38651ff35db0a3e920fc42eef3f32d3e7d6db95aa8065c92b14bdcba41c5f53e

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b5edd3595eb60b4361f64e72bc7d70d_JaffaCakes118.html
Size

8KB
MD5

4b5edd3595eb60b4361f64e72bc7d70d
SHA1

08b6ca6a91cdb7ae9dcb63bf2740482593ceb18c
SHA256

38651ff35db0a3e920fc42eef3f32d3e7d6db95aa8065c92b14bdcba41c5f53e
SHA512

3b9db4414bc8c6c77478bda0f5ea6089426229e4b2bc563087b89eff9c32a5d4a3c944ea6efcfff7789cd76b9c5f7cf7f3d3ce65cd257674ea84cd50e300a151
SSDEEP

192:9B9fo8tgbW2ZWEMJNj8wqoZ4q42+4yOnjqJUXs0:9B9fnr2ZajnZ4q42+4Q0s0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000094ecbdfb7b98eab4a9131a7224636c455dcfabcf73f3811600501bd0e108fee000000000e8000000002000020000000f2034e734a5871e07511dbcd8737bbf5a8ee1cba4b25de48950fe7612c922e0220000000ef8a383dd334e815ad0da694a9b2afa4c19795359f26af91ea3539b93b15f6244000000070ed6eb93947100e09133d4d9b19ed72c42bbc9dce26acb76e11c46f3664c945251154d85112be904f875cbca1eb3e7025d0a0b8c635e304de6b4dd01053ed2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fc91407d02d71a9337787a3b311d61843d0703abae7ad92ce2ebea70dc244809000000000e8000000002000020000000fc3b4b85e370377bcd413078c5749b1b31c8038fd9d5bd95096ece8c626fe4349000000014a161d4e50579f826758e0a3784ae7449ea520c83daf48637f0aed0265a4fec8e19ff591c4f2099cd377305646e1bb5955ce3ad0ec72dd1e0bd03763b5ecf628fb4d77f2dddf1eb2ec8f6f004d7933c26f2c0ceeefc35b50d76371ccc090911fcec2f110f54e8efdc11222d2073238a2c76e7f986cbd32feda216c496d64f7d4ed44aea5036f9ae86506103865b157b4000000011f6032aedd73fc4b0b017a6bd79f5096b946b93f2b1e3d97b26ec7b0c56e4f3f9ee04fe3b59ccfa61a38fa5c8d6811b405cf5343ae89e8b65e87b19c02e5721	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806d913397a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F114A71-138A-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422028916"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2612	1872	iexplore.exe	29
PID 1872 wrote to memory of 2612	1872	iexplore.exe	29
PID 1872 wrote to memory of 2612	1872	iexplore.exe	29
PID 1872 wrote to memory of 2612	1872	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b5edd3595eb60b4361f64e72bc7d70d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be853f0ba744d54be9ca84e007b1da79

SHA1
32567e388ec2af25d66ee049b3cdcbc1de9ff51b

SHA256
94ac70db8f5f3d9f6c0ab1f2ce14b7f469c466e518f1da02160d3178ee042dbc

SHA512
5bb97e2886c3f694100e1ea0be3c6903684c7cab27dae7da5de6c2c136a0a041fec30013b9ae155de43ce94562564dca1c7048a38baf4367cf21890e9c24534f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ce6ce86e36bfa417ccc7766e565efcc

SHA1
e213c51c6b08c631f37c8d5e7c86dd2497813cc6

SHA256
ebb51a2ca91764fc2e0099f76d2014d877b4da4f577b944057fea381a6166e47

SHA512
8e5c248c79475e83c3b69eff3a9999f2fe76e977ecdaf9df250122b23b3f9fb6e2a4e30107773248d0f8cfc796830d2bebd2b91a7510f0025b02cbed3b4ca0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d979474a96113097b320032ecf8404b3

SHA1
4db7327191aeb76fc1096d3561062a788feae16a

SHA256
953d70b491fb7ebf259606bebe61d86bd41a526590ac8dc1c80b62a821459c13

SHA512
dc1e34e96a0cebc47c454284fcf46dc5ed0dec9fa6dc39c5ab433164b0b61f288227c913d9fd5e23b10255ffa99a704ca464310fdbd4f406dae601702a2d3e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4447e56ffc156cbd57f418930a06ffe8

SHA1
358fa5d5227f7356827650571c94fa4ed1cbbcc1

SHA256
aa3abbae7975686a7aaaaa0ee48982d0451015de463590eece806b639ed2e62d

SHA512
758ea366e0ada0d170770af6c08c07a3b750144a2f5ce694a69ba17e2175ed26b700ffb91a5388648993a8574e602389ecfe4548d1ccb86dc25cb3ed2a5a07e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b5c03d4df99df6a731197d7cb62f42d

SHA1
560ecb8c39726f265551f0fb5bd0c15263c7d79f

SHA256
d7e5642407f2b8e6c8c1fd2b94a375037d1ffdf93a6a275be174ad9f2523bba1

SHA512
b4fc0c55d028eff4e6ab238df85a36906faaec4b60b5391167c4f65744bee8694ac2fd52d35b9b7c0a0617dea54651063d3c7b83838b5e4c2a62a21a147706d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5512327a9fd81b3e3d1aace7b8984e41

SHA1
57d154944ff0cacc9b8b2d06337264d2dc9dbffd

SHA256
1ef315cdb2908b44067ab5cb73c6a8a2754592407e9439287d49fdbb1e9a8929

SHA512
e7d9afcecf9c92c367d8becc3378533261817d1d80b546ebad9d791089f6d3407095a31cccceaacb884d2aef6ae0aae620c2271681bc250800090ec700f8ff49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b52d66f7e774cfb95602bff86272c2

SHA1
3d35e7f322d5f6586db22ea8a40e8701abc4e707

SHA256
e12723b6c6aa3e8d0116eb364644ba026785c161a02c5aa595b729260d6ddca8

SHA512
23cca74ebad881f05e3b9acb7e2431d0ca89f4310d89282911249966e896618ddf26267b97650d908fc921a27a9393a2f88621bc6a0315819bb3635238cde4c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c34ef9752f309117baf78daaa7846aa

SHA1
30dd357d26733513975c5e07448a963372035e6a

SHA256
bfe8a278f428868dfa38adc29c281c15d71d891a883a93a084b3f8b71de2728f

SHA512
e965529dfd1b9643531741d976f7448ede754792fce2a13114ec042d16432f728b7784959b49797b0151987aa87b49192799e6cd7c47264a25eb05d6635522f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1962f837ddd39017c92ec26929198c92

SHA1
e7f089725dfce9e4a6743e21fc2ea0916f16b2b0

SHA256
44b18be71d99a14e4de2069e3da3727eb844e2861e0c9ec6bc90d6fbce774e25

SHA512
5a1b5ece7b89805c87b38f863d3202d3d098bfdf511436a17dd78b937593bba6da7d3238781cf2260edd8b4c7b38f9f904bfd5df27b2895b2af955ec2b17f857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c95574e66940d0b5ea9c0c3885d5b38f

SHA1
6f2e04dab7106ed0af82cdad7143e8f98d6edc6b

SHA256
56760ab88a8ef1bb61d71321b14fba70830ec3486bd063de3004907859659a20

SHA512
90b9b2d1c8e6f18fc92bd1d6630c6df52b366aff8bce639329f1122c66a285581cdd9d4e9be674c7533662746d9b1a177eb57ef55a418159f636792787486437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95e1e187e2cd5eb68ec257e9cbc4883

SHA1
3eb42b50f58163396db6b4e55760d0780238f97d

SHA256
f38eea691a952869b7fc06c33a78cf1cc76133de65ca7d5030fd124f05e401c1

SHA512
cc8cae932ddc7b3a060eda95f282ad7aaace5033edd9a4a1464103b17a6609cefe908b3b747f728ab3e689a8b1922582253242526f8882aac2a2e6faf32500e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CFD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DAB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit