72c503f6b00d68a98d7762789c8723feac55110db4b6333ef8a17681cabea970

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4655868f9d53ce9a57e71d8c056ec6d8_JaffaCakes118.html
Size

65KB
MD5

4655868f9d53ce9a57e71d8c056ec6d8
SHA1

7de8f3fdd2517bce83af5fdac851980cd0c90644
SHA256

72c503f6b00d68a98d7762789c8723feac55110db4b6333ef8a17681cabea970
SHA512

ecad646e6e43b2a119a8a042b5ee7e447730f79fc10414a5d31b7c338801911e71c303f885dee0bb9b243b4a6c83e434441335fb39bcd8f1793984db6cde3375
SSDEEP

768:JiIxgcM0St8tN99OIsoipkFoTyOqsCZkofnMdtbBnfBgN8/oycc8QFVG8sP/IjkE:JW+83TIbeo0tbrgaCcFNnzAC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421940685"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F00892A1-12BC-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f658c5c9a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f9824fbb9a72e8ae58df828d62421a2b79fc00762e25768413947fb981701a56000000000e800000000200002000000049551f7fbf2d758ce07ff214cd0ef90cd073797933e46aea18eb06ee477ddba920000000a42b3f3ba9d48510b6868a9ec9d462adda98d24487487a85e26da2c7efc04a3540000000c742f088180d156b4e205c2031e43063c1f570658cd2b8c1028608b9750166847e424ae523395395ebabff48a8b6484f0485169832f6e5a7254bb308089ad0a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d204699912a1bcb267fe9316a686c7baa93c8465a329e018a24774cabddf1bc9000000000e8000000002000020000000180ecb8aadff6650e4d084de6b80c161bbb1e58ce58661890112514d1260bd29900000003a7819053f0474abd4fa7f78ad02448f2657c870291d9c11106a5b9bae7150b8b15006f2064aacc14c17e76507c893b41205f9a4ac8a6abd78585569ce9eec37b0cc34a4cae944f2dc88f881efa7a77db3065ed6d854eaefa7d31911aecf990f161af2c9841722831907d085a25f71b69b5a3abec279937ab4124279c8f61154a19376c963990fb461f6af9b7a4679674000000006c8c62fa16042cda8cbd46ec87f9d8ac74ebe32a49ae89bc28a707a1041fe50dedd262b4acb9ff07c7b26f3b2afa754e1c13b8793e65b3773b87d4e86d2b65d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2860	2320	iexplore.exe	28
PID 2320 wrote to memory of 2860	2320	iexplore.exe	28
PID 2320 wrote to memory of 2860	2320	iexplore.exe	28
PID 2320 wrote to memory of 2860	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4655868f9d53ce9a57e71d8c056ec6d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7200fc3b8d145a30a90fe9df18e840e5

SHA1
b3304ae6724e0900b3cb35fe8e7323e7aa56e49f

SHA256
d291e981c004af37394f20ef95e7d8b029efe3ec1012f31d08278707d2952535

SHA512
db7bbfef1ef58f3ed65efbe08449ad53be0d5d85b49302d0f7122cf9e90321bd56bd3d624dd3463038e5c0fc4b0cdfbd78e736f865317a56228cd55352d7c1d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e118e108798587795dcfc569e3296ef4

SHA1
dd06c669c5398cdf0664cd1deb8cfda4b528808e

SHA256
70eab720fa616172fb268a51054a0c5eb340214c27054131c72bc635a23bd211

SHA512
97bd97b4d34437143d13fe6405493d40dabc2320136dcf30c5919078cd1c2adaebe17e4a7169e3252b7fea59794fb0ee07da3739380ebdc542fa455dedc8e527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d081aff678b48dcfd9ac6aa9c72a18bc

SHA1
bf51658743523e98ba0781e4dc5fa0fa0c049298

SHA256
09e50d8f0439371f34b310412e3a56509bd064b1bbe81203fbc7fd1e7554dc86

SHA512
c31d20c3cee26a409420c48e57fac23cda6c1d5577179a968f36293e2414edf647046abd24ae290a79031802403d3d436e86aa56d2d22b577291eb7f8e284b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8000b897d748d3d09f7a6337d9a2a830

SHA1
e80ff31ed8ae6ca448901281e41bec5f2cb36327

SHA256
b2de23f4965d77de2245e8d1d317c68ea7f941918897781c21378197bac4d857

SHA512
0642a20117586bed154b91c4147296b8eaef31c399cbe53d746541090b2e89129cdd9e4599fb6e29b84d53124d06694f00b050623a817036ed589a9b0a28a8db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
156c2bd543001430bd1913b2f0377737

SHA1
3db440007ce064c1547c39b1eecde520e219e779

SHA256
8ef984635aa1143f5e8c27d069c242db6e89f5a8d807b2d8a945c4e06f663433

SHA512
1a626fd2a53b510e4f29530e64191528b1335f311685bc601c1bd21e0b9fc2b22df7e0d63f67912e526683886af9faf52695d6f9ef58c413965dfb648176d50d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9128b80093954011b26f730fd2cb31d4

SHA1
be8a71c01c8b6af7e7740d93391cc47f57708a43

SHA256
cfed0e84b92c7408e1c863b2b192774844a8b0efd715cc3f94d1915fb717cf34

SHA512
8f3c8279c7cdad6c3144353df99dfb3fa5978810b7b312c0847b48dafc2c8fc8f8d8523260a14f44b8db3bd3501adb5690041d1cde8c3bfcb1283c7ba9d746db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6992965ca685361441ae5fb7b7c04971

SHA1
e4a78eca8d00e8d17d9b13d7cbb70fe0706d724a

SHA256
e4ff1dad7ca251d9c09e55e44fe7f5a4dfddda69cd848e36c9e1581389b871c9

SHA512
6247623381dbe9b0e3a6947726da996462c1fd36c1f8f88111fd4fc677951f21ba5984706a02c93c7965b0507927ec156c54e83e89722fba389bba31c16222bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b836ccc59efd2015c27bab0145009a37

SHA1
d53dc6d4e62644e469e5be6ce637a38e4b59d3ed

SHA256
a478e6585efcde617d19fa564a3f23c3124af272f4a18b73b00215fbad201f1b

SHA512
dec38d8299286cf2a250ced27ba67629f2b818a509418abd19c4e0a99599247aee0fd3ab37de03201faf07164f6eed82066ea33c358cfedde2cf610aba0dde57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9fc727e29b460757463277f91771332

SHA1
be278ca112360f7b120806232188c63a5a404b3b

SHA256
4afd1a8369d7bd25c717d1f7e276553a7ecb2bebbbc38c8c3a7831239e92c571

SHA512
c4ebbc38facee6af978e59ddabdf7e915f44b926cd8385c10fa408f5994921890ae294db0410ee037d34c76ea7ae78ceda7c08fb7e8b48a32d8484b4524f58b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7c0ac18998b52dbc44f227863496584

SHA1
bf6140f66bf0eb443f41fd5fb3da36a77921b5e6

SHA256
816fb9655beea79b541af93cb1c67eb166cd9ac12c36d72feaf8e6ffa2fc1ee1

SHA512
8815eb130c177bf88a0fc3b4cc9fa70df62b9b300e05f6a800db14d80af72aeb5e8753aadc16f9ecf16db3cd73e1d706795f7147d30e2125ac2a89afb556683a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3a1f698787a185f3070bf7b7573ea0

SHA1
a2213727aa714b7d80250a96de30c33d7222ea33

SHA256
ae3791e855394887b750d046d8cb805b891a2a2ba6dfe206752a073bcdafc9e5

SHA512
c7477201c34624b535721e8588786995869c7fb6a0c6a6d56c1b00b7448e6641d9e8f52aa299788e943a50868d063c65d14a9c2935257aa03bf13e6fc994ec96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cac59bbd889bf6e89aa05a413abb1aa

SHA1
5da8f6e077561b96ba02a368e44dc8c58f0a9892

SHA256
28140041e76166fe113810420c580c0fc247262a250472bcd8c81e677e829de3

SHA512
15bcc3e22b00bcbafc99f65d218e78709d84912d84ea4b438ea2a0c1266d826c49ec5b79a2f7ad98f9349a2749332b877372d753bf6f7c459302b02112c1f7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
371693a18c17f1b8bbd66a21be4b597b

SHA1
65f4996f238930e1402c28ba1bda0d95e3d42f19

SHA256
4def38be2bdbc7b1995e52cc49e8cd763e6975916da4541c60a40882790c8451

SHA512
7070278d86317f508e9ce873983375b2fbfb993c07d2e48a4195b56f0bcf7f8e46053652d0d604a7ca0d46a0dadd66b497ed6f76deff8f87e5bde94911bd8cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c356d1332091e90d39e7c4ea7f4be2a9

SHA1
6842d0cfecd60c0a40fc4bdc9dad62efa1680978

SHA256
0589230c7c0a73c7fceba86c0711c149f00565d49fd5dc6117f47026bc4f7a4b

SHA512
c42f55130c386ef895ab43f65d91b9c836f127714049a7648a1881140528ed707815be4c7ad85a89ff83eadb554c8877cc5f584889c07a17afc305300670f543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e58da0bbec65ed4020bcb077ec7f65

SHA1
39b8ad08143ec8b4f1af9e5f83e90f39bdb3b26b

SHA256
00bbe5510ebf6a798fe84f3dce4435e16f7151720ef3f314f8ab422a46033723

SHA512
99f764bf5de9d07e3f255479e498169bf96f02490e4da842903920be10c82d16e86726b773917978bfb709ef60c6c34576b68e090364d0b77ad5921dc4caacce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e779850a7b9b6f6630938491dff9b521

SHA1
ec8159aa2f4dd402555628f0b478a7de8ab421c4

SHA256
1a558bede178fe5a6dcc03bbfbb1d1773c9182c74731152120a8e01f94c2e516

SHA512
c22f313e15d5b845660a513519657642cdd512f2c8f06ae0d06cbfbd092c2570c4a6bde30530d82ad48ab11535a1617202a40f25197172981bd424dea3e14585

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0AA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1B8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB21A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit