9f8e371bc2a0dcf04d5600b85644e6eb2eadb06865e657fff80a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2713.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2784.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit