c0ccf404d3f28f858c986751142b9f5a318491d90713be83efa591918bc42f77

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

510b19a1f23004b02c125e48892e4970_JaffaCakes118.html
Size

137KB
MD5

510b19a1f23004b02c125e48892e4970
SHA1

9929963481fbbb2fbb7350410e2e37dfe5165ac2
SHA256

c0ccf404d3f28f858c986751142b9f5a318491d90713be83efa591918bc42f77
SHA512

c773c6bf5f9ee9401896a5a9d76d201058cdc9d0c3ca43d6cd4e2b45791d71389cf84644b9c8294f99619d10dfdd2edb3a56c7db0814fce3b46fab6722938225
SSDEEP

1536:27ldH9yASe9w0o4fhlD47BsxJKs1PbYXMTEJh:27l5Qs1PEXMTEJh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e9bf63a54c5f3468351a02e45ded98d00000000020000000000106600000001000020000000ad57c90c4c796404e79d6d2677fc93123203580b8c1348434d5e209ea12c6a63000000000e80000000020000200000000870087834bf1db401a4b9b8b22a6ae7301778833e05390eb23977fb3c697656200000002edbf04b9c13f5a65b1da2bf24e75445d719b03aa3b83ef0311c547b9e1062a140000000dd56fccd7fbc5d9d93cca361e0f4b14ed561a1d5b63edad6bdbe1336b55ad6a78f1271e6998164daa1f36fb5e9453a0b13a005ee8579dae9cf189bc2b8af62dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1040b50f8ea8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ADD48A1-1481-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e9bf63a54c5f3468351a02e45ded98d000000000200000000001066000000010000200000008d4c557744b4fd3a872e8bbddb95e637fbece6ad2693746db26f8d8920dbddc7000000000e800000000200002000000067dc65e0475cabacc6594c2cf6a03f18488b6a6fb128f5107bfb6df99fc0660f900000002e2a078275f23f6340630a5a01f7a988edef403a9a460b4119b8c8b2e11050860bc69ce92a43a445f6a197f975a10da9a5e6c7ef43fac5fb8bfa67d5d7117abf2d3853c068e2091d0601d486dd62b10fd0fb90f02b09031ed9b7cd320a9b34568a26386301953cdaf8eb02c7c5ba84bf3e290192be44d15cda38436b9a388d9225c0ff6b6849914bab742ab5588ec2e5400000004857beffd3280c8f995559d24a8e541f1fa736fcc7d77d9b7c2694939f4ea547bc17d26c557734c495ae8bbf5e52a94e77d295948e460cee1a0deb88bec2f25b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422134941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1624	1988	iexplore.exe	28
PID 1988 wrote to memory of 1624	1988	iexplore.exe	28
PID 1988 wrote to memory of 1624	1988	iexplore.exe	28
PID 1988 wrote to memory of 1624	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\510b19a1f23004b02c125e48892e4970_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
864b238a57e5cc5a27ba407fc94b86dd

SHA1
6b7e23c55167a7257aa38716a37ebef3de04b18e

SHA256
499771db9373d9d4f511e70df30ac38e2a67625ab5567a3cd7f0adf21fcd6cfd

SHA512
93b4c3ff5cfe5a3c708b1f2b57fed6d0785bbad0bf92a75aba3b83ac5063eee17af90a268a03eb873bf4c045d3f72bed618b5a23f747acab1219f2fa032f0b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a130b57d5f3d5c191b75bc16ab673b24

SHA1
11c830d0f583b8707a3e3543117bbcfc1a7183b8

SHA256
0e314efe5a282501fb3aa3a0dab99d82d6179ff44e22d6817a179ff6a4eb98ac

SHA512
3821d2b93a1da08be4a00db4a92e1805b8076c22ef58e44d2e6828d0987f2fa75dea431d89cf32b7a0ffaf85411ce2f14518cf8ecf35616d07accfa22d7e7188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcfd22a52e32ad2e85c2c3ec86b296c3

SHA1
3fa859fb578663a29a025d7cdfb7fd8aff3c0683

SHA256
02c4695dcf9516c017b26079be7a0ce7581ec93fc5cb3b9d3a51b53753f67f9c

SHA512
ec8c55321ad392d5f8c7473df7eddc7b55d8f82956ac40653857134002d82dcb9e4c393eeaf85b5e8b5764a26514c0a772ae4dda9603da4144b17aeeab249792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fa0727bcf29e04e58764b4dc62e2184

SHA1
377deb304d81c1db10e1c093f2bd857a4167cd66

SHA256
4a3c103846977be59c4a2d617b21ac0c20c319f5fbd68e922f38123ac2e28d32

SHA512
efb95bc0f9937ba45d87b2e475b94c1fc96cb2fa88b750219fc7f0f49a9439446ca6c111f854f11d69d7bc357b3b73b1a86d56d3d69636b9c89338080b05f5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d909543c65e4fb859d7483cc2d55dbc

SHA1
1ce371b82f8769dc59f481d706f810654ca09c11

SHA256
3ab056c0479e866ddc82b888baffbe55fe644d39eec23bc20e03469463a65422

SHA512
7083b4b20e88882a59003ae3c9520bb8b069c6a1454126e2cf60a9d0b50de78b2f2f4613eeb28adce95325a1e8740525d9a421b8b67a13d3f9145bb711064a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa2c754a6ee7428ec28b744278d7b21f

SHA1
6faf0542e7a3649d166adc486f64829902bbdc4b

SHA256
bdc1e40e360c59eb8134f50c63042417ec28b55d036b177810779d5f2253839c

SHA512
640d67225a7c462c9ae1c4182ef2ade08ccdc1aefd503f239981586c8756d8bfb9b1a59c3334381bc6c7fca90338128f537c9e4b70523edd6be311e2be09aa4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c23238161717c6f092e7c4d709c9d64f

SHA1
4a65e0f5f1bf1792b941b32dfd0695a604670353

SHA256
7ed814da1c072a536d4a27781b894b8a53d3474c7f070e814393f5811129546f

SHA512
81befcc85f8263071c32a92eaee9ee7069640af4c108dac6f461b5bad9169e07afd150011f2cb5963941a465a50daf9aac7ea7f3d2d628b207cc135e873d6a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a60440bf743f845e81e0f079dad64c38

SHA1
74ecf5e81d5814cb18fd3fc74f373defdbec460a

SHA256
1643ef7dba77cef44b5b65997a4b1d35399cfbd1931b81f21808b0e5cd8a6b5a

SHA512
43377c63fe987fed0e7ae7c7905d11a91a42a3319a6299cc3915e793fab9a868cb01f47650e9c6ecd5431cb1388fa3a873c893c2b6405e057a0355047a028574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2fa994e925d145c28e000bd72cce685

SHA1
57f4ee5e110d344018dc8f79a3cfd4992b1f6257

SHA256
d9b1ea3e6b62284adb043af562cb54fb602a498dcb0fe93867b16c1adfbcb23d

SHA512
4d04254c87ae7a003ddf43ba3de23430500ad9234dd9d974fab452ca094ebaa6e70a035a2346c0def35f0d35e9c74b27900af7e907db13d03138c58a1287b759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25d07d373101f87227107a03d4914d3

SHA1
8d368880d5e9ffa71579570bec244f59c942e414

SHA256
2a66c43bf03bf8b1d8f4987e5887dc753b85164544bd2c025fe46924a633f749

SHA512
7f85c3875b5144cd1015afa2d01cf4f6c4c497495bb49cf77250c056208be20f1f5c9bd7e926afc2e9c543bb34839d6e09f32d186e0e7cf23ffcb6b688efd70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf6f180300e15c4f0c5c021dd2695c4a

SHA1
c811916b2cb3ac1519cb18388d41f336b3d11b04

SHA256
a0a28a37f89881157c5bfdf9c5a82619eec3bf4254949015c2d7d0e00cc3ed06

SHA512
9f7fc14b5b75248e3e08d234652aa57bc565622bcc92fd45cd1482352df2028bddabfe6c2cc2875530e66ef5250872fdf9e7926744c1cc79323bcc18814b8ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
41e2465c34b310bda00cb7c421d09368

SHA1
8a3f1dd50841d9bb65da19740f7a792f231241b7

SHA256
a841d1054cd80d33b0a3e080586f8c032b14a933d65df7be68852ae0535e73e1

SHA512
fd50598d605e2f94dddb75be0d654d216e6f819c819506af35ed0b6ad43aac979939573b31f388a2184eb9582d9d5b7d61eea40ccc91ba1449b2bfd9afc2d9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BF6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit