4c09d97ead941cb46ece9819d9056f55baef85966ce7a74ee9533b3f9ac2a6ce

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a7a17be7825dfed42bbdc66c041374d_JaffaCakes118.html
Size

96KB
MD5

4a7a17be7825dfed42bbdc66c041374d
SHA1

fc5ee0b0dd3f5b6f391c29bca6894a5528736169
SHA256

4c09d97ead941cb46ece9819d9056f55baef85966ce7a74ee9533b3f9ac2a6ce
SHA512

a515fc501f80ec931d6f87e6fea358257c2efaa7658755cdcd49b8ddcc17f96dd1a4658f215f762ee386d13b3c0d97763cb53b6ea86c8587ec4286f9f91f9ad2
SSDEEP

768:3702M6oLl/NulCNihiIwtfF62L4ayyWXUkIru+UFnwJWBX4ISp/Qe+vk:3708oLl/NV4ayyWXU8nwJWBJSj+vk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008ad6bcfbdb4270db9ba572bdd54115d6bc4afa0b0c1619712080df7dfd514a2a000000000e8000000002000020000000a0d876873f3bb3cb84fd5797dbe150a8f0630a25e629406af64e7f7e6e877368200000009f85c49e33a717de791829e2e60baca3302bdd4b8185fa62c79a7b621d9e0dd7400000000117f8843ed05c92531e8f2b597fa52eb3d3be7b21a15bfe0c3f2ef7406679e3334fb3d64761c41363b5ecb7aa58a614fa0edef46a6c86c5db289a312a045b3b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a011e55076a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62483581-1369-11EF-BBEC-C662D38FA52F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422014749"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000047ccad7a2720bcbd7939c6c0f184a669858dc40d230cfb19916686a90a5c1310000000000e80000000020000200000000ee42e742570e3f5929561944e97ed3467a541a016fda9b63e26d6596b07cd4e90000000855b2d8f31c2bf620a2652c92b4312fb2f074f6fe21329ff70fc5b5cc208c9000a62f5a8612c2aa5e1673a296ceee89a206f5800bf64ec68071d99bc8c5357c4dc7959a7d008da522f5a7f46821ab5b47264056ec838de7f9674995a17efe52de8845d7d15fdf76b5efc3f66866759eebbbedc563831124cc92775584a7bcf56df8cd75877b9a26ccbc69ca9db2ab37b400000007ca707f9bf289dfd7c9118f68e940c2ff88a5089ec91fe41a116e9f07dbb09e5280dcfed72c195942df585cf3a8797a2b6bce0959a409059a6e121eb5ce1d5c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2416	1704	iexplore.exe	28
PID 1704 wrote to memory of 2416	1704	iexplore.exe	28
PID 1704 wrote to memory of 2416	1704	iexplore.exe	28
PID 1704 wrote to memory of 2416	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a7a17be7825dfed42bbdc66c041374d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04ec89e781552dae1d6b92dfd3cd4e35

SHA1
3ae3a9110a142b4d263398dd0ce9e102a2556f03

SHA256
3f9dc192a4e889a05e87c721982621f8e441059af8401eb6a2bafd94f7192a81

SHA512
46eb9694be00b3a92060f154797e1fa463a9bcd8183c66d5f9a643c9b635882b852d3c1099cdc227c4c20a75d1fe1a2ce0035f4c0c13722066c3ca45930cbfef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565b606ad8c7360c46ff82db27794245

SHA1
9c0af2ac8511a9c83f734c66184d51d428da8a8e

SHA256
61c91ebb5ee967c5ee0e8f7bb3ee5ccca5fefdc49f099875ecc6bc4ee556ba30

SHA512
5a40f77b8b02a4a2589fd2051aade4078e237e83fa578c08601eec6af857d2b6ce462d61034f8e99130f64920335c1b6071bd729bd4b792e44b0a337e0b97043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
792c285ef53bf56ee003adb416ee4a94

SHA1
917e5ff83626eac8bc371d475a9ab2006c4581a4

SHA256
979b8dcb0fad2048934b547c16c880b5cdac95e4b1e07106c60baac65116287e

SHA512
4e6c472cd77562fa74bf021373f9519e4e133ad58b62fbad858f1f7c01362cd8ddb5686dd9430ce75db79268018bb238f85b7a411628918c3b8cd9c28201c9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70c7229e0f52ba360bd1973db6111d55

SHA1
05b92a2e327b444eb8fe78059f343f973d5cb019

SHA256
07227a673cf6267e427b5568a268bae38f82c7eb0d5d76833b1080f0e23c6e7f

SHA512
edd885213da299cc1c0d027af94429dac124f80dd632915ba1693b5b3f0be7fabc8a7af052203fea9d620d61ae360df310d7e9f0c75f6c88ae5bc7c7555e7e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbaa2ffaba4732e1a72a1d657b1b59e9

SHA1
e2f9c6a6eebfc2cba566416d6d2e97199c97fbd5

SHA256
d4de2999edaf58832bf023bf56260c73d0d8eaf0a51573abac406c48b8696682

SHA512
dde1ffc25b5ee64fba3a3e4091df72a7ec9fc2f725cdf18083aa88f2194db9c7d7bba61f64cb0ba40dd94ceb90bd1ffe7b7f40f629d27836f44c78edfbde7675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bd5fee70368b11a87f2efe3b5ee1b89

SHA1
bcf58e411de7120fbd442a98d604ac6bc1212b07

SHA256
90f2e420e811610da2086bad36b5d15d54bc3ab1c59484603988fb2cefd78b64

SHA512
667571335d14ad70793083108c8f0ded6e112a581de1ccfd281bc914d180d8bd4ab3ce6346dec43566111adcf710e8920416c9027523130e0595ec6716a7a6d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb9723189c5d4a74df96153731ba0bf5

SHA1
1fe06979414dec484711f4c0b1a26708c4e2a4d6

SHA256
3ccd6a9d43d9fe962adc774854bc661b4a06a4306f92f4858419ce59a7e4a0e5

SHA512
0ced8434ee1eb45990e6c4c7369215aaf4c5dd7a372a2f237e65da004bcd33bddfef0a626a599e4d795ff244d5debb19d2b7c532896d02b759fca192482bf1c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f70ff2574b9dda1a4cc33c1b78dc925a

SHA1
a8fd5f6e651670dd39e7925b6f5d6ccfbe7c8cda

SHA256
ebf17e8b28fb72f675087bd802756b7c477d7f43ff12805a18fdf955dce1dd04

SHA512
cbf3128dda3858604c1216b5bbd7a64d3e56848da6de4a4f3ba233038fa5f1ebbd5b4eda7d117d2cf59c53c7eb88896064717254e1bd7f73b01330a7de4bcba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef1cf1aae80f35164335b389ec3a1fc3

SHA1
6a07d13111c6c562000187947a55cc88baffe65e

SHA256
97e69b526c18be35286106ac3a07a5a6c757ff6912059ee0285091af56082178

SHA512
fb998a1a556471a346bda0f802f5078d961920e0058a0ac7c41c0dbce12876d4b88f6ed040f5bcd9ee5e6caad54cc78edff47e2206d16777106495f97fbf6f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80edc77ce6498ff7e9d5327804a6664c

SHA1
b2fb70ce019b1bb6339bf15a5ae1bac4893a8084

SHA256
914a277b6a2700a3dec465ad2e373be33178ae046965e3d953d0cd296e1404e8

SHA512
bfeaa90f7d4d53b0e2af41ae74422da27dc678bcb18b135abfde810fabbd66b5fb6f3bd56e6abb03126004640f82857740ab80db0c169b71d6df925310df4509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a361ca09b5b141af712453077110030

SHA1
f818139f7d08f579cb859147487b72114ad8e6c3

SHA256
7d95809d3b01ba038438a60fb81b1f7f34ef11f8ecc94161d0b36787781ebb12

SHA512
11bc6275810ea85c2d8874eab0666ef23d16886907f0c8288cf5d9cc3b5b877500c4af0e050dd9d8f403be3ed23122af84a9ffb096a94565bafb88ab2a938142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd768480897534ec1fc3a66c7e7fff92

SHA1
f1ce5ea991d5b9ef92731fb9f55da839fa9ab385

SHA256
973c8a6a96e57c5b32cc0cb0faa3f30a6b3ef3852457e6d2a43a7f979b07fda2

SHA512
23f6f0bbdb8cb5de21c9756dadf5aefc80c4a3f875c37dfe214be9cb170af8d21a66d43b94fae10c97f36587573db6055722c63906d33cc4be79e6c765d1c064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eeef1b65deed9e227308b477d12cdb4

SHA1
2a5a60feea69260c1470b80d8ea1273a5b904c72

SHA256
64bfc01243cdfdf3293ffe1d922b9877fa132c43d9736082af89c456c63a8032

SHA512
190b245a8b308f67f98c532ad9973ca54b7b7a960d29e19d7f46a5453ce8a287de6fe96a01a8587e56e617d2af63c62775b0912a7ffbeaa2aa8d01078a6ed6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7445d6b9b5f7f71fac31c11eec8a97

SHA1
78c7676804301d697f82304f41ce36654b31b2d9

SHA256
363240f777e079d5a01c4b1e413def889535a39938d3db17a3811e4fce6017f8

SHA512
38065b173053ad9a1aa8c90ec9698b8f4aab457edc720a02dee9eb36250e37a2fb159e1f659f87315699c65b16b701afe174c2edf8ea3a35939f91c93c8beddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41dc270e2392567fdd0fd834b5eddb3e

SHA1
a92d512b0616338b567524c420644bd83a502f29

SHA256
9e117c5da92444c3b2632ce16e857257cd4033c5baf5e294fcaca18e4781a343

SHA512
9b07743fb6b1f607d5598bff3d5ba6feb47dd774d32622a565e2d8b9f48ada3a1697decbd602bb26272a596d27277f8cbe642d7fc315c375fab3c79b9a2e3e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86dadd33987cef9717ba3e0ee3160ae0

SHA1
265c2b82c30d9dfa6ccdff6871811578266ca56c

SHA256
0f1224667d20bdaf5593bc383eec91f724506cfadfbf09850418f3315da1c9bf

SHA512
a9bc8b64d9b5df4e463f6741af5a40c5bde4cbaab46836c2c3394236c112a0c3845c0d4ceb56d509f1c83bcc583ab8c7a9135e6ed40f8de1d70c57bd543629d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0fed960c5aeb8bf42c687bb139ccb59

SHA1
5d6b700d3a99e20dd7b1ed72f71ade233c97070d

SHA256
ead58b6aba1f3a5c265a4f6dc52689736b53d4fcd5dea8ae29f31db451c18a91

SHA512
d6f6bd4d25b20cc32d60e7901c34f21031fc045ef9db9143fd5531baad5d9e2e0357daf30402fa5482b099c634d89d485c1897307d017daa3b6aab4add8d62e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA8A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA89.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit