a6c5bd63d3d83206f5aa178bd82e5a05a992f3e026f56e121b058b81085c2a97

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4402fefd1989a0d07e606b45f8d6c565_JaffaCakes118.html
Size

70KB
MD5

4402fefd1989a0d07e606b45f8d6c565
SHA1

33267b3e783ec8b5de8c14386567d16509a130c1
SHA256

a6c5bd63d3d83206f5aa178bd82e5a05a992f3e026f56e121b058b81085c2a97
SHA512

4c724145c719ca8b0bcc1d9aa917d36bb40c8e58e796be2a611f36b7ec18ce6326648ae2025b106d8b72260619df196da668b659da1107da293dc8ed5fe5bae0
SSDEEP

768:JicLgcMWR3sI2PDDnd0g6ZBCZoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8F:JGUTTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421898979"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000854b8519bb89c43d16a63b1231a9b1d849d7b1044b9c095b751901ab215c9db1000000000e8000000002000020000000f180ae5e097fd0efcabc973a50660fc8792e84c96a7c2fac78834b9d8bb637ef900000006177473cdc9656b66ccfd31293284703c4ea262061bf00dd32481d2f75c0e44b1dc8cec16d3c625ede25b4083f9be96edf4531f7829a11aa051a818ac3c905d4aefcf7c93a8a638ec874f6dacfa6c1a7b0128f8424612e087d8b8135b123b8cb77e4f1eeca765b00ee552df747ca7e2e5d57a6192a08b53e6b47677e208f6b6b84615bdf8d069e4970bfcc777cff0c694000000052f322becc30d0017ca44a9813eafd0d7d2df0512b156072e0bbf786e2ddd1aaec8337f2884350c52f1019602575eab289857bfd248540e4f999374880e9c09d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00021cab68a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5D67BB1-125B-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000095db2699836b91f28793d3b81ac4a32b1d3f86c40865ff193d7dd5330abb9860000000000e8000000002000020000000de48e5169362fdd3d33ba059dbbfb6bfb3d60e1cddcc44ed0885884f6db8805120000000cba66e72d983e38ba32a1a929250401b1f64637d54cb7530658a6a63755688c240000000a105d0d168f8b32c38d673e15a56495a894ed6b7fd661ed793a489975a7a526f5404d77b5ab9e1eeb1ae23ffb639114c079ad7cb97e5148a493ce7b160281fe5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2540	2312	iexplore.exe	28
PID 2312 wrote to memory of 2540	2312	iexplore.exe	28
PID 2312 wrote to memory of 2540	2312	iexplore.exe	28
PID 2312 wrote to memory of 2540	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4402fefd1989a0d07e606b45f8d6c565_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872d91e2a4ddf165f8cd64effde425a8

SHA1
16f456788f824180c7a0fb01977f287a048c833c

SHA256
7163cdfc490f98fe03a84d52a71befea01b493f935f153cc29521dabbdf84571

SHA512
8d7d398506aece87eb38e54bede603f6c67688ec6a88cf4c25c0c5ecdbb891ddcd203b1f22b0b087ed40811e8b2560a12a90a15eeb35a7711b97d83d23179309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9348f0d18801b7914ced34bf255b06

SHA1
1dabc318ddb783c90da2a11899e5cdccedfb8abc

SHA256
e2bc163d207f40763ca570198dfcac1ac2b40e3cae4961dacb198b7d8919abe5

SHA512
95fd8a5001d02e10ed49c350d271352072777d5468388c799f16077d5a75dc5e8b46a8e260d60a29931c7ed1947022de4beef96cd9f0ba3321c4595f4ae4aa56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85165677fddd8d7a260dfb2d22b8f2ba

SHA1
635ccf0ad9fc0cbb28209a7f4186d4a8a1be30e4

SHA256
7d19dc046531b811cac3999e83781c5c19948436d9848cc1e6d13e0dcee1a939

SHA512
3e0822ad5760bbb7918d6260546178591fe713bb15252d2a5a60cc9b02c2ef278cf6e49e22a85d6abef0ac6ed710b4e13dd1070ee4b144cc44202dd1964f6ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ecb919a82a61f0500431be843d601cb

SHA1
594d7d0e6331202520bb6413bd975cd9140f6d37

SHA256
74d757f0d2e0e03cb211919d96657051a1d1a3f53e2a4e4b58b72e0ae2d3f9ca

SHA512
31a6230920aecab7faeec1a2bec10931cd45adcacdb487f0a0eb5d7424e31f8ee1f3dccbd07c6b503af0869438a6efb9b6d2ea07b0b8fe26eb382fd3bd44aff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d62092b7e69eddfd8d8d297cb9c76070

SHA1
e0de588e9220846e498fb082db852a16911fcd92

SHA256
595a69d4c8c2230aff1115bcc2951f4e380a9a33e55f88e3d762f25504f97e61

SHA512
b48689cff2887a0cc61e522237d47c6033e38a88aeee1fb73b8fb3896821f02faf98ab16013181a099650b34513ead14b1962067d09197a9408b3903f4ffa3fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0400981c9f0bb788cb6509431ed6382d

SHA1
103e2efccf6ca28e83c623e2b83ab712d51777a5

SHA256
15d8606891858109b5df5591874581e559f18be41d06474e6d6603bca34c8580

SHA512
83e3edf7111dbbce23107b0bbeda3d614a3829017bcebe3ba87c66956e6e0aa648a92416003d670b13c6eb0e9f15f79531f57c9a94cc002c144b173fdd8a18c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6fada8403bfa83d9d340b72fb1a9ced

SHA1
f76a448d0d79546b145b1424b8afdea778f0b981

SHA256
ea34ceca299ad732129b9505266e8455fd2b5a514a2661300f8ab4ab0e76d32a

SHA512
8d011ca7029e245e87a4fbf3477069026b63e2dfd43f5de54e83f9d4a64952c2634103381d278ee1901b15df3ebf6aa2d04f02f196d54bb9b17007bc647873c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bdc6493a11b817a047533716a33dc52

SHA1
6292bbaed5a89d33765df233d88b10b5bbb8b69b

SHA256
49692bcf927ceeba14f2b277f1d5ba36dc497050d7fabbf8629155ffe5921fba

SHA512
c85db66093ac5adc46581b78aad92a67e59c65c22e2aac0a83cc8b175fc34cdcf3378be2913319c2689c9f947252ab8906d322b1f1b5bbe8012dca5c98499b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28a401e0cc134f390b36b77b9e06f3a

SHA1
196013ec6ef0bcf42afc1ac4f266515676a815b8

SHA256
456124ed08c1e5898be514bc051fe08ae9f4a412d3333de354e76f83a667c511

SHA512
0f24e62c9fa281229a5ba72f1ff594971b6e9871bee2577f4c9156dc105ecfd6d8a92e4686c544cb4262f694fa3439830737c9c8d9ff1f8ee695bb79f43676e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2954aa51af3dceff65ca8c1e39bfe9a

SHA1
c71341603fbbcf3269262ba81c43ba31351e0fa5

SHA256
ed0a2c4b6147077adaec429880c1ecae31935ddf0652db4ac42d0b0becb60948

SHA512
0e4c18f48e0086c11e145c348471309c9b570f6e5baf068593091c5428fa5df1f0ab4056952f9e3948345f9d1c6947333cf4bf21116a6e2edf23b3933eb3fbe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5129c05a0eb2af53c4567cd6cf864d0

SHA1
495ba91e14fac458c9f208de52b59f3be76c14a1

SHA256
f881ce60148076810df50227f3557a5d90a89498072df31621316be8cabce8de

SHA512
0460d157da0448c3ff8973e19439dd6e7c5a178a729dc18978353849bda247c70b6e8decc8de52969ded72d65fe592b7489da91838a6c125a24f393d61b2b763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d697cc07a5ecbdd9079c3d6cd10a039

SHA1
717e4382794e085008722bef4b4d1f15cbc89a7b

SHA256
02e7007c0d509f115506a9a4890cdfd0e94dfebda6ba4eddfc5676bf8d634fe7

SHA512
5c331bcafca7ba7901db31706066d7a40f2560539b541b56dbd9780cb3bafbd3ca9ea0427792b8051307e0f8cfdbc9299fd3398aa3b436e459159b7da5101c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c8554000bbee272c7e9d2564b5a0b6

SHA1
31c34271dc9251e61946d4726e13ac649b1cdb70

SHA256
68149488ea472e1e484337ada6feb6cef00df4502697c3da4f00bcbce228bd93

SHA512
4904228eda01ca55b838bd079327d9ba3527c21b29d95230279171593cae130d35c84f95e22bd30c5404df80c54b67dd7ba8db32e2bbb1fd82d1f3cd214fb7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e47813ab33b224466459951aa9e7ff90

SHA1
96192774a7b458bf4c61c2cc827cbc425f0bd9a2

SHA256
a6bb762b77e8d5fb7e8aaf9ddc8d9bed0442b415f4beefd71ec48b4eee256443

SHA512
1b1f01109ceaf4b3c6eae8fecde7484244250e9d33e07e9d894ccc5d9ead7cf44a95b38b7fc74d8002eeb0f88144b53f09f0c6a5a2f1911b3b22944b805caf57

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA065.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA399.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit