4ef232b86716b0463bd86197ef50beaa0455ca717845ee90945886ffac4c73cb

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fbd83690cafee7a8b67972c7d2d7dfd_JaffaCakes118.html
Size

110KB
MD5

4fbd83690cafee7a8b67972c7d2d7dfd
SHA1

848572fb0a88258d784697d6147d5b10eb4565d7
SHA256

4ef232b86716b0463bd86197ef50beaa0455ca717845ee90945886ffac4c73cb
SHA512

99eeca66e70b8c6f78d7a98e14df10e7062817bd286e1bbacda3b117b2c5b32b5d81a0acc33caa00458b697bda9905e9ce36273c732493f6c4febbb89283d093
SSDEEP

1536:iyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSz:iyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ca7dfbc7e1b022248a884eacf8c76e543e2810fc6ee2bc10bb54428d5676a01d000000000e80000000020000200000004d4f72e68b5099b3902f7a826fb277d12afd498e496029a4f3cd5317dafe7ccd90000000475fb0fa6b16f6a489074ca0cea442a156f12b12b5dfa90fbe78bb5c47562a9ffadb3bf7157da9f095476a6b15e5565939006e6edf6d19766cde11b71dd5dccf46fcb2c1659963a7550ad4421694477c2e5f6774a3bb8bc3a0b3744dc20172d8f6f87cd27ed9e5eba4e85bfa63ab16e99a10881a6093991853fc4ef0a2a7edae2a2f032bff8040b9e56191add39fdd0c40000000851f92f91e0798190d0209a9dfdd9e4ea09d812d8c6f7416b0b9275bb26c1d367d7e8b89bb085f2e05afc1c6b406b355e853d87610cf111743512b3ea2c5b0a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422109105"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a8e9d851a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e291b83b44426c6e759e9d9458a64e9ba5820b5234e3e903c7a0a6ddab49a923000000000e8000000002000020000000df7f8d91b88757fb3af554346e2263f38d65f04ecddbdca64a5c00d2bd9f2ec220000000513d7a2c9604fd14fff3217ef4b14b1446df9d0ea47d78376c5dd9ee22d852c240000000346e91768983b71fc20ecd0732aeca031a65dec289903e5f9b5c5dbd615aeed9771bbd9df1f12755ca15adac5b38964dc2215feceb9d12dfae3d548996d673b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1375C941-1445-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2612	2140	iexplore.exe	29
PID 2140 wrote to memory of 2612	2140	iexplore.exe	29
PID 2140 wrote to memory of 2612	2140	iexplore.exe	29
PID 2140 wrote to memory of 2612	2140	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fbd83690cafee7a8b67972c7d2d7dfd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29ff59ee3551b80227b1ede8dd088096

SHA1
9f3ad1100860471129e466e2e7a17eaa9717900e

SHA256
01416d8b6eab5c7edf7a4333bfe136825805768dbba4497ac17d1bb15df579b1

SHA512
3161148ee1bd976022bc918125b86b49fc30714a194070cd0b8a4aaecf308e6015b5411ba19f08d220b0ec5a3bc39ec028602974986c3a4c4a9f9cfaf1426d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30193664832c3bc9c1ad30cdb64980b3

SHA1
aedf8e049748a918455dcd0b6bea1379e3cd32e6

SHA256
b267f97d488b6c24a0785d89133dfe590a17bf4d8b14cb9ac071c7d0bec38d02

SHA512
9f244d4605f10b76fcab780143f574ab1ce90dcfd66ed9a2eff53d28b28619cc33d5f7826dad53c90b2b298d834bef7ba91f0d9ee999aad2ef0617fafdda8b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e1a83023908e056bf0fa2d400f4aeff

SHA1
b5b3e288da3a75133d189ce97351850f72848121

SHA256
08401616b5b85a5e21076f43c34bfb23e6926a4f8f3ce6a313b3b9147fe815d6

SHA512
d9495dc0c14bd4e2e1eac42e184a9ecb5ff58f7d98545e2c82842ce3274a566fc6e1e101443c73f911219467fe85f06b9942f1462a2d3c65766347bbe9bc731d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84f83d8e88933018e26df374c5a7ed06

SHA1
5959518b5bbdb8000c75c37a65a797db49ef49d1

SHA256
833ab8edf1d1ed0a76b019395a86d21190615cf69481a17eaab5d59c28bca472

SHA512
d286b02f1c9ded4ce18c173529b7a85bd2cf9fc1fd136c31d21f9be0f1e36bea0d006afd6854140ddcbb947bd00c2f7d3a1cf06a32cd806d8732f93bd4e77f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f8093ac6335e99b8282fd7e5ae47351

SHA1
009e12ef6046a3d59db70067456d75c854d0d375

SHA256
eac89688444695e33720a8bee4659580328c8de00637e13f792cae56eaa818ee

SHA512
8e3f8559bd62b77875f6484bb26f481253581670fc15c263dea65c7c885acf02f5995023792a3768f7713fb756eb5ad3a843d769c6349f9b945f673e8ed6fbfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e059e446321861fd597b1b89a38377

SHA1
ef597177d53add05af40fa124976c09f662cf478

SHA256
302278936493e4897fa20e74d98de40e28a5f0a0ab6131ee265943617c583244

SHA512
c9df35d6b84ff82a1e49e15717cfe01dd9ce07ee712c18037edd9bab55245ab0771021e43af77204547129d84e5dda4f056b023b6a9c4662cf88a3c3520a10d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cac95acf6709966c0093218ccab3da1f

SHA1
8ccf506ff2d9d9f5252d3da4365e55e9d14767df

SHA256
af68ffb1b5f8c1007528532c52f0fcbd79f0b2b3f627d187878f3412ea70965c

SHA512
e87e20927c4d4a98448d17d7bda5441936fd1d28f92ab0649df8aaa3521b51dfbc69679b3a28894b0f0ff04b86551d3e3a7d9401afa16710be297222446d624f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1356862e464906cd11a1ddf8763b099

SHA1
bff61f133dc1499cbfec8404620450b57838d70e

SHA256
90968da17f43a6b217602a441321a2556f4547e47bc9a4b11f72f301284ffe33

SHA512
08799d55b25fb61fe18d782bbee633362ad7dc5390bac9ee4046d64e92da17d45f0f4eaa84f58529bd984ec508e29f905d90fd3bd309dbc3fd813d8fe1567f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58e70270cd9a2caed3d056040500aba6

SHA1
3646b97926e7364697c0994073aad271617bbbcd

SHA256
1ee5c4c8614c4d8239bf854329fe2028b8ebcaedcc490dc43c50078f342911a7

SHA512
b84aeaa8d36072fcf137f77c2116bf3dece57001097e7172d4a143cbadd5e8620d923739f11104cb8b98781c8a575fff1f3a8ff36c5b0b7cedf9ef95417459f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1881fda62a9cd31557815584cf7b852

SHA1
78287e4692cb1810121e63742d9688e6467564c7

SHA256
2ff3b60cdadf924e0a66affb29bb35bd529c77f4267fc462db9f13e9a1baebc0

SHA512
19724c6beced422fce62edfed19ddb837d661823abf95e4a9509a3cef123dbae0e2d6245ff37b43b03d203c382ef9230f08fe59eee319d6ffba3af631e9dc701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1dc26517ed30867cf7e8b5a1b2e7068

SHA1
6427459258b77b3e8da0485d8e253436d422f0fc

SHA256
6d8282683d7c72c9400e24cc3e5e8fc07366d0546e755328d144f4b34ef4719e

SHA512
99c9fa169ad8f15af1b1ffd5f1061661e3f040fb8b83d904fd9a911b79848c1cb6a26b9bf9ea1382641000c250f95b24683166b830de61046311af4352909319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3075.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3144.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit