9a8a18e950d9303e224cad7e4f9c9d3437e6633883d6aa6ccc16318ab9e3d9cc

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b7b815f987b97f02947ce8160174f70_JaffaCakes118.html
Size

23KB
MD5

4b7b815f987b97f02947ce8160174f70
SHA1

6fccb011d7119b59b01f6629d96d2cf83728e3ae
SHA256

9a8a18e950d9303e224cad7e4f9c9d3437e6633883d6aa6ccc16318ab9e3d9cc
SHA512

9fb8a9d01fb9343569f242d1151b999492a6da44e7d13f5a5794fe0ee5f52a3e4f27e4a1336be477331904c8b59a77656fd2c5487f0a3710d0a7b2371dd2f137
SSDEEP

192:uWSoAreYS3zSb5nHf48kQzHCPlwvzWnQjxn5Q/R2nQielJNnwXbFnQOkEntjAUBH:oQ/UxV8E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000004282705d47c280174ce04e01c291ce30205aca67e8bccdf5a092c942d5558117000000000e800000000200002000000026d7d259d2888c7f475a65fa5b67d1a9c69e0f397871396f7732b5b4b7d394e920000000e4e65d60e5eedcb52e35bdcaee4248c143c558d7ce23848dd66df0b20c211f2b40000000876d76050f36fe38b91a77a6f83439d5751d87b56d06d9a57186266d3b5ef017aa165761549c23565ec8c4218c671554440879691d49322fc9423f1986cee45f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d6640e9ba7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{398EEAB1-138E-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003fcb6454c5023034efadd02c63d2c8032c6fe575bc40b919c8364735db15bc77000000000e8000000002000020000000c0a732f2a088bdddc800adeedae3391c63e7635801e1bebdde6dc4d86975508f90000000044fc92a894cae666d3a463f085de91ff7d4d06e19150f5066500b7dde97ee8c8a0cef5899d2386d48f76c30439c8f2b8a4be71c7c70af861d517d319eecc1441c049c22a9d938582139d77c0d54891cd2ccf1a76099a61290f0509502254cf09688a29feea7cec2912405f7c818d075f6a70f14594d1aed9d480dd4f5bc35bf3dafc9f2d0fb3a8b33f58827eaac6295400000001a7b96bf5ad615cc6095fbba8431ed0325073049065f92d05a34a1eea7ea6849667e0e418947ced9b1767a6b725d201f287ffa42821f77a6eb31ef691f27fed4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422030572"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2936	1984	iexplore.exe	28
PID 1984 wrote to memory of 2936	1984	iexplore.exe	28
PID 1984 wrote to memory of 2936	1984	iexplore.exe	28
PID 1984 wrote to memory of 2936	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b7b815f987b97f02947ce8160174f70_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
383e11dd93017a76e04be06586994423

SHA1
f79606f4545e26180d69f396cda688ac48512d8a

SHA256
3b7e1019f8aad202642a3482595ef46519934db9997995fd1fca99a370af4e18

SHA512
c8f967444c4854e1e0a67f9e59e87c39a15a6772eb656e95daf346decf4cf18b19c8fed68ef6c7826adaa251cd3a2338bedb58cf1fbdfbceb04dfcc4ccd2ec5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4d6bd9b6098aa2e96e7356b24d0522

SHA1
5f4706940af04031589db0e616126048bb5b1230

SHA256
31ee3ff6c9329045abbc309d44884436cea5600d10d42bf1ea24e4ea7eac3865

SHA512
d4e2e8889cfb2d95406528de938250c62578e64bd8ecbdb2539cfbfce9fd244c38c9ff6a9aedd13711e3a0ba95caf5766e28a7065a59aa7b62215a4fae2672ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df40185c42d5583d239b49ce9bb3d3fb

SHA1
048dd821c53a7bf8e427c197202a3b0ccd445bf5

SHA256
891ebcdf5ae14be3981642e99ce8aae528f853af58209d1c2bb70ad3ad064e6a

SHA512
e5dfff8fc88d5d73f610d6837c81cc355f27d030dfccb294d6fba9932ecad2e3c3fd84b58f777a042c914898570a40c562cd2c7529e4dd563c88a94cb6ed4d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5593cd2452450aad28ad994a1dc6ff31

SHA1
866433abaa4d744ad81ed1fc1888eeb533fa218e

SHA256
732cad46319d22d9766c90db4959807135947fa8e1e1e24d2f12ba23b15aa33b

SHA512
5a00a7d07107be1f23b251c196b11a65e5d948b7971f5254ffcbff57089002ceeb927970eac6997bc7a1b4c138c82998f71a1b6ba3770d8912c4cfddc50713c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47105847e670a11c983e90987f465b5d

SHA1
13f892b97d52ff59d9252e33a9c6b634a510452a

SHA256
e8cd03322aebaa31120c38d9321f28049c664d81f38c0967f379ed448aeb137f

SHA512
7ccfb19ca6308350c7acf599ac277f33b598fb9a481421130d83603f89427faca1233f5cf43ade236d9d56d2158193a5cecc2f66883f3853a2336815300a697b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2580dd5c3b4073f8c0f179c9b8925f93

SHA1
f42a072a9d2b5d9b7395851895aee35af15b2c06

SHA256
ed0da8c2f35b5b5028000567b0ecf0dd3ac3df018fc7d108e8d6489d92c64f8c

SHA512
e9328bbcb3f21295f5ef2425f913cac2dff592d8eabf1b7f7797cda7c6c2c2354f19c816a92fc43f62b4e311c21c5c1038d561ef7b1e95a3d528961a891e87ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1a7b49ff885f292005cefb12c43e987

SHA1
cd081f9bf93e96012adb186974866e97a6a6f7b7

SHA256
576a3af91e6f806547e336d0bad50018b1c91b537f57148362c55f53b611f5f6

SHA512
41268acb3e4e0bec8d432e40f47316301bf50a9065421ca77c7447c9be7efcfacf6aab1b8bb647cf438e4192e7e8ef13e4126eb62d694cebedd24ac72a5b2f0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bba8b8a84f4ab17601a977a0c896f31

SHA1
cab626a2491f4313335f8d9799f6333eb92f39ee

SHA256
bbdeb2424bae986d7e722eec710d0b32bf7ae3616bea2067090c0f9e7a127c55

SHA512
177e01c016cb78e8ad0114d9f4832645588db37e15555571056f62eabfe47b07ad642b809075ccaf79fceb32dba95e58e85a974bb0b91de3ff8567017b43982a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6dd396dec9ac6a997c5433f3e21aca0

SHA1
6bb9117492745e7dadc9813bc78dcbfabbc10249

SHA256
899a33088a0ca89da1948777ebab8779c487aed3534284a0a960e51d432a888f

SHA512
8421e7a937cc398e5bec0d7590c194159b7917ff8aabbdba7c32b1082a04d09d9af654983260ae95acbd11096b2d85cb6f651e03ce749b5b4d37bd619e9ddc7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cba3af877ac21b56c4ea4edc961bf65

SHA1
5c4c4a2c1086a8700184da8aded1f81bf137fb41

SHA256
b11abe850fa7ef79ddf4b3b39bd715c47f988c6c84528f45eaab1bfca15b317c

SHA512
fab675a58876da1b2b70aee36e8c774e4aab8a93dddc8bd71c86f631cbc49903ebe850390bcd821c623f1b7a49d0a929890dc2d611c654e91a4bb61afca2cf38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f93d9e117adc091db189c3014c9c2974

SHA1
6d61396b52439bcffe2f4d58f86177431cd34c9f

SHA256
6b5af470020d85ffa663e59c63717a2d8fb00b99d4140ae198510e47c720395d

SHA512
5a6604c0a42ce8d3c14e3cef341f4dd7fe5e96ed634e990f449853447f97649d207bc374901026950a4c838ca69f2b45366f454f4ee8cc7c66c4ae5f89e10870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35F2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3721.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit