bf5cc6f56aa8403263a0d2eb3e7b1efd87edeb7839c39a66588f1316dac6ce37

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46f064af7df8b4100c323fe54ac24d76_JaffaCakes118.html
Size

14KB
MD5

46f064af7df8b4100c323fe54ac24d76
SHA1

71c229d0c58051907ffd20272cd013968287459b
SHA256

bf5cc6f56aa8403263a0d2eb3e7b1efd87edeb7839c39a66588f1316dac6ce37
SHA512

2f5bf08f1179952be7795613754da083ee9a0996f70bdb64060c37919208e8119cc3f470a4baf8b928e0e7d3a1898788be6306cc755707d3d2bde83d7d0303cc
SSDEEP

384:CyiKlDk/YLQFAi79y1wIqMWh+sb3OJyKT+wiN:CyiwDU6QFAi79IBqM0d+Jal

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006945626004169981093b056f896ced16c542774750346e32013078df63ff3541000000000e8000000002000020000000522bc4d2ddf3f629379c0538c0c6faa127ee3010642383691aaf82f1e1a7d046200000000c203616ba2c1be3403408caebccda02d5b29b12e1bb4822443424a7d934730140000000c76c3f4d0927031f37caebf76fdd6b77402ab1b13fcb86cedc6e1db18e4d71b05010a79b9f41de1a7a511a2c77238e594ac17ccc4a1fb92c16ad9d167bde3f5a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421951019"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002b346c261dadce88dba7c135c55edf5175dd3c804a06275c85b83fd8322a40ad000000000e800000000200002000000035f3f4c7aea4591e5af3354c11ee647bcd861e1f952b5c22bfc2ea78ca71f8f79000000035af90bc18e8d46b3352c030f1da88fd8c23ab88965994b10893f44a07d6cc9cb4b6d954e28fef7b2c8a0a750876fb483c9a83d46f92b5a8dbe7a797fd9aafb538b5277bf9230df205b7110845d50f3b1ecaadf57fa25f27bcc9d379cd57c3efca0c241c96cd32c5eec61ef5adafb6ee4dbde061d64ae9f88fbd12dcc6547f2bbd65aea9b56f2fa2b9df59054a6b4b0240000000c42bc8718de456031af52483862613b96c73a522450e68fcdc85f200b63cabc94e65ada5daf6d0a8a3a62ea8779e0bea7861377f7dd1a15f317072492fb795b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00456A91-12D5-11EF-8A5C-CE787CD1CA6F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a4d7d6e1a6da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28
PID 2080 wrote to memory of 2508	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46f064af7df8b4100c323fe54ac24d76_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51029a8a3ae8d970eb3cfa016cb8f725

SHA1
9c3799855c3b2137faa1e51418055a7c9169a522

SHA256
f50c0d68e259eac72c065b2ad4460352e12ca28fee1ad0a206b6fcba1f650fa9

SHA512
99b2d6b46e9cbc618d95e191778a622bb41d60f5652eae50dec149731fa1d74cbca9fb7c44198e65ec86a74133ef058935cb5f7c4a01cfcf3c43bcad01f183bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b34f1ab6378eaf64d852447f7026f823

SHA1
11b9be0977360ed3fca51f481f0402387bf21ac8

SHA256
d20b47ba79203a621ddf591f1a96503fa98a865f872e2b3bafecea02e323a902

SHA512
abe90a2eb090662fae0c1c3e68c2e763f0d743b7fee9da84a8b40675b9a2f9ca1b28ab5c3223b19a157ed6131a4fc9e992160ebdfd54b2144dcd09d0e2122ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62abac60ab109c7bd7b14afb52d19fc0

SHA1
34507fb2f2a9dba012195e2637e73aa8531ec2e6

SHA256
88c4af6d28be74beba073894e2abc8f3b41d115d5e4814a4aef8268ba6073f80

SHA512
b9537d8f6e2bb39f90a1296630dd7d413e87dd2f58d09a61d2715f5ae6cbe9df140465eccaff90c4f7a541759e79cb3fe8f5d83bbe8cf3319dbc6a845df65367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1d4b4d4355dad581c1f3c88373e88cc

SHA1
211583dcc29a943aa3a329be4c57362dd4f4eeea

SHA256
b6b81670ea9da017871aa22777d70756e2335a3dbe48f586bcaf32ee1e957ab2

SHA512
6b9afa1c68c95831ceea1f903fc8ba1665f197edead5cac578fcf135ce49192732ff43acadaa90cc4c6ae56e5fbaa3cb2e691ba7082a6eaf029ea21e0911f1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634732f01607f629df600ca1a0020e41

SHA1
c84604754a728dba7ca7561f9692dd2a44637259

SHA256
7021506442a24a167021024419ee9cefd5cf358971a525217bb42ce23565f107

SHA512
b697e421cda2c9b08271e1c2542b6a3bebef16a41b995a12803d387b941efb8050d067aa05400d93c757e8b032969a9a99e2a57617dc5ae70415c7ba3303b2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea89f4d474fe97481d9f5972dda447a2

SHA1
b27806ec491aadc864a500e8eda5bcddf0eb25b6

SHA256
bff76e6b7fc6ba99886a1fe4e4adf212091a39679bf0081bfc8329b28eb218e9

SHA512
9fff7a9d0ef8b4c3c5f7f13baf334fb3ce53dec62a9d3ab16624228f8e944a2748a976a603afb22273c2f6e7938ef41f3f6d8e3acd90e8685299b77b36da0242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dcdcef7a1baced6eec258babae8fd9e

SHA1
92f6df1f2522a018a4cb5e06d2a162b0c761d5a7

SHA256
f00e752b3887afc36fb9696748f622fea6ea26be62d789ceb14336b5684bc0f9

SHA512
1a4f7568afd99b2dc2da6446c12f4f3bba089ec73a07a49a6fab863c1b61a01121c74a3f59b10dcf7d11643c664677642cb0528ba2dacc935bf11c153a6e7c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c212dcb1f91f6a3bdc5e33890e89d754

SHA1
a5b6c464b80b222ed3d6e27868d90585ea20f185

SHA256
76a54359743f661cbfbb39cd13d5b2c45a728c694129c00bfd98799c61b79674

SHA512
3c2c1dbf92fba303e7eeaa7610756a1fca5f692a45e9747887b3ff9501ec1fe87e7212044575b5d117c2765e42a84ed7c110535484f509372d4d7681e17eb8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5542cda527a0fc67ed0e2a67a03b9a8a

SHA1
6e1e310d9fc6c74daffbe702a3ee0571cbacade5

SHA256
d0b3d04ff8a221ab0245d6777226004872b6ea0bc409bea1baa58b1f05218b2f

SHA512
1e2f5c11bc0b16a742a0c3d52e3fa489a22a79541ca7424fafdec9f617f3d151fb805c4ae0814cae6910aa7b050203bd068bbddda51cb4deba0865caa0b3c4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc5df8e60aae7e21ec89b39d1118c98a

SHA1
9cd1c01f63f5de22fde8e0585c2e4f01b6dbd4a3

SHA256
d70b47493f306eaf4baa4cbd965a577d8e0f1225f5a561ba4a7038c42b24a7d3

SHA512
f4ab407c91d1fa97625bb7e99fef6a9440209118290d918a1232feb473ea45d40e9dc171360c536393b6be1ae8efa2f29876500e01670d5aeffce5b345c7055e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd65a6bee6aca4fe7821c36bd85e886e

SHA1
75073ced8d51129beca2530ba5a7ea627d15e2cf

SHA256
cb2503dc073d76bf507622be085671f0665dab29f44b91d0f6e2c964d09fa672

SHA512
24f7ad77e2a385c193192207ffc9cd74d39626fd6ffe64128fa8143793c39fdf53cee2818eb6293849e915a92c5003b569f36b2e2e7d669f5f21c25249a52663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebfdbb62dae0112069be5a6918ae5875

SHA1
281673b4d0ad5d81d6ca14bbf51a4ee4129059f9

SHA256
a29aa675adad7d90c2b652681adb51606b9b14e487b48550a65169233dfd2498

SHA512
349beb12747d9ffdc1e94476a8462d7d2ba111c469abc54ee9bc8121bcaba690e3eb331c0ee8c286d2dd2e7d27f82cf43ce533fe8f297f201b1f4485f44cbbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0de7b4e4bc5de8856760d3b7e45b8934

SHA1
6d4bd2d21ecfa437beaa5cf3bf277698abc72a4d

SHA256
4998f050eb6db229506c33367e714edbda422fb1e0fe6da143aeefafc2146999

SHA512
1fdf574f2d8907abf1c5393c472f5ef4ad67a6d0ff3f8fde5ff1a44b266b15a842e3008d574fe433b6cbdc69c65fb37751186f5acd842454bd64d8b69740554e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9732c6659135cad3caf101030e591b0

SHA1
0a321c6b722ae722a5db462408857541e16f8338

SHA256
7ae722b18771d0126d67ef47a157d802ad2ad59029d4bca08806bd6413d36fc2

SHA512
e5df8fa40318f295e98ff0c7b06596cc2b5cbb98765769dc9e093d237b6ac4b0ed9e4e9fdd64c9b1b6a9087a1b8986b5a8156119265adac5ced1d47b90c7457b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3719.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar380B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit