fce84d7b88002eb2f67d501d53bfa486d00162484e7eb5132d9e7f7f2e44d148

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a26b54c02826c12637ec3ef47274518_JaffaCakes118.html
Size

463KB
MD5

4a26b54c02826c12637ec3ef47274518
SHA1

f3a1cad74feecff8c4a853bdebeba290de392a9a
SHA256

fce84d7b88002eb2f67d501d53bfa486d00162484e7eb5132d9e7f7f2e44d148
SHA512

2551624e57871866302af8ef1b5dc86fca6475780d44d2971fb57078e2adfe5a69ff3645818a5b5d67b114491eb8e534f7d8e72837ca95c64a289d20971c7be5
SSDEEP

6144:SjsMYod+X3oI+YFsMYod+X3oI+YKsMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X3v5d+X3u5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d5baee68a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422009038"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{163F2A21-135C-11EF-9907-E698D2733004} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c60776c86f0b4479a65f3188da62ca2000000000200000000001066000000010000200000004b1118cff428755db35f579bb31035ee83631b970732ea7163b78c2c26e3c387000000000e80000000020000200000000e5cbad712b9d83f7be0bb300a0cac7d2a68ad40e11a8fe1d7417aefe059631a2000000027eaf8501d6b9bae21ed386a0b6c4db779eb91fac1882a94bf11b79fd848c5fc40000000642c0e116e591e25caea7729d166810e3414df8167ebf0d850ceabf3bf9f09cac3c8b477519dbdddf20619234be33798dde86db27dc8f6710e5db552b446849f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c60776c86f0b4479a65f3188da62ca2000000000200000000001066000000010000200000006acbbe5e141dc9ad65d693ae5b1f2ce752723d8ec86b880e17fae601cebc1cbc000000000e80000000020000200000007079bc4b54d07221a22a53e62ef651faae2369e0c57fea4f73a463aa632dba1690000000f40a5835a9562869aa98c165ea1b1b1db8b4974466119470836ecb93fe58a55ac4044cf4eb2ae8c80c3426e4ac3afc18b890c9816f7d2c57bdd9114dab5fd587a807f2d46e44f433fa3a64ba796a87d6b2cd9913648fdfba66d01f84d4ac013e308eeb03fa7881425a308bbf4b5630df31586bed01f110a74b9592167ad100cc8a67a7e82af48b5610d71a16317647dd400000001fbb380c73ad1189fb98890a8ffebf118d0f8e2c27c4017fa0d066538ec6493182af94a2cf6a4eedcc0f80da72fdabed9ef1055cbd0a1ba992e2f8c900afd2b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28
PID 1724 wrote to memory of 1936	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a26b54c02826c12637ec3ef47274518_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3570ede4749e853ff29918ea474c86c9

SHA1
d59258dc81d8945bfe99dbcc106e207f295ad325

SHA256
2a9929dc9a131bc67e79ba90594a3e071586c3751efca43bf7a1144f1410f583

SHA512
23f0ebf70daa63f5a0f25edaae30abf3dd779510f40671c5c05e845da5413f00d60ad721fb47f208d138d14bc530b0dddf394b080b4dd6dec4d737decd9dfad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a228f2b594062732a74eca09c863e650

SHA1
f87efb571845d07562b968671f985c87c75b25e6

SHA256
38c2bb384b233b18941f53765ed8bd5d5212f96bb3f78becd4663df1e0f925ca

SHA512
009488887570922ccac8c3a676558891d5c263773d719fd2f0e6695c7ea25ecb3efbd1d48b0526c330d644132a8a5a21d248f288bf442bafcac79948a58e8bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3de34d5a2c2e4121d0da68b9d4df8dba

SHA1
912704862a55739a6624cef9436de20b79105a2e

SHA256
aae5d86520420a8f47839c55d5bc7e0966d22ba7da196895ea4cedd105c72484

SHA512
38c9e13ea633d09ecba7c6556eabe38c76ffbbac46924358cbebb273d5cf33aec2b9050a9709d7b9d99b20286e61242b942bb42c20fe49d4ada25ae3e02d4690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e521be79de92cb4e0b4ae7829314a72a

SHA1
8db23c241b1f2d66e66a3d65004131de336f01a3

SHA256
dd800ad562d2f3a2b1222444f8df2678a4704fa2774f849c12a78ab5d28065e7

SHA512
1110c6487996333c9264f35a37244cad5c801f8c057f63793f55887100af731fd8dae8afa0d8c15dcde830011a6f2b8cabd2c075791463d6059c7bc12af4fde9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f611430c12ffa28ca57b67ccdf1d25c1

SHA1
474593e0ee60f12a3fed434ec5b34c8f7714838c

SHA256
0d5b40d2cc098fcdeacadf43c407566f5faa02d54d07a89c51b664159b68d0f3

SHA512
dcf951ef86502aca69d17372d5d23fa5d10c86ca3f4ac36d68ee18e049e0d36cff7dd00a4560be6bd829416e03ed5dd4a14b2cc8e34fc2753796f669ad4c8ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac7a54d685704f596f060f2a69fa3b01

SHA1
b0122e7d0050fa91db7b4050271370052d716778

SHA256
2203c4e0263ef1d385407e1a8f749b5cc17355fea5ccff516f306ec005b91136

SHA512
7ebc28aab918e5174475fa847764bb8478cb919a9bc0ed718dea837f08b8c91b5faef34022641e66f2d3b8296651c4e78eeeccb4239cc2e856356722f30f57c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d71dc4b265b2b42984c8632609afb5a

SHA1
2a86d47813ac5e758d723ec3970ccb514539bf3d

SHA256
0a59696a020d4d04baf474a980cbb77804792218138a5767f2f01a680a9868aa

SHA512
7dd8780ce82483a33e3f0eab88f2f9beb88c9cfdde8fb01c1faf3dee571aea62b701053ba48acee9a2ea1e174da007d2b010467515e8aca4dbbf16ad9066eab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abaa74797e07671d0d2dfb5156da1ae4

SHA1
9ea5fc54fbda54e63bcfc23fa62a1cbd44873390

SHA256
9d9257976cc2a93a2281ef11fb1f974988e93fa3e9e772ebe6ecaee5f41e09e1

SHA512
bc2c30947fa154b386d2408e54326c13f154d90571427827e9132262fd003e14faec6dbe26cee6267fb6dcfac9bcf5ecb6dd95a1364731bd0aa19858d1ef51f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0159246787d3997226982cc33f8e8209

SHA1
00f7295c1e8024450b03381c279a59a09af1c719

SHA256
7d611e461a1b801e0e0bea363ba1b535c406e9c2b6d1bfeec84ae92c4e5b6fcd

SHA512
f64079e25458fd08995f4ba15418b55c524e60c8c0ff39379ab4401494ffe7f5d74071390490ca1410a091e92027490d742479896772160119255534ee044382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d021d0bd115073a01087d33eb99fea72

SHA1
37f811e4dd32f5955f9bd1f00e2a55a9b73fade4

SHA256
6bc1bb0ffcf05681e20ba83b7a205c23509fd5c1ba5471dd9554ed7a9f4775e2

SHA512
79adc0f04adb066a01feb81048ab0eaf3b3a3c098b4f9cd2add6055207847ec50d33f45fc1d2cea11568591f23bc0115524ebbb36e9d9375fdee2ff0f3cbdd11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5ca3a27e1b87f7d20c766e291e6d425

SHA1
a57b110f621202bc2f1d04622b9f5714e8a4000f

SHA256
969e32a19f81b8a3efe3388f403173ee0edd366537ce8a476b764989cf90ca44

SHA512
072554f91aca92782d17ff638cd1846e0e0d02e6cf573f328531ca5f5ba4a37117cef73114867f87b1ec8dbe499a6fac04a551d4332674acec127ec36f2d0bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555abe431e38dc537efbc140d029e7a2

SHA1
c8499b24d043a34f346ca70b21212a9406affa32

SHA256
27ebef3e5ebf36bca27c468b0fd463e8e6e7ac31699893fad73dbd1b3b443cbf

SHA512
432ea5a6c73251e52676866d615d21166c037d583afc365db9b9818e52259ac898e1a3677f2374a0e5df5b445ac04cc4a35e1a95006209cd2f4fc854fd77e670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
857d873e4154258022c219f12184d6ef

SHA1
3264383179cae3065b2d20766517bfa51dd0f9ea

SHA256
a61be86001a9318f4a6d317cf0c311cb55f19472a71ae8d0db23910d29346f4c

SHA512
6cd467466b34518877cbc7f913d91cacc1f94f78c7e55ea86574e62e1e55dd5f7f76da87949715b88c83f5aff8a4cb5b5726da9763e79d68fa9eed9735706f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58fff876706aa7ace820e353de2ed232

SHA1
d5bf1d66cb9a75b36e59f94a5b33961f27f8c072

SHA256
871478b71142e84d950ebe355d0185a707a362b7507dacf48e4b9d9be4e42623

SHA512
48e657b18b2522a6d836118e640d96b6d5b41e82683cd3f0ef68ed8c923057981efe99185bd3e26b927ee21bf46f0ca77aee918b522d1a209ab10b913b0c809e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595d4e26b29220f5d38b634b6ca75aea

SHA1
f569d92a82927975165c2ed24d481212b14e3d56

SHA256
cca845fc866dbcbfbcafe8d4d2eeb1b4b92ca154da124b5d4124c99daaf3d2cc

SHA512
e3ef6678e36ca3c9aebe499f1cac9133ee9a9424b2c1fa6316736c0c87a9eac4ec68d3959f720180140a4923207b2a57f991b6f5f077963e3877a478d38f1c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ffd58be4020df739c6e5c8a4c9d3f2d

SHA1
da6da89acdc0c0cc8541c641cf53049463d4610e

SHA256
c9ee9fe843c01675f0fcf4528ee04519b89436775f34f854340d84a97f743ae2

SHA512
8e046e5b6138bc7a64dcc9ae256296e4b8991260f75833798bd00efbaf3531196fadda275b07cb55a8074a9e72169d7d84f116de36bb4ffd4d4fa0b52f97d052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4924.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49F6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit