898c8dcd6fbb62205eb00811fede6608b662966bc3add9ecbbbf7baa919939ed

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6260f587219a27e3791caf4a788030_JaffaCakes118.html
Size

8KB
MD5

4f6260f587219a27e3791caf4a788030
SHA1

aa02c35e702ae109f6284b2d2ba45e8ede6fd892
SHA256

898c8dcd6fbb62205eb00811fede6608b662966bc3add9ecbbbf7baa919939ed
SHA512

178f45a9180051f5dea28f39b5723a21d1dd85f194e393e7182643b661bd34a9021f7a8c41120c8137ab5437dc954e5ba90f110f3fe6539b7ab9b9f63b9026d2
SSDEEP

192:S0r+9GXYk9ZeX7whSFoiwP1GmHLXG/eu9l1HG7s:Sa+9GeUgVwdGmr49l1His

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DC158C1-1431-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000091b4f79f159bbe58c960b419db8ca06c902749832db3ff6e5e5d85a788ad5a4a000000000e80000000020000200000000e9cb0df11f2b0aaf76e8cc802192b6d5f8e6098cfdeae264acbcc1ba6f7638820000000a202a2c0077f3adef413762937635a34db7a7961cad13f8a1ff89dc1bcbbd97240000000e49688e58f5c4950780abd1a27d9523bde6b12edca9ea56e3a7b1aa8f1a3568496e1fc295ab383ba9249e92e4cf7c86f4f8b38ea3bc5e60b7864a2463e32ffb0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08746333ea8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000475f9ce5bbb47c56bd3660561e600df77cc75964fef96449bd052bb197ec7125000000000e80000000020000200000003ba9451b9a6505bc6d494d161f96f32c6b6884c3d32c6ba84b24530264968295900000006b1a43de7299add82ee7fdcc5f5820b2e93329306193a953af4dab9d38a037171a226b2c4df0d0cf291bc3588daacad4002c88f45cec29fed071fe3c43e4739b8539a7afe05882610f431d59dd1158b496af71ac153afb5878c4da7d9f13f1f5a2434d250e07ff30029c50034b092ac906db6d7779f73edfc8159f4e54989a994edf8e64655ceefce798c07d5fbf459c4000000055d5a75648a8c760bd620b31aa298005d1b4bf848f37c587ca9eb946ee24051d4ea9216ef7f211866590e1d04bff127f1fe839062cece2ec20484b62915652dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422100642"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2124	2092	iexplore.exe	28
PID 2092 wrote to memory of 2124	2092	iexplore.exe	28
PID 2092 wrote to memory of 2124	2092	iexplore.exe	28
PID 2092 wrote to memory of 2124	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f6260f587219a27e3791caf4a788030_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586a72cfadce3860282ae58599c28c3b

SHA1
31ff9d18e6937773f37ea38c0bd255cb773ca552

SHA256
bae8807c8aa439265b5b9073d123a781517d3adfb9d5feedba52e0559937baa0

SHA512
2adbf3efef61c37b70bd1cb116b28431ba4536fa4f1dce6f99a31c3794579e2d4d7688b5ad443179fd9089fdc29458413a8e75614d86865d26e3324de3bac742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b544b24b649fc3613c682e05c468fabb

SHA1
bec112a87b04957bc3fc5551ac10d6ae2114c2a9

SHA256
13c27e2971a880e989f3faf01d37ad9520500eea55edd19177236532cf33689e

SHA512
6e4785b3dff66f44dc147b24de5c75dbbeb36e6ba3fbdb2cd0dc96d2a98539c5ed36c26a3adaec55612ff0deecb14d660e6bbe9b088b0a01308eb51f04e1e3a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d10c46c9272aff33ac5291daf9f3b6a6

SHA1
830d1353b264a4fdc17246efc8193984b16b1256

SHA256
cf7575f706a484c4730f082ae3a6b87bf65b3c3d949884a02e1e25af0d18409e

SHA512
3c66292d550d71b4909e7fb4be60ae9d61fc0577a6567799af5ab4bef6d3129bb3befef15cf94e5a720890ec130de9e47e9f23409c9245370d922dcce2cf9e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa4cb43791b9f776047b9d65908cdb10

SHA1
ae15a707370fe5abfaae74f2c66e719c8982f5c7

SHA256
e2d982bfa257a033d0704ea34180d736df8d1a4e83261fe1265d180e94bcd7a2

SHA512
1066e1261d5dff398232a311ace406e99ed65a2e91cdd18191816844ed8fae0b9c42f7344647dec454e6833193bea1780bfda431af064c21c128628218936802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b0f9b7ef214504a06cd39f0d7c73659

SHA1
01d7524c3459186299188f539fb1b02478630e78

SHA256
b00855b4021aa6b2b7cd66d45eb07c8a57947eb386679094dda4e575c52cf885

SHA512
3ee9e13161d80040930406cb404b95835208e71bfa0f405a19ee67729c072d5966269930143ef3be9a8b2d875767719759237e0b5e05889a8f60c7e5ce9f40ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a09c9b238018770a8501a69afd718b47

SHA1
931adcb75536a9ca5f0ee5f19747a01e98ac1c5f

SHA256
14242cf7c98dec9e3f837758d14a4bbf2359a39460bcb836613c861808f063fd

SHA512
4c6aeb83513bb221f45e556d7a1bd98d18c280b0803f704b37fa9f142c665553d1293e5355547709ff35a148dd9e7cf78c70fc5e94ad0cd190ba62e86125cb90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
960bf75094165ca72ef77a7c0159facf

SHA1
b14c761e52658990bad64441ecd713eb66909688

SHA256
9406ef8b56a8b5638bdc5455cbe8c6b1e2ab85e91767b3a13ca8bdcd9b6fc93e

SHA512
1e3bc9563b3615bfedc6c49f202df2a6af17a11eda0662f79a698236af01a716578795aa75a5770ea412880fabc61d32576764f313c19a66ba3d0bf066bcc81e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d05f940104e26e9aee30fbd9d1961a8

SHA1
586c1d128456b22ec1abbd42386301050e5257c5

SHA256
251693574fbb6d40ae8e130211af81684da8e789eef7b087b551693abe81a85c

SHA512
c818dba3c72c8a4028bf444535abdc96f1c64020b4a4d5c86a444960583899e421c031399c1fd10ac7e97265acdeb6c4164bc08ca2381b3a8cc1cc4a8df81ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3765ee07f008fb5578eed619123d7c1b

SHA1
986fe8d3fb5d6edd4e225bcc81559d5d37f84953

SHA256
34b08cdb63951739ed6b3f58a9479b773156625ed5d9348b1c62286d52570979

SHA512
2b8d140ae251607c720bb5f03e7bc82224a4448228fd541c109b0e83d726a334983509345f78ac794b94216f0f79c6971f550768b9ea9bc3472284852b20eb63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d4289e127f46b0bff25647167ade58

SHA1
8830193305ab92e7673affba0366d8cea1645daf

SHA256
9b50e9e8e9842c4f091bb704b9d11b9f39fc2a4814638dad9b30dcf4931a5170

SHA512
21908bcd5f3f400d86d2c551e9926bbf9ced904af659ad1d82edfe3f49921b3d712c7bc8ae9cc90a2828586104f850265049ffdb8f7ddc5cc9f0606b407f893f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe27e6d0abe55130f69dd7e92671a8d

SHA1
640b9fc7538bf7e438fe9a180425b4aa670676c3

SHA256
0fa16d942c6572ba6b8bf39be83a623c5526929b32da8e00256fbec05162c1a6

SHA512
b7d9c536e34318bad4b5ea036bbd72ea52c06800a4c5b1653c74fa472ebfaee032d5d4af7a1e2972f89d71884309e14e048a8c83ed23865f84b766233bc75c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c45b8748874612a5abf626fa241b7f

SHA1
8cb5c7f2020c93acf901887750a54c0f7001fe17

SHA256
5832fccb4481538429915a694c4188c234451baf9b2c6edc6761d58f53fb3f6e

SHA512
c275199d1d32a3103227c9d835a03e6731548f40afa743763812548074518b1ce7e114067d45c4f0aaaa47004ce82d3ce4e145238b2bb8043faab7615e079cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabdc7a93fd592dc96cde2d03916971b

SHA1
af998aaf3a5d6a8f67eec90c9a9b372dd419636b

SHA256
0323d5338d8414940768b9704223809cf08240ac5e87157ef6eaee3a55f67975

SHA512
3d3a3013fd4154d0552a9d579769a783c73ddc2752e1fc48e860c53a70abcbadd656fadad1f0273a03ab9a531eb325f80d01ddcbc3ca623ff439464c2ca6287d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a28b655fdba9511653feaf038048f79

SHA1
fd4d4f7134321c63b041178088b47c94c1a4f692

SHA256
3f0a4ab9e3e32bb599f34c23b62816a77c4cf6769afb3735e61bd755cee39c78

SHA512
21f8f9bc3f68656eccc18b96daad57c7421d0e91ff5f7cb5fa717479fd8f66b1160a9559419b179b6c1e1cc3c16b07e9cee645cf60d322280a89a73774df7f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8529.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar862B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit