a0459dce5061581c89f69180b949306b41f5a6451a7ebe9ce567e2d9b6eb0a4e

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dc220a9ba38a2f840f0721b4de03caa_JaffaCakes118.html
Size

22KB
MD5

5dc220a9ba38a2f840f0721b4de03caa
SHA1

f2d14d14659e2b0d1ff6e9fd1efbef0ec9d3bead
SHA256

a0459dce5061581c89f69180b949306b41f5a6451a7ebe9ce567e2d9b6eb0a4e
SHA512

4d563de203b44c4812845017a93564e07d545920a753913d76479a3d3ce3dbdfbf556996d19fe6a8ee364f682ee762a3f5ba2b1c6a3999811ba6cfbbcdd50aa1
SSDEEP

384:WHtRlCui+cW/jIBmKR0/eBumtqZLl4h+Ld9n:WHN60jIIa02UmcZLl4hUd9n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD720EE1-1676-11EF-805B-F637117826CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f4f58483aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422350312"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000063184252b1f8b547bf43d7ec64ca092bfa39b596a6f84498235b405c27aaf7c9000000000e8000000002000020000000c56d85ce7fb56d162ca424352c3d1eace8555f13d86d95bd619a06c9bbf3b5d79000000074a82f0897ad57ea3f0963f53dacf757a85c062174a8986e31345f0124a73dedeae9ec78257c0d27a80dc907bc632987ed069b3087bceb8ed51371b59e1853c1d76b989bb00d3dac2c5c00e1a11288d81f46c861ec5792162f50f53b6c7f15030000eaa7c136467bf93fb550b0e409dfd420dc27859f3e3c305af6af571c5296001941935e030e2a73fcc5433b9a9716400000007be47f478a1f6505a1a6373f28f1a8eae757264991f23e07f1fdb17ef84f5f1f044f1e9298d4d2c819b07675a2c8170576692a24d5ccb1d5b52a992977ca8104	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b039ea109f54d549163136a1c3eac82daec5b11c3be441620895e78f52343f5b000000000e800000000200002000000092c0373361e1c9c2a91d92193485d6334498d768d1741996506353a064c5f9c52000000059cfac55f4325352ee239ab3a3aa2791edf5afce1dd3cec57d33eeabfa0e38674000000053de80199b8da3c377fc95d4fee5ceb6ca79cd5a8084e4103e41a81fd93d9aff927835e591cad5a71aa34aca05cede7498f3cd9f63750c212e25d0d7e4fee422	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5dc220a9ba38a2f840f0721b4de03caa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b834880eb5e602b9f44d78adbf66492e

SHA1
be20809c4af3a9d1d79dca96fc0fb522c8a2561b

SHA256
ac3b8ce1531a7d2e990a975b98d75f060c04c18c22ee0dc743eb3b68c33ef691

SHA512
b60fa0b450fa8c709b0890c1dabe0346b747980925985ddd74d4ff0c25f8d4507ddc1749319762ca5ace4fed7ec600f0e11f8648eed1bf77ceec1ee6aad41b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa10877725d0b2e015f6a7cf9ccce276

SHA1
bebeb80f9cea2bd3584d48acc6275b09c8bb852c

SHA256
938cb33091d2481187a4bc8b51860306850e1e874dba3f25fc91e124b2bf386c

SHA512
67eed348eb7635e776173fed409c1fc6db7e42c3d48b1c3b7d0b8851bf533c248fa0e752e6e4b9822e1882082684a1a1245c287cd24ebf81655285f9f0ba9851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495d41fcfaf336b5a97ebd53d7ff78ec

SHA1
a76ceee75cf1cda540f2bc47ac8b764d5923f117

SHA256
6bc7758a5d5c8cf637fe9257e42f4cc6d4f3ec9da27e0e32a273228f847b1478

SHA512
89a2caabcf6eef2c027883691465bade3448368c0b03ba2847158c348acdf76769a11c55dd240041b020d53baf358f153bea634ac513b8cf38a42be6449f5620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b18b2d21bf434dc94cc9a274fb0ab2d6

SHA1
26add991cdb10b6589c3507d472a27e75adcd491

SHA256
0b286aebc189ffff600e2530277a521add2952259e1470d02b212ec63cb4703c

SHA512
cde719f43ba8639982bcdf8e680a440a0f937e5e7e1df1716a44bcab55300dcc5b5352cc8528c091675362b710de9bbf34e9db3889ea69cceebcf3ac9137e432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73e25fcaf4247b002c9c77dc12aa837a

SHA1
7f3a5f9601deae9eb6b6597034e1084aea7ac7e9

SHA256
c915e87d38780453b2e7ab504fb94e5fd640708fdf950e4277e20766fa821d32

SHA512
fb9ba8fe5f02442c54c5e3572ef431418ef6f0293f018926aa108c9a080df951feb53d3659e75a7b63e0b2b301fd140a6feb42a4f5c32fd94ecd0101822dbb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c05d833b3b9583723029dd2b945800

SHA1
faae813a0a76a193727fc820bf52678efa4df00a

SHA256
0d8def85f80788e0c6197c7687a1661a8bd97f910146be095ccb0f11728f5c56

SHA512
d3523e45a8d17138c4029e1bd9d6ad171e5417be878707ad50ce3de48a27b487887c8b873d184f08cbce8cac688cd0e48435fa2a33f8bbde3239bbcea3dda420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b32a9cb42c73c5cf0d81fc359d807e1

SHA1
b0d8102f06dea55d37151a83f8b1e6412c8d1113

SHA256
16937ec46f9f53b99e5c21f93a60663fb7cc637778d482518160af3d1e245dd8

SHA512
0a10472ecd2b61689ece76f1abb08e41055429a057563af828e3fd34c6c1a2a2c63f8683876c792da50d40e432b168183905664d8194ca94b76ca06de1f19c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a959339622028c2fd2b0addf9e69c7ba

SHA1
b565858da983e2e0ff9e79b815fcb66b658a1e6b

SHA256
da69c9340761c65cc4883bcadedb7f6e8b45dc47a695fb97a1cb75453c0fd095

SHA512
cbbe071a24dcef77620fd1bd44a41335f4daced7d20ba4d0cbf2d391129ee7a6478224330d5be2f7ae6d1e75ed7cebba4f41aa350fac9f2256705532dc9a29c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceaa5953248f94e8e910870b0299c7cc

SHA1
eb7a1f00e4f8f765bd221e861d5e4535d3ba1cd4

SHA256
94066ff4c48b4351e6a798e34353a767c1c9a589bf4f9fd3b828c40d8c6afdef

SHA512
f96194d92f3a7c70a9f034f5d35e3275ecabfbc2b318a947559bc43b9a0dc7e8f6cc5a73de9e01d51ab050b453bddaf327b9ae738196557a0e26212b382f3727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb55d780b32e82ed52c1180112ab588

SHA1
c1cbe59e5c4c8460df2b698f98d101adb063b621

SHA256
31de33f949054fde5cbf37322b9bb5dd0a2bbcf969a96896e75d7b49a046cdfc

SHA512
8d873afa7bbe367493dc277f15a651b2ea83f564f11d10dd3f0235de1a9cdb1bbfa48b150139517515cb989e3dc5ead7feaa45cd983fc6a7dfa3d6ce4803ea88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc59e32a6d4b6d9d6c19898a3d26d633

SHA1
43373017f042614f1e695b930154eee9d27c38f2

SHA256
f3fb5bb6b25a5e802c3b4a1789e360f560096a321d5e8d682bcfec2c8b1a0039

SHA512
5989e61ad03e9bb45eef22b4b878e348dcea2c12b3a2139b45e737811bb68e409f1992a47c220f5d37af48c8995bc83652780c459547cd1b05ef3b028ec7387c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5dfa214bcd3270f8302bf4500635476

SHA1
5d405c278cbcf7d3d24cd271a633e1de40e689f7

SHA256
b4733d91f230da06597bd6243d3f8dd88eb8b547ca0dc72d57bf6627039259f0

SHA512
75cd49a14290f2116fb12b2834e8b9a7759bc90f04c27e5a4ecf4e903dca431c72d85c0e9c32eaae168eebf0dc279cdd79488206e06c5dd528e6d94cd74acfa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
973ebe790df01039872bfb5bc8ed3d2d

SHA1
5c82a47cf62e0fd297c983e8d33919423b404f88

SHA256
6a3c231261903ae63f12f2abc2aef5311dac2f48cfb00df8fc29eb6b18b6b314

SHA512
3320c7be6eeba5b3f30bf63488209dc3238ffd07a8f1b772d042ddea795f89e2148378a71b51a4916d22b88674c5b8da35d489e87369ac4617682e0274bbcda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab2ad5f3fed071016d1cf4089258c079

SHA1
43ab84aa03ce6125fc7a91996e55ef12937c3e13

SHA256
ea8fd2a3fa1567c2d29b916e85182be12d5c568a7299ac659c170611117321e1

SHA512
cfa4e158aa19fb21b9177ffce2fd989d2fdb96fc0cb060a359f4b9cb7c8bf7027c5308322d01414802a52eb4099196b5700b31a70702457d0867480e354bd003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
931937876727d4b6cdaff4ee68490aa9

SHA1
19adc9168105a2599362dd467da5c66c62cd7fb1

SHA256
84f39f46d362d605d6f8da9677eb8545ed1d1343043863ca3ced1bfff7fba491

SHA512
abc7370ff0d752df20b5f8541a33f3101fd76cd8a1577bd7d9957e6f08e2e9c2c9050b4d4a049a90f6c5a6c4d3bfd70c183b3070c925906823762a2403cbf89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c84e86fe2458fb372ffe324cd2890d99

SHA1
47b651f93874b067274f30e20b9395c95fb3481f

SHA256
3b53ad11393c9b0b4222674336476ea6a9ca17b578110bb1e3aa38006c41e33b

SHA512
38a1fd7f0939d830dfadcaf33440513856119d4b44cc6064bf3487c2fde5021070fbfbd3b21b60238318d8d4203e5183e03779c29ad36836d75cc8f3f9998f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1622.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CE3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit