bf56db16c706acd40d53abefbd5e8d7ce03c3409afd6cfcb29ec51b7b4260abc

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f527f2e3a10f458589bab6fb92127e9_JaffaCakes118.html
Size

15KB
MD5

4f527f2e3a10f458589bab6fb92127e9
SHA1

a497fad84e8521e26b229471cf2a439b6d559b3d
SHA256

bf56db16c706acd40d53abefbd5e8d7ce03c3409afd6cfcb29ec51b7b4260abc
SHA512

8ae7975d73695707096b501908722bfd4146cda7d3f019668db3ef23f55322048909f6beab433ed30d50e0f18360de5316d6548049614e4dde3cfa149d30aacc
SSDEEP

384:jT6XBUfBMFXKTTwcOA9CqYELORiE2hRnrb4x1:vMBUfCi5KELO4EyRrb4x1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D492171-142E-11EF-A5E3-DA219DA76A91} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b436623ba8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000fa10f9fa2e405ef345445c0ab3c4fc84c3315bf6ec33b2ff6d4fcff8d4e4cdb8000000000e80000000020000200000005f4d09c6ab0ac709f995d0b1ee15cb4a7a2b924bab2c47324e7e906ff10e3713200000004bd85f3e97bf850301a517125c1e52a1222c9e3486e979ade942299250d839bd40000000ef97555039479b6f81f3ba56d6fd71f30e471d4fe174234a0cf558d78ea4cdb9e10371594a515a52bf70321500fccc05ed1681920127fd1292967f36e464d9b6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422099431"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000043fdf7cc4f285d9f2af8dcb427cc74af8a5043edc8bf6fe45c2391948530ff7b000000000e800000000200002000000071d424dc7e492232d4c21878d28a5e75fa27394278ce2a85c6ec2ed6f3c2f18590000000a960aeed84309279eb79da245dae337721c3f5d1180bb71a7c5cbeb85a9409402c324907267d63429a6e81db476d2d8cfdbbdd413e3549450a4541a8f17a0b75e187f5d3f44a9dea938b615550e646583e38074d5e658e09cbadb833e85d0feee9ae02aba8e878a503bc0ce572ca97a0fccf9e84512ba8d878ed96a6caf5f9f70d4fb9ca510f3d0571d8f67cb927df834000000081b95a2afd670f1442c6a2c07475d11d32dfeb22b8886e04e3cf88dbbc33bb713266847a9c1d4dc4452c84d2243131868d7784fb0d1d5192e1f60df4cbc9e6e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3060	1644	iexplore.exe	28
PID 1644 wrote to memory of 3060	1644	iexplore.exe	28
PID 1644 wrote to memory of 3060	1644	iexplore.exe	28
PID 1644 wrote to memory of 3060	1644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f527f2e3a10f458589bab6fb92127e9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5890f403027d273ef22841e66027ed

SHA1
db7d020fe272c92d2db2c3d2c99b8f0606ddbd49

SHA256
0aee274d4a3659ca418276e2b4d7c5e51d8c4c4234c52d77b2d3c115bb93c1c7

SHA512
c6e3a65fd7da0e77e457e4b421c64f7f4f7fe90ed8253174bd16c69e82e6b41f381b2210aa9a1d0cec95623baca68f6f7285532dbc3bf4bf55be6cfd1138b912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f6a2ac36ab573616e01c573c72592f6

SHA1
8e09bf969585895e9818718b6e890672a7ddb9d6

SHA256
a54a076d16555eb1a9fd86e26ed523c9c99d4c815b24868802770dc42391ef80

SHA512
b8d4a3f624bbbee50a5e493a04054da12a871abd7da753e97cce3579ec10eadde9f30a564ce233b486e42636cb1dfc6723f889eb88a868e4cf6de7fba675b1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aa3c8f46079b3381e45382dccd6b6c2

SHA1
c7ab55f99c738daa8712fc64e723b6d64513497f

SHA256
b61c672298e5d20a7e6690a184e1ba78f29fb3cae474e143fffa71fd048f0a8c

SHA512
186e7488936ac9bedde9027b806b9f3ea5c46738c04e84c233e9bf0b9d617496571cc9dfca9c91673f60daf921cab31ee91a115e0be81df79efa6dd87203a7cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbff9b1189aeb08ce37268326bcd1068

SHA1
bf575910b8a42c2f87e33d4fb833c0e7b95dade7

SHA256
40583d0b67eaf2a12f54d7679db85afc5e221db0ac98a89e5f63caa979d50b85

SHA512
06dc3e06b8a417091a4d768d87d7f49a3a5151654b3851810fd40b77ab9da6c775e20b9adc1e4d143a245f1ec0c625ba3766401ba6a3fcb7c685abd849fe511b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6f85cbc9e24e32174958a44c3b53e7

SHA1
436724f1664b0df6c808492548a5118cb6a87874

SHA256
c9c4f9571cdf886e454b31688e0b666beadcf809126842e456ab6557d5a5448e

SHA512
87a92fdc6bc800c587b8bd4e166a6507110cb549d974dea42326ff85b530a335035d9aabc1ec6f10295bda621ccddab022856e486a93cbef5e9f3b6c3cae5f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a66a733e5ba270a3d7596008434f939

SHA1
f5b5e86227908263f9905be2b4c141bc0592493f

SHA256
9e6237c6a0f822ec94601b0e7a5dedcc57edbf80695c763e5a5e8b98ea2e80d5

SHA512
c78adbf4248562a8dc39d57b495a997c95496df0d1d57a80e98c53daef67334c7068ae470ecf3e899aa11f527d606c95f89a0daa138bdffc87b48ec545b4991f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dceb64223d2afaf7d4882d94f72723a

SHA1
0fc9ad7c277adb5d7bb30441043329d368b0208e

SHA256
be78e9406d29627236fe6b498af1fc08b9ae60707ff10fb44f57691da14e83f0

SHA512
1b49e1fd7102d28e6bc4718add3863b68a7c4a7932eebb9d9ed6ef6d7b513847b6bad7b2c6c4664865ff80ee037accc0467caf4ec11cbff820dfea6c463b0dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72d3f40cb13510913d519bd05da10091

SHA1
e4dae06d03fca4fb8a457b6f2980db185a09feb2

SHA256
1801e65c2c9ee0e60a58dee0b149621c8a1e82113e8d7c6290b305498a8b5e3f

SHA512
85ecaa7be19d7994d46036543bd4d26defcb1c9fdfcd7b6f31c81f8c60428158174626d8121dc286091c90502438f3f59c00e870a6a8cf895a799f9650ba752d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21eccb6c9d9b432b7901d122fda2f473

SHA1
6db5b87464b7fefb930ea71df8e177a069e49ef7

SHA256
8165eb6064a79ddb6a3714d86cd52aae8405a5ab0e679465d35f35677df6f35c

SHA512
d3d8bf52b435715587b368162951a9f911d04dd9243220c4f911131a88c4bac9fa06c1a49c8df2f47a22ca6594cf7af8331ed481297dc1c8b044e119f0b6c7a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a9cafe5cccc062b61e9942d2b93b932

SHA1
6ef85005239e1d5e96d693e3b599e1956ecb2457

SHA256
d19933ff5367f2f356ca52f006649845be5d33acf8038919343071ed5c1ebe8b

SHA512
625bcd0a8c94abcd5855594fb4f300b1f1d8e384f16a50c0f833086e76d8d072a1623ea2fc94b2a193cfc4e4d0e61bdfe6b7aacb0c6b099255a819878d9579b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec212f5bf10ee406bad4daafa2db4428

SHA1
5f2c5ef49959f7c87eff057f9dae1292140c7017

SHA256
5ac2c05b32dc911311dafad8a177887e148bfd2cf78795e8737dcd166fd97147

SHA512
79921dbba90d8867a67ab693f1a0ff85e7d3d72e7da3c8a149c2d84743c1e3e9004c11ac72f0dc647f81b37df4690a70883821887ce7f07832f9c0d706a75314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046084e464229c106e219d62290cddf4

SHA1
bc0b74a0e32476fa6280e4cf56fef9e52074a696

SHA256
d7fb3fecacf0015c3820d3cf85029c0d28247f0bf68f1c09e777a701942408d7

SHA512
a14806068ddafcf796341b532561fdbfd65d2db21731dc265faa4ce549d16423e106cc15973b37ac1085f1d7f1cf666a5e420393e73edc36f54dc2b87cea49db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
708c03db1cae1ede554cd1d217be43f4

SHA1
46121caef8ad4a2225594346df3eb237c05442df

SHA256
6476c3647cf34214398fcfb8becb7e291f547e74a1cd2ddf4b3227120ab1e678

SHA512
8be638ba24d9431a09564f41d4656ffc72e496d78d98d4cf166418365585d97d01093356908292bc125490d43fa485cb6aa75fb1a5d20148466fb3fcefc548d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e9024347cd345aec1f2e058a9dbfbe

SHA1
e658d93fa1e7a0c3a2dea6a5945bdd22d4002237

SHA256
054539928029504ca08e6bc5977fdd60eb2942bb4cc9af165e2620e476c32413

SHA512
47ddc2c4db898c224e2025238fa6643abdcceb96854a3843dcc84769d4c501ad6610c8cae1883712c88e86c41f3aea9234f841cd85bb00df849749b8b8340320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6667f32f40e03a6fdf21d34d36e5e063

SHA1
3da507b306f198ce4d53499fd7cc1f44f462b057

SHA256
e4d69b7c0914984ba93b3ade59e8b2d6c1438bb34c1ae9fc448820002e2928f8

SHA512
558781f514c70d975920432670587b28681bf4b3ea6fa3fc7ae5e1ddc781ac195c506f2a3fffbd3e3490630c801d2001c2f84911ee7dd2de785ad9a70e0b037a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a6d8900e1192727b2260c2d28dd5eab

SHA1
b5912d686caf25ed5287f6f473aa2eea0d875b3c

SHA256
a663f53273e3120aa2a21fa4c51d245275b1bc386451a19ef42c73822fc8dc70

SHA512
2d53184ee8b364f6f9cc7702a81e63d59d3502232246c5e49e8562f81cc27a118276a4ad7960ad018eef65dcdf5f2d1dd17050417aa2fb943e5ecb7c72e6da1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d76d45df5b58f75171f26ce3b84905c0

SHA1
5815a389191258905998ad95f0ccb510282ec901

SHA256
6678ebc33954715af65c4b9adbbe01e17724e563b91751976a36b6995a7856b6

SHA512
207db0e3fc6c02a00737cf50819fc69b5a1f15e1b11d1eb7275743d7b6343ead3a6ab217c005a1fab04e32b76171854ea05ec82951c2a08e71a7dc9b8be27311

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11CE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11F0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit