79df592ec00674aa139baabcc63d5ee5a85a49d38e801dd442c8dcf6fb6fc749

Analysis

max time kernel
137s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b31ac76e64692abf74d0f63f9be0f3c_JaffaCakes118.html
Size

55KB
MD5

4b31ac76e64692abf74d0f63f9be0f3c
SHA1

ec0204f2344926f6a915a47d12332464a4c467c1
SHA256

79df592ec00674aa139baabcc63d5ee5a85a49d38e801dd442c8dcf6fb6fc749
SHA512

3088688ceb82963eea7b286b5e7cfdb179955123d34e614f88e6591acd1455f5b384560c9cbafba4bbcb62a166eb1981ec0e1c858f3ada056a791ecbd3060cb1
SSDEEP

1536:5dI4Do6+Je8nbZH0T/wNCnVZVz6LoGe0RAs0Q:5Y6+Je8nbLAnVZVz6LoeWs0Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c3512691a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ad35285c72910c05748872a54238866cc537cfd55d68c09a774e6203b0037e5d000000000e80000000020000200000005cc5f97290f63cee2135e8751f95bd03490ea5db7e72e01e733febe24abad7e390000000e1f6146a4b073038d58f4b5af2cd33f26360b74fd51005f654f8c8b0fdc853b65a1f1705f896eb8da9946ac7d2a62acf5a16d23f1cf3be5e6c2fd356e8e6afbbcf51c8716d2edcad71646df3fc8bd2f473de8c0ce2b4f66b57f1ce041009c309eabeb3f7a8054d3a8bbea99ed80dac5f99bc328397f6e75effae90183aa3cbebf76ca6c8ed7544603110077cd33bd4ae4000000010bad5139ebb53134a20180dc2d9c25ddb9d199bf306ad80a0ed79fa76ffe72a7d56bcda17067dfb66eae0bd12a22e16a8039d6ebdb808435b6ed6f5cc840863	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49A40701-1384-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422026304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000095153d58a6a4e8f2a2dee4c9df98710b6bd8c2de182dca082ddeb32b562c8044000000000e80000000020000200000004b4ebdb819dfcffbcc3ac9b6714045131a3c81f89f83d13842052d12453572c920000000519325aa6995946bb79052083fe88395e76e945c19e463edd68a717bbf7d457d4000000089e778639e732993b85dc2438b1e9bd42270ef5d0b4d79f0ebefe347d14f0ba0341ebc281b012ceb5825bb0c6cb18a2fdc54fca86570664f209d10624f2ea90f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2716	2920	iexplore.exe	28
PID 2920 wrote to memory of 2716	2920	iexplore.exe	28
PID 2920 wrote to memory of 2716	2920	iexplore.exe	28
PID 2920 wrote to memory of 2716	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b31ac76e64692abf74d0f63f9be0f3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3937c2cf41150a7200ef8f21121d95e6

SHA1
5a55a1a04190bda62e4a194c17c776ebf8a8241f

SHA256
b8af97f35651eb5770d7eb5bd71b4b9c88990d4d90e8c6f95d771366d660f898

SHA512
9885e751fd53abe3e83e1fa9c5b8b6c13cac57f34b445863f6eff31c61d47e27590596fbcc8cbda1b3ad104580aa4d9bd4a28a25f5adc3402835a68e7d9f92f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52f5a79280f3becd70d6fb898839c15

SHA1
fbdc923a7c439d66b6f7bcae523f129e79e0ce91

SHA256
9469f12a686bc45de2eb68d9b800fd147e5c0e32aa5ee36c2db57bed30674552

SHA512
1c3e314dac1b4c0ea18419a7a29720ecadc3b8348410e1c2d55adc3bc09ca300a2e747c4367b2c1299e5e237cea20f987afb3f447565c89d4ab4602e9b06bb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ad3b643355d476d5ced7e6d87053152

SHA1
d625c76e9ac2efd4a0141d7a6873d150961e2611

SHA256
04d616861642c19f03765ea1e729a738146c1f7d066d7572f0fa4f2dd1ee5c33

SHA512
3f0ec39dec5235ba6929d8cf37fb8ba52e249feb327c76a348be8f776b2a6f4ab028bc5813a562add77cf20affd9a5f184160aa3b923f82571e8d2f0a096750b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b3a003607ea8c14ada4f8ffb5bbd29

SHA1
c49804893d98c626d9e6daa8a0fc3d28af28f640

SHA256
08adb9ee9a2dfc0de803e0ad4936f4ee22a773051012da338cfeeffda85a95c4

SHA512
a96119fc5caa98e09437ccba8812ab127f20018a491e1f73cedbd410155b3b191e86ce35d9d21eb04fc761c7f05e8746f1fd281e7b413c363651b442bd194978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ca21d0483f1e40eaee15e9602d5687

SHA1
ef4295491f1949c11bd6d4e55939ef822f10a97f

SHA256
72652e253e7b5736c1c66b6f3e7aa0bc4d8054ae23257858863704e8fe6f0f80

SHA512
0276c281ed58e05b706353d9c67a7f53dce37fbd7abc20d4be0c3b611f48079df566b0cea951ae7daffaef016dd754c8bd54fefc54e999246b66fc084b85b6c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f46275cce8ec8243637e8a62da1207

SHA1
9732fe245fd6889fe32081865892fc69ee9fca7a

SHA256
34a2153858980b1620b32dd49b52b9b1203119b49ebd68c97d5948f10facf79e

SHA512
c4cfd75e6efb22756d1456d5f8c373978ad4b48c870bc0000a34635e4cf147557fdb913a8c0daa2f8f4d149e1aba9155522133a0068432f36b88d2761d7d957a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853baad11183ebad58d230e393b0a325

SHA1
77bb39a730275d875bfbac4c1ba67f1cc56d62e7

SHA256
70b19f18fe6f7083034f6d2f30d930def3529afc791bc862d06c2084094cf7e1

SHA512
7d2faf3220f66bd8ac26f8aaa943506f6e6fc5d1f4a7fdd1dd474dbdb182af4aa73e8056d2254df14ec9002636c9e216d34080363724bfb5a12004a0ed333053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
946731e95ca3e64ea8ed917a7728fa6b

SHA1
0a1ff314ddcc3cc957a12f27f360acb1222ab24e

SHA256
1520ed72b6e8dc0ab330b2b1c195ea11d85627ffce779db525c3033525930d67

SHA512
26eeff54fae9594483a23d97bee20429218c0a8641b600f3854d4f82fb0e3cdb6000bd2a13b72868378385c079a852517e1a522291bf239b58335b3699df30df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ce129f9ad6bc31a983942c757f55cf

SHA1
62e32bec821d11f9413db5fa6e7821a8d11e8807

SHA256
88412751ea9e3eca3e6e558eebfcafaffe3212cc36d9ad4726700c6ccfdeee3a

SHA512
db05f1f932bd8d8bebe1117c332e0b82b95173c587d59539df62f72a3b7992a84ec10feb81c9ba3489cba48fc0be532aed2ab73f9134b035da6ac090d93bed14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea5d6822235f726802a478c25b63466e

SHA1
8d830e4d29452b1e41cbb54af66b73b0c12b91aa

SHA256
8e23d950cdf99fb115a92b2ae2733e40dc69c0940a75a3657fa8a4e42241c651

SHA512
fe951e81df893600b49718085b7a5eb3dcbb8be1d190ce5bc4521a9ec0a0172b2102e53be60059a4646dfa00daab217a12528942f0e56d21e9cc568d778fbd5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f347fef0eefb5441176a926713ccd396

SHA1
9bdb9fb29b85f92a3b27395b7e2babad30e763fd

SHA256
7c55a0ddde5648444af71dc5395d33681740035a039857473d5dee6d19240771

SHA512
a7e0392fc376059121564df768c629467830ebc4a132376572a8a839b047773db81e571da1d725b1bdc5ba11e1d30e8b970ed13a35c37a5a946ca46696eb8887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab54efa7fca3aad1f5de64a4ececbcf

SHA1
525b8a5f6b61d6a1b2069fd1095d40e5e71cf367

SHA256
66e7bbab40dd17902820db4d9d7e172d9172926f6dac1e939829ec993b01e6dd

SHA512
a7bd9ec8d59d799e0ce8c4b50fb4a1798f709b6ef1b557406f7b8698ad3d50a1ce8cb3565decd62b2f449080fa51aed55cf25eeb5a64baadc2a9504bb6646286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e06bbdec8b3633059755b9ed840af326

SHA1
1627a6b3b2845800e6388ef8bb66c6921014f103

SHA256
6b0957261e2e30e792a9109870eff81a183c5069a94622238a535aa9d708abdb

SHA512
5c0ab8d4d67aa83f2c44ea63a466df8b57b4293c7ec84df145418b3212e0d1ccad45076bf7383c1f920cb4f6446fe3d728af08eb0e23657b9276d30427f32c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3525.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar369F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit