0a582e0f46c26cd96aa507a635f07ff481373f8607af4691110e8994dca50844

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

508f4ea7741bc4f30bca8eed33db9faf_JaffaCakes118.html
Size

213KB
MD5

508f4ea7741bc4f30bca8eed33db9faf
SHA1

acec39afbc09afecf0f73676f5ab61a592ab0eac
SHA256

0a582e0f46c26cd96aa507a635f07ff481373f8607af4691110e8994dca50844
SHA512

8d2604a0178e0844f3bec42e1ed3f197c00a6086f41832604f0b9e6647beb0b86f14c94a3a22ba65a43aae23422de4f9cc930216f34228e9e7aa09681e63d493
SSDEEP

3072:S8hWFMUxHXIQyfkMY+BES09JXAnyrZalI+YQ:S88iNsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422127585"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18507751-1470-11EF-9F01-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2888	2764	iexplore.exe	28
PID 2764 wrote to memory of 2888	2764	iexplore.exe	28
PID 2764 wrote to memory of 2888	2764	iexplore.exe	28
PID 2764 wrote to memory of 2888	2764	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\508f4ea7741bc4f30bca8eed33db9faf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7238ef8f0dbf8854cdb27ed58048fdb5

SHA1
e8509350ee5cdaab4fa33ee29badd419679f490d

SHA256
b432569221a475a3e14ce88365d6139b2b084a9111fc26676b4b39984e9eb65f

SHA512
069f09e8e4008b6b1961e0288b5374c260600f6d189f3f2773257f1accc5429e6c4d59b3b509a755ce1fd55cb243f502e2be0ce4312cef563278b806fccebc4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3249b2c1e2ed18c1f2c085fde482f299

SHA1
e1a399c94584354afcad5ae50a7f5bfe49ad66aa

SHA256
93f48fd0a4516cc9a6c49432c65f8f77efdf2697a8201bf936a6139d4cd11345

SHA512
211e2785a6446e392022215c9905a7f8b7cb81901cd338ae6d84e35c7873cc4d5e1e38dabcfda5f5df33dfd45ede25f2bfd06d65c8740219fcc3fe53f3388cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b4a836a8374656eae456d64934d832

SHA1
14ff2694d023afbe34cb93acd0a51229e98f8ced

SHA256
27e9080aa8c75edbc56e6e60ce1b907ff8180f106f6c32a126c270183379118b

SHA512
018b13d48d0431a12806f56c5ca71e94d15b970894fbb75e55b772fb0db48f278efdc270ddd94520f60a509c024c035945d41528064fa331592b7b31f03904b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84807538fd1df6bfd294c7dced26db93

SHA1
4b48d88af81f03dd45f2b15ed805b7818373dca7

SHA256
2a1ec20040536c304fe5f872bc39939acc4cc813353605758dea5b8a39eae7b9

SHA512
b3d88f063f7164488d6ec57e4c406be8db46f4551eb0b031323b86752bab9108384f8cb958bfbb90bde25a538b2230042a6d692af80b936d802b60dae4d9ac2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ac71e2d9eeb2e7c603f271e763e0c71

SHA1
3b67329952f440093afed8a0cd2a25ab6b2ec178

SHA256
5c7c7e07b27f5f90468a933985753e2b252bee44af2a16cbc607be6640911a74

SHA512
cd099198d5a0aac033b0c827f9349122a57c3ec3a9b365535200d7935aa86c62096c65b401feff220d1085d6ee818d43b26be7fc39d34e47a31f8f578040dbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54de9ad23b55d095c559d5ea4a7cbc9e

SHA1
7a7f4b4f905cc824ede88e5db0b1e5431367e8c0

SHA256
cb8bb1692b71e4d4ba8ccb83c4dd6198d0809d804e575147708c29ba687822c8

SHA512
694d035a64d61844f88f8a8db3b82939ab53f5f1b32a2448ea856f8bd4aeb50bbc19c4178f6203c8e34306adb20085a4e5390cb3f78ec43e81aed0f2755f6438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa63e8f15a4ad0b0ea00a6bd680cec59

SHA1
68df3e117442810d18eaeca9fca616df754eed42

SHA256
02dff8b6b7c6ec8cc10efc5fe92027933c9a158aa6b0e9c74609de36d1f1b70d

SHA512
9cd22af9363672ac150b38641f1bdcd6ca4f9aac51dc1f6e10f95af67920d52603381fc31d7932671215045881908fe653cdd492671520339fab78876607b9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d5bd10cc9cbd528873e22d8135aa44

SHA1
507a61bf18780dd41938c3c600bda7de3c0cc68a

SHA256
0a22e0849bb124fa7b649c279079ca83f8d182e77c38367cc1c133d75c1c5568

SHA512
94ba5cc143c8b69db2506f4a07c4e75f54faa18e88f3d5defb1865df4cf0b92d26912f4d738dab68252e00ad9f1d9aefc5a2fd1cab12c15fc20f22f177fe4f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b8fdd4fc0d4a21204cad68e5786d51d

SHA1
67611979d8f5a74ee11f433716156af007dc68a3

SHA256
7a4096cb4cdcdb6c9de6c565b8e4897fd528937d06edc2ca02e5d373a4d67a40

SHA512
9cf09a2581a8551c0d3f772077e03782b200f7c7ee9fc892977145d5762351016d4be202baf4e45625003e81ffd0fce92753e8756a755a047558431423c4d0a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2deb75249f300b8c5c245fad710a9fe4

SHA1
c26cf89b42c56e6540d95618409922ba99f41136

SHA256
bd394eb8465cd83bcfeb5de4a3b5745a4004cbde5b7b68eeed488223dd7565c8

SHA512
dff0dc475534e1c3535a0b56d171bd096faa0e9953b0ec0be7220988efeba91e8bd14f8806463052a66336d7aefd00a153c891e6ea214832f6681583d06785a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf0f186d122b0bb471949976127542d

SHA1
4173c5cb62b3e8e1f4f72fd7e9f0e51077ec2c1b

SHA256
e4507530ee7d5629881bd1716f34210aaeee33996086f23dde24c9bd510a67e1

SHA512
b8de9d21864c87b1a74dd0c2cc800f31307ebab233eedc2cedbaeaea92d612d8e81ec2ba5a26abd01ea8202b3a70d01a2bc48f294ea2583347601b77659e8c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f636d2c2d53c814692daa2455a13c8b

SHA1
9063cebd7d04ed9f8a2e9699e8a8f94f835574f2

SHA256
c021a18ca3a1cfaf3c0fdc0ec77cfd79ecf68efba56dd646f9f2b5b048f12527

SHA512
021cf2eac95c768dd6d29e567084a238cdb63320553de06d3b387d77f5b88a5661054e74cd3ecef8df420f751d5f620f4a4bbf59665807e5b269693a15712578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d4f87d32927053103e2a93bd925ac8

SHA1
832cf95bb91a82b50686a3b0dfe76a234d7e0a4e

SHA256
388b09033bd074ed781068540bd81d443a1d1a24e394498c81f81e690c3183e2

SHA512
3ad284e8fb4279c3a3e31d8366d50877aa541f2070da1482b14a45668b9228f80716cf7d6877186fe77cedc266527f1566dc05d2f4a2564907c903855da8203a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35a94bede10a1e9b324cf49e9c2253dd

SHA1
d4cee1ca61e06db6339d361ebdf03b6978114a9d

SHA256
e1c51b865da0660fd7d1403003c94e1eeab86a4ad8b0ca98e5fac7345c37c4f8

SHA512
3f0ebf0849bc2495b245b7560f95adf3b27b023052c615ecbc197fb1b1d7dc7aa7daff0438c4a1b5d9ee9dc7f1c85cb96b4712908f3462c7d5c5044379ca7fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4933678cd0373f4ca60a53650f2e0f

SHA1
7c9bd93672a502487fbd5159011e0a745ba23bfa

SHA256
2f997264e373aef67be3884a6272a8f7bb80bea7cd4c79cc24edd16642ea754a

SHA512
471e8ea726f723f90e1e946f456f23f225462ebeb403e329d267855e9d5cdf1235ab444146c0670e32c6967817fee37ebef9c8efd483de35ac5390cfefa12a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c6bafd8fafb9061958448ac1e9355f

SHA1
b56e19b1123c4036d089afd539d3377c18ba032a

SHA256
1d4b144def3405e4c7802207fb8ff4802c98340b8af94f91783c66b1200f5b59

SHA512
bb60120d02074c88d11c7743438193bd7637ed00518337f96b29c75f093ab0694faea768999ba886ae56eca75b50bd2bb02e5d9d94e97baf3bb24aeb9fea9401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
163b481715f223483d5d87c401fb0710

SHA1
4753a55988a43bf24d48b076277e9b12301c0918

SHA256
f8410cb79e75e4ee7be17f8b2a3c4fc63e6d5ea09bcb55dc6ad52146dc316907

SHA512
37875b3341bdd8925ad33ed3d6876860e7f7a054d688c8ccffa2cbaecd0da8cb8089c7e5c753c2608f954840e25ab291524a2af006bce58865ac6ae807b49d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff71f71f386e2b7559445dc1fa9ecf5

SHA1
bbf731e61e1bc85e2e1c097fefb4a35742e66872

SHA256
331cb20145e3cedddf41fc1605c6e418fe02cb165381027521116e2b64cee2cd

SHA512
7b42652b3faa3d97e8f100812c694ea9da9c3431c63f1377bf4ea4e77d7113593d775bb8f56ce323468247ff3cd996aaca318972f56fe028c8ddb2457405185a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E44.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F40.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9F83.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit