a084a2872b51ec48f16ba951062db8901933a7bd2008816ef8912539aadf6ac0

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

499f6649a62d7a42791bb3657ea9de29_JaffaCakes118.html
Size

25KB
MD5

499f6649a62d7a42791bb3657ea9de29
SHA1

d3f69b248ad36d20cf2042b2dc47900653b92e1a
SHA256

a084a2872b51ec48f16ba951062db8901933a7bd2008816ef8912539aadf6ac0
SHA512

85c77f453eecf8ee3729bdea0da643032500fd64e4d5a5ec6155df70777ae2dfaa6e367229a5aaf5fb31612307eaa75401cdf50a0015d1beadab42a9aeba3c91
SSDEEP

192:Nago4br5b5nOnQjLntQ/ZnQielnknQOkrntPMnQTbnanQBYqCzAUpdENwuXMLnF2:AgoQxQ/IcfL8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009fb8b45f17caf4d955a78cec50cb613fe09e058bef2e842e64827f7bb096b917000000000e800000000200002000000069bb40ac80c8f9f49755bc5d8e8e8bc884ea2229a15fc7eb820abdc65aff1ca220000000bf6178fa657f49d5a422dadaa26f9fae05c0af96bd0f02c9f0c9dbf1471635ec40000000d55a7fdc7ff35d217bffc450a41b59a9665eb604c729fa65b33550f16287304f71dd1119eff07303c3239a3175e44ba3621c1bf86803c0b456fc3a5b0ad0da50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c5ab6ecb130a596c6245353fd245f000fd4296f7de1854906918fbefce798e19000000000e800000000200002000000027393911522cdb2c2c5f87874138b05490c4288c9e57ca85ecb7a3258ee8f30c90000000c8e58e8aa61baaef667c4adb661b9bd05482f1a0679c93fd23794b5263148f529dc50041d202cc37d22151c7dce4a5f48889d456669d98313a95be033191b6d2e841530daafcb8d96de618d3030d964971996dbdb1da61f4411beeb30b8a8b75a2b52e3b3b3b344c64bbeeb98983aee9de22c719f76b209586f254c00eb9ed9ea2e5a5a3567ced82601f01a34995a1e3400000008a1e220def048e2063b0a0b8e625b3c05c8073965b1a3a4d83d5269a578ba37b2aa6a56bb577af0b8dea6296a0afc23ec74e86b23e3941d1f33ba07dfa57eb30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B744091-1346-11EF-A4EE-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421999732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20094c4053a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1272	2532	iexplore.exe	28
PID 2532 wrote to memory of 1272	2532	iexplore.exe	28
PID 2532 wrote to memory of 1272	2532	iexplore.exe	28
PID 2532 wrote to memory of 1272	2532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\499f6649a62d7a42791bb3657ea9de29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fafd16cf63d2010454446d1865a1f64

SHA1
8d8607abe059919b15eb0a75373d736edafdf6d5

SHA256
caa2f90f85ddd5fa9af365f5e33ccf3f9f8721445e4fd6f7b273470cab359784

SHA512
09a7a766ec9489af1e83008e6275ee033a4e16b7d93c1cfa70812e03b48e91fe46269abe6a37ea791d1f9bbfb5e47812f176cccf70f16ef77675afc1129dbfda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3348f72ca00ec358086c95d7ae5989b

SHA1
16ecd258ad7ec59fd00b2beb476f7cb23c193dc0

SHA256
fc83a7dd38bd5b514728264309bb1fa2ae4678e0d3c57212c5ee3f56e1fed2e1

SHA512
e9bbefe2a0ed5b852b4426772230b525536e4c8c790c72a5d4aa389be6347233c36483b2db132c4a2a583c0927ee07ff358357639022c708df2c035f0eb6317c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f3b189d31e8891415c1f65702e03dc

SHA1
6e077944a50abc5b6a49a4c138a379670a43af03

SHA256
4a6c463ff82bdd01225588344cd9f5d81d6ab45b980cab62cd4815704b97482c

SHA512
e05a694cfaace0f411339610c30e7aa9f80992f7b1e64382bfad9c6f77b50a80ff9b699da78eca57cd32f2cfa0991e6a36f0dd3a5d954b0b5593eb2139a831cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d32914df59730230d2355af453679c

SHA1
c78dfc20ff9c86e6d46585770babfee5e75b45ff

SHA256
6d5a86ed6f2fbe70c67a71cb7ee71d4b9787a648fabf4c22e34d3f2fe8c4cc4c

SHA512
70031ed1fffa4ca075e99ae44eed4e9261b31deda450c87f8980634fc2912f6fcfbcd7c100c5953a0effbab62fac2d843cd57e87a794bf60f45fa7aad3c157e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
813b9b9b0083a8b46c67aaa0c5a0ac62

SHA1
ff74bbd9cbf71e693588b00b4e524703458e8024

SHA256
249a64a762c270d342241508ddeb5ea1b4546fdc74ec4c48170e24c0885a7997

SHA512
053e78eecc3814cc5369b98ddae984a6eefac3576f523383f96f42541041992ca9c2187fa2403c1ead0da27a4576c8fb852207ddfc0c0cca167a6e4917950a07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be0f96b32641230f1459c3317ba44c5b

SHA1
a2f4ef7d01124c285b0dcf0d4fb586e799e5d36e

SHA256
cb36d62192b7885e8419135bbd2f002ab22ddeca82cb3bcc2f1941152b6b49a6

SHA512
291643036457be3388ac91a90e0d50c1b839d821e326d9d5325f57eb2b50e2fd530a2484c36a64068c81853145c9208f5eb9404248a51a8997fbca31169327db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29eb0eb44adbadc6da75f465899bc0dd

SHA1
04c2b1f7f80229fd3d452957ddf0b0dd6a840b37

SHA256
2510349d0bb93571d188798501703c338b1941b7a494f1e697acf476a6eed016

SHA512
77e10cee8ee75946b5127572ec9de1030fb13c15e11d8f4f7e17ec34a419523c396782b23f259923a2288ce82ad2f6b2b9ad7f7f878214347e04a108046e9479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50068b3be8f0cd176f829b643c7fcc4

SHA1
532ea0e67ed77307a9d3917da97e64dd12f18743

SHA256
3777b7e113346af592522edd7c4d2709b6b50e44961e9fd363e412cf11fb190f

SHA512
d2c353bb6ef5b46ccf18d71dd73373fc0b4a337bc548767675b311f29ffa4f1c30df99365fc1f9f0365b6e103e6423a7b95a2469c4913a3a7c8c0dbad7b1f3ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c61dd17c3d2968d3f62fb145cd4c3bc0

SHA1
641b8e25a615280927ab3b2d3ea1b95e00abcb79

SHA256
d499c34eba4bca0ca0ce68fb2d2f0c6e60c0b5fedbaea5ad8d2d10c7897d1989

SHA512
e39a4d9706b44e82cfe7598fd981a40a5b769542229dea9c2612b032b0b81cf7796f7ccebf0dabb272ac454c597a3bf5e876ded7b1a7a57bd3d11b251f9c9ca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6734d2bae69ecb6125e6533a46cc0eb

SHA1
f19290dc108b97abae1c7a75c358825e19c6b072

SHA256
31b77d70e06085b48e1eac3bdf80fd52ec743063847820d7b9e23b7ef7ae3847

SHA512
510264fd1df3add117c8b52cae3904dd5b6d66146b504248ad07a355a30dfd5386ba1511a9660f92f472aae4d76e6c132eeb70d38d38f59c36236959466b2dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23396b43e5ff9928f1a70f270e672291

SHA1
7d96ae147d8690355c92e3e7105f2d69c62ec300

SHA256
10a9bbfe6703d1516b3c0f343615ca92d7810a4640a070dedebbbb976b33d168

SHA512
afb9d2cfeb55d6b0e7dca9a886ee621fa7d44391bc5068bf47165eae8eaf91acc80f855ad7fc764f743c39111fcc3805638607a8a8f40958a3257fa234bda429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7857e8946fee3d3ab5eac8dba6f07c42

SHA1
14d339c15763da25303a82874917b840a8e343cf

SHA256
27195d77c38fb0da275a6ba0559d0532f3952840d6750d87e6ff4234a66039e3

SHA512
8b43e6676df377aefce83ccd76aa4547764cf65fa01c5da3b3f69218166dce8079165c59d6e91f75714304a95ebeff033bea4a7050a198087765c8108e808fb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046331952ea58173254869ac29dc997b

SHA1
51355c92bb48ee5ad6aa3cef33db3455622f639c

SHA256
5e31370fddf55b0db38a7660953fcbb71a55100fa9fb5785d03041274f270735

SHA512
e9c3c4e9314a1a58da5e8803510fae381676c31151dc8f39fddfac37d71f7b434b07fbf8e00140d7e0c7f01194fc2125d82e9b3dd89803a360ab5c5ee7b9ab82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d48107720149828b703a29a67910f208

SHA1
a31afb8a23c4e18522aa56aebc64cfbc4c684f46

SHA256
6a87c4c3d821783d23b8585e2a3c5bffe6b0ecd1aea83ee638fdfbb2ea7b674e

SHA512
31a3b14ded6af78c9ab603851e5797b9917a949a6e79bb68c3fdbc020cf59599a388fb1ad45dd7642f312a3b2f4fc53adb145096f364b7478d71f9eae83c82ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29B9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit