e79d66bee59b9b9663ab9f89f16d5b9dbd86648990dd5a817b3c6da43aae28a8

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4726b62f0a05edee119cc1a2041a78d1_JaffaCakes118.html
Size

63KB
MD5

4726b62f0a05edee119cc1a2041a78d1
SHA1

8005c323d5e25c072cc09fbe091486e858b6d804
SHA256

e79d66bee59b9b9663ab9f89f16d5b9dbd86648990dd5a817b3c6da43aae28a8
SHA512

3689f8df7054d6d966d8b260d49583fc77c6549782eac143b2a22c42d2832b37c6fb1028e41d466b9d8bc4c9a5084cd2f10bbab1200d51d4c1f499ea901a807e
SSDEEP

768:JiQUgcMiz3sI2PDDZf0glJD60EoTykyCZkoTnMdtbBnfBgN8/oi2c8QFVGys//I+:J1PTTFec0tbrgaMc7NndC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000cf220a40473a94d634a3986edbeb19896c75f2ced725b821645f324263bcbcc000000000e8000000002000020000000f0de29300c6f236d643bc87d3cf9a8878db668fadd30f44e4d29fbe91bc7d404200000005a8ef5efce162ea55848108be05bdd46cb2d5ae71683c17f095821b0b29d2a6d400000007ca04b4bbe61f77dab3aed435015f298fd4003a46c8ee1e26f9ef840086695c440cd7080c34a1d4b565ef0c8b2c7f715a50e1a95487039373eb89ba9629b01f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{093494C1-12DD-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d9b624e8dc6b9195e87f9442d5aa5dc28188d0ba5a8128ff476fe454d324f29d000000000e8000000002000020000000f14e855daaa8cf41e9a460dc2598591ffc89dddca92989d850e5872ec23ff5229000000026a956d51797c446240743cec5b63727a06ab77562279f5c8a91dccb9ce7b2ff6de429ee1e54d6d79b0ddbc207925c76435b8ca3ca98b940f34d95d43189b23eed2d3b2d2998caac81658591282ce62242971747b2c949824fe43ab783fcc73f64f606e315de942e4ec4949e01dbf92b6ba0d462a9fbb8f16ec9883f87a1a2c9e5c85de97f5bf6d89e763ad49f83c88640000000a35c8db45c62cd6b70685b7c4db98e5a0df99d6384f031bd9b676007e8c7b6a6d67f42f26775ac9f8562bdd38160e42d1c3e4adf2633558c8876fc1912eadac3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e041e3dde9a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421954470"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2120	1700	iexplore.exe	28
PID 1700 wrote to memory of 2120	1700	iexplore.exe	28
PID 1700 wrote to memory of 2120	1700	iexplore.exe	28
PID 1700 wrote to memory of 2120	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4726b62f0a05edee119cc1a2041a78d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd3cc8c8b86159eafc0814f0c2f18a6

SHA1
c36226aff0338320d32103bc575bf82694236e1f

SHA256
37cb5f913b6947e9893b8dd8f78a731d484c3333638440d9b939db4af8ca4c27

SHA512
16b8ab67760566cad29ca67123fd58a830c3e659727fa0d3e06b67ceb646a0597a3fc019f4007730b5fff7b41f4f783d0cd62de21bf86ad8bb357cce96240c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e3bc7a007febf686b764a26c8ff1b7

SHA1
66a4d38a85f88e38f15916f63ec4cb125b965d53

SHA256
ec13a8fa78c2ffebfceb9a76f4d9604f46bc1654975a46dd2e0550dd1605cc41

SHA512
b919b0d41660b1b2d5cf7f50d0e9cc48542620c9ffa48cd9739b9eaa2084d76109c5ac60958371ccfd2eee947774ed8ee2df8c11b7c1ff5167669c28bc7bff1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e54f80f601880c71f3f1c8ba39cbb502

SHA1
d91744d7c50319e85f53bd1824c3973481223744

SHA256
538d0db598cadac38caff72aa62cc63fda8522b4a590d4f91bc4b6ed265a668f

SHA512
ca0a797f88154987dd1c1637b3397b23bb609b9b19c6f3ae52cbed3dc7dc0c2ca2566b17693909f3a391b532f09d1439b8e69c6874fcaef3e4e8fc3592228199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c751a12e2dfd9c0b8eef7285c2bb5e31

SHA1
19372ffa7f8cd2ad7fd86c07b5eb75c006d7616c

SHA256
f1c5d729cd69b96283a68456f9b53bc2b1d0d32458de31bc7652409983277d36

SHA512
9978031ac45488ece5ee97dbcff32dd13614a300490f994ddba35be199b034edc68d6b5faa4979e4a201503e6aac469461511c9e028bde662e7c1519f574c945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffa2ae2dc15e7d87d21f6fb718eae18

SHA1
84fc7158bb6c079279cf54938d45889e8e7e2cbe

SHA256
9ec75901f2f3815ba767ab5caef2652796a2fe5ff2b3e7e4e645306f3f4e059a

SHA512
38dc1f3136bad426ccd3960a1a71b8c72207c66c3bab5c94808152c34524693ae29b5fddb057d905846b743d33dcbf8c6bc3243b7f652a7f2e2a7fe485519c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec8b962b47478a10e13f05e8762afc9

SHA1
b77470be0d752bf39901644e1007b58b9f0eabd6

SHA256
1b66115652e6b1d2915a4e7b672bf005486939975996460a7905344ef391aa7c

SHA512
19edeb7fa39e99418c25ecc81c8b28af572933ada64abc4d78448a097d546f06ffa1c065d582f3fe22dec4e185dcb2fea77b0d3fb27ca35092f2c15273126528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2617ef55e88d68212eaa0bf057f12a6a

SHA1
6d39c37955b2386280cf2a07153697576e7362d3

SHA256
fce6641761d363d942f0655e97ee484ea352a70600f641eb32635dacf22c3cd0

SHA512
07070868a743f94bb867362b1ec5c9c4aeaa2f3366eb2284c5535cb867716999c3a6979b0522f6c08486aa0621a735dc224844f6d00d8c441b1e30831cfedb04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e66870df41b137c5dfef7393ac28b353

SHA1
e5a9f7a76a2b2559ce6203871043fa17b2c27785

SHA256
d711fa582f7ecf8dba12957de92abbff2d4e4bb0d144f2d6bf1b63341a4fd444

SHA512
f5fc8b119f5f5126033ff123187bd1060946e94adc2dcaa0c2ba9033a61d72ca43f4abddae14456c081a0f945e39e9b3cfd6149b9000d3a794f2ca8a2db9b604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b977d81a55609d2b479a7beaa5e61d1b

SHA1
42a67a71c2c363b70187acaabc3cd07fc5a49dd3

SHA256
c80e39a3634bbdd9c08debca50a80b07b980f44b9fcda5eff506cd9855ba65a6

SHA512
6d6a1f5abd19502bbed3a5ce03c47b9d6b2529d08c4d4f34db3815fb973f2c64a57edb93ec912aa65bf9fdaf618691fd050df942be024059ee492e002d5ff23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ccd4420f50de219e77b7c73b4843d45

SHA1
c1af1991a9f46b6f2d99710c6aed8f56ed846b6d

SHA256
22130eecfde00455ad99a7e265e0bf34a594772e1c8fc4b042820db4090baf3d

SHA512
61a1511bed9e56e3f31d9eafe8199b97270066cfcf8080f23128da04ab6f2d30c42179a41bf8bfc43b646e4071878fa41dfc467ac0cc5ec1467abe5147d31a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3410bf4775f9e12f6037f300bad3103c

SHA1
2dc616d43a45c16080b2ad6f57bd9b5791a79a59

SHA256
3bd75ae770359d3bc2b9afd8915957a00ee5dfdaaf91d4fd49214df0e010a177

SHA512
fabffdf6927456707d0b69db47a6ea0f666ea6fb8d86e504eeb4838260aa0b8f34f1470527b5dea86cba1483939d709b1266c2964638ff44671126e1ca986747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a949cbf6af31d1e31164d8953f236c

SHA1
830558a2307afb995c90ee187ef870e2fa60e1b6

SHA256
a408374492d344e6904ea5ccee5d80c756c2aeae1fc9ba8a9e41466a7fa1826f

SHA512
a4218a5b34c11383894295313b1ce214dfb22ffa2ad397f368c577874682b048190173ce05c521ee0fa5a7f708c6b15d9023f719b29772195f61a589acce2c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ed2cb9f4368083bdbcd68f1e02678a2

SHA1
e3b9ddc6cfc47cc02dd01fd6503e99beb34f722f

SHA256
ae1267f62782f3160f3c48e3731f6f638a2f6ea0c07863da7ea795e908d67e72

SHA512
6c4f9bd73290735228037c5ba60f38d3d6928fa30740d1fd4360aa99203cd2020c31539d3f01fc9982d9409a13a9af6a98086320d8594c7545b6cd114cb13df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c58e4b05d950b8e5b3a376e018ecc72d

SHA1
2540d0cc9b807a5b54df3a53f96b2f326e412ffe

SHA256
a5e42f080dcd0a4b1c8aa5b5537b9b46bfad624ca1240a29f36ec309d5ed06fc

SHA512
2eab728d7031f4158dc1d3b63b838cf5cd54aa8200f5c4d6977c10b3ff31051c53236853800769997dd09bd2ef6fa5a32178663eb0eccc4cb96b73a3621cb50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7db522e4634b2a44e7728499095bbb7

SHA1
c45f9afd7b359f5e72401a14ce7619a2553d0692

SHA256
647e393b020481b28a309991d87b9f2d2c335ffaa1e8d340fce230b035dfb6a7

SHA512
58ca3f6d826a77a83c792f55164f6858665817ca53911d2d75ca08ad3799056d43ba95f589e7c64e4841a21756581f839ca6da48a03d2e3105f78d531ebebb50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c2b3fb8115b1043dffa54ea7805ba9

SHA1
07f8132eea53c495af019dd2f2bf71403313a8b6

SHA256
4691fed694f3c32f76d401261f665aef07da95b5ae59e73441ff6dcc0b48d039

SHA512
1d0549a0990977dd8cc717bee3f3e7878efa6d66c4e1b380418b92c0d7d7b900b33f567ab2455b1451514bce16d6e8941af89dd993165195383264d5fcbbff92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb6985abe3df72111e84e5112f087172

SHA1
2bd56cce0f0508bd9b0b692cc50349ec84a1e015

SHA256
e2767e139f4fd39e25c7c2b4167fab8262ded6fa07c8cb4951551f993b61fd79

SHA512
eb5643a129abff4dc331ea0c421c686ae0e3b3586383e5ea23c7ef94839d10851bc7279fdb57396bc2ed69a5673d1d4fd6016edcb6c5710b4ce5e57fdc6f3def

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D04.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D68.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit