a8aca3d78091075e55a813b4f9337dc7635b77e3551de016e4af49f2965053e9

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

451c9b2e95556a99b8396ad9852e41cd_JaffaCakes118.html
Size

4KB
MD5

451c9b2e95556a99b8396ad9852e41cd
SHA1

0125c15b940b0dd992a860636177220136218802
SHA256

a8aca3d78091075e55a813b4f9337dc7635b77e3551de016e4af49f2965053e9
SHA512

166bc791894955cf8806f2ab1120810eb7fa9aa5d948406c1d72b33734ba26207adf4bba5f1c82dd91c54ed903f64f2e7719289402715e7339e97d1ba72966b0
SSDEEP

96:Pk7hJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oOd:Pk7hY1aEFHVKtF37sNjtXATIQFM93pDp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009b311e2f8bed8b3a218d8f50f4b1c2126ca92cd402430a7f784cb0c1b37750e4000000000e80000000020000200000003318a8dca86de98d38217050019611ae168ee927900d28ac75106fea0cd6e5c320000000c0a97e1de19f82919f4cd0c5eec8a3247f5eb0ffdafc3618b81565965ad3fd49400000002f5aca094b8bde835cec3331bd54798886d4e4e72bc28e43c271e9cad5e28cb4a2c0d1d1b8f2fc6bec02e5eddf6ddb6f7cf1c786a7afb604afbfc0476e1c861d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D955A9B1-128C-11EF-9B71-FAB46556C0ED} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ead4ad99a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000016a5f62b95d9ad7ce1cec0a0a81a0c7d962ea5fa17b78fc1029c4bde46dbc99e000000000e8000000002000020000000a7f05343a70e574d7e5b8c8801f215cbe1dc4ab5522f3562d3a8fa49b186ede6900000009cf9830aadc8b6ae5644c564f2be27fc17462ed510d63d4ab6cd5d1d17c65e4d66b7e2f3da1b56b45076a54fbcac63f5ddccea2a21aeea090409487865f1fd8b4f6bb295b5972c4cb5ab3f80790b079813cc4be8a6a6c6744d1451e5a751188f914625095c875ca22a3a49930b06e900d5ade5a0a56d21969bbbb41420103734547091ad3dac803d09cf97bbcaf7114c40000000b3bffd2683982d495ebe377769fdad9dafe7d7b709b791fbda1daf8794f8c93a7bb5b88306ee73a0203d309e230d63abdcbd40e5c2bafbe750fa1b94a8109da1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421920029"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2936	2428	iexplore.exe	28
PID 2428 wrote to memory of 2936	2428	iexplore.exe	28
PID 2428 wrote to memory of 2936	2428	iexplore.exe	28
PID 2428 wrote to memory of 2936	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\451c9b2e95556a99b8396ad9852e41cd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f472467c13fbb729e05db89c913983e5

SHA1
9d0d048d90b1997afe3ca988221de23eae6df02d

SHA256
66dfe101917e643e9e68c24f9ba7417911326cff035a84b280ae9c2d1fa264e9

SHA512
a9198226da28cafa09935f63845e4e7797aab408db8679428999882a784b3c521db14f616fd5d98700cd2918fb4b7f465727b8aa2e5b0af5067de583cdd4d374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea7b6e777a5f6383b72ea1925010a212

SHA1
d538d5f083a87a5b2ba749b9116db40eb5ce974e

SHA256
5e2ce886a926a711675dd1ea07f64c5851f48d17a33f095337a4900ace268fd1

SHA512
cac7654254163374fe6034861b06b95a57a4712d30e73e1ff81c923a06c0f6464614fab445f469626af66af2f84e2b7a6d1c1e320d4d063487ca327bd68846eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7ab2d62a99ddc7703f871fe94ac526

SHA1
e6c0797d16d3e697c3f9563778615643e720cdb0

SHA256
2e5668ebb40a54dab40aa6a6b418f43daa4d7a79e79cdbd2dcf1db2461f8de99

SHA512
cf4b8cd0dc7f655ba5d4dc84b0bc0589249437d235984ee6cd5c25490caab61d16710e6f22b972d1a5b2ebdd0356cf8a3aa7f8c314416a67425fbfbcbaa24115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324b548326debf29c3842eb5e9ca8b3d

SHA1
3df5293a880a09f295f3bb355c397738806423d5

SHA256
2ef204c8611b0eba1aa0a7a14591f357b50072fefc78aceab61509882db26ddf

SHA512
3bc7d0e0b35af98cb30d50b8f662c3054ffa15fb048455f391fc3d7753eab98d347ac9be019285324c0f47b6983de8ae3fa4d2bcd490d9890493695e1a93b86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede0e9f9f90c7bdd47a0df0be58ea5aa

SHA1
f0349d9724c8a252c4907a751ecdc84ebe5fdfb2

SHA256
e6c48a77a61939598753a63d084e7c9843a452b6c0e45963b0e6e803712231fe

SHA512
44d7c08eddb066eb6c2ee2932e67b0fb52508c5661b5dfc841438dc457536e02a512d4a3d59a87d1ef28cd2e78d248c4d8aab79ada3926529d23636c1e7e9128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
403d528cf803e765ff531cde884e4f61

SHA1
2d6b8b34bfb48132024c24607393d064b13d1b99

SHA256
e458245746677e4b673c76cf1aa8333c0c5c6fedd41e6c2efcd818fbd7a1271e

SHA512
bc1dc2a3486ee730ee6a53dca2be12177cb3c3fade10d8010804942d7c8cd5aaf3b4a5bc5fb831d0e61c5955d5d65682b55f10f1d55c3d70729ae27050314086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77608dc822ed8e7d3ad20737fdb6d3e8

SHA1
9ebcb483c1639acaad1de373f66ae62a4c57c7ed

SHA256
b39bfe797c2c7a788595346667ddad927bf5d9e29e611a4b3025023da8347678

SHA512
b972ce80f7c6e00256f91d77b85be6ba7ca8bbf51d59acfe1b6107fdaf187cfa8ffa7a7e33ba4757b325c6244860a39b77511815b845cf99a5ad8ef72e010581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
886f673d6e577c56980822cf05910f39

SHA1
4589f02f814ca777aca7f3a3452cd7e7eae245e6

SHA256
7f3e9c70004787395854934c93985a1d50beea6883897deeaec3962727b33b3d

SHA512
b4e16ab251e3c698f0378c269f24a821b2d01479f315434ec2fade7696d2e765e846686dc5df2a06f01810bf74c4eaadff047626e6791df2bbbfd127ed1940d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd112c012e507dac34dfeff594a317f0

SHA1
b68843ec06a19e77d39c5d1f66aeaf1d49fc67d8

SHA256
51b0eb135aa5081c8d5a69e5ebf13bc55f63381bd7957bcd086b7dbd13d50a82

SHA512
e8c5633dc3e0bce1fa9ecb0885bd358d7f231a59c5a8b86eac002cc7cea89b1f60abfcad53bb12e5fee3c801835360463e587f9c853fd60c5e7d76b4f8b2e9a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35295acd39060867cbd48ae0662777b7

SHA1
45858bcdc18a58c7fca7732d063f7723d7387281

SHA256
d19aecd8bb04b5f19bee25afb47ce67d2ee99a864aa7714b6372e7930d119c1f

SHA512
a48a30b0e51f4f223b4275363b0e7cf24bebd57bceff560c590539d12c1c27429ef29c8d405ead7c0b8615da9d238edfa7c7985400dda9c8e70e615f6a4a93a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
739c17fffe3b7ac53a6a4558d4ad91c6

SHA1
78617a7ae3f6650e62c5f879b714ccd36be0f79b

SHA256
bc00200f2f559d0545d246dc7b877bcd401f70144296da6f525fa46dfbf6ad79

SHA512
ea9034f7c2484de3538c457087b2d2cd58ccc4138c15130106faceb2eeaac29aa270d155afa2178d2c3bbe3b2fcdc76e46ea36693838d043dc0f00f2d0b91d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfa181d8fef4625bd148dff2bf4238b3

SHA1
2060e8048847544a09c58f05078405dac91862b3

SHA256
8dd35d0332d0e0b5c70347fcc47d677a29f458a4f1ecfdba0c01ccb13a920f1d

SHA512
2602d39ca8dad04b3e7cebf4f216dfdd0d0d6a60fe63b81ded6c63e617349c1fdb494002e941491f0879412c9ed57861b8b5598ac975b0189aa409836058864d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e0e4713af4bb4b9700e4f05536383bd

SHA1
f34b06ae271e502c609a298fd5751216bb189b4e

SHA256
e595e2ea429498fec721589e46744e6af86f71d6248c3b5dc3e88716a6de6951

SHA512
079b65cd2279d51d5e8af304ffd1f51615e63de08023900a019ebd6004d81a22498e581c73c7ac22402efc2785cd0d9ef2e80359308d0b2c2729649e60464f6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3277d70d93b14c307f19b810b5d49e61

SHA1
b84e55de780e4805632047bc2f57a9dae08d9a46

SHA256
b02f0f83d7c16f60b747ba0e47e21940d8943ce7294abda15517ed860ef18b70

SHA512
8d47c87c5f3a66d9092eddfa6df8692231ed33486a4a5cb277fde6b69d0d24e50305e42bda717a30826891c01226b188d7157e791bb71c129dfdc788ee5d61a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1073697da62e968783567aa4a3c5c18f

SHA1
f7503cb6703f6ddd41ad5c2b1ccb45a0f9503a0b

SHA256
59b4064a1242b49c626a63040212baff33762ceeb4eb614cb05c20fded614cd5

SHA512
327ee75c8529b53dc8aa43392fee03145695c5e56f80d3e8b8bdb7e6771c747a83d7bed4d35f974ddd71b3663ffccb59f757396cabf8b4c92ef060eebc6d6085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2204d700155311c9738f7ae864627a4

SHA1
53c680a17e4c53b0bf4e237f6362b2c08a41ff48

SHA256
d576eb6c9f955776fcf5d132e417954c82c8f3b1ecaa61b907e5b00d9af2380d

SHA512
31ecd8fb9283188407b7512157018eb9d3a72f0e8cd0bcd614012c49d79a971edc0ad03df4f0b8c720443ecf4ba0515be87bc2804f2b24d4eba9d5e2d731511e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab323A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar328B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit