c5a6cb925dca774c26113b0290aed66f1be1c92822652867e50f621253f4d256

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dfad4f4652f2102ea90311ce58b731d_JaffaCakes118.html
Size

23KB
MD5

4dfad4f4652f2102ea90311ce58b731d
SHA1

bafd83c25f44486c62130ff8d4c4cfd82e6e137f
SHA256

c5a6cb925dca774c26113b0290aed66f1be1c92822652867e50f621253f4d256
SHA512

1e683bc1701c67baf305b4634bc4d6d35bc95e5232a46a9075c14c6f7d00b473f116bb0513c3606a2e9ca105e86bcc811d153cfa169d55758a06c9bc95fe9fe6
SSDEEP

192:uWLgb5n7KnQjxn5Q/41nQieBNnLnQOkEntSJInQTbnFnQXCnQtdwMBhqnYnQ7tnY:SQ/4TanT5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79CF8541-13F1-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6025954efea7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000150dda5af5ff1dc25fe1014f1760fa3d242e56d564a37305dc438e879160c86e000000000e80000000020000200000007645d010abcb85dedb8ec263a4813c0f2fd13a8869e7c93b763fc64659feddc8900000009a111f2647db7e3c04bc918600414049335fbb2a6526e3512e902f09427e392c8ad0d46810fe8b0d834748cc11e73bb3060bf06455fead08b8d0e782e18cabcd6361da2c9c2f3e0caf566ded4f215eacfd584ccfda35602d958062447c2d5dd24534bd670aac7c209ba628df984c8625aba8058fa9c16d1152c82fe6756f8ce22f215944dfc40416dcddf7386ee487c04000000042b4064638270933ac409a1d534af2a28d18b42ba809ee5f1e0a48c38643abd1b892c7a4619449cef4ccf3bfd7bc3aa8f8b43fc76f99a98924a93e58f797ce5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422073208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008ff5bb2b30371ea6e4426f2de191fd87480ed2ff87a1259b53c1eb934d1afb0f000000000e80000000020000200000007d754464e65fd46f5699cd8067964a61bc6118cfee2c34274be1d345caf766f320000000c61e2dc562d7cc57bd97a474c46ee64edceb755597ef44a14a172de9c10db6f14000000072dfe6d4ce8769a2778ffb241667e00e0afb879441c3b6767a654a1139695f4e8f281632e11286aec60b4cacb30afe340e2825e2e37248de95d6fd186c41d6d1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1088	iexplore.exe
1088	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2700	1088	iexplore.exe	28
PID 1088 wrote to memory of 2700	1088	iexplore.exe	28
PID 1088 wrote to memory of 2700	1088	iexplore.exe	28
PID 1088 wrote to memory of 2700	1088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4dfad4f4652f2102ea90311ce58b731d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82a9927c74585d37ca792d636a9ad9ba

SHA1
496b1b687d5042a6ea519e450181addcb7ea40af

SHA256
7c80b406f950c39a59de62f7c63e14e642bb42f6e8e5550a71f5ce5e04222548

SHA512
6ca320203f2a4dfa0e597d5dbf1c11e3dca26d2f8900bd5237f834f0b153965b3bfc3dd496947b6a373cf52099d5b5a447bfb67a074741a60dc1840b4acd8624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2fdf50b68469f2d827e49d0b45827a1

SHA1
a2ce9e12d42042a615c13238143f682ab39263f1

SHA256
d108ea2a791ad5a6c080dbc4998d6a99f975e6e41551095fa1573dc66b5264f6

SHA512
0d3a0da7bf83ab70c81a4cb4077159e6e646078e4a25a68ce1d8acf07bb92f135caa14a9a2e35f180a5c0be48e1debe9a29c860ea54e270831fae6c43a4b050a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
822115e296f9f2c2b3a21d67feec1b79

SHA1
c18ffe8dd356f36fbf46d0dc33f570b4892494b4

SHA256
85bbbd09e131597bd2327902062cfd5c521b30cecaba8152e2c76ae8534a088b

SHA512
c06950fd0b89dd100f56542ead91bd46c655f99d7a91f939f71e863026ffdb5d4492c0bffbe5a6154b99ac4a5c6808837c156df898d0b7e893320da4d977eb4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
662bf4f683cc074d172a71d09fdd63bf

SHA1
c6fba1d53950b51435f2e55c28f25882112342b6

SHA256
27ad0d58e67f905c2c788a7b3d0b28607457a10884879d5aed6d4229fe3e2f93

SHA512
804917686a4664b7bcb4d78e47b7f9ffd621388bafb50794777b02481db4e79b0a15d2f7837922957863d75c680397b7c76ea4e7003dad10f3e2407ddb3ef76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e941efb0d406c9eb7add96e4e6eebb

SHA1
b746e79746e6d99605725777107c6ee2f24bbbcd

SHA256
aca546f2af8b1f2e0566cbafe540befb23b3aaa6073e3d8a0d7d181c11faac75

SHA512
06f59505230b61f66706006e69131457a742148921065872ec561392e74456fcadf0d4cc16e9c372809ae76c41e4f8ac22a93022990b38b2cd941ad5d15dd829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfef2c04a1eba37ee15bc605fe66bcfb

SHA1
bbef2cea27c167127ec6cd0d0e4870fedcd13d17

SHA256
5e9b132fe000f050616033d3bbbf1ff693e9d23612cc861860f95ac0fff89e3e

SHA512
49ed41f1e238b51e1c8eca9add44dc3ef1f7dbc904de10f429e113ea21ff3f46d852a2d90b585f5242e87806134fa99ae89ef4aadc25aac496ebf9abe812393f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cff89e387a79a45674d831381d97fc30

SHA1
7d379b6d86d225d5da672ae739fbfe7edeae55a6

SHA256
8d3c4f23fb0c18b5401f7d5083ec8c37939b7763f0869d850e99592a5878c35f

SHA512
869cde8bdc5cababeb7ec8f98d2a18cb6a5080e7694ffda0e3599e882228df81b15d61d5863bea14acb54e3dcf78c51c85020bc2f5114ae205bfe847364945e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c28b9ff1e853c79c3424598cd9cca265

SHA1
0cc92e60f0dd2870a85d57927d2f03e7efbf9da2

SHA256
f794408b964221d9540c6cbe02c58a102694270af4df6740ba0f2ca008d70415

SHA512
aeb36d3fa2e9e5cfe94e03531b7724988b904b88ba20511efd0dbc949bdfd061c9999774de53bc4771daabc229002dcf9095e0b7e9f5aa0306de78e44a25289e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d261f5024d5db96ac917ad61cac834cb

SHA1
dd8f33dccd924927392ad01afefd267bf12467f1

SHA256
db937eaea3b6ca50b392c52b4c9af818c026db389d8b31e3fb39bf4967eca0cb

SHA512
504c80500f063742183ac9c8073480d1179ec2ff534d0f8ac28a4b31b46f1192d856b7bdcfed58e1ba124b6893629504fe540497bb2c16a1b593f24bb8a3a270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b56a82a06ec08129bda1eb3e736f3240

SHA1
911e4539670ec905f713389df736397dbda50ae3

SHA256
ff33bea4557c0ec90f90a38f810abe18dbc29caddac9a0f6f623155b4727339f

SHA512
d70edce64c931674fff81a1009d423d47ee93e8754f099e5e42836b88109c7d2db966b0472b604a5a8749b9df4a9148afa0176d659871a381f9f87b062fe1f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74105ac914c70937052501229bec77fe

SHA1
413dd86220020d51ba6c8dbfc54d6ea888eb37de

SHA256
59cb75e1ed822ef1dfdc2fe39b52f04ea67c9033b94bb291ff4b77dbc0d8c4cc

SHA512
9a792f936cf780283ad312ac88b3a57f82f6ea33fd88e58491276538dd13ae4548285dd41dddac15e50d19fa3a3afe79574eda6ee1fb02e52d39f95f57101c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faf6d69deef6e212f45473b99aeb0a8b

SHA1
96c1ee0cb74ad9750805a7554bebe34e525764be

SHA256
068f8928e372182dd751bece9a66286a20af65392a255e525fb5dabbfb682a3c

SHA512
9cb0dae5d656c9b7e9b40e0893c5601300522fb33a5169620219d39fcbd55de4ad10e9777a66aa0ea259a1a1aa223f69dccf6c29b187f5ffe8e52c972f32c16e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511eea9bf3adbaeecff712377f69fc38

SHA1
285f04bdf732edbef9587258ec3a42b47d86b2dc

SHA256
3a588eca2c253554ad789909637c69edc845e584d505ac51b117af7a3edaed93

SHA512
73492c49c890faf92c0e83b227b5b3dfc16c04a1b519bfa03ab88a52fdcb5bc82208735fd9c05409fb1d076581b4387a3f4f1eaba0dafb82d985c3c0275a317a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
315cf6e4108203a9f1058dd97a2eec32

SHA1
0d551143d600f384a2c228ddc3194c614731cf59

SHA256
da78654371f9bbf13774e390787de177326f6869caa56a8ecab37ef88a924433

SHA512
1a5b54e54c7ad87ca9ed1c43ce2f76644cd3a4c9f4f5d1987335c1f764464d4199b43d898de90cc325088a60af41230e97ca8a295fda6c5c489ca7fb06bbc539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b87cf3ecf7cc4b7018fea87fef02515

SHA1
4baf411a714c5dc7734904e9e7f4242181b068c0

SHA256
8743a21df2806a3015cfcccc0128863aa6d810b39afc7d910256c577b3c99765

SHA512
77f1163373c97af9f6bacd862cb771f34a34701bd37edb498835367b18ecac1196e44be845bb68ae29a9c7357a3aace6289936346a2bb3e6b23b7adbbb6f0679

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab282B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar289C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit