8d7f34711eab380175e4548b96011a1d36c7426fdce246d1759d37477274e883

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dde1b67635f0e15efb8693ddc5a95f2_JaffaCakes118.html
Size

68KB
MD5

4dde1b67635f0e15efb8693ddc5a95f2
SHA1

94e0d105fc603c050dd01f9b00c8380dc9dc691d
SHA256

8d7f34711eab380175e4548b96011a1d36c7426fdce246d1759d37477274e883
SHA512

6c614d1c6df4c87daed66e31be0e0faf04fb2aa6ecbaeba4ed8ffcf5eebca8d8f5fbc8c3a231e475507926801fce734e2d9a7f6f27b6efa4b571ef982680cb48
SSDEEP

768:JiEgcMiR3sI2PDDnX0g6RFB2Te071oTyv1wCZkofyMdtbBnfBgN8/lboi2hcpQFf:Jwiwa07yTcNeD0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f824a110c026554993f8bc81beec0c7100000000020000000000106600000001000020000000bcc905b5d2b52ead254cd98ee58e85ab8055c4befde19060e5dfb9efa7768770000000000e8000000002000020000000d63e07265a4e99fa54891770936ac7074116ad28e1cfc27480543862ae8382712000000017601afc48170db10e13e9428fc737fd452299bdfde64714ad5b796eab50b75240000000a6a1b284b472a0bc30661babfc2611eadae78387e987e76ba46d0e6aa493b0208006d6f5ed514e7de73717a8ca75a68084230e9d1b16f4f9bc8a14db02232903	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50003e47f6a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72A15C61-13E9-11EF-B411-768C8F534424} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f824a110c026554993f8bc81beec0c7100000000020000000000106600000001000020000000123d98ffa579237e7b01cee7077ca57be30ed2bbda539da5d30213f04f0fd6f1000000000e800000000200002000000053a65f76196a3251bcf1e881657ec84b9b02b176c51385878e8b679ac13ea26d90000000e1f8c269ed8657d7f5d0c851d4e147615c6ce874cd463ad66fb4f6598ab6a828f456929ee7760711c174762c3c0db9cd4cec4c139b96a64fa88fb71fce85fa0e476e265fed2e2afbe5858366c1c5c2789879aeebc6040d75d01ce3762bd01248b6efec75e80a7403bca38e22558fd45e64799b751fc53f9591593ab47f826288b91c883d4a9fb1b9150a9a9c164b6b5640000000be09657c453c90f20ab1334556f19c2c979acfdbe9b20610306c2a803682d5eba07f0768e83cab093f2073fa8f7071bfee730525151b511043b34f847f3b8fae	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422069751"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3000	iexplore.exe
3000	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2640	3000	iexplore.exe	28
PID 3000 wrote to memory of 2640	3000	iexplore.exe	28
PID 3000 wrote to memory of 2640	3000	iexplore.exe	28
PID 3000 wrote to memory of 2640	3000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4dde1b67635f0e15efb8693ddc5a95f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19eaab8aa0f8e817567f1ba9ea55820

SHA1
9be78cfc4e199e4c9e32c8269ff6a422780a0524

SHA256
56311fc04f5c493b36608483a81ab7b3bd9f0f44a342b2f74cb8028616893a0e

SHA512
b314912e1fd96e32cccd7cde2cea7c91c9b00e7cf92f7f8da35679b09ef8607bfdbbec2b5af4f3ef9b6489fa0a2896e2df3051947a2b5f603ddd34e3fc9d1044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c84f9323af917e398805f0ff3de8827

SHA1
06ac5f2a063aa2800e8175c6fa9b85aa96138994

SHA256
558138bc17b9dbbdaaf6bfba13be3f962c535638866354fae913ca6e8e391150

SHA512
2a7fa07024c3b616fa701c33821d1dd13c6d25b608debf66917bba66081f498ac90b3b342aa941991c35ecee4c867455a463f3f100e290c0397bdb5001cf6c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66aa3bc4ace97d0c6838824e00a67bf3

SHA1
51d45221fc090fadfb2ee105e09e3dc799ac5ee6

SHA256
501598a58bf6f89c5d6f8e8ad29916af473b11547afaca6bd7f255a52735fabb

SHA512
3401f3645fb973ec78ebbd03496f0f570daf3b385e561e073b79763ff2a8d4e384f5400b9130f32bc94c492e7917ff34dbda0265561a60bb815daff8139ee8b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f2f33ccfa15d1dfa48da4ccf1b5d230

SHA1
8fcda0a7b47c0c52c30e773920504cb50d19afa8

SHA256
07f9100819f5ef0d594843d42c8a75debca8443eb7b69ad7f207dfd91a6d213b

SHA512
cae01642a7167e27162e0abb307aa76c862c2d38c39a92d60d63edd1672d2d12764ffe68de1b0af489a0aad45ecf0727e71ba4d467f527715d5c8f6b5ec70765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aafc6e0281e4b4ca8a8d3f70cd1faeac

SHA1
a20ebdd92fb8cbc244423e47d80dd413cf65f12e

SHA256
a909e9ed7ae2a09ec5e29dee4bbbda46c613e1b25fbe32c722a92a69b6e09a58

SHA512
818d2ebdea2d1933a76d4386f40581dbe08e044afa5a19c266a897116b11a1f353121f99895ed9d0cbe9769fc5655580e7faa14cc270dc57d789a9de4a466dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6888a0000cdb4b20251e4c36a1057e65

SHA1
340273452926b2cabc2e648c176a8acd1d01cea8

SHA256
20fa530ae15eabe9fd91630c46b5c1560c8e33b4d155f95cf24e794cc95919e0

SHA512
198c64f603bd1e421df62b1d6f2ab77bcc68e11c8619811cee2661a38e62abfc9596feff94cbd8c44b8e17bc2db8320b1ba37e3d0a0ec7019141444b0a74d532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e247c7cd9ed3cf6328af88c45c7b4e

SHA1
1792c7847da0eaca2a0d54affc1eed0053dffd75

SHA256
5b002fbd22f6592dd152bbc520fc6b2e1f3ae41de8608229fd4ebb8ae974f264

SHA512
093abf17538991b8c275ede38da4278d8b83f60399634f2b072663c23948fb7b64a59121184f4ec7a90ac8c58e9ec1835408b98dd23daf25b92040301ae28a4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61e00448d3b0219573301f423be1ae6a

SHA1
64ca6cbfcaca1797d78225c5603a4a82f1ace70a

SHA256
65562adea80fa971176637b779b39ba90ac71f7a9f26567261df344732e17310

SHA512
b5dd8f49645bf1bfc65952c12b2ecbb4811509561fca8ee062a4173994ef0dc1aa32c6acd9ea135a1b35332533ed73eebf2f8bcecfe77fbfbd4ad7f56352460f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c27bad8d49af202c8dc36f12c3531ab

SHA1
a168e3738123f2f176d35e5495a2f04772ef000b

SHA256
fa11095972c25b53f5969fb0d4de703339436c46f9a29116b0088cea3f6c8308

SHA512
5f0871009a341072f36bfb5a6b8596f0b9d24e92ae2498be3713474f98cb34a9bba58f5609a8bbf0af37ab8c10c60876f2d1dd27a63d3fa4d8872a93e853e63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
064683b11ff7388c7c5d0c1d7e7e00c7

SHA1
6000af8870f0b5b15d5c5b0601f1cfafc29fd124

SHA256
1f8564b4fc3b64666d10f91a7ad838a2be1ce2c078753cc6345239dbb7eb28fe

SHA512
ba3189b3f5e37b5fced955d71e4de63b19342a9d9de82c44265794dcd775aeb9cdf01f10247ecd10558b4597db96dfc8123076006b69adf01b9cb9f50b9ef4ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d00729cfb8601201ed1fdb95e8804e0

SHA1
12fd823dba1f606bf32825334ac71863a0e83835

SHA256
e147979b1e1006c9c2e2f7d923ad93d23ca389b4b4174eb2d79f39abba87ce13

SHA512
371d0d7c3fca4326cf91e9c48ed0771fceb7de321639f3d4792bc9f7bba1063f36e32d378a95317e41a10414db7f2df895e8444bf8484d6632f469d3e3db2258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
735b24925f92edb65be2218302b4672e

SHA1
ea4f7872ee3f137368101df4784737168428307d

SHA256
364af49423942d323268e94da8223f96421471eb1d775ceb6268ae08c659362e

SHA512
40e182911e714ec74572252c70c5a3ea850acc5fcfd890d4ede8903390a1e4a9d13e7fbdc935bd6fc462af9f0da1e15310388e06d24294944cd3cb505fc995e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac1e65bd7a74c4e4d689460614bb7ad

SHA1
0f579663fe972b5bdfd31b2d70528363a25f95dd

SHA256
c5de93cceec5996269356f1ede0992f86824a7472d010a71cd63b1bb14b9032f

SHA512
2762d72d71d3171e98e06af103748cca7ccc15d1d4978d750f9b285dab205f476e649293948b6a1278f1864e9f59a3b122b5f9a960d9b5a986226afa0666b892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a124986528602d781632dfdd05d17eaf

SHA1
77927773cda53db042bb7d1a854a09a11addff22

SHA256
c9b4c2ff01a74bf945544d0776b7264df4b70ee29601f2fe96ce6938814fe772

SHA512
0d09e34a9425256b42a482ff84f2057fc6ab9a90d0e4811c0fc3790e9f86aec9b3b6f87e42cad536ad99fd6bbb3bdfef13c355b1aa6becc5a282f0c6d56f6124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac409101dd92b7a4354a1113984e969

SHA1
2a1ef8558edcd0dd68b57c34c2b810656c11b7b1

SHA256
cc0a48e9ef2cc25571b07a8fce0a3c87086ff8673574f63794778c4b57fd080b

SHA512
5c48207543218ab5a73bb99d1bde72ae1bf5044673062ec7fd4eb12c34c53d3ca798561db60a00d7be01dba8ba4865cb6e7d921c8bc940b3d2cc4161d8abb48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35b9771ad0d88513c58138b83fe70b31

SHA1
b3d0554dc854eef63f183b7f36586d5d5fc5c53a

SHA256
ddfd803649e6bfe688ff0ff64e088d09d7dc9da19078766ad9f448a2facf3dc8

SHA512
c6e0b631a69b4bf27c73d3b5395e246f7909e3b82a122e68d0337cee8a0ecbccd4a8d3c40a5d37c2f8e474fd7482023fdefb0121f4745bbe6033e678090cbe21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab283C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar295C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit