93d0dfd3369e42ebe3843a68ea146917faa8a3bc5f927d76ebb0158f38f4c8c3

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a1b16135f0c394ad4cd7417479da71f_JaffaCakes118.html
Size

213KB
MD5

4a1b16135f0c394ad4cd7417479da71f
SHA1

209b87917c881b42f51f740a218c06e612a12866
SHA256

93d0dfd3369e42ebe3843a68ea146917faa8a3bc5f927d76ebb0158f38f4c8c3
SHA512

e0c805fdfea08920d9dc6b28f1e60337d11a00a9c7448628798514ae0aecb54999159c22cc1339582cb8571cdf70669f3665474bd402d36f7007769849406909
SSDEEP

3072:Scl429uhYxPqyfkMY+BES09JXAnyrZalI+YQ:Sc/FPsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422008213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B233231-135A-11EF-BF51-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28
PID 2984 wrote to memory of 2916	2984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a1b16135f0c394ad4cd7417479da71f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbde5d4e4c7d68fb03d529fec9277546

SHA1
e59cdb18fbdcdbadb3d4d0da8f510d91d78b0d47

SHA256
8d9ad3946abe0e9b0f3d46d2cd296d44be5b97c90039ee55b768c3c267f2b3ff

SHA512
50cf240877a46566cf7d50ec97f99bd345fc50ba4c86d61f499c3860c17d65b3fc32b7d0497b93c73dd24f6fa0ebeccb238d54f5f946fadd04b384fe2a9f7196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8a26e609f1dc3a7d12af311e000c08

SHA1
b12985dbd4f4b90ce58d9cac9fb48ca375bfbf75

SHA256
9aa31de4d74960b10119ef25e46f64bd44b8f83864f2b2a15d79b32b155d1961

SHA512
0767501e8bdf3fc7fc3b2473703a3d5e2ac2c021f2e416ba4c3c19a34a95c2e391f84cbef239e6299203380fa83c2fe44982a97e8fdf4b7220c993a1a70405ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
882b4280bbf20b6306a6ef94e5ba17df

SHA1
a858bba9b556ee96f384819e419bf050eddd4266

SHA256
cf0b43efdb8135f47942e5fa5787ed1fb668e4ab694d5c45c886091c3b97cbee

SHA512
7744090a0d5492529ceb5f7a3c9e88e22bd924511bee1f77d5f3797045eaf20ce2c04a852999f994bc1946265fc8c177c4c0b32813fdcca7dad62b93c2277e47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa015b7a70b95e085f27d64d896b547c

SHA1
7e68e44160d1bc814ca32f33cfe35c4c6ecf1538

SHA256
ca763be66b0276a2a77654a2d76a8dcd24b027ee4364c5da7493649b798d2480

SHA512
24979e5582e6077a63804b87ea3b5a358e214598a3275a4b39bc0ebf458f5fdeef96050c51d11819b83b0f34c43962b7e02e791e46ce7a10c57749e01bacb1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0084982c328b753700ef567b98b9d7ca

SHA1
08fa5e5de232f64686d3a660c3d18c533d6e14f6

SHA256
66b79142dd5242448e294a08c85ea76d5e30fd8498ca5aded3c89cca254276de

SHA512
a1fe11e23729e285d221f3b243b126842c6241f8dc3d7ca82c59f18843ce4a967b555e37538c9802884869fe0c1f90c991f47302d5b3e5f85f6cfcb74bfce2c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1088845785e87d9925040898cf02ada4

SHA1
a6664aae95e6cde9508813ff250df0564604ae36

SHA256
961b66ca31438635f46e4024c29946dc16aee9c36b1b989d63f7cc9de0c21d78

SHA512
a289b5e2961b7f3df29aef464e4d6e4e6a3620cf0bd0e7a827cc6acdb6ed82ee9f5c6da5d3a18edf5a8b09a63ca2a47bcdedea958b3793ebeb8690bb01cd95d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc554a3162afbe9a1c2d57ebebe6b7f8

SHA1
614e616151bad0bba9299b93a4d7114e568626c9

SHA256
08e8ddd935810450278d5702aa9a4ea5c27d97fc3c2038b4c6468578ae5073b1

SHA512
ce2ce7418e8a6af4283e20fb6eb2887a01d7aef44852f926b4627d6b4fb7439d5405f593d553509975b68d6881759743c8eff30c2e5470e6e0f0154419e626dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9351ae42098b3a391775e73c82e8c422

SHA1
e70641a98a52471e3fad3567bceff55f4ab08219

SHA256
e539f275f3be13f826ac281112d82a711cb45a8c4a1b51b552dab7bc9271bd71

SHA512
d2d6248a8263b197ca3150db6c0bba68afd77fbba52bde9143860465a25110200eda587d150c6a838d93c0c375705de1ba0c25173899a653ec110a40b8feed6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
039e215a874bfa5a916fba925be2dace

SHA1
47574859404c82001385e0583556cd04e3de9e61

SHA256
aca8eeb33e54f859da19b8e9405fc90e424b561e6f306134d7c5b9e9e76dbcfb

SHA512
1144e5b1ab99ece81c83b0386243d29c13af44eaee98c197121753c76cfbe1ded4120764fb0aed8f84abbf4f365372e8c66fe70a39e57c72f7b6e7ffde2e0bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83b30f009e8314bcfc46430ed5c014c1

SHA1
f53f219cd1d018d24f8351d1757d2b752349cc85

SHA256
97dc71c36830930aadd3a3240e181744f00b42a722bafb5066d378103c51d970

SHA512
38979fd2acb0f9972f8ceda053d36f5763432cf24f7695536dcb3675c730ec13ac1781a57741219c6fa87aaf4a09a43d8bdaf178a7e8e1dac246fddccd218f4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7ec2c079defd3b74061426a5a87a4f7

SHA1
f6ce8bac4161d703501dbfa22067fd1b81016aa8

SHA256
df917f0c9ff4eb358f296eac81a5be0c1a69066ac554a78d6f80cd1cbc0b1ddc

SHA512
f1afc682ed50d7fb898aa7c204af88e3fcb7cd90f1652738e9f90f6e586760f1e1ff847a5f3aea0327fc62d6d514c55890e65a96bf6352269ff863ffd77afa33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c694e478070b2c4ac8d317c7326841d1

SHA1
fed1aad5753cd2f6d05b2600e839eecebbf36476

SHA256
f30af77f3b5e5698d4e334fdf3c82ed9c3f7160196814dc938e6c1c41e1b34b1

SHA512
6e5d761063083bd5177b39af45bbc010916ab205f95e2e581b186e7e0ce49979d0c9e3503847c5dfcaa676337dc0348eb815be728baeaf11656cca9362449afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5508c7466b15e48aa14a8d3100e2b80

SHA1
932f083f2c5f77ca04e086db4f447a325d96624d

SHA256
b5f35dac56507f685bdd582a0f65d7a2fa43fea966b23e46281c1e4b655b8271

SHA512
a7fbbaf009a11a0cd56acc08dc5e6c2483c67f4a8eae3b2a141a05cb21d53adcc0c051417ba5eda99b616830ffad3aa62a8b414af0e400b1dea15e21f2b44685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d698815db3583f9b17b40186e070ad39

SHA1
034c0a1f362832ac9d359540909ab22515aa0d38

SHA256
1b9f0c5db3fc66a0ffcd844225554c80f87fac83d686b5eb50b3e113a51c9c16

SHA512
c9ac7c93a4475d18ce0e845e69c05e25f9a8fc6edde5f65dc269ca48248d34c1d5be27c4f20551bce55574c27856da35ced026e73428fa7d01e75e3fc52ed14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2540272df711fa11ec21f79f4c16fac4

SHA1
5f74e272d62a5b44ce4df6b1c0acfd51f0c2dbc1

SHA256
7bbe70b0761dd4ab2c33040d1ef243e69a20d0f259f28887f35ced8acd452472

SHA512
ecc09204311503727c5fdd064b19d5681b671bf8e89f641ee24d9dc68a0e358c733dac9a6cf947b246957280034192e417628da4634aaf0fd559117a9a17a865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcb32965046024866365a8478cb676b

SHA1
05232457c4c378b56d72cb28506cb0f1999863c7

SHA256
95c97376d18d70380295bb6e974939436fe8396c354d19d34526766933b89eb6

SHA512
56390039722ea1c50bb3e3fe410b3e106cce62afb52f0ce7852e6c1264e29d40ead41bcfcfa7da809c00e3982283cd3f7b87d70ef8d04c0332ce9f397c9ed6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a644a8813b7af26121b26e97d49a5e89

SHA1
4096896eba6f092aa3ce3a6dd937db2fa02de817

SHA256
af324700991312ae0fef63806240e11234a0be99201a0332f5d0c9fe7377c1ea

SHA512
131d008ab442c0d082cc272df35542d761235bf4dcaf94749620143b6ce5775930c33e0df7b4a1c83dcc4589900f5bab42ac1dedf0b731d1481e713f194b5b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfbba08b7f406ea7b3f97742314a0170

SHA1
7ac60ad0751b450e6dae5b8876dbe1e028d7787f

SHA256
b17801f09c5c5b9e4f42182851eec4883a79056cca2b6758eb843e0dc85b0c94

SHA512
d07cde884e09f5afa9e4d752db6617981bfcccc74c8008b74be0aeb9c2634293d84230c45a8b20506ebd55b41cc86f96f701f45f31b47133ce67f96a03302273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9df1d0be8e5570360ca34d276f6ac712

SHA1
99f6412ecbacb44cc8156235e0329373eb9849d7

SHA256
c5eca4f4aee264846633a8f4aea5ec28490da2a17b6fa85ebd098ce9cd936315

SHA512
f5a63aff985f01d21f29fd149aa88b2f3f01722dd5850702b5a7e68ff4bc559710aefc84309424af112d814adabd799721f2f408bc9099195b017456af648358

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2187.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21D8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit