7976423ef2b390b790b243b1dadc69c1c80432e27bd853ffc69f58eeea7f77bf

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4488f8b8dc21b9fee4f0d647b21a736f_JaffaCakes118.html
Size

189KB
MD5

4488f8b8dc21b9fee4f0d647b21a736f
SHA1

525bc9325dd578803733e34659df936d9037e2ad
SHA256

7976423ef2b390b790b243b1dadc69c1c80432e27bd853ffc69f58eeea7f77bf
SHA512

8224c2e1fa072b693024e23582595f67699ae9a211ea03b5a7522923f38074fd8d0f0f26f84f8deb71a11f06035d0e3e76c4157cec0d2e062395b9ab295433b0
SSDEEP

1536:dEmNGZqnIYnyRZWS5ogpuz4fQpp1dVWHGZ4srV2ERZTxAHxLcZ3xt3VSmFgN:1FkyZ0KNSLcZ3xt3VSmFc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a75dc50ce5c9e787dd569e419a34b845e1ae673d12282aca3e688c17e5012921000000000e8000000002000020000000ebc5e42fb9b4da5257cfb7844d22107c13dc78c4a0cbe33c00cf22d92fbee7ae90000000a723931de32bec593ea6ced5a82088c800a16d3917fe790e31ac3b9ccf080f354977d76554b5d42016395ed1c31ce08eb80136c1a0bb08d3f88845adcdb413ab5f78fe9ec19c2a9caf45dd2a20a4edb6123985e0a29747c721752e38b57d69944550adf00bb8319048e982f4cedfbdef7d82a98e77b1bfb359d602118537156eaeb0fa63d8e716bacab9e3aef588d90d40000000e22fef37df015827096f5c59f8ba8a3fc5e2e35e1124bb96de191a081bab58a5313b660a592cb6f14b045e52704e255d4d3b6fdc4180b068e43de62d4c1f7927	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3DADA81-1273-11EF-BB1E-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421909336"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002c5767d8c9ca9ac57375a841137707baaa4cdc22509e56671203f4076464b7b6000000000e80000000020000200000001325e01d6258a9773c73847e3fb40e1f3fb3ab1c091c796868a2887356baaae62000000024499d07c18e23b74d55e703575456041032b5e40dbb31410fceed56b57ef2cf40000000e38f8b2333e3fda8eaf758fcd81939f37a2c9056f440930b33c1589d41266b5c8bb0c608484153e3ebc1d04615520cb819303804a54d10857a13a8b68c2d1895	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7085c4f680a6da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28
PID 2280 wrote to memory of 2584	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4488f8b8dc21b9fee4f0d647b21a736f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6919481da0c62e8b85851eefa0915004

SHA1
7e102aae5bfa0bb036e3ed159a6f89c71891923b

SHA256
a03ef6f95fcd0f73bb24351e61928dd8fae95532781c6714b000bd5127ddb998

SHA512
c1fc61ba41cb02c8ee723900259861043e711bdeca28364225c910659dc3a4d0c401698d27ad3e263a934c9ff66214203c8f3effd6212ee0b25491941969b539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d1079699608185cf852e46887d53ae5

SHA1
0a86db9cd75e2becd150ed95f29a42a1a94f17d8

SHA256
c203525ef6a0110b5b0a170b7d8787b2f53692cec4f0a85522ba915975795904

SHA512
ba8d3863783beb38ad7b99d4fff992e25622b836030a813e60cbd24b642a9ea612660f2d9d1ed4699426a8a94adb900702f778e6d6b42c86da97573e6247f8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2082c1348cfd35513dc2616846dd7d1

SHA1
7da1b8cfee2487607c1ea955d1b7be5439882a36

SHA256
b19728425e0389a1fe7680da18ecef2897d47be9d9f6302dbc3ed73f45f7afa5

SHA512
186df03527f24a68e8caec7913e0630c01cc29047316fb3030a107f66b19e3740b299535367a4e3a5fddcb796ca31383b7d697205a863f765da9456eca041017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8efd1707cf3e9c6d6c23dc33fe122a3c

SHA1
f7d8d205fea4a9b3ed7c7e649dc7c1146239d9f5

SHA256
5e13b50a58d9f43a72e652489d685f3e8c44fa21e6818da49810d2d0a1153c6a

SHA512
8f730e509c65be7f3550dd2d4241fa4f67fb64e99f7040473cc9e980c83b42e5fdaf9ba8a531ead72eb41bdedaf3c62a85b6137eddbe90ce2ac04f539967cd46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03c24a922abc0f884be525a6b1a86767

SHA1
fa9eb18d2be9735ed44c3d8f76c14b365f8c88fd

SHA256
ec2c1400696c0b2fbad0d70bfbe07355b948087592c3b7495c9c76638c7f1b1c

SHA512
d0eae8f01aea622d1d698c0dc9f7aedf8368a69915499a23473174e8fe06e61beb0d591bacc67ad1c36e05af6a7946cab9a0ff4ea477831a464d814c52ddd3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f31de9ffe25a700cd65c6cc2f29a1f5e

SHA1
753f85913e91539697fe330c6fbf9ecf2a84ec73

SHA256
13764c4fc86fdb166710ae481fdacb34c14b619b189accea0f722cd425388434

SHA512
07bde4354e4a0633ca36da4c4f465da0e450d4933e9f415ccb048e2b1d38fcb4b7b146c78c1f3dc64dbc4f1fc7ef66ad04c59098c8e6df3814378957600b6662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4de7d43fbaa7aa1da64863e1d5194f08

SHA1
bda5567828d3221a009faf465891f20743ced5f1

SHA256
8efaddb67c5b7eca2412986b166f042a5a00e6be7d592d59a660876144266f9d

SHA512
b2dac1e5592719c6cb7d10d2db6066e810bc366c0aa70f23692bee43f5e693ad053bd5d9434c4885d20d48c22c2d53441fbc23c240d26357687c7630075ed44e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27e878a364a61b5427634be08122b299

SHA1
5de493c2e91dfcc70abf423b25ea613b4a962dc0

SHA256
e43dd5313ba0267ea8cfe357bdaba54e5e90ed7a495b1e2d6571aa4450f19143

SHA512
85c1bd416a937ba50da723517e504cb7572b72b67fa6b611d39772bea9bc4107bbe3c82f96821db76fafe55b336911202851e7a69d6a547fa937880950c691e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7605be9ef33ccee493d0c72813693521

SHA1
70f42cfefd4cbe21c0f4ca2cf7070b1d7a4e92a7

SHA256
c0255802091faa8b0f29d4ab388a3f0adae1c1e0a42eba1c17e4d619fed137cf

SHA512
f292c7ad471c02e4da07ece0307815245409ba6a2f4db52649fd8478477fb9cf0b65d399f472d944b3b64b324d1872cf94bfd82cd72b17097b918c3dc1570785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64c78cfd3f598a912da4227d117418ef

SHA1
7a2d687c9e07b401f3f3ae5305f2cfec4c87df83

SHA256
f4107f47d3e7b21e8435b8c0d70d191bde31b64cbd59533219cede95152a7979

SHA512
b0d7ee8dec61daf8958a4881c91272090dc76c02a0f8c2b54d89456fdcffaf4d29513d7f9b67fa841fad63baa50ae7723bccaee2df83856f76300aff4aa9aba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
606a297e70fdabdfdaa069535821d326

SHA1
a46fa145221a22ca25254577ac85461c577c9b48

SHA256
400281591a7a7b83da46b8fe978bdc83fe477c6611a71025f2d32f5f0ddb3f15

SHA512
94f8719a5a2945e8bcc1c0b27ac35f7b240daacde8ab53169a337529743c1c7e2b6afaad361a354837b732e1f55dc3638573f5ecb2366222e0a7b23576045fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f8d5e3c0bcc87656de1a94dcf1aa060

SHA1
cfdba699916bdab50a8ed1c1ecf81609fd8417f5

SHA256
1a1b1ec3675809113340fae691062a658e66f47ac161deb59fe49b72f5bba929

SHA512
05c57de8ad427caf7be4a95c278c80974df8d0361473e8bc09891b01d2985925c66322787cdeaf9fc9d6b2ea3bd531629668a783dd55dd6dafa2ede0cedad98f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac32b7a9c1f1ef1d4aa8ddf4d17bcb9

SHA1
d134bad6a069a343cb225d52f8449f228a0ec80a

SHA256
9c8e1693460c419425af8feaa6a542e60ab4309b572e908fab3d9211a2dbf3ef

SHA512
f1cf38e3679e6fa9d8fa7d203e6d41d41d92d1a516e34819b5f5017811a756e0963036b709f3fdd6c9f0d5bea275372b1c5394de1d0033505b4ad6a2473913a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee7f687fb0a172a7aabbec44b1d026f

SHA1
7cac557794c5e0b1e753eea613c9cf2fc5fb9300

SHA256
e7f8980dcf615ee5b2a0fe1df4db2eff51ba7e071b00646bc428f63b3060bc97

SHA512
837efe19b9fe289e586a74264b18de4bb13286fa21fc51bfde19f3aa16f24fed2f9b81ed5a14aedbfb38c6dc5717322f85c403d119f9788da4f45c4b40a31f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4a8d886ce275bf06ecc2f939bffb901

SHA1
fab8e022766c88a3b3b96e193b6c6d1b1235fd0c

SHA256
9911d766dd4f1a4f76912784a7552d409756e8a2e9a586a30b5f440a8e3dd26d

SHA512
9b8bf933a0b331e5f093974cfe391e872813cd4d85780d873c0b23b22daa65acc9274f4002f43482344ba959b2e5a4ea5f7d8db4559713ef94425119f115ad09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28628fcaf586fb1bc8f7d97551a4a639

SHA1
d2869ecd655d06780a8df52c5eadbe2c62bbb4fb

SHA256
42209551c94f86d3496e52d9acee6156ef6b54ee7e478262f7c4d850c07d39f8

SHA512
f7780534bd67e0c284bf2060402d4c2a268c6ec9581e33a8984fc1a47613c246488009a1ef63345faa9e7c72419922e12102c22783d27691c2239110fe0641ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9a9ac4e9c1ccdf1fc3ba08245eee63

SHA1
361bb2804cf4b21657863afcc0d05c9adac4e857

SHA256
6132f370a0c32ef3f31455384ba77a322af18e3ed80b8057a30316caab7396ed

SHA512
a1e05a8909e7e64bf5fa67631137da3a9b48c14a910665be80a800792d4b66dab8d79819da67766b7005b6ea4d322611f9c5517c8660db40b0ede4f17d8df604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1095.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1096.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit