f835b9898bc7c6e82aa40bf879e796ee683903713c103b0a5a9e4aa89410101f

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d3bc4aa8635831ae7717324ef0d2709_JaffaCakes118.html
Size

4KB
MD5

4d3bc4aa8635831ae7717324ef0d2709
SHA1

986c9936f765a3c2a4ed6413cbb2e24ae08cb73e
SHA256

f835b9898bc7c6e82aa40bf879e796ee683903713c103b0a5a9e4aa89410101f
SHA512

316b52356dd94f70ff43b5a5332bb297009cc027680dfa15c50714a547905cb2cfa5df0e2d8aef77eb7b0240f95d89059d2fed138e5992bcd9085d0b0ef5dffd
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8okNgWJd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002e0fd28263924cd47a2f32490420c64c169be82348c40d4c098b69b27377af54000000000e80000000020000200000003403cca14b259414e1239ce1e5268c4cdd2556cff8f95a7e997bfda46b57526990000000373f256329cbb0486872d506652b18db63a7784675210910f0ae6ce5fd6e8186f3628d87810db386454027c630707d9646da08827c57b982b0116b9387cb2941949b6749b4c23058679e8181a388c9a8167ab66f172bb52971789f2c2f4b5acacbcd010e1860ef1c10c356d91fd8f1621cb4939ff76e8c7f4d08f6c56a9379a5c332539556d788f2df09c34ea8c75f6140000000587a314683eed3da07a4f2cb8ba28e8defe8ea3110de800d74c58cbf3e7ec177f485e8a9119db6774b582d0e6ee90f138623a3300e20ba9cede8a12150add535	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005e974c5db67acde2b54c8bc5606574a71eea15152089dc41dd8dce8542403fa5000000000e8000000002000020000000cdf0eb43f69bc6f46ddef80cc526f3d7dfb5d6e1f1eaf992661d4722ce0a51ad2000000079185d0842dbf3ea29276475b2fb30d5c10017c991307902b8b827da00379499400000000b1fb6f92956fdd531f8e1987ad57cc8621eb7c468451bb8cd1201900a75f5c51f049b474a52b5d92a431e259e5b489dd941b037bb20a4bb1434705f38957819	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ab7c1adda7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422058940"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45767091-13D0-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2448	1952	iexplore.exe	28
PID 1952 wrote to memory of 2448	1952	iexplore.exe	28
PID 1952 wrote to memory of 2448	1952	iexplore.exe	28
PID 1952 wrote to memory of 2448	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d3bc4aa8635831ae7717324ef0d2709_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa27f2835e6cec56b0983ee09620c00e

SHA1
a548e4d40a1e0109a2fe78e072793169c05e2d60

SHA256
eeeb799cc20c9ee2b0bafa451694656dbe1d3fd93b786c009e9c38fb5519a169

SHA512
a20eb3bbee72aa7c56dcbd396aa0f6ece297c818c1c1417b2074bf1cbb7a454e23a84abcd87efd211133878db984f4ce450b5453e754a36116e719b86499ed74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b732a484436fe5ab76d9e889e08a59a6

SHA1
f8822f6c46ea4b7678f21ab94dd6fb78fd43036d

SHA256
5c3e88f9a8d1ac4babf3d7b12ba57330b510a29453fb411117f7b7fa90b6ba64

SHA512
2b2725ddf08b3ae30c360587a0cab88d18c08f8be631cdca723b454e752359d83a2777cef5f32fe47f71a5ee22e9a1e229ac130ccf03fa9617b7cab1879b9fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b9ee684566bb70a35d7cefcc92778fd

SHA1
d807cc9a0e3d99f50239013951a9ddfc7f140b83

SHA256
ce06c67b89db7d20ac642b007caa63dbb798dec64f3cfb8c291ab04087787bfb

SHA512
f097f0a89b22b1ba4f21692b367caa10857ee2c71de6537d42359f24bb801b451f9d89ec4c49c5cc8cd3ac6754c3a5e53f17df4bc2ad66efa0be7182394f0249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20147ea697ad7c9d2574ab717c7fbee3

SHA1
540965c43b1cc53298ab66fa188818ed73155f0a

SHA256
807fea6d9db4dfc995ab2198efcbd90285300e692dde401517b2f3c7134a9dfd

SHA512
b70b68e76e21de82c1f219a3befff461b1864a15faa7397efd4c6a2b6ad0743994d5ccaa3862d81dbd20f5b9f6b45616d8e8c1b2dde5c5e85b1a2aa9eb98d898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d601223ade7ca2c164dec32b0e001dc6

SHA1
5c0013f1f407ecf1dcda0e9bbaa9ae5114c81195

SHA256
eebb6b7043fe93a95d2d41a3a10b9ab9d77e88dcbe8b02509b14c0e0677c053b

SHA512
8bddb113a67a5f3ecc122cb63715e6ada7b79160c659a2eef5302f7924a1734c467f816a34fe8f2eaf4572110b9cce345364aa9dc70024880d603bbb62ec404b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5a25e2731e787335d0d8002a3284e3

SHA1
7efcea2694a1f6012eb94bf02543be5aafd5a2c5

SHA256
7ad751b51d5684dd8d5beb55293ed52bc7ce468f19c5fd366b28eab07f9a05c0

SHA512
77f9b4293b97349dd6a8ded0ae6cace82090c5a5a96f394b2d9246c851573113e50fce3661bb1db17e9c1f2e533648b615ca8588c71ea7418037078f8c1fd11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c5b4695ccb2328e49d3dd4e493d650

SHA1
6f0e9661d608807c2f66d1d87daf0c10be0e0d42

SHA256
eeba1c2311049e0ae5386db59e404c593b1a16df4b9a29c1f6a1a96728901ce3

SHA512
6d72c232313bc7f3f1daeb4f6413e5a5d2bd2fb23d6b111c2e44e0d5270d4849b2587b1b86862f7e0ef94652f4f1cb4d8aea76d1d267d8d29aa85460fe297330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9927e0440809235832a2c3040ba4d4fc

SHA1
04e854d006ea360336f87372df135b9c416f8d0a

SHA256
1de8c47ca259781a3e79d96a0a619139455a2176be1bb62daf67ee961c4630de

SHA512
9d28923c3db52f61a4ddb85950f91fd27cc9c3a7aaefc746b9931acf0b41a6b09219d172ee1a8f2425d4257c58a3ca3c4547c3351346cf4dd6aeb1ae7388b987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0bb494dad370bc6a60e4fc5f26c8fe2

SHA1
414afe771c5fa7879e597a13e67a109f6aa8423b

SHA256
113125addd673f20ac4ca2cfc343b97761ba9fd319cbb2dd38b6830eee39cf59

SHA512
d31285bd69ec0487fa4d3978926240866a2ddb857f1b3c28ae48abbbc9f23935f69dd7b4bbb94110067529d3a49e5e210fa3fd067c77969027f54fcc31009028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6af5ded5e6bfd379a694e7236c7e01b5

SHA1
f13e5074a3898d2bb49fefa8a1742fbc04d0110c

SHA256
b7b20323313ae6d252cff6a56d306c5520b6e4b5e14170ee9b379a05f8d30c84

SHA512
b126d51ddf9f129590123b34def4fca2c6754c55207718311a54cb877923c69108c343c201a1184fa97d73f3aed4b0bfa48dad70fe9c003558e047ac7a5ade64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7c1b0dad841a5b0032ce2fc9c41ec1

SHA1
71e8d5ed657e6839351fbbf8e64a6dcc4c6b06af

SHA256
c647b843272b132b08d4cec0d1e250f92635b21a08cf66364d5b678001280349

SHA512
da349cca2e20b0f3b04d85241f89e622286f4e8b89493e80b3dcd52b9ef110c0c224404c6d2ce909d79b80a96fe7ae2d543a308447240eb7abfc4a148a97bbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e21c910268dbe5228d1130f5db79bf9

SHA1
a08fed6934c77ea1dab937b89c1863c8646cfb65

SHA256
80258edcae0aef4203c05684fc707b0fc537b049ae03deec8498c0939f6c2138

SHA512
7309ceae4223ee2be33dd4f0650f99f39f1745fb6381430875195244b6932046b006e16a7b4b5fa6d582d999d4bdc512b58fb1762ed11ee39e9198b42b050908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a58e84d4e47282b325fdc46ced297fc

SHA1
42fb9056f18ccc3739564d8baa6e3f663a66925f

SHA256
277b2a2d6033ff917dc86ae484fdef09f7f93b76193d387e1244bfefb1d8b82a

SHA512
123c61ee5ae064e72f459b24a544426fc608cdfbb1f228745f050e0c433c771606141001dcdd84b1eda043f02800ae61d3568858f9b6b3850f785c012983014f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ee421041a8cb03977c4c05eb40f85d

SHA1
4d7c209f0726d8e36ceb1e1be864e9a869d46a44

SHA256
5cf75c53e3be15d51a38a91de0608e4685f8d9424bae5fec1839c2f3f3db48ca

SHA512
f71ed82a65a6b5c1a1342096282057abc4b407fc33933fdfcece927aa5e895c705446a804eccdceee68fe29fa6f1eea00855d8c1a516b4aae758f4448bce22c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9627eb4ee0223b760d0e0d2f9438406f

SHA1
6feb18ae152de1adca33a2f3b05d656f0be1fa19

SHA256
8145b9a6a8e3f575fd63dc37ed40650fd4a8ed69e3073524152165dfe6ac3f94

SHA512
19e8f45143adeb9ac40e99ec22b6d6bddb64b152bfd437dbc3c93f9e7c588ee4bbef86570bc07e081b86871a09a5eb3fed3cdcc410488304d64b777f960b2d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb83d9bf0ca959cf3556f25200f94810

SHA1
c0fff5825c8f9ed69c18e62106cd7578aac62302

SHA256
a5d4707e91fd405b58803b4a0d522a794d86e72e993875de87aa27596e672265

SHA512
3a4895993160dfd7d3343a8e85e4d4bce424c542d302a7db7a969e812229596129bd903c492c95c19124428df8cefaf87f117b84e1cb0db7471fc10ecd3d71ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADCE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAED0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit