c8f7ae00e38cbf1f6a51f0efb92d8b9f4e18f2c675c3c458f0b4b49910a96874

Analysis

max time kernel
136s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

469456b9aa2fc9d714668a97989b4257_JaffaCakes118.html
Size

351KB
MD5

469456b9aa2fc9d714668a97989b4257
SHA1

9fc7a103cd0fa9800aac439d8107dd3a82d82107
SHA256

c8f7ae00e38cbf1f6a51f0efb92d8b9f4e18f2c675c3c458f0b4b49910a96874
SHA512

41e078317298e207076decd79185bc924161af4ce906a83b0ea2a51e150fb688eebeef0c7b29576c0de0eb1da754045cc880c44f42baac73c61ef407bd56ccb2
SSDEEP

6144:SWsMYod+X3oI+Y0/sMYod+X3oI+YAsMYod+X3oI+YQ:F5d+X3Q5d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F15A861-12C6-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c266b2d3a6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421944843"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ff818bbc7375bd4eab39775374cb9d4b733afb40404fb2daa4b6b61da2e78a90000000000e8000000002000020000000033ecdbc1aa16d5eef74afd77bd5d7d42ee5b182a846142220c793fd65540b8990000000f17d052ed291787870d9fe7ac2bb685a11cf123f4633d163b333427d26daaed44b2e6edcb80fba394e716b40073aa7b4d55d9ec4c48679a86d892558229ee9956310dcc5e351a18aaacef57174d055fec62136cda024b0d81434ef1082122a0e245f1743ba81a20b0052c6c19b7a1aed49b26d40ebd2eb5f67ae1866598b813b1be17c00f102bddb170b5d46f69756be400000005d71f47e1497e035abc11ab4897696d619d73efc0152f606370224b96e52ad8ef3434445eb60b2aaf392f9a8553b7ce0726eabfa26fd38861dd1f830a299c22a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fd74330a64198b0e0c8847090fa390c73a029883c1cfbbd70b3ea39f49b7fd54000000000e8000000002000020000000368f2e43711befd4880421e13177eb819fe752a0e02e110cd732bd1080ea406a200000002d71097356768d10da398092f3c352b52c3c41e8b5f93eef8f9b0e6718c2e6c44000000043f29d1d28a7c2f193561687a079b1cf33ad80208aca88644d3310b63f8973530a2782c156b0171d4ad3e1995c7daf97a1fe1742b0e73ae3487deee3838b2209	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28
PID 1640 wrote to memory of 2800	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\469456b9aa2fc9d714668a97989b4257_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d1321dc3025d7cfcfce37903d214a5f

SHA1
43825bcc97f3a947efeb5d52994635d8d8ac053a

SHA256
fcb3f4af336ff43d2345ea32ad53b14d40597202a829cf7da6eede162d1c2ad6

SHA512
5585e2df90eddd1a26777f344fbd14fc65c71844c4180eca7f2433c5473e170f4042ec59f49d24c41ae00eab8ac0ec7cf10d9706869461e2c9e5d1f0a8472546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47bbad137cc4646852512dae8cce274b

SHA1
b1178ff7307c3361fea66386d526492e71d650a8

SHA256
0d615223054e3b06f1531fd4a21e945aa67ceef8cd0659aacffda99b3ed4dc99

SHA512
ca0197513453fc7c0a3198f4fc2b1ee9a7d420954321acbba7bc96db73006b917dd026e4b8362e04b43c58de4672567a64f62bb21e8c003dc5a6cf0be858cfd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
971a151c4e443fe1d0350f51d78f0ddb

SHA1
12e0699cdc3e4726bc2d8d18dfe23838a6608546

SHA256
cdb21c7e4ab5bc426ac9eee9c2d5a2f91c8c250474873757cfb816a0a44f6e0f

SHA512
d60f4ced532344d83438a18c53f48ab56ef3aeed1e4f951ce6d71523e3fd9efe3b416d0cbf3e2eb138b22d116a9f726d2708bcbb8b9d71955ea0da6f8c1614a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4ef92edacc708fff66677ab0f46d43

SHA1
c0ac22aaf683abb2306817f736b230a7faa64401

SHA256
603dcdd628f1c92aff36ba1cff3cb57abe709b62b6fc291be504b9a9bdb0cd78

SHA512
07afc6dee09ebd14c41b05a0bff000e9c8102373757cabbc23f2db1d934725e8d720fb4c0ea8c55f11ffdb87b25c35b0257a076bbd9fd9cda394fe312a3758ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ff563d9f417307972746e2cae76d66c

SHA1
dd43fe05fd8048f3eec41d1c0a5cdb12590526e6

SHA256
62e00d01093ef5cff6640eaab7ba91a6581bd149feab19648b23ec229ef2b706

SHA512
c6326ae36036aae02f2e1c77386633281b0630e09d4abac4321d4609bbcd4b3270fb9ac372a1fed19ce92bbf20c5dff71fb9b26d1a6a0d617f433b3f14e62c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f88030c48e944629e462b7340f4fd64

SHA1
a4c7f60e0169753ba1bb8253109376e62bb56d04

SHA256
44afb064b5345d049227d7cf87ccca4940a26442e09742a92c2105114b9c20ef

SHA512
f6ef2498a235b9258026153a112b9dc0005f63af54890f50ae8b7ddc64a8ddaa5460dea583d890ab0560432e2e999b89861e40bb2d23584d446d20d3eddd71d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1644dd5a7817b02fe1007ec2d5600ff9

SHA1
1648f38b03795676ce9a6e6a9a4aaacbd6ee02f3

SHA256
276d0b0442bb43d03766b586866e516d8761c2d155272b914a98eaf54e296b46

SHA512
cef26531c42f323629c7362b0c71fc0d3514e28a9634a202aa07d4a6578fa47a78c8d781a31c2fa5413cc07c8e836115db71b4ccb5ae10751199e3f25910dffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6577b781b498cd6be23dc6649f372f95

SHA1
7cc7210b9080081014f1a7cf19fe12231734223c

SHA256
2a438f908bf9fdf2b4e31a0c591e545fa12b23655c31528454839cf581b6b1ee

SHA512
a56ef1c3a7340aa7f9633367eae48d4874d2539a7be276a301da446485a03c1c3d4d5c88d38a5d32618902134962533b531f1803bc591ea25a6f7936c6fbb2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ec3bce41432d34dfa94da446075564

SHA1
6071269d38a141aabcd2bcdadf7a77732a847c5b

SHA256
82a20439ca6cd73b1268259c7fb994da235006349c48f563b9b0b5f5c041281c

SHA512
c0c3993bb88641a22e60d419210c49bc61e1e9a2abe572fdfb8315ef504c5435d065ca67c71ad2c7485458464cc2ca0634806075fd513909fa8401251a5320ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b23e2cae3b4e9ac8896a32e7140eb69

SHA1
b44ce34276c054d27c64eb1dd475bc430e9f8e86

SHA256
df8f9660ede243b2c87541f729a7cfbfae9e473d2e35b9d50da2da88dba45cda

SHA512
3e9338f140fbd94e421b584a67eb391786442e6d32ebfc712114c9ed4dcc9a3b56864a8670143373d7dcf524d817dd20617b18b9ce53950763a1ef182239a26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4edcafc150dedea46482386c7596c0aa

SHA1
58aa1aa854f0199136eb0718560b0fb69b817543

SHA256
cd03c5f67762a9c2e6b0ae0509ddc3cba3267555ee97da588123aeabaef18b38

SHA512
91b66bed1457f408c267721061b6e31639b1242fc490e14727d90e81d16cf2e28096b5b90cecded1e32cde0e8f6de33dcad6acc14c6e573adffcb1fb09d55236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb0b09ae64d593c4def493acf848e916

SHA1
f2eccf7448a35165143e7bf4d748b845dc19ba50

SHA256
087efee79b126d8ceffcab79f0d807630a7b6304d895e56dc8613975ca7c52d1

SHA512
bd91f87bc1350e335d050bac757c186f28b802b22addb70b98f32091219cfba26aa83bf8bf4b57b1742c8751be270b582491d27c1bc17eaaf64d1208d61adc91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf42268d9625c57e1cd609d269f7d1fd

SHA1
92da4c3d0409ae31a573ef396bef43fea8a9c1ea

SHA256
bda825e5f9b0d5db8d206afb9e438820db5e8ee06a967b02c3dc8db0d75a9822

SHA512
83538d80aa12576002f25e50f0df7efd1be082321a5ad8c0833d631b46756270cf2b1647e8c8b92a7476e40f9140fa3d0bcf9d8663a4a267ba1c89fa20ffb08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
965dbb05f5a0ae4f7ca73618e1675a8f

SHA1
01482be1de399a2bf6b11647a2019a4443a94576

SHA256
8878ba8c004844f646de13bbcd134d6bcd0db705ff04a4af24dda387f7177e6e

SHA512
910f445dd3071474109ab7caab9cabf5b0b5cc6a5472c8415c7c4a199bf874b723f13550191258eafeee831899424e0fc766ee336c3be408bbf20940f48636fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7358ba805dd1d94334ae07a81370f93

SHA1
df27b6010a859172aec1969b819db407c893dfef

SHA256
24fd99105c6a0ea209ba9aced71c5c80ecc6aa8fa7be42b1b21238b4356f4f4f

SHA512
074de9ed0a345e4a1d71386ed2b69b13e17c29e6135ba3c8745b0c5994dfe0914d12a9a979a9da0817f36c0c858292bc549e61bc9801be883a36520306acdbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e0fb122edc07ade8ebb0c22a3f4818b

SHA1
a0c99aba2ebdb0441ffc071f56a7528c8dd14542

SHA256
70520f465bb28774434028461dbd04c01c5d3917fa1566b4682a413bbd38bf80

SHA512
f50d51e0977f1e144793922a16d9df9abc00b92d4c94d7e1d04f8f11fdb79da8d35e4ca9842ebb6ac1c7bcb91a89ce11ea31d65fb1bb36c9c5051cea14473496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F17.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F29.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit