8b95f510c3d44a3fa8eea0143a4bc3f7bab94c8a76247928f4d7b6eff18ebed4

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a1f47b4bb68e994b18f138c80f5bdac_JaffaCakes118.html
Size

16KB
MD5

4a1f47b4bb68e994b18f138c80f5bdac
SHA1

211263073be18369cab5ef80e12d4a576a757d8e
SHA256

8b95f510c3d44a3fa8eea0143a4bc3f7bab94c8a76247928f4d7b6eff18ebed4
SHA512

fc9262a13044d5a5b275c04e54e40bed3aaca32b222e1db4c4cea72ec5bb9c01aca54f188e23439237ade60efa0a04815746402f0f9237dff6240bad581a6710
SSDEEP

192:C0MgBEOks1QTxE6av//G/poUaBZf9c9+DitkiqUilpqiemi/0iuyius1iO/izi:ClOkjHav/e/uUaf1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05bbcdd67a7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422008581"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06777351-135B-11EF-8FA5-CE57F181EBEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000952e11a9a3da731640c4362e945054242e16c1a3e94a7efab1282b0f38b56b73000000000e8000000002000020000000067dbda7ec46ea51eed2d491dedb8e1a9f774644429e6222e7ff2254c1604aa32000000093305fb616d94818b049a19a960342d6e721ed6d3cf37766c2369d764dc9c310400000005d590c15bb39e876517ebba3aecd5940f8939d07004b69fc426bfd7e178e20e57d5de0fdacee43efa7d038a1e7f908aa921f038c2b91393a3eecf7422ee0cee8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000942a4012462424d4dff8533187d04a646bbfc1c980303fc006d4a2f9bddcd1c9000000000e800000000200002000000027b0c68097d55d87d9e7397ff1796da7b648bfa714ca660032c85d8b8d9d6dbc900000001f735a72e213d5fb7550692fd8d466f511c512ea6edd5d30ebb0f020c00753c7deeb6aff7610966f5d133cae663f63147c1239ef792d83780966ecdcf1284103a5044c60d53054866653dd46ede90a460413d085007c054ffec30744deb24904665e3de8f6ef6f6b608ae52e2dec7babc3cf277e1ae45195ee8ebc9fd212618e00e1eab50c33ed135b91ff4865fd468c400000006529e20d9d67a7a0a24e73a68745b5cd32e652a838eacb11dabffd622d17a989ebac510bb9c7e871c6d4a0334618dfade87904cd63fdc8fefefa3b30de8816da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28
PID 1676 wrote to memory of 2536	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a1f47b4bb68e994b18f138c80f5bdac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1289b7adcc54a3358d385ac1d09796c6

SHA1
de96804df5502b9d2cdf45e3f6b09dad0ac73515

SHA256
c3df34a1a262ee4fb1771e339f3e4ec1286743879b2a81982d4585bd4b0e86d2

SHA512
43927a6d40ce50c30733fad90d219edd4b56278e020e3f6cc9999141adc1aad5b9ea8513121d93cddb7ebda641366c580d1a5b6c768391de518edd0abe718724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ca83b74daf9e51abd476ee685495383

SHA1
bdc00a5af992e19318a0556f37903a312437c5db

SHA256
676c1cf0b540d341712f5e4215fa6483b7a77a4fd7d12ed0ffdd7dffbfc47c01

SHA512
b8ef30a9576487ee84ec8e73608a060b8414b42259e63d40495b2cdba2e1a158da83e5c1a39a5e27167c01e0a580fd41a71c2e5713657299587a93e169e3befc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ad09ebef6d321e8c9070e029d1401a2

SHA1
eb1300eaaf0bda4fc990d21c90e68e83320e6eb1

SHA256
5d321bd11a7ed221129944c5c2a85c5541493779ab9e6e1587fc2650a342b8aa

SHA512
ecea2ec6515dd5347cc3fa0c6c4dfc7aa982ceee78f01fa950723e87894d8aba67d3cbf48fd76f613fb0afabd763b95ec4492d96e8074658c8330a2d783259c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ef411a150da9fc4bc76889f8b374c7e

SHA1
40331c2346fc0eeaba63ec84bc50baa580e433e9

SHA256
450bc55ee15c4491b16fa3cca1577c371f4c9d39f64293145b0e4cc8ef6edc3c

SHA512
600ca05a9d81aacb210efe38816e7a4941fffa1bca38a4589c0e49a8928691e92994687468ec63bbf35eb30c23c5d07dee4dd8aeb26b79113fc6e1d315a8fd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad3a513cc2ca0403517c8c8569f5e779

SHA1
0aefdc852f3bdb487b8afd514157254501eb91b3

SHA256
4268e06ab3ad615766b248b37518abcf3fc6a5421375666df72f1a29c7b86302

SHA512
52ea310c729a1018c236ae14e24e53598aaa2fe187c1cdf7e12120bb27f972d9e948eaee5c728c6e55a258571cd05eeff1c57f7a551d45c0b0e89d4710950125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934477b1e51f4e1d2352b2d94eade045

SHA1
a1f658e2c18efedec9f5ff72eff0ddc46d3e51b0

SHA256
ccd0f5d879f87bb5af42b91e5599a742906792122a71b8dff118de49e53b8789

SHA512
097f2db2f7933ee65bae47f76732beece2ce6c7e8055c29a9c322c67baf35db03ea34ff4d1df08836da72993b007513c12e5db33e90692fa51cdfb0db210542b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57d504fa7fe9134e00852288737adeac

SHA1
3e3fd58aa278c71c8f4a75f7a9d0589bbe6bb171

SHA256
3ffad45bbc5ddf5820258583f78f7b21b0aaba614d44131559a4672f54a33a55

SHA512
329a4b28c75d16e28bb2c7959d066e242ce4bf188d8d1f1427d4cd3525c1382e56d37d62e0b2d9ebc5bc613e23549fb4bf583e398bffcf0099ddd29781bf85e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4d6988c0dff449a42d0885291ed9a47

SHA1
1bd3936d8978eb733516c3abb63955961e7e1f4b

SHA256
ad372afe067bf9969285da333cc7e04b375198602fe9f2b3b19cfca097290372

SHA512
55549694b635bced0db61250b4a85b995ac6e89771e65168fd0637b45c982dcd82607f8fd37b73e2d603af02f7058c801132d691f0cd19b66ebf65750281fe76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637d491a9d8c16b74a8300643b267ae2

SHA1
e4863faf7f6f5c49b079641c8c83177ccdb6f359

SHA256
23f049fd27e6b367a47effa2621e5b6b2a24d5539740a1f3519f0aab4920f46d

SHA512
c2a47d5a4423f796245f6360d98a0e2087d7cfe7b401f8f7e7fe894b5bc1214882aa793f2a00417551ea37924e653657acef2ae33355d6ddd1b4e5bc69e3c8d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb23836fd4a331e612b71f9360c73d21

SHA1
3b2b2c9fa2e67a66d7125e35ea767893bd59d478

SHA256
04dbee61319c969bc382d787bad18d403c80be08da0a991df59ecff2267b8071

SHA512
40b4bfea364c5aa3a5de1b520c6ef3470bc8b0df8ba39ab59833ccff47d31d64f9d11ef322883cb3f2d24993e7418e14220297b2d5f78f532ebd01924121f7df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0ecccdc1343a8ce6057aa599d71f15

SHA1
e187b3ce4cabba7d70e94e701e4e32dbb1906a16

SHA256
26af81d00647568c75ecc57f062d3df62153effb38ca9b8fbabd8c4ea9ed8e9c

SHA512
a5758a66fabf0f9ecf9de98c6477c4941bd59a45d54e13c9a703e0fcb691f3cea0a38f2253eb3a0707b08fa0d19ac96e987fee04a6996101927f48b4d3d691f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97088b561a12be129c3477f54f3984f8

SHA1
06070c3e4b037e121e26f984463a6bb10a0d0183

SHA256
ea29e436a856fe14491e2c9e0b7914de27c4a9115294b3c0480800f63b42b4a8

SHA512
342608ba34b2358c3f24b79ac4ba05927aff3dbfd8673349f3828feeaa1e10e4132afe640cd71e76242fe01c46c521cb1a8ee7a4b61d18918e6b8ca0d750669a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
329e958964dc3b91d06a33c8ae5736b6

SHA1
76bbd5a15f9c1c2b8fe7fbead4f44f63d99a4dd1

SHA256
5eceb106fd82992206b69554620259098c92e0851800d2f34f58d4a76ed0baeb

SHA512
2e0dd81b9b7924fc872f047f5efc953cf6adc14194e4f20d8c285b3e8483527c302a3cde13150ffb2e5c877f05ae55c9f7cb6bac18e7a304f03452ef190911ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
066ae73082e287fc0744d238b4ff10ab

SHA1
a85f31a501217d16f503f6e53bccef745c13b6aa

SHA256
059506746217bef054ec6a89a3308338dacb9fd337650dc79d85d9869a1a4ec0

SHA512
a5c7ac9852c91fd5a72edeb2a93fdcff0d05fd580c080351429ad11f31f6deae229207fc5402f59fa659614e9f7bbea005bcf1f1e95678191d27a6f1d9592620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52251d056f7d59aeef026cc95655ad63

SHA1
1cd351764d9ea7a033b4659b9a583aea79a4af5f

SHA256
7bb95a56b6f29ba9c1635e27c92241dafd8ad49aede74852a91b27010091587f

SHA512
f5ca5ce17ae6d42682859d3774a01f86bce948b45577662d3a657ed116475fe7d8b2e203e6940f059dd76602a4862b4622ff99d17af982c642e332706eb39705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4425.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4485.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit