d0c195e826675880db03ebfe18532fb9f9b5f5813479a9b5ba846306bf42b3d9

Analysis

max time kernel
136s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
Size

140KB
MD5

4da3bdc51118fe1145a27261c26d5551
SHA1

db445d7c09cd7d12993427814f6ffceb4cefe162
SHA256

d0c195e826675880db03ebfe18532fb9f9b5f5813479a9b5ba846306bf42b3d9
SHA512

e315257ee2c8c13b8fdb55cb886dc8077c1d952a63d932bf9a48ad3b22d3d66f855b47894de31fd61c820fdcd11f426c2f23d543179425da6d97525624a3dab3
SSDEEP

1536:Smb9pFOcc3lOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SmbjTyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c5490ceda7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005a3309d121b05a834912ede30f6e938b007d6119886bf75258975eafbb749d3e000000000e80000000020000200000006222218e9ea19de103669fabd84555331b81863beef4c8c285964df08046c40a90000000904373b0b15239e231de5433fc1738bc6760432ef27fe5cea8230599a3a9e6b468db43c8949f166dde6b98e63f648a6422659a099c844bcb6e9344d23fbd205558e777354cb0b21e5b55bc79f6a3163d260c906dc7132ab0ce4764515eab197d36de4cc4447c7414a5a21911714aae26772c50ab40a3432d28af385ae7572e23daed2424b9d501cdf84fc0b33cd674c640000000d4c7bf85316955b2c3f0f8ffd1f9ab10946d17ad0cf8abcc95def61ee402b9846f2cfaac6fca8dea08a6d04ab8445e37316a0f239c90ab3a1491b33dbb7cc42b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8AF1FE1-13DF-11EF-B826-EA483E0BCDAF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422065682"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008a2b942396e2f41e53c83c71fdca29206796eb274a0a124571e406df27a6fb09000000000e800000000200002000000008cb1377d1ed033b5b09a7aaf6b2535d0d3fe74f0def36fbba94c7d8d4dd743020000000f364548910a40a2194ad0db568cf2eec3377c92e0e7d915880d693d897e15e6d40000000a5874efe187416c251353f2865a3a3408337924f0fc4c96c1c00456078e89cffdd430a232a1ece6e69a9dc120c9632654084f3a876748eeaadfa0df608dfb0b2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2132	2956	iexplore.exe	28
PID 2956 wrote to memory of 2132	2956	iexplore.exe	28
PID 2956 wrote to memory of 2132	2956	iexplore.exe	28
PID 2956 wrote to memory of 2132	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df181b2bfbc9920b4181a916d07108bd

SHA1
de54387e828f04fb8cdc561363790de8c7d75061

SHA256
5bb888afc17acb9f06de0fc51f00c8c1e3c4a2fcc8fab5f15addc89e58e2f1f4

SHA512
ebc1a141b39d8b3c18ab0600cc594fdb13274aae63d89c872e0b0f6dbb3f1a185199085a3d2ed6d5cb37e2b32856a355bb477f993d1e1fcff070409f60473c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
571ce30fc40a76dc3996f397afb1111e

SHA1
0a5cabdcabd24a099a0ce78f931af2695b771eb9

SHA256
12f6e9621e0bc76761171a27896f19a1e5854926b0b82bc6ab400fb7d9025c2e

SHA512
85cab4d4c3c1b8f99cb620cda82cd24610ab2af8af46b3518eba34f6036b61f03dc5fcff382d1187509f56d66d91bcd0dbf9a276afd255ce1dc9ffa3c6dc0139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b1bafae01a3bf2d011927d3ba951b30

SHA1
19f4fe7cdd250fb18a16a3d1378a23eef77207c0

SHA256
4f0a877a2081e7e47331d81a14df1dcec3f06bb45d108aac1ba27a27b88b465a

SHA512
179c5343dc1e760412b9e1916def166d0db44e8118c2dd830efde1660ab5a983ee712565aa90077839dfab068c19052b68df8e8ae8c730ff194cd1298f2085f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546548673d5f076bfe8cdadfdc6c253d

SHA1
018fcc0a22838148f0e4351860ca1b109d51a6d6

SHA256
7a8141cab78d173a3c4bc55cb061ad14f39533d8ed5bb22e0d1a847a1889ba6a

SHA512
630e6d9e7b9f5391b96305eaaad6abd1a1429c475dcd124deb01aa3cf6b7224fe55dae3a48ee3bd364e808c26017a8c33a93cc2cd0d42a7ebca5991a85ab983a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c13cc9048dced616f82acde93fbfbf6b

SHA1
ee15e0b9955cd1c21a82b5a3759a2e492c65deab

SHA256
52ad0083d74da09684cf457c6d0ed13df3a7e8dc199dd124da03442064261039

SHA512
030f7988ff44f0c05917a48ae4cce6ecde4083cb019e898eb9d6aa2c3caf87c2d377b159d899ecbec7174656547d11eee02875d61275c0a83d623cf05f30b0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d6c077095984f4529c9046f11c5790

SHA1
123797466ce0e8b967ee1328ef81c2532c62b950

SHA256
f715bb1c71d8085c8e2810ee1e37d3d2a55b49be14f430a9472580eaffd43d14

SHA512
53adce6b450b6508a4b45772e2b9b7182f59abf6d4de499b844e22393863641a15ed2a99150525d463979c8f1d09c3d265bfb7aa1bef11d8cb8d46fc95d7cb7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d20f2f791e2654463a625c0e5d4fab5d

SHA1
75c15e0507aa514c2d794548d50af7aecd9fc75e

SHA256
69e0b0e07a8e027ff87200b62b99ef7de9a14147e253a641546d703344ed58ea

SHA512
bd68828bcb9dec885b0dc1e4eab67c73ce0002ee7c0a5bf4392f7fdfe3b8eca6743ffa4f1512b5548d228c69b941e049d3f16bfb040bcb6becf47374df6da7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31abe5e7917dee7eb885a13854b0bb17

SHA1
1b4424fd46586c7f94694462031732c4ee841e66

SHA256
d0e5a3fcc87a8b656e8d983d15e313f4da36ad21fb7c1fd0e425b17344f5827a

SHA512
c2a29ce1fa1830464ad4a8e19eb126dbef8ed81e7d0acb82a4c4b5719af2993c3578ec51ebd33358ae854f6d5bd0c4ed664bec49cb4e2d18bb8721a9e278a237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f292ae69051a208eedf78c763cd7c5ca

SHA1
a503cd4cb09a1087e4fe7a31797a9865b807c340

SHA256
7ef668397be7910a9b778e469003254fd0df8679ac8447f4c5a3688b3a036df2

SHA512
9a730dcca81feb981c729dcbc4902fdb28c3b32064934e3b4a3aff3c303b592e6d02607af41dcbac21f701955556c0d2472fd4ac92902e1cd556d0bde984a40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dfa7e81e5893fc0e80183cdcfa382d9

SHA1
07d3b380c2a117b2fb787fbd043feba45ad826ca

SHA256
771a422fa4d79eb5cf6aecf2ef9e3f09edb1b9392dc35736f99c852560cb7644

SHA512
4c9e3dabb933a194bc93ac65fd70ba32fce266c54bd48a1434c08acf56576e858e72868ef096cc3e972dc255d91fa1f67d09b6608cac83708f4f5fbd7bce7b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92f7b6d49b85f1a385058b2a869cc317

SHA1
fc97f6e39bce075a752d80d89a48ecb949696fd1

SHA256
b692ccb5202f736f4fcaa8596c68a902c6911d693d72e305d8562c21a74fb527

SHA512
a5b0a26e2c68dc4ec5fb523f3ef88c8e3f7ba7fc30dae201af36fe028487e508a6852ef33ce3809bf4b24e6f253acd461143f4177d915f6d4f8a7dd4d0b7cfd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8275879f0d65c7b167a78160636904b3

SHA1
953d7a97713bc60f0278796e4fdcd57c7f733051

SHA256
812a5e34a1ad33f9529cc0c1c9f6759b5ccdc1ec05eaeef5210b757288681f86

SHA512
b1b2474d930336367166f3aac8e1aec183727d88a1a1cb8fe12ab65474cba981ce783c89d75fd6bb7d007ad2a1af7a38456a886294701332fb578c6095df8123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57854fa5e8c8f64be3da19252b89ea2c

SHA1
34362664dc97e9914627f5761057eacea3ded12e

SHA256
d939561884099eb08e47b86537830362ad8ed31888646a79d9e409412e7ff892

SHA512
dbc2c349f2a2a48cee7e3841b63e51a7e42be00eb4b5498c8743367da07d9371b848191f977e26db855e460d8d97d927e028dff95d56c6234a758cf20705badc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a186c80b95eb6a9ca7cbd5098a8ace

SHA1
29968c186fc26e76b95e868f700c0208db2658b2

SHA256
2db57a04e9f3d0313f2bcbff114dec99a618be85d7d29b12bd88e7561f9f5fa6

SHA512
9a47c06dc8ec55abe45f449062746c9fd04dc6219a96418723d6190b3b919ee03f48e018fecdc0a4051cae4225d1d9b7a9fe84ffa06d8d186dfcf597fc4cfcf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2017.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit