84a56b293f2bc43dece49c5129576d8a39360416acadb9fed4aad025a1eec78b

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b9167df1218515a6091e2ef1c1744bd_JaffaCakes118.html
Size

461KB
MD5

4b9167df1218515a6091e2ef1c1744bd
SHA1

d3457160bac113357f72c60a2983acab542bac42
SHA256

84a56b293f2bc43dece49c5129576d8a39360416acadb9fed4aad025a1eec78b
SHA512

c04b447679d8602b851669278efbc419029c2e7c67bafe5c51809ab19f2f28f6ade2138b3cabcb63c90395258d1420f605dd0dbdbf3f8842b1b33c36f4cfc6c3
SSDEEP

6144:SnsMYod+X3oI+YPsMYod+X3oI+YI/sMYod+X3oI+YLsMYod+X3oI+YQ:q5d+X355d+X3y5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000133d04a78fa72cb5116febda90cbaafef5efe704daaf7316a62c4a16b5da35ce000000000e800000000200002000000097764ade2284bec9207ec6c5dd66502deaffa4222f244c25b940704e30ba57e190000000cc808f1cd03be531c727c38d5729d6bade794f6aed9e2fdb92311bde5f52573555b71a6991c1181e419f16a151714fffa8854b3ba821df2361d1de9c2df5a592d2a888043c222cd176fbd11d1000d93daaa010cc45383b66eded6563a64e80599122bed16e5548d52a3ede98a04edaa5153204fa19884cea86514bef16141f362a0938abdc8ea895508fdf0636c6d35c400000000d653d379aa95f84a726b8287e2660073bf32efa9dc709c77ed157ec066da24f34d6f616f13cda301213dabe289eaa52a70bb065f73bcc2e5e82542cb0ee629b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d5fd1674c5a689fbfe760448a5f64dc8b13771f6ae38972384bef4d9542ba7df000000000e8000000002000020000000c72cf5454a7bc9d6e38f8536251b15403931401a2b26cacf9a4e006179e8f69e200000009845872f111bac488b2d40c71c533cd6749d9b6c10c0aca2a10b7685fc823ea74000000018ab272a3782099715a3c50f98731e351696717c77eb0d8f12a3e2e59e9d2ba586f377af9947cd6fffcf856a1edbceb202d2b88b687b13fab65e2512a489ac57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422031925"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E35BB21-1391-11EF-9A38-7A58A1FDD547} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05dc2369ea7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2960	1740	iexplore.exe	28
PID 1740 wrote to memory of 2960	1740	iexplore.exe	28
PID 1740 wrote to memory of 2960	1740	iexplore.exe	28
PID 1740 wrote to memory of 2960	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b9167df1218515a6091e2ef1c1744bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ac19f4b823c0a3b39d8ae4d617ce67

SHA1
1075eb919ae59e856b845c051483576220db9c40

SHA256
5bafce595e5973a6bf8679c3ee97e1caa88bd920f1505aef91687335b69e44e5

SHA512
9f70b9f8522f4a2cb366580f0c7309c9d0e96287ebd2ecb40c1f1a165d1db094f31d342e4284d3c4dcbb94094c9480c13cd8af99ea3666466ee2ae71e8bec640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3195b1a5a1b612e2e8828fc55b0e00

SHA1
8f37c1118cd961efce5d8e42d1269ac61b5a7885

SHA256
c38d0dba6ef35ad57723cda37316bc5635e3065d6525e6ceb4a0fa34af9426a8

SHA512
dcd3c69e2525a6a3f9b2b23ad47730d5678bec7cfe823429b194910a864b7efe0a45f063ef4c93812f41618698129927cb896f2c60700450b4605ca830d77046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f00bfa800b656e4dc99bdaa969f6b7b5

SHA1
0cdbf428c440e0209621360481871e0c03f2abb6

SHA256
fcb1425aa1f5e5ffb70cad4459a9b70a2a54a4891cda864b39b86f2ed1ef4419

SHA512
643899358c62d660305c5f58a4fd0a09429eefc4e92669ede688c0ddb3f338376cd51c61033989aff1548057eff6098d7b34d699afe42e338f686938614b193d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aa7ec3ca69c639b84d3d178cd7c116b

SHA1
ad6973af92e82e55744535f5e8cbff97db05c8fa

SHA256
51425ef4036ca40101c9e5597a83c1abaaf8c463f076f6b59051e1e9c3f79ef9

SHA512
fbaa2a9529de641716108f91ed7395c00c786d51d10ec6e7fe21c3dcbc0d62375619df6ca7864b4f29bda1daff0b9fb154b92e324826674c1e141ea7018d0fc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db3fb2857eb55faf74483d941b310170

SHA1
3c7219782d1760a15e9e8fafc6c9760b3bc9a6b1

SHA256
824509cef502f00d065fe61645fdc025d10115174f858a5edb1d66bb97104f56

SHA512
b35f1528c1b3bb8a4305f5db7ccd5e966b9d893054edced75b120c90e23716c68ece6470067fa6e859e50d4f6eac8a7f2da81e1ff4ecb55cc20279196751b971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53041b691bf74e1290ee974ab7b38c8d

SHA1
3431820407fee7f6abe450ef2bd36ccd90ac80a0

SHA256
b36d1d9ada0b19bd5d80c84f96dbb89c32754b59f8a7cfc0b223dde7fa5616f1

SHA512
95c15b0b48156e15584bdc57c877c2f644de928ec7308bfa7be2937c00c4a58a97bdcf1bbd7da935c18b914c5c659e6af04c19e40e962e564e49a31fde28c485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943c34aaff45fc48b06214566b0f875c

SHA1
2bb0e41bfce97066df5f3984549fa39d83d2d6e8

SHA256
9529258d2831205fd0d353168696c182b6903672f36bd3067b850df93adb406f

SHA512
6facdf50751634c7e5220773a81da03e2dae91e198de266d49a002d74d934679f5f4b4d60a0745b40a55bc1e234a0be953f1cb4591f0859556ce0d1e4d0b1f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189b595a7770418b9267a65b1c7e952e

SHA1
bbc47dbbebc2b844eb1a45690c6c7d5df34b6118

SHA256
c3636765f58bf34c615d7387b081258d8f434ecbb333c3a4affe55e7bef6f36d

SHA512
0962b0d0de426a6aab32e1638c32d2ff2844576381ac47119cc1dd10c6ec67aab25f0e3add5aae83a462f01e34902802cd3fbca212e2d2349338e34791a6aff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce8527a214203af25bb244f59351aeb9

SHA1
46202ca70cacce3a73ba9eb26fcc372b3fabd45e

SHA256
a8fdb83a4ed62e68448eee0acfe8ddc44aabdc50d50cecb039d4fac676151e64

SHA512
2b320b580e37d9ce33ee37fd5872bec952a2da4642df287de2297ffe6e73109f6c37c7c32fa2efe79c0ead03c1d4609f484d94ae7581675626b4da597ceaf8b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bc35d106c69d4d3357f4acdf9e32c31

SHA1
903786427f40b52692b77f3c0c3d5c49306a1ccf

SHA256
020eb2fe8738ad973c45699e52dd351a3c118e9c5c61b8fe0047669f1354aa07

SHA512
64c81a0103570277e1e056d9379567b9de1fb0b88e3148148cfc864cf747ec4509214b298b71485b10c28f212b980788302b4983d0dbbaf88c70ad1097010da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf5430e7e673666a694962f10d2f6c6

SHA1
46f8de7273339c9681e958179f1646d30d78598b

SHA256
00b3f6cd6d4870543ec77b2847c5d9214b1b41990f2a75392625fdcf47106616

SHA512
5ec1ab2dcd90f61f49bd3177db1950696168cfc0ab3685ba5fa73a7fc160c8268374142b95c729739fcc12e05859f486f1e45b88dede9470a7a80699279c64a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CB3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D52.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit