ac7213c30d6b95934a6bf36c2597f0caea90193d3b96e97299625e99e87aed30

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46ae99a25225ac7fc069cf927a57083d_JaffaCakes118.html
Size

44KB
MD5

46ae99a25225ac7fc069cf927a57083d
SHA1

3a26342a47280620d2a1dd492257f7c1a5d3304d
SHA256

ac7213c30d6b95934a6bf36c2597f0caea90193d3b96e97299625e99e87aed30
SHA512

40d3a1a6947404b9005e77137cd5e785501f96759f7a226fe8613f06b35e70580345fe06c70917881442533005130098dc56b02bae25cef8cf5f7c509afccce6
SSDEEP

768:ZjeXSO4RaoIo//xMedxcdVO4VGx5KyzDUS0ZAeipHFlDOn4lrsRvMZvaodhbYYxq:ZjeX+RaoIo/N6S5FDUS0ZALpHTqn4lrG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421946841"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bc9d1bd8a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007e84de73f666709735f8c6c51bc30640446e29bfe132e89e46c3faaf7cbeac32000000000e80000000020000200000008353d0e47f81414454ae47309f2fe3990bb8958cb85de68fd18cc96a4ce1a060900000001b5642ae31a8e1b385bd16d2b90f9f488b258f37a5e48ba130c078718fbb98bd64e12fb8a4095cec8fe78221ce4ef74ac9e35a116900d3d29af406b825eb1505ec25e2313e3f0ac53081a080ae8cf49d838f42af58ad4c7a52822524f50c6f5a53bab224d67eedc9b1287a24c5348f4e7b35974b5b3e221e4e0480b2ee02cb5e725ab9dccdfd44c5482be75d7136b68740000000c349725f4907500564ffca9450b4e24fb87d131a6d6cc58281076c107c31210fa4ef26f2b81690c2847a244cde2ffb31fc4e64760517509ffe6b3826e36b0096	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{469464B1-12CB-11EF-A002-FED6C5E8D4AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000e6c4588f05e94b67b9c38f88e0dd3bcd97c5c37333cb96c6fde63189d6cf1dc000000000e800000000200002000000034488a28f21475ebd8b6abc93415f3d813a2d97719a4c40cec908242a85b10592000000071cfe80e0431a7f9521aa2d12c74c68a9365e961176b50be1d7efddea01e56014000000095528798950c87634c10d85683433804aa5aad446bad4b0ff5003953669286384de2914eec6a3253591e3b4cae060d7fa8ec7f89936f9f300b4c7e66c3d87884	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2552	iexplore.exe
2552	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2424	2552	iexplore.exe	28
PID 2552 wrote to memory of 2424	2552	iexplore.exe	28
PID 2552 wrote to memory of 2424	2552	iexplore.exe	28
PID 2552 wrote to memory of 2424	2552	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46ae99a25225ac7fc069cf927a57083d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d016a514731d77086f9e926b372e443f

SHA1
860a4a40651234ba5188d293f44dee4c489dd818

SHA256
82d698a8079393b761f2fac6c7f22654a05e241ab88e2bf68cc4fd155c6764b8

SHA512
ba732c3b6aac69a53f7e7dada321efaa5c07bc9f15f7f9ddc93a1ff0a08709f89cbbcf9077acafc721c4e4f537b2b7dd3c1179e8d8079964278efd802bae2940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e41a45fb1d2453f8e5bbbdc0805cd27a

SHA1
756656ea2fce972f74d40a4d9e00f6349fa566b6

SHA256
a233a47634a9716d45c69a05cee92fea842feb91d63949c980efd2311f9df27e

SHA512
1406d6fe00fd6ec7f71153d82369f58458ba8d6fa01cf105110d4719c5f13a32f07a82bdbe461bfa4cb7721fee4076ea73771239d87bd091918529db24adeb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73445428e65cea0211353d1d8f0063c5

SHA1
81220fb5646afbeb4a0fe4c5a0de7b55f365a496

SHA256
371062afd6f84484e9b0feff324af2ab9c610475f9d84372f14cb6a4df0b1c75

SHA512
acdcf070abc1f2fc5b121d742d3237f8ee46876140b24353a9940fc61b992aba5ad3c3629ea4e7ccb8e13bdaa86527d8e4d350fa6db9474141f83eca907a96a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1555c70808839d7648d7029f93943bec

SHA1
6ab077d2bbdb1370c195170651eac976eadd3a13

SHA256
7e29a4a25d806199ea086099754be6939ac2b4da3991295f14bb636f7714e3d9

SHA512
99642c4839f4133434a14c8a79b27eee6e889ab9de3a0ce3427d1c71affe671c2d0b3b670bab0f2037e972de2a8665c58422cea5ccf23949dab73d9d8f20199f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
438c41695693809b17d36f58ec707126

SHA1
36637d72206103774bba8249836d3575047fb174

SHA256
a6d6f65ec76525c3fb3bfa7592ffad5ceebf182d06700c6ce9ea69cda907c47a

SHA512
16291a04c0d91fe139bfce1d02ea4a2695f9cf5c93b43d72f64195fbdd7eedcee5fcc8ae3f89fca9fcba7541401547ff4082bad79cfb78d1e01b844e4e23dc2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a1d776e5b942aae73aac86fb45dc333

SHA1
353aa75be3a38a695cbd8fbbdbd47c38758d5e7b

SHA256
a2cfd5eb7900e25776db10fbcc07c5db091acbd9183674dc6cb6c31b5beead7d

SHA512
ae9b88fd699b845f091b279e6813eede90479424cf043e53f2290ef50d1a6e910a9aebc3bfe105c4021b2377620ed4b255a24a4acfb62257c4ebd26d9aba9dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4be156fbd022031a83e90771660f512b

SHA1
e99712cd91881ad5f78ddae54c885f5f7750c3f6

SHA256
82f424b8f5b3d666c4ff68dbbe9ec9dc73d68574dba6935cbf8adb07282dd150

SHA512
b289fbaec1456e81ef0e83697ab886ec935d19e0dcdfd15331b30ec16c6c111da08f6292fc97edf2cef0a6ae523aa85ad8bb5d86228a672ee651c338ac72748b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e88df4f440293283094f14b3fb99e359

SHA1
017146a606624b999235f73bb9b69bf7058f41c9

SHA256
1d7b042dcd1fe6449f46c52df6002176457c40e20ed8e99d79f0cff70d8b98c2

SHA512
3033010b9f3e3b0e9b4289e8135e897f9d5a655a06ce15e8daede012a491895d49b2568eee2dd8d8b48d2957c2db2b67d5b05045cedbf3b9b5ed50578b61dd10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e99d193062917e7a0c2f3966b948880b

SHA1
58161ed8e560ed24c385127d9ea40756ee186bf9

SHA256
fea3391fd2a4e6bc74f82cf911f2d16cf8e145c96b4588359b8308a2fb7893d1

SHA512
d751f5c0d1b3ed3d9f24f1ab200820405672d0158313d9a4539a41b1461a51e1575a47ebce5bfa61d43e999b00e492fbc286c1249cd70f61d56e609590d47ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca09769378b8c62f9bcbfabac0cb1cf1

SHA1
f808eaa6fcba1ac35c76929d02a3e7b60f30efa4

SHA256
9285e88a9b259ace4f5be098078cb77899ca41376d862078710d8b0bf8940a29

SHA512
faf9cd6c992b803b4cb762a076632bb8c13a6a0a4788f32374209d52e0639a2332a449289dab7bfd1ef14900f6d705726e06fac5452fd95c0dc6200e2acbfbe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9330012bb24af90b6933da76b985a612

SHA1
adc769fa30a97b449b72d6380eff9a1b3167baf9

SHA256
2f767e6ac10304549f181924bd78f3253fb7244cee4e0dd57ba748c94a2fb32b

SHA512
6ae37a053ed8c76612ae36c8b8c21541ee207ecf1274c6989a60b5948bdce5377c923638bf6a7c425ca22bf3d8b0167daa08df8652576cb252e71aae6d9194b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92bf95539e8bdf9f8a1452e3cd4a81a3

SHA1
91024bf99c8010bbb2e922da2aabc2622f52e24f

SHA256
9a4c5b791453090fd8e88fac286bffb92d3a8b74bdd54503025e079629d64dd5

SHA512
fa4a2dca55a56e68d686c41fe6d46a850ea7cf06cfa66b571b746e384f96caa44b1074197db814c1dbb70c8b19165e9919abec4af651c47c29f207e289490cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eda28cb93b70045dad93a6d994240c56

SHA1
4e1960836b1dabd2387c8d2c7cfca5bbd7a27f65

SHA256
e4e689599df7e4df89bf7044e0a3bbe0df2e3d2d109c159f35521374744686d1

SHA512
5fa2494c84d07346d8d51ab38ba204f6932f834495e0d12e3ee5c3c0b4df108c18006c87690d2a1a69326e4276c4509e8d3246b77d473964d98068db6ffaa728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dbd67ebc10715b3a6974cd617f34f80

SHA1
e06f3959e29ce245bfea9eb9a6f5eb52b24500fd

SHA256
cbc23b7cb54a3e3fa838b76bef740738927da9b0e5340ef4cd5492b9ca38d75b

SHA512
32aa69fddc3c505a50d4d50b4bb51e393669237ea9856ec0ec8995ae8dcea0c1f3cf13db0338aa47a376dd2cf07d06cf65edb97b241e73f937a537ae077eb862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4acf83a263007eda4a3d4f0238b80847

SHA1
9a08db991e7bad906ac66abee0ec89d06ac659f7

SHA256
5f5ab6ca144df8bd5a1b986f13178b3c9af2c21828e5689c889bde998431b59d

SHA512
437903bae23c762add6ce9e6d11c805ef1556c3bbba2751dceecc76775284caf9b3a30e522419a5a2fad9b43768cef1415d040091a236765fce68d073095222e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3f18fe5c1e01b7324234b38d5d60bc2

SHA1
26c81782ec93fefe8fb566d38a0b090a311791b9

SHA256
9b83e5943d417b7677db1b4a919a03b376faa841ca20ff107dd411fe818840a3

SHA512
1fb34cd91b81bf696be2aeae22639c83d8a8f9fda39bb9cee087fbcf1edbed1a4f2cdc76fcf71ff577f6d46b5dc38f0f25a8073123015bea81221488c5ac8f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5ef6a844aae528fdc13aa6eee9b7c9

SHA1
bd881bbf46f412b5286c18bbc9388f7d979d6b49

SHA256
1782e91ba83c424d6b95f729c2fab41a0454896149a0fab40faac79defcffc37

SHA512
08f9353cc6f7a7443ed4bbf4afb1cd4caeebeccf2f69f6f534d2b244ac387ce94541bc6ab80336e07b362880dd9c9450f7d65657de1406a7e433f618e3ea65f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
715475748298c724ec01d187a6584aa5

SHA1
3bd4fd9e949f3e3ca0bfe311831ff48597085bc3

SHA256
6d3fc3397d15bae02a20e4b7d3474c9421c9630233bc1d07875c6babdfec1144

SHA512
37a15a0303664e6b086adeede1d755c8fc3d94275a61b0f1632af2b06fbfa0994a73f4a4d90e1a15e6c0dfbeead762e599c5b3357ddf0fad3e52c5712f832c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab31DC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31EE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit