e71bae29c8ba39ae8d5f9a3e18a68436469378582131338db3a243626b547b09

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47c69eef4674745451789d43b4a4c75f_JaffaCakes118.html
Size

4KB
MD5

47c69eef4674745451789d43b4a4c75f
SHA1

c37e8f6b205881ae8a3e4323887e087a87ac5786
SHA256

e71bae29c8ba39ae8d5f9a3e18a68436469378582131338db3a243626b547b09
SHA512

908d8fb94eb4f78cbeae030b17e4544574a804dcd420a3ba8c9188d9192b99603c5a4a9c0ef9c2273e57961941e6076647077b07c070b43b87b14189a15fe29f
SSDEEP

96:1Hd9hwVPcoGg/j5yntxI8vq/5K/u04XtLIQpy/:JdbwWo1/j5sxI8vE4/uPdv4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9084d20b02a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006c991bd603864c39a3ee33ce2c0623e0c7a3d5d2ce109d4e603207941349afbd000000000e80000000020000200000002753e06750d0ec6c7508138ae1ae12328f6beafe28ce7aa39945a422606b0c16900000005fd84c9e3f54323efc935a5b58076c5d11301c71fd54e403f43d48a78942ae86a1819122bb6aadeb87d13907ac7d18448d9e0c44005eae9ce28b516ac2f5e06ac0df657f8f110efe52c3dd4121d1a5650491b0b70c44616d24add61f39821e117cfd0cec68ec8491f02b7a70234b34b7c1845bbfd3c631c624e18c556e2b9f7e28d50e5af87246137d965ad872ef5ca740000000a16c835ca106295aefe98a6f9ebee1b900c299eee895d774d100501707842ed3ab14819348164c3505d9425dca6b14581945f455e0b9bda426ad4ece32d7b218	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421964851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34C27F41-12F5-11EF-BE4D-CE57F181EBEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000090c2db369279cba281554364c9875833601f640579b524d76cf65ec928d12dff000000000e800000000200002000000068f1720aedba692ec3e96674b896d2cc701986b34f1dc195244cb01823d6c332200000003903aa16b9f18de483c086dbff962cd0843864dce774ac104312817007539ca840000000ddd17efb12fac55923304f0d6d1731250d364c0ab959af87984c5133c9789276ebdedf22ed97065da3870cd22f5d4addcbc7d6bc0bcabbb2b149c81d5ecb0ab3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28
PID 2036 wrote to memory of 1752	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47c69eef4674745451789d43b4a4c75f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf079fb338e9f45ee5130611b9300e9a

SHA1
e7acd9f31581a4f8b7a635e6ca2c97ecf87c659b

SHA256
ee030bd939643564a5612357152d7be276b04af6e7f4755b77dd71ea76cd21ed

SHA512
e38fa31823bc3a5d9ad9268b4f5454d3c0029ab4f7f34fb32f123a069713034df58f349e0f6159a99c70f8aae3f834f039e4fa0adcb785eeb59001414b5a93c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bfd96fbc28a6d54587eff59654cc575

SHA1
9cffb761bcc70b17162483a752f209f72b990adb

SHA256
f03fd0728d98b19d77f04fa1a06d87880cbc155e75341a17cec9f947ba6bf33c

SHA512
c3ebb2f0bff8e0da9c1ac22909d727ccc55b2fc3041a839b2a12d3a0f346707956c2eccfcf2efb4fe918d493b7ee8b6b7d0465ad113bca118b3d85aeb1d19ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d070539950291c925cf6906c8b7ebd86

SHA1
2e121b361d38598f8ea435d238bfe8a5eb3cf531

SHA256
8307249c8fca151298ce39ca34818c49f7ff94575910e3db1c807a3182d7f9e1

SHA512
eee0d0894ea721858bb2d912719d40928394052e2cf18f5c2c3c901cdbdda1255884ecb7b16cbda78c3b7da1837844f896c15cabbb3ed011e8e14ae356765106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1326532c552a32a8758c1c9832d7183

SHA1
7422202c2ea6a34c7a696c61b24a17a4ebf57cfb

SHA256
336f96a0377301d74b6059f39483a75360aa058ace7561251ff06792d66c322f

SHA512
73b3385edb5dea49cde9130d40c8d274ceb879288216e8649478dbf890ff4e92fc00758ec7196e1113e3d2587175d13c0c313af6935c7b66fe3524e0bc900852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdff4b629d13eb1b108daff38d35ff5a

SHA1
5e87961e32f8de95a85bf8b8ec4bcba9c86183ff

SHA256
b2e939e3dbaf6d95083d1666f99ac6ca87505c96b1ecdc4a9ce47682880fa2c4

SHA512
fec09773a008b0fbae443ab89d2de40c59ed59d59c88cff5c6e7888c2bffcce81c9c90009dcefe0c84fb4eef2b2ade76b4821f5d7ec79b3e467156da8a5840b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173ae658f2c013b1b49cf13a93aad35c

SHA1
27e8bc80ac1433336fbf82a6ea4e5da58fde9c27

SHA256
8b35fc709910f17b48bd0c0cd449de8b6968abc5eddd0db9940a5465e92d8ec3

SHA512
c2762bb7f4d8a3fe0ac85b19595f3edf2218adab56b540a438068cd466afa31e400111b4b194bb8bed1882dcd2b5fc29724618c444a647826429a1d5e056ae8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c41c775c61d905f104320677019bc39

SHA1
a031391811a41a71597e1130e57f305a9388d06b

SHA256
963efcec772d96d58d109c7ea888b2808d7676cf60cf6f31cc7a72922912fcd7

SHA512
54797c5f197d6c785df96f6a27464590c9253f3ed699d657260a9bb425ef673444403279dd1cd33bed602ec3352a00baf407338cd7e2318987cd5c1cedf9f6b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a93d8dc93cc9021f31752f1253a796

SHA1
281acffaae339d3eb08c00aa3582fa6f7d88a54b

SHA256
53f3b55682efc74825e1d6c8ac627244a264037b6b54fe6f218dd5da13210544

SHA512
b9717e4844c510db77b0a03ecc5af0c1a9789c528f73382d6188c7b8ce99d33ae26f3b70d6338ef28c6887e5d672bcd02344e599913848ea9a4bdcc281211753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6524b4beb69fd39ffb0fe48879436d

SHA1
7d7461e2e55a2bf7fa51cebb0ec4ea0a577e12ed

SHA256
84d0955501d463c6bb4e67536aacfd1f704fc5890eacec500a9d59e95c53883c

SHA512
b5d49d719c46fe7329c02478744569382f463ad7862d3416aed5c0b54b51aaef65f8564d2008f3f6f45e28ece366af0994b58d16f95dffc008ce6ba739a0c90e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654d45b188248fbb741fff7a09ad9435

SHA1
794809cd33a3864a3c2dec3ac98dcdbcc8d4abfa

SHA256
b0e4ccbc4ea0f0fffd4eb4a07f51ae266e21eb7c5395a04907ae775099dfd7ec

SHA512
2bb1344a8eabb6c4e0ccae82ed4f8a248efc904fa34cf387891e002caee7eb7dd1dbbdb7c11964424051dad5ad9e34d870889646afaf390e9afbb0016756c10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b2dae043c4f4486314b41e7b432fc2e

SHA1
1af06639df82ffe3d1a2cba33c9f98a375340ec2

SHA256
7c6fda1f6c1945adda8be0e8c572a3b108c98b4c9cbb9d98d038e6b24aa02a37

SHA512
02d74eb815c54c1779274872feaa14e73436ed6c4f231f991334475ffb9804105f9fe812c8f9f164b3bc5aabca1ecae7edeb31fe10ad0520e93fee06af24bb47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bccdcef743b980cae75d86022734e29

SHA1
9e6c359903e8c857a3174c0b394d931500f8a2b4

SHA256
56d79e77b2247ade80226c3994ebe521c3a286495e631b3bf2979715727c321b

SHA512
1efa30435e52b36af92f439adc08529ff0b01a9377ab5d6b1dc44b2324b8d2a5473863cdfa291cbed759fb2ca45795a527de6eaff7fc603357e2972b332a7089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d443217924bb087f112c57555009e70

SHA1
be9708157337f7891c71b49a44fa216765775ad3

SHA256
249c2b90f960d07406fbafaac924b9c6dfd822cf88989e07742c6e412536653f

SHA512
bead6478b3ddaf4619791e59d4e92f978cb1f891265343499a4950d1a6d15b29b59bedbc6a99ca024ad9e54c303661032a76c716efb1fa9b3ac51685341202f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4265a3c824120803f77ffae56d49472a

SHA1
eebd1f2c86e4ac47798da307a834c11c20d7b0f1

SHA256
a64da511785b6f53acf3f00399ff1869da6344cb20d30fe1e38e1294e6f89328

SHA512
4bd027d2467a97eaa67b3fba691f63cf1fa2519543d5acbe459d11109d8b9b4b1fd8434449680a938ffbe3a32fd326d1ec03b984132c500c47030a94c7273ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f9c134d4d17b938b800a0011b398c8b

SHA1
237c1049e58c970065c944e0bd5e6df43d7e9564

SHA256
7982d1f8b22186cb61bbfb5f78ab672d65d2bf7f0a04ccb24be716a9331d7f96

SHA512
e10d3da8dc4cad8a045ab70e25da3b11312ba0c745bc37770084fb86bd4fe96928f3007fda67b1b66fe1555c6fb88a79415b6a801fb1a6c8d13b4a92a8a2964f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab44DE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar44E1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit