de8ebe97fa9142ca886bba12e87fdccbe7fb685a0438342d2d44b1030c523198

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46ad724c04cb4b3bd6b8b7ca4bcec9f3_JaffaCakes118.html
Size

94KB
MD5

46ad724c04cb4b3bd6b8b7ca4bcec9f3
SHA1

96f09f2d56182416f90a5fe7068bd4ff995b16da
SHA256

de8ebe97fa9142ca886bba12e87fdccbe7fb685a0438342d2d44b1030c523198
SHA512

13ec9d0ba836c5c11c24e740ccbfc7b7b9f2176fe82e7184a97ad1e207b197c1b2f02a2c96eff03bc7b22d1e015c82c1e0419047727d6541c35c3b0e4dcc8580
SSDEEP

1536:BdH6+jId5kpIOQSvo1AqB6glgjVwhtWr1iE1kNhWiJnJCD18tETg64kk/nWYeq:7H6+GZgyZ+Gp3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f0e1e5d7a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421946751"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077f62b99fa67be4d8a696eaae3fc161900000000020000000000106600000001000020000000bc94ec64b544a2ef6a0ad6054f213291d6d0bc192e1b7fef65dc383cb7f8ce08000000000e8000000002000020000000c1d419a9c3d16730ddf017d5baf2ea0fe55394ac95d8061c0c95f15daaefceca200000009f647a6be6533d14225afd9b06ddd632407ff63711197a56f2677c0a86e891d840000000fe4410dea9adbe81d9ed0a4776166b0c7448ebca227d6f957e40cca49d842c32c3919fbac7ffb452c36ca7e3afbe7c50d3cac3b8d74f17946c9ad1ad95fcd8be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000077f62b99fa67be4d8a696eaae3fc16190000000002000000000010660000000100002000000011e6994ab27da1e0677f04d5e450624b4757f8b86a3f613b60b9d20d7016fe39000000000e8000000002000020000000ec1e6cc5d730f4ba8d2b04b0fa415b13b58680407ef52d622829454798fa7a37900000006ba10a770a8cb602f61d8fa82085c2bc6a71d5b2e7e5a1f9cf4343a8e1bc6779fd9b3e094078b1db6ad8d418093ba531c4a33660866695142caf4e8dea254b34c559e9872eb71791c385af4595372edce3508db6d7d386c5b9199ddd25bec48a8c7059a791b2b06e8bf972ea16aece07a49dc282345959d3beba418ac7fcf4966b0b84dfd02ab25721ee39db99eca3cb40000000af85679f4e12a641f927001c47b92d347124c4cfdbf9abea0c9dd04b05dfd5c36a63604b6ae13ac63837ab6c89db939dc51b176c04598d5e3342680cb6a85e4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{104B92C1-12CB-11EF-8A73-D2C28B9FE739} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1908	2432	iexplore.exe	28
PID 2432 wrote to memory of 1908	2432	iexplore.exe	28
PID 2432 wrote to memory of 1908	2432	iexplore.exe	28
PID 2432 wrote to memory of 1908	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46ad724c04cb4b3bd6b8b7ca4bcec9f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
001bb5ba4cd24b1bedb1a6a96346a724

SHA1
bbfafa5a1407629345f168801ac6249212f77441

SHA256
1cecd2d266901f7286b70953c61ef277ecfbc4cf5dd3ce56d3cdf9cc8c2fffe7

SHA512
bb3bb1628f65bd3b4942d674a5a970a3136e9952450b480905501722a69088f12ca1396140e65021e2c921b60001418ed6f6895f8451dd6fc8e94b0b86bd3124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0222391434c06cc1ef1b572d49ced7df

SHA1
b4c9beec2fe5f4d5ee85c7c65ddb9ecc8db33cee

SHA256
4c170f5038a8e3f836469769624b54f15a80de4723ce6c07d9f47b6ab10a7ff8

SHA512
417e41d75f0f005f14bb3c65eedb1f4552a81ed31b004871b2ec1b494175a20047ef70e5e5da997558df3492a9e8f0cc0bc5b96e03d5c4f08d56f3163cd4d50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d39885c67c0a60381928477863de0c

SHA1
ae16c7b6f90fc0bc2aa04662cf4f1bb7ba0da574

SHA256
bb457b4cbd9afdeadbec87aa4e79aae111c21ee50ab31e5ccb284ef4151ec1c9

SHA512
4e1f5d0bbc509a61c0a9450ab4b6427fc2fb819a5a3c165b1f47e7a91aa91050bcc5191f005852fa520b5be06ca5e3da2d5959065de3ec03f594fc1a87d09e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
970d8896d9827245a9de2b9d1a1fd507

SHA1
5be940a50a3a848a2cfe1e4956c375830b69cc89

SHA256
8f3dfc4a8cafe40a9c93b75d9d30a3a25eb9d5a9d77fbf384f02d025ec692020

SHA512
0b4e9926e590b3d6931d153a98edb0456eb9186644236d409a9fa579d911c3207d0257ab81e5f84970998ed4049a2eb0614683c454a3780cd8c84123af7d03c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71217f34524dac986bc576deb9d04559

SHA1
89883469846fe7ee1e5d16781abf8baa06dfc1e9

SHA256
ab6097aa4b25f1b342070f2b75a6653dfd482daeae55800ad482ec3ca1bf907e

SHA512
96b79ff486baf2188466e9d04966674aea7781c4502c36a046ef9ad3aa59a62df374adf4081528056278c4bf61133520fa990c6f80a1b03ba7492b1aa5f66f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9622594113883b0da64e578a6c6c955b

SHA1
db0b36a4cf5e212576338f9b3fe722dc6eb57ff5

SHA256
899bb417329d3a617ba1b11cf18a81ac350866d0dfdafb06820b65ab66df7235

SHA512
735bf9a4217a83e00f4768ad3d132049d60a8ac98cd9054d82313d6375804cf89455646469ad626686bdf1f7925d2a6b7719947428492ca9db556f1ecedd8128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b27d42f29495602a79a2fba35c2d77ee

SHA1
06772f91af842a11e3c2dfaf19eb3261c9894b8c

SHA256
2385cdbfc371eb7884c91962ca5f366f875aa5243b710278b887d6199fcea643

SHA512
7cd494c6f08231afa20046712b21c789725eef8ecb74fe304f6b523536868a357788b137ca7c32560fe7abbf1b54457855ba506b8952dd22963ec62be9338a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aaa5551578563986955945e46902485

SHA1
16bd1563a6b475c994f71b27a74eeca21fa71bd2

SHA256
1efa2dc441f68da70ea08cbfdf126848f023abf20c44eebe1bc74f7014853919

SHA512
96b32c337bf2d7d280af9a3185b435e88dafac70f63070bed318d8e325c429a46da4c935c4265275bcb295490b561ea8f16e35223f0318648844faf1fd727649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0d59eec15e9cbd42f27c017f92828a4

SHA1
e809f96895d0ebf6ecdfe0665bbd5f57bc3df0d8

SHA256
e0edcad13a633cb1efbbadaf437ff7d3d66ba3e1498abb8994115e6f88f0f876

SHA512
3cfab8bb46bc0cdb6f81883131e05c75330dca3db74e3345e8160ce66d2e609dc6becb6953d747123a15b36a2dfbf98cf1cf8b72106f741a437b0bf8ad41aeaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51189832e6ca56cbf7349e028d41c457

SHA1
9969589efad6f1566cea28e415019cd879127e60

SHA256
52dcbef1f875a345e423b92c5c11669811462927f87fdda972423527caf865b0

SHA512
c7568d9615f207533f54488949392e54045c4c9a8386713d11ec9ecb5ebd73475ba9bbbbc8e1bdc470f85bfe46d94fcf0ac968190844c7fae9a05e435034c059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2bbc9cf82feb110dbcfef1d1f9448e41

SHA1
f2316dd1b5169d7f0f509bcc93d176a5d50f115b

SHA256
60631be55bb91eb3bb1338ab044a57807b15e85eaf43d252a9e15cfeebed65aa

SHA512
6ce903776fd273a059d7b54c0c138a2c60f27f29284ba854b94cf180569f9060af354ad3eecf7c43223600713ff69dc3a867ba422d2e81884cded5e8736c9787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B0C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit