70ca2566a4d05b38b38da3abe28c19c59e11704753987108bdcecd1df4f41aac

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

475efce8a18c72294787195f7ea830c5_JaffaCakes118.html
Size

18KB
MD5

475efce8a18c72294787195f7ea830c5
SHA1

aef268ad8a63c46b375326daffda282b5d7c6592
SHA256

70ca2566a4d05b38b38da3abe28c19c59e11704753987108bdcecd1df4f41aac
SHA512

aefd3285b97caa11c422b3a9b952f9c074c98f6aa9dbdeb2777fa597466b055da418acc3fa152497972cff139e1dc47f6699de4628d1c11814d8e64ac29b0f24
SSDEEP

192:7bqLvWazfz8JGJkWPzEEz7/zjozYlzooADpOplFRp8nVaJoTGHRCIX27L/OVB8ai:7OLB5oTGHQd3OKhv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421958079"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{705BE4C1-12E5-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2508	2860	iexplore.exe	28
PID 2860 wrote to memory of 2508	2860	iexplore.exe	28
PID 2860 wrote to memory of 2508	2860	iexplore.exe	28
PID 2860 wrote to memory of 2508	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\475efce8a18c72294787195f7ea830c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
352b9c52672a89db231ca7a7aae05d1d

SHA1
6e37d555921d359f7d45e7e2041caa9f7a277096

SHA256
753c04141f45d3cb9d2283acbdcb90a29fdf2ce6e558a52c173f162a9f0bc264

SHA512
210c81f2b2345a31c6cda8640c5b01c5f2c9c93ec8c6ced09aa25d0a919ae972cd726c8ee4a78d3fcd659f4d393f7731393f502c1aa60276a01d1803aabf8642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33f540c1611cf2ddeb19616bac0d19d7

SHA1
c7c17f03e52f357633f2ae4c20cb7b21b54db8eb

SHA256
cd711ff9934889f39511c57f812bf6d7325cbc4833cd1409eefd3f6bb4d855ba

SHA512
c146aa0b28b335381c7a32af1148c0f30a458ac8698f984b5116b9e30070eaa8fbac7ce4c4d38cb2be9fbc8b7ec9280c9afd2f9350da81b1d64156854c273573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaef9f53175d4d301d827fd899c3f22d

SHA1
5149c5126f83c79eaeb309ae63e74b5c1fd02e76

SHA256
7b509a74cc4940504cb4693302a2706f38f2931e721f3428aaababd7203acc8f

SHA512
8c68bcd937e7c0a2fe3d2333757a622ced1666bdc32d4d41bd81542164d651a6e6b726cf1d3a4f9bfec13c7d1a6337c044cd9e718bc84a93e75fdf111934c023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9836b4fb0d2bcb32564fe1aafc23cd78

SHA1
4818e4b301dc6280858f8cb83b91892dfa34e887

SHA256
6053460baf2774eeda80f4161dddfa5f7dc96c6eaceb903db8160ca837d45ec0

SHA512
8e4bdafa1f5f9c02a465262a576bdf1133242a1e6e2dbd382539512fa2a41055687e22595a91cbe8ebaa76d9ce4199ab3d6d12e442d897b93f20c31672764d37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c99e0897f19bdefa4d35a6e34edc1d9

SHA1
bc1cc648cdb643ec5e4a450b168ad21f9f50ff39

SHA256
06f90a30d52a3cc6e4293a72c7a3a1d27c8f2e3ce830b6d7e9b5a68793514495

SHA512
3ce8f629d0711f6a9ffdf61252da00513af72aaf3220412f46573981dacac11fb73a16f99b8671e51793cfdf7ab6f8eaf71c6618a0ce0944dc4e4b83ca94cdb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1a239b2716aabdb87c106734556ad1a

SHA1
e38c3acd3c421dd285326011e75e80ff85b2f657

SHA256
5feefbfe56b8167844f6421dc955c3d279a5e56da544e4791b3bc89af595a3a8

SHA512
fa7b4fdf6de87d11d79f1c7d00219c6b077536fc6e4f19258ef9af649b9cec0d054152cec4332bdf96020cb78c5bf24167b05614803dec6c6a35eb8febe1c1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e87c8b58e02ef63645b815b824f78c

SHA1
9f31cf89d0e4fb5bb589ae38c29f741d09a6d8c6

SHA256
d9fd7e8f33bd457bab91bc59e0dc515eb345a46acd54c9bde84bccdaa60c4783

SHA512
08dd251d31987c03a37b952adae3de5c94812eb697569b2defbe00a95632523edfccacb6ab773849f142dac030e247f23ea61d35dafa7a9bebc4198a3f78229c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5733f4b2952708a6b9d82d8728df6d75

SHA1
a4f7359c2f0fe26d213cab40e0ce5ca4fc97e5d8

SHA256
dad7ed0515671bfb70d376566bc2c0e9ff0fb25f1e72fc0ecd2e6be063ade864

SHA512
dc59eeccda908d8d9f6078ce125492af0978e038b0882c8628e2087f40449aa47fd484ed7ca2c73abc5837a2e24129c17d1f3e3481022ac7c3765b89a1d0f802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bea6527cee65f05495f0a222b2ce3b3

SHA1
a787e6acfe53c4ad5c2e9f13fe249badf54f169c

SHA256
8b571243351bc4046416a74fca81caec6e0eadf06a2f40cdb4cf54d5062ea8de

SHA512
0f1fd256ad989dd166a0a40061f77c36e803c7e26bfe8c88eaa22784a30e5529076b266e10e757422a074e973c53a6e0ff7c98968fbc48c82a901aed959151f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad2796942e449aa4ff94e55209e3edff

SHA1
60646b6bea67b1ec23164892167e75c0e1720810

SHA256
a182a4660d5dfe04658458352f791ca937a9d6121164d213dd59b4e67778ca77

SHA512
96a23af3143ce1143f5ef020f977f49461b7e0e059ac3c7bd7fba94976586dcbc5a9e45536c73f53adaaaaf0442ceeff35a9bd45d75c0d09adda871b2eb809c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c912ad719e9dec8d4acb97941ffe1fd8

SHA1
0895d0118f148ff02749f0dca38ce0874d5756c1

SHA256
09ad21db3e8c168fc0b95af0c5d5333590fb0ea95129c795edfdf07f8f4df7ae

SHA512
ad35d16a691492c5dfecebe18e4a6046abf4c12fb032bcc01f13f4b85a5c1ddcf09742ee7dc31904dbdc4943a6d007021dc6535269d718fa21cb57915053110d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A16.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A19.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit