43686c562fce0493debe6411a25346bce5cdd78cdb732f7a1d3e045190c2d87d

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f4ee7ec95ca3d9fe871a304570cc120_JaffaCakes118.html
Size

27KB
MD5

4f4ee7ec95ca3d9fe871a304570cc120
SHA1

2418e7ea481ad04898ff9b154c1e1c5e7ed8992b
SHA256

43686c562fce0493debe6411a25346bce5cdd78cdb732f7a1d3e045190c2d87d
SHA512

d5624550053d34a3babb83132af894328a378c544d7c6fa9a5affb53150b067caa3e89f5d5be6e6bedc138f570f50d5c7c80215f37d0da354fec26a03b9058a8
SSDEEP

192:uwXQb5n0+nQjxn5Q/bnQieSNn26DnQOkEnt5RnQTbnxnQ9eEmm60d6gQl7MByqnn:1Q/s6LJOq6DS0XW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422099084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002803e4671c20b90dfb87ac40c0bf3b452e05e22f64b12638d9890cb8b9889850000000000e80000000020000200000006965949b5899e7f3780a2c2496516e5da6f3244a88d49f24a80785c9e5e43790200000009e102c72b4c3e42a41c6dcf924bd4223047fa51ac5c6f3b0291663b9093da4d6400000001032490abaa143de0b496894b715cdbbcd50d3da6d50e9d4b47a612465fd9483144f0a4c24530f2ee579e9780447b17d3efbfcf04dd941aada61cb23e5309c5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06a28933aa8da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004c521ab10004e8d61c5ff711f44ea89da3fcfd8a8117c1d73a3d2eeaffca4550000000000e8000000002000020000000bd6b9a827faf6df59598075e7d1c8c5ac338ed0dbac5d57cd4273132aa1870ef9000000082e2e3658c867685b3917ded03bc524ab069749a3d30a271609d81d25f43f4d71cac3ef595d88580040c9e4829164542a875e2e5125151bf9bd2fbb4e5a623bfac3d10ea3ffffb368dcb19f941daa26b9ed32e6561dfb11988e9940530f262a20b99c653571617aedc7a232bbe6e32df2f9c861c8513e857fed4f2f551993e301671a93a782c5342375c3bed362bebbe40000000051cc5f9914f94a7f070783ecb3a57aab20ecee1534116f90fa730549b1a4c545ec31fde21075bb291aff3f14973867eeda86651a8b0ac61768a2e20aaaf3b34	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE7AD6E1-142D-11EF-BD9C-4E559C6B32B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
316	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 316	2932	iexplore.exe	29
PID 2932 wrote to memory of 316	2932	iexplore.exe	29
PID 2932 wrote to memory of 316	2932	iexplore.exe	29
PID 2932 wrote to memory of 316	2932	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f4ee7ec95ca3d9fe871a304570cc120_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc72950226a5a06da77c886bd5a97ce8

SHA1
a5a38464d1cf12a20848c222862fdf64ea53e7f9

SHA256
cf12d60009e15864117565aa05227941f67587a8b05eab9ce1558f9ec2c9c5ee

SHA512
8fb22b72bb459d3c521052694e01df77c9b08e0aa5cb7f7633637b2fe88f287958fdeab45cf6879cca5a8e7942f191445cc92a6878e99f553ced432441eca6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99fd7b5c312477169015bf2d48af12d0

SHA1
236aae7451781b97b63684dea15005b768f59333

SHA256
a368c94aca6b48a0a0b25854b2d5c22227f2d302eb9f89ad83ffcee21b3534ab

SHA512
079049158e86ae2b6d58a922917afa8f89a460236a14f0438716ec4bdb5d52088aef12f90fc6953e8a63ec4e9cae06b99aba60ae50061f7e7e2f3080d806e9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d49fa2abdb5b297fbb0f658afcbaf1ca

SHA1
9ae63cab02b340e8bf5a332852f2cb47e39c775a

SHA256
c57e3e7e7d60d70c9df41d2729aabd0ae52c179212bb1db48f6af359cf0bd61b

SHA512
88adc8e251717295ef88a984ffc570b2aef0f2a14f621bb8ef0a1fc305330e6681cd75e4bc22d2906ad68ba776334515b6815f830f5ddc6f0c40da350cc9955b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dce31aa5d1e81a2c20f907ec0ddd19f

SHA1
ddb6f2d5e98003baf7a15f1baf907c495f9e4ad9

SHA256
d9430b166e73f400155e9324d32fd8627c126fb1e85a4212a0f809f4ea10b7d1

SHA512
cb971013d2709130a655213547df9414268215b617e392f3e6afdf7d36647a2ac547286c9b43864d344cf1bbe20177dc18af3a93afea39602a61dcca8a61a255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f486836a004be0bf7c7e7857ce6dcd1

SHA1
372afa42981fe43e39c61fb45dffcc02708a765e

SHA256
e6b281139ed755fda83ba0e9d3cc5db25abf1736fcca864c651d3e6dd88dcd5f

SHA512
a7c5a91451914a1c05c594f0278a04ecfca31acb8185d7cd9aaf657bb8e5a1b2eea8e5047c2e129008e84258bb87235ee3f46eb703d7f0978ed430569f7401f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7819248b6ce625f53f448db1c5011c04

SHA1
527d5eb8377e25d19908504dfefc2be0fc729065

SHA256
c24c331d94f6712303cf457127f03373e340f4246d4c9b22e5e96c6be6f316b8

SHA512
a3c19d09852e82ca6994677bde55841ad3f1c01e32d4dcb9ab69ffee7d3be731ec5b52d14a9ddfb553b866c41056afa8962e10bcce5bc76c94664391c8d5fc2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65bbf33b198ae54e21cbee201a5163f8

SHA1
8d9c889b5ecd246bd86044e806a6954c785ce230

SHA256
4921e901e1b073b4e56336f1bbdf64caa1ba00ac0935e0011fd342ba6a8791db

SHA512
efd7dd9620434496c038af30e328c14dfc67a847b538e4c54dd7e5449e401e5a5e5c3d0f70e5411cd4f4e00dccdf4c8aaa2953d14beabe354552c82cd183a7a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
941dbefba64b669dbc0e6ce9275353c5

SHA1
98aeed9757e85525dbd418d212688adf5a1fdb2f

SHA256
a1188affcecc99d540c0045b0dc3a76bc4c16da2d453f5aacc3cc97f929b1f47

SHA512
6c92eca578113b54eb33cc07e4b70f3bac3ad83401d22d6484af2b9912987fb10fd526267c34c34617b7e13569f8985d6185417020adec72ccc97db0c595da05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
525522b5547afa3bb9cb09c08330227d

SHA1
c3184b2929861457101ee26115450360ef36b376

SHA256
37cacfd43a199ae2545d5a3e967feeb2e9f6c19f554988044d202a1e070f3f15

SHA512
8db54f6c41660f1f3ccaa2cf325bebdf4d0b3bc7647b9d88524993a1a4e68090704d2c22453c90621437237949bbbfafa74dc87c0c86cc8ca757349d76cd0547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b4e4e3242ee7ba5ccf3958de27e187b

SHA1
056ab2204083b35f4a9080238322b0cf5cdfeb92

SHA256
eee05073de87135e0447b6c9a5fb678b46a5106242b05e26e47c80489b46d19b

SHA512
b65823ee216e15d8c88e30a3ad398efe70bbf01c4dd1aee35631e79cc6246a676a6d1ebd2de7fa05d14ac758f41249828bcadaa17e35b68a5fa430af01be306e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a8a96e6e921ffeb481f73b143e954ee

SHA1
c3f75c957c199d8d00847cf214eb65db6afa18be

SHA256
2e6a7d9ef0935757dd4612f19fc4b09e1738b52689bf6a38dd07eb8ee18aef19

SHA512
2225e9bbd48ed8c820d3241701ea18b0f6168af1f2590f7da2994cf2363462208601c2bc5290f951209b5900ce2d35cca844aeabd00f2859d6bad86584d49b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c4ea19d3e41acc48f72c4a594c66d7

SHA1
6e319c7bb4a51377d4fb49844788e4a74f257119

SHA256
99b0ce5455046fbe60437206a73f326c0f2307d74cccc2765fa958fe49e6df70

SHA512
bc0ec92bdff6bf42d9e06f2e821bcc3b6f0d91f7d76b9b2aa98d6fc4032259c0e88b4ab9b1d6a11a1721ec1038f7239130dd81f82d01548a32624a4dc7949e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef4fcd2019f6137a4b3faebcfb6ecfe2

SHA1
f25cb080694a11343cda519b599baaa7d80ccf81

SHA256
160cae9ecddd6c60afa27bd77765245862f1e9903c882d6789b40a10d8c29063

SHA512
69521f9fd513beaa8ddf5493493ede41629fe25103217df72747215ae5c5469df5e4598dffc9115a5baa6938a8a93025357d3eb5897e34aeb243ca47e2cad22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e309441957d86ceab5357f4997ced487

SHA1
8e34075a14d98ea7c9a2688d713b2f52156b59ed

SHA256
c6a1b7d3f8e773892ecfea41bc7fac96c227d6c1eeeadf9813c78ead01e355aa

SHA512
9ca1327ecf99ec59297b89fc8cff8058b005d08a6d995afe1cbed895ae54c269a92e5cda84ef64f6db3bcef1b73e1d4e14689ed3c939a97df09687ef45c9b365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3489.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38D2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit