599f9cfd662b6674df24038ac2f2ff69c0883763af206b1bcdee1a2aa531a109

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a521ddb2fb89455616e1bf9edbca7da_JaffaCakes118.html
Size

4KB
MD5

4a521ddb2fb89455616e1bf9edbca7da
SHA1

f5d2e782b287abdf5f268c627dc0d4fd8900a1f8
SHA256

599f9cfd662b6674df24038ac2f2ff69c0883763af206b1bcdee1a2aa531a109
SHA512

4a7377a15529577eaac883eec5acd0571563724d1221c051a826459e8f6507cef887621eeb3b55bcf85de9f1e8a50a2ad86671e90da147488e728c38eb73f51f
SSDEEP

96:ziED/8UZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhD3+v9XJtIM:ziO8UwV4GD8/h/KiZwQn/qF3+v9XJCM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000023b4c7581d4ca014422ed11551fdf26db64b361a4b1e4e1458074f7847410ceb000000000e800000000200002000000074306def460bd459b5a022fa38f96ee032e3b19cbe43dcc08d4950e684f3ff08200000002b88795501a4b8c06d3d3d499a08407c2a3caa5f78c89c82d0ba7f896865c5bd40000000519b646ee63598c2156b239e713a49c1b026dff7c38e715dfd1618c9b6dac2987e98b9c0df21b878ce5b35dbc29450e01073e21113ebb50d520ac1caf344165a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003ab0177322f5def9f4e155b6e4f6818fb46ec036014287c629ff0a51d3c64b56000000000e8000000002000020000000cde6b7f0ea695fa5b46d47aee51bd6874f72f71290b94d310fe1e400a80eaba5900000006ab035a209c802863622dff8f9a6c82f4fa329170a162e2b9ea3f43d75f504afaef07ef8e1d57a8053451296ca0c95f83ebd58e74b3bc9af9a4c1742df930cc0daeaa15ef529dc8c76454e60c44d8f49aabb4088bf6ef9d1f6a737f78c096c30717dce7220827d5081c0bcfbce1109b062e1f3d3fa8a7ecabaed477aaaf38417fffaf0ece09b0a3341a893873af6b62a40000000e4c7ffa8db92a0c6913a7ac0cf7fb07cf75d007263d9ce8efdf1bc92cceed1d527fb0e1715e22dba31ea77dcab7a92dbd11b54ba3f624130417dc2d7642564dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40bb65926fa7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422011925"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF10EB51-1362-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2312	2556	iexplore.exe	28
PID 2556 wrote to memory of 2312	2556	iexplore.exe	28
PID 2556 wrote to memory of 2312	2556	iexplore.exe	28
PID 2556 wrote to memory of 2312	2556	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a521ddb2fb89455616e1bf9edbca7da_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b14f528cb992d9ab66f485274806c229

SHA1
3393bf2c6b3176078f07c241a3cab364a509cb99

SHA256
09b73b9975170a87f61d9fb4576ceb04642837f071edcb89ed745805c2f0bb2d

SHA512
7eb69ecef7aa86b176f47ac731a0287615ae125f747665619307739035e6fcff5436f1002ef27663a3789d352209719ce9a88b5ad284afbeff93e62aeab1b7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d26ca0992cc961bc60004d39915e8d06

SHA1
1d648af87e27d669afe75afdec9f4edc071d24e0

SHA256
494f9ef843e312b357ba528f705f2211248aa4d4e3e99befbd1e13cdbf23d4a9

SHA512
df8a217947fb8838afab7e4efbae592b2efe1a761d8e694468e0a5d21f468f7a90ff9da97be0ed618444159ab5684de46cbaa68db876b732f04f54714f50f265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca9632d1e4963088e02ad53315d9932f

SHA1
5380d6111d38072b0c6ceb029442acd29f1c6af0

SHA256
c2a9a2abfcd1969e78e3f2543d8ae022a00559fa69620f78a11d4e2ff0c69a0f

SHA512
27267b57557ff0f8e0fe8c89db5679142d61400e027e9acb38be6ba674f802e52dce72fc4f2a46c8675d80e1b48fd2e3f0aa670fddae3d0219f8386ac3b0b0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a1354d1577d5538f61dd16679c0f3e7

SHA1
f00c9393d78885813bc6346d4748250b8119ff3c

SHA256
61af10af521a455cf7cd1e35e8f15f7fccac5bd8c131dd354b982d80f4061f02

SHA512
686b718b6beab84b5cb6ec84b9c5516d0e65e988b7a2184489a1b988d21c238a616771724c139475ceccfa7879c1424847974d1abf2143e6f7d095feb44878ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f382a1dcce5e1f93624346bd193bcb5

SHA1
16db3415c443e46e7cd17c79a139a9763e0f8df3

SHA256
548faeabdb0a76b94a51d2ffad77807d81c383e643ff188bbd2e89d2372da1d9

SHA512
488ea84c739b4bea49504c1f2d0abb6be3a7b18843988570b6004ca95a74292882589bb3bec40156bd0732143a55eb9b04c8d6b2d736927bff9c5a6051bfd336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51befe48604db4b4a5d4fd9172e08710

SHA1
49dff9294b4d8157a87860a0d28864c486204c47

SHA256
1c390155c0f20f5bf3a269717ae5d0a6d84e06ee61bbb6b97522255d79f15f4b

SHA512
74f2dda7ca7d11c00023884dcbad2e354894baa1867544b782847c5950136e60b1a59609e39dcbf3b2f4fcafc1196b06fddbeb783ac3d950ce59a6ac75471982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3323d9a71267d890517d3cace231d96b

SHA1
fd0d5834ead934c28de8915400b5c79fae3bf268

SHA256
fd4798a41d514900be52e12d8d960dfcdf00cdfb9637f5e7574e6423133ce190

SHA512
aa11952d360365ac8bf0acaa18dc5f62ec658d62e05920c45f7f1841b6b8f298db7d9c1f101c7a77d152f40827617e05042a40f59712ba6772b494b365d6da79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c3a6453860e56561b2fd2eb5f9102cf

SHA1
17bad0e271e23766905c9a8d6cba9cb93404d9b0

SHA256
24d6ab9387c5a003284fa3234ff84646c0a22ce74dfe2f217ec824bb013b6439

SHA512
f5e1caefdd032309d53ef10edd8bbb01db8e3aaf19c530ed840e819f6525334c1c00dfdd8f3823d791be3bcda34d5ca82e2e29effe311e530e8c563d9c882e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54d5c3de1fa9f99b3983ba210bd3f768

SHA1
582ed830c41e4f9e967b43604214dc180bc4cdb4

SHA256
7ccbd4802893c2a8266fadcc422862b4eda0d33a1747c40dc25a2d2a42cf53aa

SHA512
a8347aab3212ba1b9deeb6a999bc8f7ba882fa32d95f21e1020ce45390d056dfbaab9aabea44a2b1d555042329e68179280dbd032ab2f94906cfd516a080cf9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e4291de21087da34e38fa615c40e9f

SHA1
c40682498dc604210b71f4a1af9a0f087a23fabb

SHA256
feacc50517b6ff52ae72fe6aa8d5a7d1dd9a5035fcbf2181abd346877752c8cf

SHA512
b8bd81d429cbc7d2260be9a6bf0a625ab8af9dc76aab2bf0575b9223ba4fd9242dee085d22b7ad671f81d52ab88663c120147687fdb67b4ea2affc3f5365a19b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb625946330b5d4d822afd261f992181

SHA1
f63a7620d1fcd41abdab0439c30af3bb6a415771

SHA256
700f7c95a2b361f657dc9d88c5522ada287c22faeeebbf2727bbc7c202fe8b7f

SHA512
1e6bbc99568f409e3a65d94b180bd57e74731a72089affeb18eb9f229854dc32eea66c8ab9fb3a9edd37cdae0b8293e43c1c0270501bf729063c458e0f3254fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3da7830569692d7a7bc548b4e80cd15

SHA1
ffb90e7f775e2cd066e142b8bda31044017bebb4

SHA256
62dcd2447c326c6f5b94d8d71f2b0142b7f95a0ce131794203317d0556a510a9

SHA512
816d40298b805991977f89d3b0ad91bab2302b7c0260923ca12855a33490ecae755365827042a5aa10be5ef3653131e4240a34e431dc0ad05b3c6dc3d1cf6126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e55b44b8a501cb75e63fd02e3b7968ac

SHA1
a4882b758f1976279d012db7ab009f29d562b9eb

SHA256
bb84d77c279c3fc653bdc4ba2d0665dc80a90e8577449fc410ee8c475120cfad

SHA512
f02080e734498fc8bf722b7496cf55411c17459439d0d40cd2dd22bb02e1353e562460f3d36697390832021feac924747a128def4b8b92d9e2fec410cd0acbad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DEB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E4E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit