52f2b3d4d2cbd5afdd0da52be6aafcdc07140ab74ba0de59c122c591a3854a64

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45377fab5af475e085c751cefd0cdd08_JaffaCakes118.html
Size

23KB
MD5

45377fab5af475e085c751cefd0cdd08
SHA1

cd21724ca7921d6a28a747962437f5a1733262f3
SHA256

52f2b3d4d2cbd5afdd0da52be6aafcdc07140ab74ba0de59c122c591a3854a64
SHA512

70ae912d3e5978893b28b0a7b8c5a2267fc8ac20352b53fe73a709503293a79d00e8871bac20aa8fabc7b9f87df2e7844e9c0ade26f5b52374c9fbfae194af7c
SSDEEP

384:cQf7UOpZ8XRW+esLAYAJJSxhMqdVoEwYpumFll5BmPKvWbNO8wC:cQ3pc4+kYAr4hNCE5VeKK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000535d2326746604d002d2295ca8f4122c2495fda3ea89110aad301b276204fa59000000000e80000000020000200000008a2a5a3d96ff3b95fd76e10cbc215be052c22de02a27187c6d5211acbb30d9a8900000002de4596754a1038dd25db1b1a04e1f712beb6179157db8990c53e2f3b9e047a9f4565b4ee2af07d17aa6298f687edf1121f746a51096aae9211d78d7c2453bfb4914ca29cf730ac9659f3a0b23124afed00d1dee444cd7c379fe1fda7afe76c5f887a7568f53d7061f3247d1c7f04c8d208a7764afe49bbdb66d14b4f3266c35242b6a35f2eeb6ca9d64b9f90cdec16240000000908ef8b9f6c8e9e350285099fadb3dc90a4581a62ea2b39ac73c68130c8d8a6598c0977328e94bc01529334e5e03e3da8908b4d987e126f6062f630bcf5751ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b80c9e00c3c52264d2bc2d3bc13b2d6e744beac39ec8cdc713da069ace9617db000000000e800000000200002000000010b994c73edbd5b0626686f1ccb6c68b29bc7624c69aa496bc4542f7e46e809c20000000f18e878a2f5f2644806c483204cd0d98579e575068f414e1044e8256554c704d40000000dee3cd928987034acec84646c855ea9a41f036fe04ea29e5df3a77cafed3f9a1c188874498ca772eb0ad4c91e22b53e0630790a14068d8f9a43047739c60fbde	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421921753"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCF6B101-1290-11EF-BF51-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a029cdb19da6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28
PID 2992 wrote to memory of 2916	2992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45377fab5af475e085c751cefd0cdd08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17406227c2b0bf2152feedcc3d791874

SHA1
c318e3fad9da8e4d1358840b4e5369c67e9d135c

SHA256
73f75b5fbffeceaca1f559791d6ad8d8da398aa143f93dd0e87fe9195735ea25

SHA512
45b47d57fbf8bf3878125125c9b10bfec07f94edb1f8b32a901e202e55196379172a65d153fe4b3a9c68dab8793f4af890dd6e7e8a803d310d5f480d7a97048c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79383e751def564ff1e3133edbc34bef

SHA1
09422df129ff046fbe924f559f060726b82de2a9

SHA256
89510369ad2c896c073f57d1895825dd6b7b75dd07e805d18ddb2603a50f08a6

SHA512
00498877e128b7f16bddec2e74f45fc6ab01dc839a881a0a4210abcb6c37d276fee7860cb309e5e719398990245240e41467d37b9df28fa84491d00903a1ed75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aac0ab2562b2b1ecb78817c996b10fbc

SHA1
9f1f3cf3afd109f33418d7b3688c57cb000d0b9e

SHA256
05a5bcfcc69d8f49bd7fab364ef7e30517f9927a2a007d6120bf841a323b68f4

SHA512
8be9fe6ee0220fe4b43decec615b66052b5098c565be9ebb29823189e2a0d9b2e295ea3b67dfb6237764438149af4cf319715cba6645e198b2f6ab68494ab947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9642d058860ad6088cece4debe2a75a7

SHA1
eefb68b29a9bb1e69036493c95b7bbb92ce07ffc

SHA256
ecb691996607c462df265490c4a5523d4ae0e4416f402500a867c24d5c4a30ca

SHA512
a24d7be296ee84c8ee3e15b2fc9921c37b4e5136011bea3e2279e1ec8ee95f4d0397122e99e0e87d708ff644e9954d0a4247c04e8a57142bb08995cc8103561e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11aa89e4c86e6de900adc1c8cda08ade

SHA1
af20efc8c51f95bf4f1f612cdda5a2eac066dc34

SHA256
bd85cb39ed5bdab3b8b0ac018440ec42dade944fc57599d20b7b640a42f42438

SHA512
f143d93ff26997fb9175f76c145ea6146779b30ef6eaa56139068d1d961eac41fe30cfeba6af1d29f86abe7301d43b9487c37d8ec49d8f618f95904062c63f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14f8dd04a1662eb736bf86718fe5d7ae

SHA1
bad4e19fb6d02528d64e0f862172e499f82fe260

SHA256
3413039045e17e1fda960ee27514c260c4069fa56e0e1949a7ff2e81350643b9

SHA512
f90eb141c62df5fade9c32866481786991be9c1739465f7a6e27393c7ac0f56679f6b154e461f6bf5c521c4b903ef1f2c1a895a0f8338460879545b8475cbc53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1e17541a2eb85270efc18a2fad44084

SHA1
98271ed4e0b6ac55861bb43f6d0036b3b92e86ae

SHA256
3bad7c48e5cf9cf97ee836d903bead7bd886121820adb9fb88d2e52f9a38beea

SHA512
b8b70d74191365e2b21a5a684648d408bc26f65d25eeee2531f1ae3b4b64c12b879b83d479bfc502d0b36946a5a6b8a5ad7ca82e381d7ecec9deda102716136a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73903da9ec413c13c29b48bab6a18fef

SHA1
81778f47c22edcdbc603d4d8349d89408da31b63

SHA256
197f9bd04dcbb73c050b553298be3cfad848fec558f67258024fffeb09441793

SHA512
4d9918988d9e0a1ee715cc459679fff3f5ffa434b43e51bc36110e30d7402b462cc25acccc579f3eabaf62fc1990363c48e96028b85f1950ed5f1322359af008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb3fae3bad4ca14ab62d7ff2220cd3a3

SHA1
14a324c8a7beb7e94f971738f37103f768a0d254

SHA256
0f712de451ba83c02257354cca6315a8509e1ad7ff2d357f69ae0a9b19213e5f

SHA512
6e2b3789a37fc1da24613ec2235257d939015f039275df690946f4dce5d7792a57a1ce9c843f04632969c9bfd6b5caafb5ca4e87a8499050fb5f9e0191cba8bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00065a335385500a4f7552ccde1c614b

SHA1
cb6c2560006e5b1e20d5c3972320577e3d5c8652

SHA256
29e8fd0a19cf38fae850036eedd9ac8388310ec0bea123d682097871a986f79c

SHA512
4776a6d5da71471a5315322dad724de8ea8b07050fe8913753224f7c70e70e8610ffc751bb2026a35a481cf8e988f9bc28c9e35c0e600aac7c81f191e965e66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204406b9ede502c8e97b5b9fc75f2fb1

SHA1
e0e2dd06466faefdccf7cd1ef189ced3386b03ae

SHA256
252379302c5de8eec8bf23e27513ae4cc08e20dc667a3999bc5260a100ab4d1d

SHA512
07b6bd8ddb2b38854dfce6e135de7a771592a21307b4038b53a09cc9e03a77760d85b38ae5f3104da36226be5a4ce71d4415515e305fb95016d98cb154bc92d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
250d0d45e7d6fb491d5af33c184d0f66

SHA1
1732162b1825608adb95f02feec330d7c861edc6

SHA256
b53f958baa6d80fd2391f5ab21103ce3b3f44d7dff0baa5d89596053828e5a15

SHA512
29853a096b315a19c1c631267cb8c1e0fcfc5b100677758b4513efd991512b67e4355cbe0696e71f23d80c4bf750f8f85349a027215110e66d17a0a4f4e03b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e744bf53e404c0944f75da13eba0f3

SHA1
984410b4c2040f0d1d75eac58f3ca6bbbda082e8

SHA256
7fadb232b8eefe0bc4466a64c4ec81e688d6a089030900a07cfae788af6741e7

SHA512
000e32750bb6ddd004f9ff88e9e534022a780cd9f9c4b50b4f3d05c3199d328681c5a9f1d4129f7a525b940060615fd68c944be23d2121d58a4d19ab647d20f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AC0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AC3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit