fbfb9fc1c859227da414230373bc219a03fe716a4240ce48481817f0e85b0580

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5eeb50a566c0865eb216c33352980fd7_JaffaCakes118.html
Size

131KB
MD5

5eeb50a566c0865eb216c33352980fd7
SHA1

0a761e670c003243706a64611f9e1b1038ec9b20
SHA256

fbfb9fc1c859227da414230373bc219a03fe716a4240ce48481817f0e85b0580
SHA512

fb0072654e775091561a1f054a06ab8cf23a507429ea1cd6a5cc0018d75284f980207c9e62790f32a119043b846398f100891289a84ba15817ceaa70737e4e29
SSDEEP

1536:qFrLyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:q9yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c6b217acaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ac21d6d30d0e292243abc01160e4845a13ca62bd25887c2a425150477da9fa3b000000000e8000000002000020000000798f87d0567334086dd9a41bf208b8a11a07c66c7d79ec89f8ba735e02f450ae900000008ea83b70cb25e45aec8c7eb7c8b499408d543b035675e98c3d11117c5acdf2a7cf1bce3c5ad3b760cd8f2abdf236b240d227d7a99952230027459d38b89d3cecaadc4a539977b99de5c240b397f726062ff7ce54b2190c44413134b653c7c915e5c99aa09fbbb1546d06ef5a496aceaa2ab74476ac7e4d234cc05c60ade1aa40ca3112e84852c5c1b1f3c37168e75ba640000000e86bcb57bfda530a2acd6886760c5d7fcdf012bf29388c1437b2cd4bec671af0e50382cf23a38a6f33419178038848d80ff9307ac0ce02168b9ec6c7c377bec4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422367742"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c732895177d3bb861ddab7cd035d2cc7d3f899595e46054f010ff2625827e2c8000000000e8000000002000020000000c33fbac849e3e90b1a1b1c4c4878bad107ac62f236e7ea9e654163e8e50d505a2000000042241c4e6593b64758a25bdc4c300e9fd87c620df0604282cea5fd2604746eaa4000000010c36e6bfe79b8e81f6f2f45aef353e4b9ab0e48b0f435ba102b8ebae8919856b4f19e34867f74ca00cfb8a1fd7cce9eba868449e906f82b9d4b33fdc010ea0e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4318C291-169F-11EF-A5B4-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2460	2248	iexplore.exe	28
PID 2248 wrote to memory of 2460	2248	iexplore.exe	28
PID 2248 wrote to memory of 2460	2248	iexplore.exe	28
PID 2248 wrote to memory of 2460	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5eeb50a566c0865eb216c33352980fd7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80949105bc9839c417da4bc7ac154793

SHA1
d5fdc31499b7a28c11e00821bfb88223fab383c4

SHA256
aece76e8b58d0342eaae654a159c2a698f4425fe36d6397d55f3030ce0ce4e13

SHA512
8147b190abdbfd86a7838f0922a2e1068818aed78e3322f6408ff627f5e55c9c8c861a50388b7045425523739fcc6bd431f16251a9fa9ad35c53c771071e42ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de31dd20849c060240ee71992c9ed675

SHA1
ca628b5939c7abf958cda5fe96302b95765aea88

SHA256
1184fee15dd173d2e8d90775686fb843148f97069d11ebd4a1fe029c9fdf6d4e

SHA512
81638b4b193163942583fecf8df165e38360dee6874f13907e688689589479c75a6599fa25fc41cae3c0816fd96865ff05c96e409bc5b286ade5130691326f97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad795c3b8267e486fec7f263c2c9d8f6

SHA1
ec2911f355b33dbdd8993dcd355e94b81c2590c9

SHA256
431c37a5f04afae05fab7e9baaa08a890b965d05ba9cc49c0a75fe73702150b1

SHA512
c3b9a5f2b10fa8aacd15250151eafad33ffcd98e2e83f6dc17e4b5f229465a763efc0e326c0af9a3a15eede4c01595f4f4d4a2ff895c8224a4e81333574cf1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1adb5d960c333f3d963cb8d80694ba

SHA1
b863bcc4ad496713a74850566dc06b9701e27889

SHA256
c9123e0d4afe9b729e1545189f39e5000b67397ebb6776953927ac7d5dc5cdff

SHA512
92674b174631d12b0eee2b768a55efbe220bafad93bcf1899d51e63c8ac69a4cf64c21f1cdc97be84842389152927957a992050e2358042fb34de50c4305ef11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e75f431aafb70bf1c736a53a585414

SHA1
ec2d2c473806d4fd213473d524a9b474d157bdee

SHA256
3e42c9b717959d9e26462c47bd965757bb0751565f206be930e229ab540f9430

SHA512
279480ccd2c186d56ef7109a7a8115d4994d8c86e9eb49f6efbf6d4ada5040779af675b892f9ef4a789cda62825129d282e3d8dfba25b65058aab4ee46ba6472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e90c8ea46502b0e20ef040cb239e68f

SHA1
08122b291e1ec109c191e6783cc4694987bb3120

SHA256
f199ec71cf986d266522242cc316fa32ac6a095a9e2e195fe1b88d1d1446a44f

SHA512
989e568f62224b4ae2448dfbc1c807a4a09a825bca8a9820de04b68649733633e3188925c00ce92883ff729161953a37f2987df956b77133ae62d7614a282666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
783271236b8846f2915399e2e75e7690

SHA1
ac8dfc210faf427b8b7588770aea4bb93d6cc42f

SHA256
eabbca85481db207610d684cc7922a0e1f9bc2da648a34a68c5553608bead85f

SHA512
d0d29943ede891a636e92c32b4eda96600ad89873cf50443298aa21dd228068fc49994b7b649f0d1fca3d66b41b782d6e7aa843039408486f4543cdd61092fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f2504174faba0b9b9ac5cf483b19b37

SHA1
602fa97dc6806ce6f8157b00328ce7a60aabb2b5

SHA256
eaef84d9b8c8def8381b0c60df2292845de7560a4ffe499cdda32cf753b71203

SHA512
734c9337ba8c07cd22c5eb5a5e848abab8a210de4dab2a9b5bcf1100b844884382345ce7f1bb89a4d2226f5300cb1571e521e055fcae1d894995eb7786ab5867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdd1b78ed4188166bdd560599562490c

SHA1
9940b97d88d82fd6764d5f75817b12800f2a9a2b

SHA256
27ebcb75fe0cae535c677971d16be9934ae627cd5b5f12d910df38c9c1b3608e

SHA512
47c1c77e403b8a1ae38084c834d4103b8b73d8a91a50cee44b2ffa4599640d8537f1a16c8346a28202a78d56bdfb4015537ed4b4b1113f4316751c4d5669e954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f0cd260beb9bdb818112cb717478a4

SHA1
49dcca0a9f6278f782ae787d53d8c1fec21e6c6c

SHA256
a750e3e435ec6daceb54df2acad8e6ede3ef991c7279d1b6f7d3d9ca22fb3d4e

SHA512
f1ba0005c4766541e36c76ae266679cc85bdf6894cd8cfb3b6e31db8ebf67cce372d9f1f8b6f49a6cb3aeb3b7c0f0b43d893306d1b689f275e39ccbaf423d2f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffcb167d7080a488da2d26ba806e5f2d

SHA1
084dfe4289d21f6d632837e666512088c003bbbc

SHA256
94be5b53a6069c7441f3c39007cfe271ef30ca0f1df22803ee3fe69222233743

SHA512
b4187e23177a2f250b4428e4d1ad2548d98679da306470bdb9f8ae53a095bf2bade1af4ef6aa0d589eae3655836a6326af57b59c8209cdcb6dd44d3e000a9103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dd1f09ba433958b32832781a2a91336

SHA1
fbb2142aa1f4bb4017a232fe8af20976efa60db0

SHA256
b90d8b3938d7258d137329e6eeca3a438ba4ff61d36bf5027372d6de3f00c201

SHA512
278a69c3f02a4b32e612fe88bc58a04cd48c07459c4c318e37b141dd5d7b2964a2f5ad96143183ee833506273052d6bc5a6b3606e80d2a0c656aba13375bf25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ca4ba4e717d119ebf80427bae0b6b4

SHA1
5605c5d572ddd6e8e212ad34fd77e6d849400534

SHA256
60b6fdf38b2e5bfa086a3fd0ad9b04b761c0cb0bbc2b5589d5570283366095bc

SHA512
5c3c0b552ea0b447d472ec7e6f9815b84b9d00cc9eb51cb6bb32619d748e35d25ea12ddd78a63acce11c0fe9eab403a57e95339f39b5182ef0e8f5a2777a9e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f8c0c2667596923c158777e09289bba

SHA1
3dae2148e2df6ddcabcea8301b13bb07b174b117

SHA256
18660485e3bb77822588728f27443554b5b5330580788c6a40c812d762335350

SHA512
895e4399c4ca97ed1bf698c9b9a71a27bf459bf4c231bd0280d6a1cfbc24fcc782b3ae3a5b8a309c4fc7246cdbe4f8702d4d2d7dbf42fd656d6ce8ad2bb301c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d546bd0dff83fc09347673f4f04e8674

SHA1
105e620e79ff920a5fb67a72a94fe7e945aa5041

SHA256
e5027bc0855c67f4f7ab6abc8cabea4f4f3b24f270c8392728ea8ea7c4e0ee73

SHA512
78f7e34dc42375fd44dcaaf6ea9130ed993a7c3d1133cbdb35aa989b6be48b5a0c549a91f14fd4778e958165d06c42f5f709f15693ea1e63b228397972289f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F6D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FBE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit