df987bd1d71c39d459722510de164df1ab5fd242791e08487a7eaeadbc1dd6ca

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ef0b3099f2f7ca54c492afb323b429b_JaffaCakes118.html
Size

460KB
MD5

5ef0b3099f2f7ca54c492afb323b429b
SHA1

c4d5c3189e62e4cde5b8f33734169452ea1fc3c1
SHA256

df987bd1d71c39d459722510de164df1ab5fd242791e08487a7eaeadbc1dd6ca
SHA512

9dc4668bf38466d3472b18b400fd36398bcb0d4e46fdd510fab1cfa7551ea4e30846431307aba3a07843cdcd9622fd31655192da4bde2fe157adcc6231542270
SSDEEP

6144:SbsMYod+X3oI+Y+sMYod+X3oI+YLsMYod+X3oI+YLsMYod+X3oI+YQ:i5d+X3S5d+X3l5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608720c9acaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0868E81-169F-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008c263d3a6d2e7c7a678044bca28655ef8061174747949e15616f2884beb79ad1000000000e8000000002000020000000017cddb549296af33f4cd7604b019daae60a44f0c69f905f80e10850def30b5c20000000574bc0be90cb0321d877730cd19dcf86cce35500ea344bd9447342da37041b9b40000000d39691e37d1468971261cb34e775030519891c3f6540380dc8327c6af89ee1b5eaad9d6425c29162a4e8c736da8c261acf9498aa3bfe589430471443eb5b79fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000046fe6b17c08b19b75a9048a0f355fadc2086a92320c67cb57cb00cd5ebfd03dd000000000e80000000020000200000005beaeed4d7fd7cfd9ac3ed1f2f80f165c7ae478be7e613b1e6392782c056d876900000009a4ee94166ef4eec7240524a8328990ea42601f162b2f5aca634d12854f8a15efc2f92d272cf24b526253622102a98ee2a1865dab825f1fe22c02557ce805650e29a78abd78e9da7114d89983e9168cf76a0ee173f2d93afc153d8e61466395e28db8db5f517b17e37cdf00b4d688f2dd6d34f0de8d21f1dd6f994aa089b4612a10600e40a93d55520c3c83e2c72a5d04000000015b4d2b94a0eb8ff87b9fa8f437a49e4a8f469be26a9c3dfb90174e51e75bce6f5c0ade8742b5865d068482d36287ee4cc17ada93a5b52ff76bb7cb093eaf7bf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422368034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2804	1924	iexplore.exe	28
PID 1924 wrote to memory of 2804	1924	iexplore.exe	28
PID 1924 wrote to memory of 2804	1924	iexplore.exe	28
PID 1924 wrote to memory of 2804	1924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ef0b3099f2f7ca54c492afb323b429b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7120cc632801e550dd0b51bdcced46d

SHA1
5ab52bfd33432a2ce2b405888ee6394551e5bfd4

SHA256
db7a40a0ba5e21611d461a9eb3cab2e41a08c2a42c61c36281fe7ea14f7a6fe4

SHA512
011fec9f01ae56a18ef88fb41d2d4183232f41a0101c8d346431031d890c54a52ad1ccc093946134ead79c405ed4f63c4a5ff30cf2da7f4c687a5274c8797085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5be46d666572802445a6e87061359e0

SHA1
0c87fb6e802271514007576614deb0533c7a9ddb

SHA256
826e89c8b8a54cd9041a1bbf87406d598708ec12785323ccdf8ca377e86218fa

SHA512
815014e7d1aaef7cd9b8e3ca5a0a8283ab45a4a6fa3d711fccf33e8396a3ffdaa7068619223b368fa6c2a14e8ab3fc40eb110afc745c0eda00a619c0b2121792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9c0dca8024cefe64f3707c07bd5acbe

SHA1
d96506947eb611391aeb443ff0db06c4b0d753fa

SHA256
5761789171a10ae1471553fb8df8a8f380dfe84fba1335f9a867c201e9089a80

SHA512
f4580b1ca9b6d3e0446678be7854fe27473f603b7a948a2dee555e8cd4ce5d264d0f4974b3533add7fffc31dddfa4c41d622c3968c84fc23bde08ff630d17ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4ac6a378c2a47ffe5878b36e0eeec7e

SHA1
f94b76c71debd8af723b26fbf61094f8c67eb258

SHA256
0939244a160524b634ebb736885d2505328c1e792042bef674864e048d64f709

SHA512
1146bab947b6b8bfad97de7c8a8033fb725aeab2c51f1853971be051504900219f5df15c24d1690f61c1d48deb4348b4c0a894a7f8fdbfcdfc85186bd71ab4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e96149ee88ff06aa196b329d3c0670f

SHA1
2faaa244ecfec9009820d75582e5cc47b9340560

SHA256
adcbfb0938fbdcc02dd00683c482c594d1ef4d2867d05b7e176a6b3ec9aea667

SHA512
75b9e357cf35ceeb78e56209caa1da083f72c2c0cb4df9bc4403b51aca113da66def7d64f453dbb54f4433644fd5766c208491044a12a367feb0148484377a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
192cf4f9b6b3b0287ef89b9d41a1e7c1

SHA1
ed022b623322e68cf9ad79828f0f6491a7a26a1f

SHA256
a6aa1a87a0ce1b6f4c83a110c22345d76c1c6929de835262e9cdc2de1a39b8c3

SHA512
743af117cf37a28ced72a5d1676d8a02f56eedffd91eb573d8c734fea55d26f24fe32e93505dac56516d27736e80740a8fd57de90f34d821847e833f38cbccb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf91c43966c94ece0c136a1c790bde82

SHA1
23b09d2c0b03dbf634ad9c9a4daa532663c702a9

SHA256
a6f347d3b57f0693da3daf5fac681c1c1e7d2b5b738bb5f3fb568e478f74781e

SHA512
ea990529455524fb23639bd1770ea450eadca90f75d9195f12159908cef27dbd0021b5b84e3623bedcf306460c33db8fdd639afac7a5ab2eaedfa3e30fa9cc63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35b7952e1c582a7d827764d12530953

SHA1
4aeeeaa5a5e22f3906386c9b0ed898ab15e0b434

SHA256
a849d40b08f7a94ad36b1fc104d405df1384a45eb4ba5dfa36ecb336a89af520

SHA512
02c09b039f18df9062d288d5f84e8c5c8306c52553769e583a33f938bebdb22437591b17ca91696f79859bd4fff99a2eb86a0c8b3c8de6d6cf413a4fd67d353d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a415a23fb47e9f649337f0966ff7262f

SHA1
08e9f08ae51c22079b5f42124fcb840c55c4594e

SHA256
db7cfa6819c1318832b677979dca0a32fdd365fc501da14a15a8145a55ae68cc

SHA512
869a3677ad572142dece87c5fcdccc40b9cc532fc95ba1c37faf38a650ad3630d755e469daed35f7d270f7c35a9cb9de48a09ebc56fd12687e86695a234a6121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e38b36705f724a24711062c5a3071c90

SHA1
7be00b3721f5674654e3f4e1013a87c5698e5d89

SHA256
fadd913ca1d2ebc5711c00a4849797f773c0f48ebad94837c704abe6d2062446

SHA512
3747b148be0cd4b4dc513c5d94dd56b17ecd9c8fc8c0e921776e5ff899bec215695664784434a517cf26ee878ba8a40515b54defd10d668249a92b0a2f049589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd4fbcbd803fb1d0609a4a967861ebf9

SHA1
c32bff35ff9bd113d42c80b9fd3d9a16f8d38c8b

SHA256
512374869d661fccb0f25135ed4420a33c93bec39816c783482ed42c0f1753a5

SHA512
b863d75a6f81187f6fdb53f08cb79a2c72f8e05969ec9e34dbf3664550070c55d59fc96d81cc1012c2d2191242d66511f9a56a94800141e59bd01cdd8c6de418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e32c5e62187b830ab2b879a79d6e43b

SHA1
5beaa800174e432f7cd286fd0cce047c9eac6057

SHA256
e405c0a4526a1d2f099d973732d8dd69da6c17fcc77a0c2fe64de29589e440c6

SHA512
38e820a981ee94d7bd69917c28725fd05c5f51a4401c789afac662e3f5b168a096ba91de2f7c95ff8887400b9cd47f546c0b65bec6c51c91a87f70b06ac6e4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d022dffaab130e8e5eabca642f9b8bdd

SHA1
3dd32f3199358ab09c7d48d6ed4ebd5d365b934a

SHA256
4926735e266920366def37f2c9160458f4dea4610d65b664a9eb1547c9ddf98b

SHA512
c3ee0adf3cc5bf4c27a3a28494fba8b27985ad4cbef05314ebe71ada3974fae1c79ff0009dc310c7243bfa43192b8c41a0fb896b22808c697759ed1e1c9d68a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45be173fe42ab1ef5e134c2d14f136a2

SHA1
cbc3e14c51bf624501df9eb2f11bc21908a93a79

SHA256
a8868670063a74be3a06f76b5f7233ffee682b57f50de7cd8873214fedd8f1e4

SHA512
e25ccf5ee57013aa3ea9a3e2d7d3ee9af5eb3f4d655948eb4f36a433208724ff44103bc5e829b6c1fcc2fba8d7aa5529eccb5c3af5fc9b13ff96a17f17f69b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d44f4e1b65be1bdc05f9f33c13872099

SHA1
1f850f6191b245f2b6d5dbe552e14661d86d3849

SHA256
d9e50af0831f9c40e3218f0ba697c944bf4516ca8d8cd315dfda70efda44bc86

SHA512
990928baa15951d78bde83268229951c29f2a02ceda95ce458802d19bbe16161772e08d910bf13eca3859f7ca310abe05db9eb41a22fb94db2f150939d376c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15e25b459daafefa203111a910b8c294

SHA1
e900a02799706c29eb799b57020e5429beea3b9e

SHA256
7e71c1cc7a0011f7a5272572f57a573ca2096abb9968dcbcf963ef0c7f0a7e6d

SHA512
7d7884989582aff038fe20be93babbdc89e7a20861fcd283803292b1ed6d907116f7866315083232a337e2d7ba203a350f3959e841c7007c098fc6887759f98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4665.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4757.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit