ff9b0b7094852bc4ef170fdf3a8a12eeb6e8320273c54b4f1569243332998ef1

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43d61692ddd8afe31789425f2c40eab6_JaffaCakes118.html
Size

25KB
MD5

43d61692ddd8afe31789425f2c40eab6
SHA1

fe8854e89e021b10c810b4c9c8885b2566b6c14c
SHA256

ff9b0b7094852bc4ef170fdf3a8a12eeb6e8320273c54b4f1569243332998ef1
SHA512

d09c5eef7209802455df41427dd5e1afa11ebb6810ba81d565aa6c7e95de52299cb39d8fb3d0c474fd0b3f762a33aa4bf1f7593c69524b9d5b9717cde5452f8e
SSDEEP

192:NoVoreub5n+nQjLntQ/SnQieknunQOkrntw/nQTbnsnQEMCrAapdEYwuXMEnFnQV:+Voa2Q/5Fprg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421895934"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b47c9461a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000be976655fa8f7a10ff9295c0197a4d20ab5219092d48ecdfa4245a024b5b894f000000000e800000000200002000000008bcd9b1f4413eb7597d140a36ddb59e4fb1058d08a24bef7e475cbd5426cb1e90000000829572f15aac7f7303eb10508995de7636d2b3579d30804ed5994f651cea26a783d4b3f6a2f83c3da6512adf9d70f400bf87f84e1015283304a4c753ebd76549e3904aa3e2ca12829f6ef07d8b865d0e4ebc507f6a73442d9eeb6e48f5e2e140ae0b9c690537ecc024813374e8b6e8b5a82ca7e48998dbfe7089de283b971c933b653f625868f6f4f2612043203c647f40000000658f56aee14162f192ca689d27144ff190146831caffa84611f35946ad629452e37861877cfcc7dbd3c4c5aad6e679ba30a78f982bee85616d797f07d3edbc82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF9DCF31-1254-11EF-8DB2-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008729e7a72ebf886f1ae90f7a3c2845b5ea2e3f1599ae01a869b5d520d0c22723000000000e80000000020000200000000ac6d0c4ddb774ec92a797e09838148aa082a52fc145f1f984d3d05872af4dc520000000b4c628c92b7a891d80ff5a77746d057aebb59c9221189b712c8c36217e420298400000001df9059c994742eca87f957aa48cedf50c8e0bbea05d768be11f26ec921d6557540fe68c189ea14ea00069737d59ea7cfce799c1bed8f65e6eb48c273e40910c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1400	2424	iexplore.exe	28
PID 2424 wrote to memory of 1400	2424	iexplore.exe	28
PID 2424 wrote to memory of 1400	2424	iexplore.exe	28
PID 2424 wrote to memory of 1400	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43d61692ddd8afe31789425f2c40eab6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb82cc7e6534a54b7752e9e3964409bf

SHA1
454c81002af5144bdbe1da4fc27a91e9c1cff1b1

SHA256
b1932cdb3ec6c35a7ce026484061082968bc9637f45778f174ba50dd2cc53c0b

SHA512
5cefcf3750da590287075f7fc23759aff32ee3cfbf4c33471de007e803183b51b4ad4002bbbd1827ed67f72df80e1cbc76f705613766153d21d51ab2a6c02455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
884e878a4d6b6db2b01e19f89d4c7cfd

SHA1
eb75497e526ff8a91c19631628be75862b118ebb

SHA256
9af6f9e2a9e82bdec1794bcd029bb8ab88a5b6cc1b46f5cf9022ddad0e26a29b

SHA512
fc14a3398c9178444d6e2c03b0901719e2ea1cf8c6967b56eba0ae08a41559ca7bb7cc10bfd841ac1d40e0087039dcf83da3227a5b44c5844726088bd26ef54b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3a523907eeaa47f36fbf6e2fb99f95

SHA1
e7f7a457584b8f236951a6096811dd1d734881a5

SHA256
88f84b055be94d1a1f5e84328c6a2e7750497711b450cb8d7071c1c4f63d6458

SHA512
f83967b6c62be711e77548691ac593d38aba9310752c4d75fe722772fdc27aba4487a9e9d137ac9749438e8db9719fde617a97679671da9f2ebc056fa6a2f5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe86aae80ab57a69ca88cf1028c6d50a

SHA1
1225f95735681120796a6975c7d289f2d2a25c2d

SHA256
5d48377bf330165a20a6be13c54950fc0ad1c28f937972bebbab12cc66180dce

SHA512
69c1288c8805998229e14e9b91a98c499cae0b450317ec4dfa754c9fc25026c2914638e6494953cf46fdae037c41fd9c0ce06a6845bdea15142e84c9d4537ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
895d34c15b867aeffc7d7b6004b16cda

SHA1
8211cf9af9c8274669b7102b784d9fa77972b45f

SHA256
a7b6a639e815a303c870f1cbb2b1cb3232b53ab29aee4d9c66e1790baf539dc3

SHA512
505491a707d1604ea3bf1d1a1f5f56659c70d788dfe83bf36d69678b6de1f5b05e09d0056274401156127112885b88f47106963084ec7f58b2f9d6274b6610f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dea4522704e3a9b39c5862c954d0ed6

SHA1
4cd84c04fbba318168b355422e67177ae85df5de

SHA256
ef63b60c6fdc0e887cd0e65f63532a560c822b945b4b45e8cab80bcb4462a820

SHA512
7a1a9e834225a505be2c250fd48adc2c78f9bd20a62c61e83ea4eec36b586d30351ee3493f09c759bed5ff8f46eea32158105c2088ae85d67b01e255ac713002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf5e16474c9545726970df3623c2e698

SHA1
76f8e28a2fa597769f7e0fd3536a8010b307f11a

SHA256
5d6708f4278dea0d559e845fffdb894e8211caaeeb2cc9ceec8e1773f240b4ca

SHA512
55dab8109539e0d18acf54227eef96e961885ad501152b5000b835a930d21d6365c5a68f34754ae9e96069a68897eca4b5365fc4ff806ac7c32ce3d642b704d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb6d92b9c34b0a1c4c8d7880940f4c26

SHA1
c083374f21dda6eeb0228c56736d8db3ffe1a2af

SHA256
2c6efe91e565948361db379bba1c10f028020a5a0e328ef18ea85d239752d320

SHA512
aed5a11b0b914047cbfc6856461aef2bc354fb85019af7d1795c21fa9ca5ce4394e9b7d01978f49040f1de518aeb18b40d0902c6e1c2fd433d135cc454234717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c83e1ab2f0977509f12922ca7f695baa

SHA1
43cb31fc2f4af85166d7f0f3f291a20672c12fb8

SHA256
990b3270a938a16ad2bf42223d040173efd0370793214ea440c1ef957ded254e

SHA512
d5a8710c35c7acaf2c6f79a050f7eb03d0c770705ec1610fd344f88e82fce8e48166148ade6988f9deecec62448f4e5bfc065932e72f8cabe36d3926abbf5f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a9824c6888567db02301d0fbaf8efc

SHA1
1831a21571d5b549ebd4295ac0c8b9a7440da01d

SHA256
3f84f51cfdbd51759f4d3212f301a6d366963b22f8703ad1cd1a33cd5ab02c91

SHA512
87a2cb4e6d7563de43bd3237a31b1e0fb8ce3d55fd2c7032436ffa31e8f06db80d92de78fcbb929bf8d6b812cce4a606b4d2fa93e0de71b3e4dc93a24c0eb725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5459cb9dbb71081fce04d15a499e91

SHA1
4edd7f8f2d16d4b40df6a154b5101292a3831c60

SHA256
2867b3282269eec0d92b10fe0038f677f3433760b0dbe1efa4acc0eb6409ecf6

SHA512
2c863324fab2c4fa36bb0cd87a2fbf732ef7e9f4fd673535f014f7d597634059f7338c800f0d5d75bde2adb04b3d82ad01a939203250056266b1ad594bd6dc0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8411c6244a983e3b0e788ba7c53c0e8

SHA1
cfd08dd5b67c2b4af4a360f6a5b4bdf5b8bdcf7e

SHA256
c1c1b03e3d17f6bd2da8e3873c253f5a47d2343a9e4893e91688becaabef192b

SHA512
bd06c2d4820757d588931d613935bceb7e21eb1f20873c259fdeebba26f4151239ed33defc2083676c51a61090e10300ee8fc18d798b28e23524901e7437dc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfc4e979677cdaccbfe886444e673ace

SHA1
e7713500e125c9281b574abfc6efdad220a3c0e2

SHA256
3e4e0bcef4dbef27cf6826fc06711351214342939181870496f8fdd28de8c761

SHA512
0beac4cf62e4a303675437fa6649eba73da4db90297d726619ee44f91b3ec11f8829245e0e1e2171d594d1e19447f1c4d0cb09355b104a1ddfb7dd9c4564868b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d260a429c5d30456b0512a56345fdadf

SHA1
a8c9c70f32b09993f8ae7908daba52654fdf94d6

SHA256
966c37a52fcb850b7b32a95e78a1ab9f44335d7d1cc708bfddafe5a17840414a

SHA512
51aff21d5de0e5b660c31d26dcff72de1d3ec24243d1efb40f22930e51ee2ce0b434c2c6673497b9143fd0eab3edd6a3110e7c8e04de13df0ef7b19bfb2bf1b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d82c238aeddde39d3f1beb33ab81ff52

SHA1
e793ce770a5092949613c786436dfc9d71ee07d1

SHA256
9f9c124b79ae0cd870d3e342198698c0626eeea483113885906d67c119f5f5e9

SHA512
1a04374d50793ee22c897dc6e11bc5a437a381042baed9ce47db8caa00381b1064d8e20fdb6ec5277297cdb67d124e9bde3e2f4517d33553c171350a1a60f35a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce4ada8ce315475eee272c1df158adb

SHA1
66a189c381d04e3295bd71ece67fedbef774b501

SHA256
f640a4d6744c4b5df68a13fdea576d41aa7a2a853becb07ae0cbc7ee677f3b9e

SHA512
a10dac34636b6180450736d442f143076202461c6f785df2246abb9db928f1d04ad38534ba947479e68ee9452a6db4a2c1428d7e16e46a928939d9f61af7880b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b06a8d0c67b07418d630b46dbb08a7

SHA1
ba896d6e9f16a1691cbc0fe71843efadeac4bb50

SHA256
0ea3ceda9b40bc0d450f5f891365fbda53fb69950b80e7fe4a9ce3913a32e571

SHA512
48bd5a45838ab284b10a06f341788a275d088c4df2587f5814f779fc145c357dd940810bd5f417023adadd29b2a8ae51a98753d75eaa28bb02df1fcd0a2a6c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab394C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39CE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit