45e7beb040bcc888beb36b9d7d829000ae5fe1ca7b66bf77403dbe74544d462d

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44128e48b314435a247e0a55b3288cb7_JaffaCakes118.html
Size

4KB
MD5

44128e48b314435a247e0a55b3288cb7
SHA1

9181ddb4941848efa81a448abe4f838f3d1ccb97
SHA256

45e7beb040bcc888beb36b9d7d829000ae5fe1ca7b66bf77403dbe74544d462d
SHA512

7ded304dadb45313a904aba03c7f012811ccadb439848327e88384b436c59d04c851c4359b1382671edb7d6f9e8863e454b21a61653118799edb9856b9f83532
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oVkoOd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a3c456c19da5e7521b60a608f79df96452f4b8a2ccafa588bd2df34e840151d000000000e8000000002000020000000cb088d74d20bdbd1a1f355bb7df9a5a926cbb72530b3657df1dbc0c4d85efca79000000066e9a7ba4e609265489ff84023e2364db30fde867eafabebba9d9b37b3fce8062fadaf6a963814801e0f1863736b5439ca0f11a0428a82f642990fc3af577e2cc7c4a5bca4dfd94aa46a758cef3318fc3bae3e6d39ce03dbbc6ab11eb066f8542d73402c141554ffc9dda0efdc7711e2b90efe6260c1492cc167ff3daaed0144ff2a05473097ffbadf0d9bdd16be945940000000e847c5954d30ea96b48e3ca5f8165a8264ff3a7f5cb869947d0fc7933f51ae81398a4f87afac4d438d84c4c821097b879ff86ef5967c7db612cdd343066d8274	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421900005"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c9fcf7f600897c610a259a966b76a47819027477e3bee5c7acad86a598e5e637000000000e80000000020000200000006b7619422232a21dbc9267baa8f4f1701a42578650ae48d0083b3a371f20f00e2000000061b90e65d75e7ae776dc94b4147a4365fbd03ad44b05e8b4030a95e25bb03abb40000000430cf68f12ac2961c3b72ace446f28dd10c9467f43c281b3872d122d765e9c9edd7f8c2e131047107a47ccb6b836dc3f17f37e43c2996b0e2a60aada56dcb86c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6073990e6ba6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A217E11-125E-11EF-B944-E2C1BAF7F8C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28
PID 1960 wrote to memory of 2164	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44128e48b314435a247e0a55b3288cb7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f35a2943b8cdd7e6d21c4966695ab60

SHA1
4af24d76fb3ba34a97ec1313844b27c41914b100

SHA256
50ea5bb8f027e625ca5720d15aa7534d1d60abd233d66810284987c0922432e6

SHA512
447fc7b6fa2836ce4b2d42ccb2bff0b75d2622b9dfd5b282c635c0364a24f549ad7cf47b218768b5f0da5a279c40c23ad7e9cbe3a2a013ebe4fb6346bb1e45b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75f8271d47c426f482a5f0ea0dfe44fb

SHA1
4a6018cf44ef92921d94a5acb7c11b874000e295

SHA256
fcd9b8b27503d8dade2e0eb3dd9b5854a8bef52ab25b21aa84cc3d7ebd03611a

SHA512
e7369de93cde5a0de1e8acabcc47fc7056c3f9ad713d9c2aa6a06da3767f253612775e1343cd00aaf02f0aed143c74b091a7f6a0aad92d31a7b021e3678686cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5378e089f807408119fbcccbc83e7532

SHA1
5086568250119be78fc62f64f6086aa5a6aa57eb

SHA256
4914746c18fbea26ac05f83c1a9614f82f706275c20dcc92ca6777142ff846ce

SHA512
c626bdd005c73113cb11c66b67de7116ccabab284ed6c3769f89feec732531396920ab2f17c03b881f8a90f56408db3e8a3577001b4ffaf5e36a049e5ca98781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d931afe7739dadc26a499c18a2cf12

SHA1
fef28e2cad7e480a4027664f82ae858aabd138e1

SHA256
caf48c42aece8ab0ebc87c956a5f67409ddf11232d27f71f09bb5c288452f893

SHA512
86cbefb86f20f4224c6116c6a82d578c3bbf29c8c9c3718f274d2580950cb739a0dd65268ed69d8570c6af361f9cf9153103073be75c7761ce3b0e337ebe353d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928a49ecc32eb2692b8667e501d96d4e

SHA1
c0b5dc1a3d069e26a1ec9692f1d9aa0dc0b75b0e

SHA256
1be8ae181071053f77b6691ba3883329ffdb9b16e6cccf99ca5b797a7028e00a

SHA512
b18cc81d1a38b246e3d80eb941fc0d221f7b61426e7370d6837c77b40550eedf12bf6183d6cfc93ae6d4cdfb4a954f0911af0d1bc54b165985889634811a283c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d44f0b215c6c088abd4efca5edf539fa

SHA1
49708578637b1edd2e5db791dcaeeb40bcd20f62

SHA256
6261668815e03fe594333dd867947d92db6debec70e68e14136a8cd8b7ae1fa2

SHA512
74881454770020fe01f22e205a1ee6efc453fc1e5dddeaa7e6789aa5af0bfc4359904faeb00cd377183fddaab8aede0e7449267376399970dbb38bc2ba987656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ada848ea594b17128e0f82d53f622d7b

SHA1
d1e6c4a85fde85b8fd2c759395f43c8169acb4c4

SHA256
f800d498a5924617d9cd44154fe2f1832e6416e0699454010ba56d21e0e66b6d

SHA512
06d5f1d72ac670a32bbbf9356f6d6641876936288bdcceecd44833f8cb48bd870b71d370faccdcc82acf34db72c4a5ae3b3afd775eaa8998eae162ad31a57de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6d42142c1eed8fbc6631dda7a661fe9

SHA1
486a8f20c87de9bf1518ae451d05dce25b9d561f

SHA256
04c35e3901dbfc8c8ffed385cf62698ecbac2a68a33ffd912360273834d78bfa

SHA512
5faa27b6d5386585ed0f1a8d2e2c00e9a4436389fe6cd6d17d58531e6c8b29cfed9b709089dd7968458c6a36f22adac539345e3e77a9e1369e24a4bd1a717361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bea35682b74cfbca823f62232386120

SHA1
3ca7e0cd0f851d890dd5f233132b77fb940e3e46

SHA256
e7773a5b6a0fd9e20e10e65b7f012af4a9cf92ed9a518d2539d94179f5c5fa76

SHA512
7245bb76a0033626991987774e6554adbe3cdcb7f58b50fa828e24869166a6354b27c98405ec5f448072d9d59a9eab2fe31d926080cc40c3c54933e3b499b950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b01b3e3443b94339ccddaed1c295dcb

SHA1
605b4c35c72a3159d39d8286fa4f1b1799e081c7

SHA256
b40149b093576ff888b47c25528a8f176e2eeda1d1934bfe488bf8dc89fac28e

SHA512
98591e296f1005d25bbd89c4b2d5aa0d9022a8451153b02fb02a227257a65c80c4be0d74d7cca1b3966e535a144262bf33cab0bba1e43d5d62407fca5a75e66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e8382dab97e561a192d624b5d61be4b

SHA1
1725a16c1e8bcc4cd43b9e70073dae7cf712a50d

SHA256
8dd6e2b8c1b0fcf63f69513590bdbb51bde25c0b803643fe27afb805434f9352

SHA512
2554de10b7b566b15ae38d9b756ae18ba18d3145e34473937e71b14a069ac1a401b22426a7c570814cc2d8e813954da89c3e1b9d8aaccce45e9809fb3c259850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e55f7100c29ec3253e5c2c8812c2c80d

SHA1
3a500ccc385d6919750d4db4817e2ffecf50fbd7

SHA256
97e5c71bd2ed1fbf8c2b7f292852583b208de076bbfb42bcadcb0bd164ce760d

SHA512
a3a075cb97cedadc1c3a9646132910f25072bbabaa0b053bd1bc304d9b35b0b3b085cc2f3885e520626a1655f3a8b24d4b52085755262c003910f60b11ff56e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
063363e4aa1f5f2ab4636ae7c571b2c4

SHA1
6502a6e05f52b300e840f5b4335802f4f2bbfd31

SHA256
df638e950ed57dc7ffbf126148288d0bd4c32b410d2a784072afe207872f3541

SHA512
e79e4b1d073a1dc9670654ef783d80f368b4f1772380cfbe5807f7cac58fbb2593df0adb2fcfba40009d1a0b2061980e59e2481041bfd0f05261929765d991ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6a8be928a5ea90ccd30dc992ecee6b3

SHA1
7c6f5db8dedb7faa8c95d96a44a342215a11b636

SHA256
ba70a14c2397b4e3fc0be96e589054e6f812bd2d2905d3acea2f17e52d82cb7b

SHA512
b1ca6c39864c186859ad7020fba00fe651c0dffd83b6d05895a8b9e9b57afd927fbed2062ce80637b523718609fb6f2f059f102f6f7ca09d3e773c8618135780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ef2af1aa44a1746e0926d922fe68dd9

SHA1
26d5ea9e8386caa6efb8010588f0c32f9bc27cff

SHA256
1b9f9d666df7b3bade33c7122fe587ab6d3127440de88122cb83861b47066a93

SHA512
d0486f6fcf229bb3f4af0d645f06e0a10070a74ebd79ed61da73d9d65f3e0a4edcc73f3b67641fd41f9c156b80504d625ea05c4688167919be743de721b4c18f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30B4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3105.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit