a730a93a78638ed4ba686463792708a5d7f5edd47c337f9fe963b924e77a51f9

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

514a40a8e130cf7f00480db35e3f4b8e_JaffaCakes118.html
Size

149KB
MD5

514a40a8e130cf7f00480db35e3f4b8e
SHA1

07e50622b4a1e0b5fb714eee482220503b154a1c
SHA256

a730a93a78638ed4ba686463792708a5d7f5edd47c337f9fe963b924e77a51f9
SHA512

eb3d106e430df0a2dfdeb04b4244b1dc5772f8eb738f0fb9838069ba23a27b5bf77a9bc7c04facb1d73c2399a4255830de9625821480ecc2f863387929b33cab
SSDEEP

1536:SdtKppttttQQ77BBHH66VVPPdd88aaxxSSBB44iiBBTT5577VVqqFFHH99ddrrWk:SHJMw8s7D5MyC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000006c93b5eeabef123cc519f88ba3b3656c24c936b113709a3212a502386d905c0000000000e800000000200002000000067cb191658d2acb9b874275db8ef45b41613ad437a487726b3258ff1d2b900b92000000080067b4a8d8eda3d9683d23714dfac55682e6845c9d9886a25ff12baf1fc9b1f40000000048a132d3424b588d7d095161cd76757b334a61914408d8116715a70bef12b287eaf2e76b8ca23fbfd07e69d98886773e1eab354eea617780686f7035ea98187	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ad07f8761627c6c0d8df418084a069428af796c5983f7db19ad9afaaf6521c3c000000000e8000000002000020000000bfccfcaab985d8d830f9b9a83a4a7a29983392419622f67babb9c7bc112c3de59000000011c5470af919daa1f943f4652ae077f4eb98ac7d77599c9f85060b97959a2425d8efd4a9888d1846e86f4c8540232449a34e6c6957ffdba4fd724749ef26395740a44572440d5ca047b791fe0870fc0a6c415ac44ee357d831d8bac1dc01a273ef245d002d48b086cb1a0f378d60ca5e87a26efec8842b4e56a940513d506cc755348d649ff03d00798eb3a8e256f6a540000000c863282bfd5eaabdde7e8768fd935dc5a7fe3e6b841c9d78f6ee922c80da49fb32913558f54f828a520bc29a09a5071a244572946842c22adb1cc85381c56b65	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a771d496a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422138664"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5756D81-1489-11EF-9969-66DD11CD6629} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2612	2964	iexplore.exe	28
PID 2964 wrote to memory of 2612	2964	iexplore.exe	28
PID 2964 wrote to memory of 2612	2964	iexplore.exe	28
PID 2964 wrote to memory of 2612	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\514a40a8e130cf7f00480db35e3f4b8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ab77d1dda0e036f70a7e1a22415b916d

SHA1
7ac32ca818d790962a6787832a542fa3d28fb5c0

SHA256
1c843cd18ad882139458117e84f988de3e45911e36ee35062998cebacca1419b

SHA512
a2f3f6e347d0ae38d37c7297195ac7b0eea9782b673b06c5c6422a4cb98ed1026cc8e02e042162929c091085666515cbbd42ee912f3f1f71923da8013e956890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6949eb6dacc86d4b0817dd609fbfaf3d

SHA1
bb3f6a83c8fe3098e8456be5cc09952f0af659ef

SHA256
c96ae2e0c6ead6ef55a62d04fbd4f2c8fb72d79d48ad74761111c70ca5d79969

SHA512
d4aedadb1f38729d91affefc7a39ceaca451f8ef48fb3de633afecb58773c3e3838f0e00f713d7b045019913d1362da56248d01593b644527115a449fb44ff4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
987c11e3e3923736a363b8ec4fd20b37

SHA1
5ac527e2d731a72c08f131e761c6916ea0ed3e69

SHA256
38d06b3e0b0998ab12bded3901d934b6103bd7bab49e306881ee87de9f4b5e95

SHA512
0f931d5b7693ae72baafd743ba8f213b28f4fd5ed5c79d7edfeed23ed1dcdcb9bc610e4e7efa0016fe9575d2b1249801d30f8ad5983dd97d84864c293dc8f6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
face3429d27372712c26928075170f85

SHA1
0dc9102fc9b1367a09942a46d6aedb05845dd2b9

SHA256
c3efb44a71f5a29b57e12ee6b03def5ec05ff0d0c459e5eb42c01ce8fb22f875

SHA512
c3fd07d5b88540be8aca2cf27753d3525aea2b9d150b18fee2f467daa891b8066113d8b0b9716ae7b3d25b878433b83a7ae890ddad1058fe84ac7c68285abaec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fef00c0ce12868c763d5c56f93a8e41a

SHA1
a8bfab680f417dda107b987e52b188ea4d204c84

SHA256
88081de9313a954b99803a5f24b6f855f238ffc3ced9c7bca54443c4b73b0b24

SHA512
918081cf768eed187bb6a2054a3e7b1a3e2b56b8458bb641681ba7ff2ca10541051a1a7f62956cf0f0d95f5e2463edb9a15424beb71f8c191f915584ebbeec46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5a64daf173c58b75d76aa60515148c92

SHA1
e7d0e787629df0a191553e8b67fb1fddbd3799d2

SHA256
7498819b6d51f4952dc807da59f5380fbe2daffdc256c0b1c73886e4663100bd

SHA512
956cb235385dc4d91500cf2570b4a940462da52960056e998a5e7a4569948c6c679b08d6f05d882c454bdbde975a9161e6556268df76c7e516311d79f483ee6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ca0730107bfc9fe3e8a8fc3d7752904f

SHA1
e22af43b97c35555449341c0fbc346bc7fe9d275

SHA256
99ef4e0fa8366b5725cfc95f726dc575e70bfbf0f0e031285f1e3d747a1465af

SHA512
a7e38ecf4e33d977616e9812c5ac3dbbcc0f74e296d441d9d47f52ab9cb626cc281f978902ec184e51f4802a8855d371d4a775215f53e7a2740741c2ba79744c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6c9572bb55d3d1296fac29cd334ece5e

SHA1
acb6921c1f02047d5bf913376176a6bf4f5f725b

SHA256
9aabf17bcefa5a624af4e52d71c89b77072ac2fe5d32722cbcca5f9285191ce6

SHA512
949424fb78571eb19869bd160fa28e6ca8cbf837f21caee47e4b1d06a4af2530be3586fd0caafd1da1bcfe1b65de92def5b30e9c2f4c52642ddf3d8a7c69a2df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4066dc061148384859c32af99ab96459

SHA1
aa6f75b57912d3c7eedbb870e4ffaeb34386031d

SHA256
5b72c735be7bacacce5cd5e864350b1cf5b94237adbdd4a666588e2eea051c50

SHA512
4f1473ba58f8dbf2d1371e1a2c347565291e3d4a4fbbe283451eb8348759310b140eae2332c7d42cef9a7d2844a13bf8fe09ae24bceed2c9b1dff70344391136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
94360083d35dfb17f707f9a207ee8e2f

SHA1
fe3b8c615aea181ac6363be8cb38114f88207c12

SHA256
4d0a0dab45b7e606a83fdca93ee0ba0880910ba29a17d18ba3ffec11ac213224

SHA512
7263108fdd73b4190fd0ddbbbd7b42a63b068d92c8dc8327492923c8e0103cc380c8ca7fdbe7e119bbe5d0bc3adebb3427a31ae96bbe67bfaa75133490192693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7c9a5beeb3bfd9f5911df9a48732704a

SHA1
81009ba81097fb10ca931f40f306aa431fa2c6a4

SHA256
7f1e84a2293e7eb725cedb934d9690ae3bc181e830df2d639a27fb5d78bffc5b

SHA512
6fd641bb9a5fc22e3cc40613b68d2e43b67205932a9bb93bfb51698c16fcbe9ed0011248b58cd3227c08ba6ee19bb771cb11bed71e7e46e412abc21e9ae91179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1070766672db05e141c4daa3abffd403

SHA1
6df9e9e240af3c6956d49de298be18a5349c6d22

SHA256
1c35c899d5aa831b51f4d305728b03904719aacbb0b2008ec1a305a7ea44d375

SHA512
46a51b8bd303a1989cfc7c462b04b5c4f0fe24764d4214084ba1179e503f71e5d51ce936e44ee0ee81a1e941d9ea52a2159dea8ba09ac91bd133e77df87d6b56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0fc3d1159d08983e0135aa46d5c71b24

SHA1
945f8ba7a5fde6aa1b7e4cf18eb6283565c80dcb

SHA256
e21c88b49020f0c12bbe91286aadc5e028a6c0d8e0347fbedebdc3553a3c7487

SHA512
c3349186df97facc8bca953f74112a1a158bc767e0028c87cb9c30847bab74d240f4950e09d872ea7dfe7d5849c501f99bae2e19afcf2ab8d80ea038d77670d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
51ef197a08e1c5a3216fcf23735979ec

SHA1
716f1967f94ce3140c82aaaa5f990de2d9552f03

SHA256
4ff63c07872e1599f24638d3398db96a28adee7f189da10c67c07393f93136b6

SHA512
29dda3c9ea716136d409ec19e170fb8939dcaf8f2bb97db851c28ca5503bae77ec9e81e969bda77dff25d2b7cde48df795b9be579494b42c3edf9ce24b64497d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
973bdbb59bba1b8d73399a2d729dda1f

SHA1
1c21657474dd59f52e07ccdfe7fa5b48603d5b32

SHA256
31ed03e9e0f945d5617a646fc62a1ac6432036e5bde29f55a5b13a9a8ff6cece

SHA512
444a1768890cc2d26c8efdf013b2b7572aa56a3bfeea109d2df65484c59d966305b431516e0ea857d4b077a08ca2e2b83141a517b8436d90ff51913d56c6005b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
46b62005d2b4f3359e2a422ea9265b27

SHA1
87efe885787b9e0081076017af1c6a9e845425b7

SHA256
af6c17f69e81907111d5a72f1bcefd8fa951a40ccd6fb7c304a06c48aaaff295

SHA512
9be0615fb88857d13b93403f21a8266db96b455d5acc994cbc3a9e9c1acfe3c880d81d7b6b7bc0b1cbb9c2e23bdab280f70633856d5a9aa43d901d6f38be925b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5C7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit