1dade14e85e3438d005e38f3405aa54bd2566cdb8002d500bef4803eec29ffec

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b534f36e86381723aae00b97d9c13be_JaffaCakes118.html
Size

35KB
MD5

4b534f36e86381723aae00b97d9c13be
SHA1

65a135ed405a5bdcbaf452b0ecce727bf1deae66
SHA256

1dade14e85e3438d005e38f3405aa54bd2566cdb8002d500bef4803eec29ffec
SHA512

beb6bee1bdfaf89275c33905f2eef462ab7c1bf099523860a93172d205f85a97c607bcfa72f05199be24f8c87f88c5b34bc4cdf1e81e07648434480389de009d
SSDEEP

768:iKorwX4jF5Tsj+FZKVecLOGWPQmK43DS+12WavqJr6QkD:i5wX4jF5Tsj+FcVecL0DS+12Wavqt6Qy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304fcbcd95a7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422028320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6813E81-1388-11EF-A564-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007fad57ada16dffbd069380111d91940fdd48aaf4bee6ec6f312a36a2f9b31c7e000000000e80000000020000200000009e417be74e972588b6d83702428efa983190509829551590b9e0819eec612aaf200000005bc53882c21dc658e2da33bafcf19e780ffd0462ad693c7da76dd9adbbb90a3f40000000b168844231ca4b37261f9be97366adbad3aa1d14d4d10c346692c46d4355accbb09d306cae14d40ac2812ca3d6859695f3f59e213430298927dea304813c70b0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ad14f47be873a2660c5b764afc088e6b840ef13754ea96aafa245a9a310726c4000000000e80000000020000200000008d24e15a60a48b58338cc7892f98c046ebcd5109cff301bd031d2e14209f08579000000087362b193a643fcd848269d5e28fe7e04eb48f0b1caaff548e567c578d8465dffc66827840fc7ed8aab69ac5ee239401fa2c6f9d95ec9cf7d129781690da9c28ac0a04125e5e69b4f9fe0def346af608ca2e90c605b297e505ac0b5cb204e084be39d2dfe865c475f68be5c30aee8d31d58bebdc661bd719a60587f6928f67a8f16827fcd2d307a8423dde9a96d0daac4000000065046d2810f8ff02dbf5bb201519b2ea4b963701f8b3f858d7d61bae6f216741db0a5a05d4fefd8562a6451cd1f2e90f5a84e0b79cf3fbec9b85d8dc2fd1e739	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2504	2000	iexplore.exe	28
PID 2000 wrote to memory of 2504	2000	iexplore.exe	28
PID 2000 wrote to memory of 2504	2000	iexplore.exe	28
PID 2000 wrote to memory of 2504	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b534f36e86381723aae00b97d9c13be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8c17a787fd74951491f2fd158070804b

SHA1
0e55f056c7c87c8209a87d649380c6f5af33600c

SHA256
7f2e4e5055d83b7f2b89c9420114813d8e8f307b58c8e812e837b8dd12a76115

SHA512
de54894feca54f1f0cab2a33da8440f3abe0b9df6754414c3cdb5b2deebb6da0aa59da89b026ba3be8ee194823bee5d3827289829e160c7df6f6a2169d3b4d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07fd756bd76921e0892cd6450d1b5ce5

SHA1
0afdf0b857bd47d4d438dfbfa43189691d134ddd

SHA256
ae5fa22c491035bf3ba84c532e5198990452b34defa42558d949555f99943b3d

SHA512
7a15188ed203af530df6c172c889da9b945b835655eb567dbec77a007642d277f25d1457a40427fceda301f7719555cfae4991dbb522c6aab54ea928e2fc9543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8047699b601c33436e6b07989c524a7b

SHA1
1056946efac828af1b98b389f2da8bcf3b636971

SHA256
7f990e45b3891908c1bd4dca7fa97d0d2216cc9afa729eadd657b3e04e423036

SHA512
ffc1b6461b7ad0921ab6b5bdd1ce3ae2844608592452aebd757765e87e193ebb400b5e608be99f5c8729fe11d740affb86260e063ed8007c7ebd3866923582de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d5121cb1b686901db194fdffa50434b

SHA1
19acee9beb6dc64b1aeb00887a4b46d0e38f91ef

SHA256
74d204a91551daa86e3f42a67f50d68a892b0cb90e87d27da0cb19a19fd631f8

SHA512
da7e07156c42113de779199080a409716c49a585a0b3ba77de3168fef178d51b7f4236e570fb906119a61eb6bf7415efe09fd7b4baeeb59c87b0aa74c999aa55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7670f31f2e96ea50ee281c2da6a1c7ad

SHA1
ad460d8415f30c1b08dfc474409a964d209560b6

SHA256
475d9304e578b7f0cfd98b5f46f8cdfd3b8aa869acbfe69c039459800e3219ea

SHA512
d915862b1a41e3627b35a3fb79c614b5357d31a01609a083d5294d00a73f959e4bf0836be6ee92a09dc3b6f00bbeac6d71074286fe852eb877379122555c85e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f68e8016ebcccb5adde7f5af11e12e7d

SHA1
8c8e2e71d7ce4910bdc7387d9499f1e8b10cb033

SHA256
2e7ea10d2fc5ce3b1bb8eb59a4a236f38c86fd5123290c6076717de6e9c439e4

SHA512
840065ba52571ad830707507acb74bdfd76ceaef398f8bd4fa051c7c4855899b696e695f99326d0f1f7b1133b5c5777f7ed4089aee73dea123877b0b312ec04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39217242164c7a8e4cf9555e3b36f0c

SHA1
0224d7f4199570cbff0e01f6387f331718d59aa2

SHA256
e7b46019b14fa2ef2d06c02f1b16a1423958f5ecea6a9c825f5f20ec2a15b958

SHA512
878e913eeebe22e735954b9bee48a8c8125a82e7e25d6096e6a820f07202220539397bd3b5244eb3fe7edfc5e23290061186528caafeec14c05a1c6ed10fa2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f743f72dbf2ce5e444b4e08081ae6043

SHA1
f82a0d9ef13922c60ee78b112c2c6afbc406fbe6

SHA256
b5ca2c868173e08f88fda9f4a27ab57051b8089759efb9fa2846d50702370525

SHA512
9bfd5a646c102f92ab3c0ad54e3c30bf34f6407f486ea4cdbb1e01eca4ad537f219404047755bc231bc6dc9c8162ddc7edb711392567ed475ad00b938634b3e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6a33aec1035eaae99157199d97544e2

SHA1
71b5206d0a0de8c589a6ab559a9f2d3c01569ce9

SHA256
13e787d00cf1d5084c49191246a913880d1baedda83ea2145da2c3bfd9df0405

SHA512
de38aea205e7eefc3f5ceff9b32d52cdba110757df4c09ea1f69947b965c16b9b1477d12bd455416abc83d9e3fb7437bd4b5e7e7e88cd6048291fa1f133839da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de286e147da20d77878eb90327e415d

SHA1
af17d09fb8a152106584dc94b5d9d692ecb64a80

SHA256
7379aad51b5c83c19a34e06b10c65ce6763e79a829a1c620ef6d9399a796303f

SHA512
39a6e77f6ee918b4da4b57e500e589dffefe4c4cab337cef803199b934875bc6961578773736d7eae2a0a3ddc3c7bb190e1990516a82d00ce804f09d15ae8330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd2b40ff52525f1d78c8fac8aa18a30

SHA1
eea55adc24838b80f3396e5e1b977c2b768f1c2c

SHA256
d5990909c0084fc906a905ce44966b6dbc2799f571bcc6248572ddfebab9b005

SHA512
f86594538d6a2d833e5afebd1a80de9daf613d52e237c9f215ed2adab51f52d9a13143fb49a3f7a2680ccfbf77887177a0ec5bd0aebb862595775ebe18671b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac56e109c9a46bf6ac9951663726cb9

SHA1
73d9994cef33cf2c25dbe1316273a1073022a70a

SHA256
48be9c14a925f957f1920b438a48766bdeee9b224f164e6f0d82701b01e68923

SHA512
c513ebbdc2861b098290c666a6833c944146bea7b07a5a0349f9c2c60d801c340d794366453c4214c1d3af01247e384eabbab731fd5734bb388b9fcc0a541107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8f9ac5144789c877ef6afe0edb9e180a

SHA1
a1ec727acf59e5a5cf614db26281cc0abbd58113

SHA256
7752337594394dc7b9eb43c6c4659683ef0895c01cdf0184772634a697317a7f

SHA512
b20ace2b0d72f0539e22c48f7ea7d21f4361b70d49cf3e1a597b36cb9774a2e3d05e7361864b8e6f61084b067f0fc56d7249417c604f8e7d711d37b8f1e4a734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\bZivEmDgt[1].js

Filesize
32KB

MD5
f48baec69cc4dc0852d118259eff2d56

SHA1
e64c6e4423421da5b35700154810cb67160bc32b

SHA256
463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c

SHA512
06fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54D8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit