d288a2376fcd00f75be7e248c5defbd6d76b0ac6ec5d2e6f670557b852fb1818

Analysis

max time kernel
134s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4811fc8d84cfbc83f03751e0bc5d3130_JaffaCakes118.html
Size

72KB
MD5

4811fc8d84cfbc83f03751e0bc5d3130
SHA1

7886340de329cbd28e86d1ae69fffa99f4356e8b
SHA256

d288a2376fcd00f75be7e248c5defbd6d76b0ac6ec5d2e6f670557b852fb1818
SHA512

1012e771bf1c235e79a58fb62368d7b240440e76664b1d3be654d4e74f3de0d0b30a54758d95d0ab96278d8bccdf7673e63e159a91dd74aa616e946941ddd838
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6sgf6uIUsUoUU+3QoTyS1wCZkoTyMdtbBnfBgN8/lboii:J36TzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C2A2531-1300-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c3e1000da7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ce1a8677b9d398955541e9d33c7381addf70f272f18f58c0c1d98d7b124c089b000000000e8000000002000020000000643904e8b5b714e1dd00829c8213eb1156d29ff35b8bfc3741cdfac4e7c9827590000000ee27fdffdeeed8556f2a7078d528d153b0753bb335a91a57f131fe83886caea00e51558bc3b0edb59b9dc3e7494a74f2ea6e11473c215d8651f44980b708cb76289a5caa7e8afc055a3ba724caff7c6ce90400123bee378dda77de50bcad08fce808e94c47924b3ae70a803ff83c0fda5410ffbb2b1d082bd078e63d7361242c2dda5651cdb73f97a27deafcd32cf352400000007d4b60b166b418a85eade0a1b05f69b4b01df98478cbe1b79e42d91f46a9865ec0db5f9829dcd01a06a51f4a7218bafb1b47a8a8d341b5aab4434c0895fbd34d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421969561"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f4ffe1d87ec05f3e897f42a2a485c3539617bb20ef5be6192082af6e0ddfdcf9000000000e8000000002000020000000eb5c1911175fc77dc67e3d7a2ee215d5536ad67cac8b7f8d4654846270b8dc592000000058031944ceb4acde1cabc5a8cc6bb3671e50ca39b8207f541fd75762f306aed740000000357bcadb4d6fff59047e33362b646ffd41e209534f7d32e39fa4ae82557a81284300dd9757034ec7102f54439eacc69a20e4d788a5ba1bcf2c90105a3fb2546c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28
PID 2884 wrote to memory of 2908	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4811fc8d84cfbc83f03751e0bc5d3130_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790f728122dde06661f9f9ca2fdb5a04

SHA1
88b915eb5b5e73208d5d0ecb1a639a5e22902590

SHA256
dc07eb4aa16c9f884db728f98dcc4fb452c0a95a3350c6a9763ffde91f122aa9

SHA512
52741748dfa3f46d6a40e3db7d075f177e037323f56afbfd61dc5059715981420fd4e978043f5734289130010aca109a921926c5d0f27f3b45ca82ce837850a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2a26cd1b6139761f5c90bfeb3dfb16

SHA1
b11c5e928b24b23980b0a08565d4df369c0649f7

SHA256
5ea5f291d49cce520908ad09e037fcdeaacb55209667c57fc4a7905a2fb0b84c

SHA512
ba3fe0a64753a28cf59b81ea9aa66d4f1cdd5eebbc728de006c06525178321fb66446aad87acafa134a4c11ebd3bcac9e92cce782571f05d83bdc84b9558a30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e74a648f2426d663683b11d8eef71576

SHA1
e5c3d706e8fc5dccbf37fe3bbf23d9a2ae701a47

SHA256
b2e6aeca940fe0dfa1f87ca8c77a72e17e80894365fedfd5f05787c5be833ee7

SHA512
13d9c65eb651f1110d5123b31cf30a7f3524f6461dcfa4f6ced4ecdbe27310d0c39b68327a30177e7ea4700bdc4c0c5336450da08eb28b35628e042b53977655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51f1d896d2b6f872fd61e0b87df76f21

SHA1
eae82d34ab3cfeca1736e528ec8ec8af94e24717

SHA256
e9ffb24839bc9919956d469917c1f20fa00e567c73c52bcaabe633c8f89b66e7

SHA512
9c34d5fb5fd237dc55907140424aa30476b1323dc784d005d5c6fd6e4a095bf906b5210e72fd665020e8d9a6c5166bea459c8667583d9325f4ea37d2e7570840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc630b70e610e1ddfac3f8b5e39eefb

SHA1
99cf0be26370bf895e0fbde798c6e24d9967ad5b

SHA256
59ec99743dd190afd23af4b8dafe78faa45b6e398c9aae20cca66dd73b33a0e9

SHA512
f959fd2db6287aee139216c09f3ca69d1834375bb0957fe7380f41412c8ca03ec95a1f60750ea2760f0dfb4d720fed1b3fe48ccdbf408144c0edfef50602f5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa70e44dcaaf4317ba138a56fd500ba0

SHA1
7b99866338071bb79e6e1b1cb41ad3f7b9905def

SHA256
b17f8bf846f922ba2b9089c0d9aecd0b62973a4ac275241d2e6ce1977bad9f57

SHA512
7dc57363db72660e36f6147279a4d56c1c47d13e7aeb1eff5e6b487d75abeb5199fed63c400ce5d0aa2f3e8df72748c7133ad28715eda00d74e861ad791a5552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ed077d4d85137ab2e038437601b7466

SHA1
7c2a82c21077dbe019d082cb9d6a3ad19b0e658a

SHA256
540b38f95c837327d0f4976bc4254f2a21b7fbc8986024d9a00a16398a4c742d

SHA512
1a43973041aa31b76f9072f16d6710d3d69636d192028e6bf17ca5361046d70cc8afda8b679dffc9d372c5c684b8757122f981d24af37b94354c332f47b688ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e1d83ac627b7696ea31a56e9e167e4

SHA1
6785ef3ce3c61346a7448a9154bc47bdb887ecda

SHA256
d6044e065626852b46f41cb65c8e31f028274b51d9f939cc2bd73d2073997195

SHA512
e14dfc0ec46797d918d4196e804ffe9ffabee5a8d7d9dd3e962136812b73017f50c1493ac74a22be342e54c6f4f9c8af274ce63e2604bf6cee6181f662909b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab60e0412d75084887e1197daa8feb9e

SHA1
b865c4f1390cc1796bbf375049ed7c33887bd413

SHA256
17901d20f399a469a71ac07d49b3b609aeb958b944427dbd31d6e7003c11ba75

SHA512
375c81c2fbc074247b74c074ef433f76b8bc583ceb0e3beea241f1d2d2bc271e7eb8efbfad15e456fc8dcf07aec227a973461e4c994828853a3612dc03a3845f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b27cd3880a9f64cf37d3f3be6275c54

SHA1
1e8c080fbbe68493bcf370f0812b4fb14d9579d9

SHA256
dbf9c0a5f746958a94dc731180248cfdd99bf8bf95dfa4f52c9635679a1b171e

SHA512
034dea848e098aa2d4a7c7d2fe6aeef559fd4f4a46579daede4c4147b31661fb8e4df6e3083d810c9a4811bb713865fd29e57f49c49d74cf6144cc58782a6328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34010908b650069e21f923773d55d35b

SHA1
975257159fab20af3b395128d30cdb074e200b4f

SHA256
a6e3af651abcc598b0ac48806ee7619650981d90b1174d23de2ccddd905042da

SHA512
6b89fbe95758f7be7fbb3febcbd687d8e271166982e9642befe9d274533b584d1f115802a5dd61995f96cdd42b2491d92f4536847f92f4fb878e28d97204db60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ee6bb8f4386d754dec46bba8d92e73

SHA1
b0a058bd82279e31919c8281a2e48484611eb67c

SHA256
0f4ceb4077dfa9ca77276188b59ab941401fa99918ce1a4293e750cff886b955

SHA512
1f2f7fc90147182e9c5b7a42f8fbe41d8d8f05cb71a649a9a62a98223debbe4ea373abbcb36cf076a45ab8c53c50daee24f944153b4454c302b8af7375e32976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc3501ef4a09c15a5c876a60331b884

SHA1
68afbdcfae68166a4da2dc7cd09ba5b314da3022

SHA256
0b37dca3d4b3e48034fd77bab8c733c3e835b448d34706a17e0c043a0e84b825

SHA512
599535a1e86093cbaede9c06d7215379c997b9d88bcc74b5faf154354c82b8a303a2a26c7c5bcf6f73a39c2b118d0218844fb19ebf1d1e7029511ebf95bebdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d855ac8c1b1781bca8c7e4c96def4b3

SHA1
626e9b7367c1e4d1653867d4afa34b422b4ac866

SHA256
c2a80533bd3c4803d76306b8c2077c6e9e88cab2307d963eca1b97e53cf41f89

SHA512
c643e9cf57d63e75ea4a152e048c23dca4b2861a57304fef6f54c1ff4afdc7773b718fabfdd52e414b7616393c004949d76eae12ffa31c05d8edbba4a86061a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e82b4dfb3488b12dfe51057bd0464c1

SHA1
ba61bf56060c3e2edb3210b4f36066816b43104a

SHA256
d21cd8ac90bc0e007e0180e9e0623e80f0b2760ebc507f09f1cc1c5f6d72c1e3

SHA512
35c091777e52ee9ab7d41996640862e560b22bd2e66bccd77efd31041cb72fe99b311b751e67cd32ae2e0f27e86365237d9048bc1ce47fe3e5cb858dabf7a240

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2983.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A52.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A65.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit