ddf68ab7d080297522e80be32d1e0812dfa332b637f23030dc1453aef465a4d5

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

472f127ce2705f9d05dc12466d113cd4_JaffaCakes118.html
Size

126KB
MD5

472f127ce2705f9d05dc12466d113cd4
SHA1

a130caef4221a36fc2d63c08168f5a89c0f1c97f
SHA256

ddf68ab7d080297522e80be32d1e0812dfa332b637f23030dc1453aef465a4d5
SHA512

af63bdd99e95f399a4f4e4d05e01e8b2bac0800e17a4def2fcfe41154e4d3ca32853d96135db398ba35612a23882c2e7d423c8881972520c2a2c6ae7a7d19bc8
SSDEEP

1536:4g3/yYWi+scCdPo/HMkFT+TfFTGFTHwFVpFHnkFqkFuFV2RfvgGRFHnFHKlFHQr+:4Kaf5LfsFr9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421954993"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c033692feba6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006d1fe6f3a593df256f76322bb4c1227b7a42c8be71b97fcb71ad85518686dee4000000000e8000000002000020000000d4317f2c5e50d253fc8d3362d3f895af0d39bfaedb6ffebc210f7b9ec0280b8120000000d522ea0e5cb7b16b23cf957407728d058df05bac49fa33e890bb6995ecfdd5a240000000c3414dd9ff0994ecaa096ac7e08e342daebe14ba1b8b03d9d2b340301b7281aa1dfd91e673b4f239c2ef7d24f83e4d63ecc3364d023fa9fcb785fc6ec2c40ab1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40FAD211-12DE-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000327db1ca63750239111306f5f705e76df92fa8332f09d29c6c7af7999c1ebb88000000000e8000000002000020000000942ed8cd4aa2d22fbf5bee16aa46dc319232769fc72fd114e938add45e07695890000000807cf67baccf44ccf37de9245bad68c563b36b704301cffe7fd04288dfd5b54652237b38271af992e65646bb4e54b3a3c38fbde431a604e45beeafc0b02f42386c6a9446a7cc8f6dcc1438513e25f597bd30770e14eff484c94ab56030955c66391205326896d3c5b77bbedff751caa003afe3f9ad3707dfaf9e5e96d243af47111344f6018473815d175f5f9eb2b80f40000000021f6a4d9a75040ccdf773fcc7d1c23712ee63d393f20bd0013f6774c07a0dd7b04876b71e6c611b983cece9606da579bcb468adcdfa6d677656687e6483680a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28
PID 2928 wrote to memory of 2932	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\472f127ce2705f9d05dc12466d113cd4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a77c7474f03c9d3bebcaa638d87d05d7

SHA1
8d2d914c6bb94c689b18e3010b1fdb4202facd85

SHA256
573ab579afda58ed6d2f09abfb8a35d8f3a1e6145c4c34ce704e25117de33da3

SHA512
cb2da6a24a4ddfeb4921b27c852f31bbb74a2b0a784d0f02a4250c2d90eadbb615f60835b23998bb8dc110c14940d78e6f418c3eeeec07ca7207d051855fdde9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8c2450227454090f3f120068d2aa6f1

SHA1
dc934fabb734cb20eb186122a68dbe31b8cff9c2

SHA256
3e9d8bed37712c9c1b3ffcfadcd797755db3a0142b4c242a5d36cf6d5d5ffc3c

SHA512
9dd94f4292a7bc8919260ece93627480be75970b93c03e596d9d5526e773418da077cc1e3a5a0c303a1fa4ccc3524cc6298a06f8f17f87da21bdada4f0559df3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a0e1ad5e80a557d1ff80d6bb11a290a

SHA1
9d569de5dda3922b3766f5054d62210bb5b92644

SHA256
0ffa52d74713ef2533a9cbb98b63a613629bfc10e971065f6db0559548a7dce0

SHA512
db793b801014e6cb38ac425acdd2a07a16be8f7f26e0bcae9c722489940faa309cded1ae268cee81405e8aa754217819ade1b77f39f489e6b93ad95c6b5c64ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
720ac44eb4f11a3efe2dc3f7039414fe

SHA1
4ce7e39205cb053dcaf581533ceaa41ae49b6548

SHA256
eb450fb3b74be477662c59fff59c977542ca41de02f46d1637cfb3187bbff56c

SHA512
15cf2438c18142789b6714a9eff81ceade39006d88c5952cd566eae51b70e41c83fb5810a3ca953f198d7443b99a3e118ae36ddf7ce506605357b1c662141756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd3a7c63293dc154e9efd74c6c7e792

SHA1
b7889f807feb7d4c27f2d988c5863d7b053bea0f

SHA256
a3117aeb07c227f57a99e2b2fecd9698dd513ff35ceb63ae6b276f4526c5d19a

SHA512
4de4c2789902569d7adbb995f21ab0226dac46700d165ff19d5e8c6b085c7370ec2caf876f303af628aaead7d7bde29096354ab53b24ac3ee8e4d49bfc3fe29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049e7b892dfd25617fc2cf6970552302

SHA1
45a6f8edd3bf425f72c613d845152498f6574820

SHA256
73253cdf9bd328942608bd12c0461aef1393a89732657fe87590a2b9e36f7455

SHA512
84f1c841739d17b199b07c5a3ad14f941be91a9b663fa60340ebc3ac10cf1c5a2c8b0d14e8534478f7a965c2d5176352835534d1ebe13981e9afc830c01fba86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
561915f42947adc4034603bde14f699d

SHA1
dd295a3ed36c67f5fb34c006a72e1ff11be82145

SHA256
7be51c746fd2664cf147aaaf64838d377349e05e54a24e1c2f59ea445b4a2a10

SHA512
8532eaac255b43124bb49e2041437ba587f95ddbe11c00831f9f257cf9c544da98fc50426a6445207bfdfe2dbb8855f7e6eb893f5bde5369cab56c0fc2846b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1acaff89f20b4c340b677b6a3a93b194

SHA1
316604c88f88f2164219e78c9b12d4293a965fa9

SHA256
88870d6df3777ff15330c964d65132d8d133aafbb6fbd533772b70937dad99a2

SHA512
6fb60eb3806433269f314fb74029a04ae12f44362e7cd2c6acdc8d880d68a184780e17ab51ddf7a893b9855ca18a39d3df8e14f7259507c056d2a21a97f817d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69c91a6eafadb0d76de71494c358d17a

SHA1
fe034acbb8537229819e08f6e8ce1ca0f45ae47e

SHA256
414f581086eeeb44c82a8bc8f05d67d5091e62bcb90118fdced81e5b3c484f6c

SHA512
dad504c52cfd15eb81c66ff7a34bc7b40b9523dc5e2f70b930b9d44a4250fc88186566c53ff7b79cb192dac58e96a88eeab1debf8451a9a1285b269e8b6a5dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64fbbbd9344bb500852b954be14ec54a

SHA1
05f02947bf6de6e81e5a57e3578c6c4b6fd49452

SHA256
8bcc4ecda5501da519c96ab6757eba70da5b23f37e34bfca34fe3ef3bdf34b47

SHA512
dc66b3e02c3ab73c9ebe84b5daec5c4b505cdfa0ddbd6716cadf6eab20068536f15a9c9aed5835432377bfa6df2dbb47fd6c50250e6c9ce5e623889f643cd4f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14983d087ac2ba9e503be349703a6ea0

SHA1
888aee987e6335489c8f2baa1ff0c4942954c278

SHA256
08a970de56b8a12f254c5d934d54949d0dbc1a58f163322a1bdb20a31005d834

SHA512
359bd92a6ad1e182903a89f2de8d56277b04e3d8834f790a4e929437fe7efd3565ab56e82e18e98331cdac48a736bee10af6054c3a5ceca353648abdfe9526e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a8afda6bb0a7cc94be4ec55c34a9911

SHA1
397dee2686e8db5c39eced6a5062796b3f1d66d3

SHA256
d5b959ab461a9a2f2e5144c0e86117b6789e145b88b0b67be525cec557c8d2e7

SHA512
ceab899de5a5f528577e8efeea1b1b16d49f97153df784fb116540454893a9019ee3f03002c9be4456f775585e20861fff934573dc78d70b4419f3bbaf9ba82a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69c113f11687421ea557f7755dc7ef8

SHA1
1bd3cfee086bad1f9634cfcaa179da3213b73eb9

SHA256
1aede68fa0eacd7ee2d20ab98f890344be1185a7ace837a3c87898e4704de5ef

SHA512
8af0cbc7b77c2f937db1ca2d8dd3141b5872c71605d6701c5f58db21aa033c79de9818daec3b2f08ae06865daee3861801892de58796ad7c83e0e3a58aed17e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a1a4f7ea7d923b6a1de668d2a15a60

SHA1
2ac26f75497784d41f63e3e255e7a5b0e5fcf04f

SHA256
3ecb2f395ea8f909ce85fb0f57947352bf13b4ce78efb5bf4993c7403560b8e7

SHA512
94e9dfecbafd84b1ae95008acb150a8a73e56c1dcb3cc5991a648dd6628ed0bccf5f0f90fcfe1a71a055f5c15f6cbaa4995dd00dbe9f2e602b1615f151060074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3259dc280d974ecece41f70a78a684c0

SHA1
8abf46c4958fcdfa26311d8861ecb3e54ac6f946

SHA256
cf4e83240c6b2105ad68de4b9f64cc9fcebaa4e9ce30dedef0bc940a5ca59f4c

SHA512
c14f360e1fc739960a84a815cc331c2086fd2aa9c6a59f5914c9829619634f0aa260ca1236f3ee9d6b431426f49631b9a7b261075cef1d16fe637a58dc578f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bb59ecb46d6bfcb8fb1e7b26379ed50

SHA1
6ef856078a0382377e5e571e0e2c9e619ccc4d53

SHA256
d875c6d7e86579f6f85fa500381440f9fe155331828afafc954b6d35aa32874f

SHA512
a7d4c6ed0351f9775c9b686a5bd57aa3d825791f753d34fa8bf17b2ca6421c1a1ae15864a184c9e0322b4d457cb35ee3be69678521e589e94cd06274c3dc619d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba71870fd3d85e88a1906cd1d7ece8d

SHA1
863a60c748404d6f953f2a71ed39444139acdb19

SHA256
865d7f66630be8d1cc686e90e15941dedf308ac2c1e9e7df93755db31fa9feef

SHA512
134abe676f2aa9cbc1249c4851faca0f2ce44aa90868bbf078d3322ef1837abc402993533abf3fb35b4291f78db120696ec7d5da00a9dd3c4412c19217d429f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab204F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2090.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit