2b1985c1653e751b4320d03693d74cce22dcc14986425e5ad3d958597337fae8

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f95941f52f63b67de66d74556b140c5_JaffaCakes118.html
Size

12KB
MD5

5f95941f52f63b67de66d74556b140c5
SHA1

9e11c4e430068f5aba3eccca9d693d1e2bb025e7
SHA256

2b1985c1653e751b4320d03693d74cce22dcc14986425e5ad3d958597337fae8
SHA512

acc22f525e69cd5b61ef494f0a06f442caa2a534d7513c2db0c7b002d0f919ab09171ca9f0541a804da9d4e56bec994ae111caa16c92656a5bc62700f32c4ab0
SSDEEP

192:SsYq0h0fHVCs7wNNkx0ShxPmo75O2379PvFKy99Tc4+unaYD:SQMoVCs7wNNqLx375OWz7bD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422377446"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004bb2f7734fd45814cd55b4e3b92f6576cc9b392bdf469860b85549b8fb8c2cbf000000000e8000000002000020000000828b8f599369cbf171b92a91e4c08aad1fb58e84d51162a769a9d6f66524f9f990000000d433aa9acf9addad86939d07e9a94f5d249d25d013497201bf06c6683990beed89cdffe5f1814874de38601215d315026cfda347084449c18017873300f9efc24d9e815b99eef601a940c4c77e83e7dafeecb60315ab633dc852a2525f4d78cfb95f2a2efd217b9325504757deee5f9f93e05a07be446f66106d9c2d1cc8196e40ff7d4d6f23ccc3fa3eb94146bc0b0040000000e5359b38883ae320a4f644174736b9bf8ec180bccc2e43f19c141c7718e57acbc3e18843797181ec460142b8a3b93243846711c1026e1204869176e205027572	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800edaacc2aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000044b75a581be2cf79db210860e94652029195521a9dc71ed05d5ff980d1015f0f000000000e80000000020000200000008ccbc52b3a42c542a2a1632299ccd1a28edfb179fc21371d8150cc19e0ea24b02000000085623d7756aa652369e6535d1e68593c44be0a3b316b1379b49a900b30713fed40000000ff57b9438a9c89086a0728955a7cb92d52db3d04a703d48f7ffdba6ce86f9f1dbe5b0792f1c25b393904035bedbcfa16aecbee71a325fd629bf0dfa9ca35af65	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D792BB41-16B5-11EF-A649-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1824	2432	iexplore.exe	28
PID 2432 wrote to memory of 1824	2432	iexplore.exe	28
PID 2432 wrote to memory of 1824	2432	iexplore.exe	28
PID 2432 wrote to memory of 1824	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f95941f52f63b67de66d74556b140c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ddb458a99e084d7af95ee9bb8435382

SHA1
5a583aebcdf5b2976d307c48ce44d044a2a936dd

SHA256
edc8877e41fd458f579f50817ee6f61949e60fc99931dfd5f26926613c1c88cc

SHA512
1a65a7639a5c2aa0a100298ce3d3fa62f1024619efd5713b95d883f20019dfb126f5a35018875be738bcbf2d7f8fd822b4d2b0282b8ca27f0d02d6f245d5ebfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a9d59d4c2b4e553f556996eb970108

SHA1
bc782439a8bdf622dd0c7c7ace320103f5bd9821

SHA256
4ca7c3cbdc809e367325330c35c7eb306a8b643deebb2cc124aa4a43c696f696

SHA512
301a10efe775ed325692a6366af8d80f917261ef0c7bcc59aa1145f2518f71359c509b81e97135eafa6541f01a77373c966d7fa693ecfa7854dc86dae4648aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
458ad369a4c83a95aaaed3370716f43f

SHA1
c716f460c5b6eeee1a0b125ab4083b5565d189ce

SHA256
d959caee95c9117381b8340a71ae90747ab6dc1a42dd68df6c1c7dbccaa3df8f

SHA512
d5369dd0e08469ee5f4be3214e828db7b6fd70c13832504582c828732680a18c9daace9be4d1973fe3adf8051006a08e472ebc48048b793a18980d1d0f943b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef76980b3ecbef9ce399d5036f00a5ab

SHA1
36d39756d94fc151872f74366105854628cc5415

SHA256
c0a2aef24dc8bc41cbfeae299878305bca8fb35a0460d247d45a828fad5a8df9

SHA512
172da95709b7481ae0df9b857221b0f37cd50b1b35713b89f7d5cce0e87bf23f4dcb5762a2556461d581c43aa660ba9f63e73c94f6657edb80f572548727b6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26e14bb24ffb275edbadf0e417386536

SHA1
175a2531c032bba771fdb7ac1e3c3c545077dc60

SHA256
cdd3834d02f2ba6465932758400addb44d416f8d9cf1807c70c13827209f5007

SHA512
0890b2280f336a2a80e2b27d1f58fc19a2034a4a5f47ee4f10f60561fc1049a6c293d9735010f88968d7e747c8ce8e39f30f749099a5bbfb55cb64d28fb42ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5d14b24494f0cb788a958288fbeebb6

SHA1
fe94efe4709e3b594d487d5aa1242c3cbd89c1bd

SHA256
ec6d4cd26a78ffa9c5483573c5e6b2b415cbaf28abf6ab0b99736d781dfe2497

SHA512
e21b62d8fe0500866034b6265037e5798821968cbdb720b303c84caa57337be561f5be532c42d3dffe721328c5e36a73c42b923131ed348524a52941f5d2d8f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
047c98db631f09587faa5a1a61a00de0

SHA1
f8006618b73425f5e7d776d2e731a505c5c3caab

SHA256
19463810aa03c2bfd9d1b25a88e9bdd83b23567e53e40ef8f9bfb4b8624eb61b

SHA512
7887338816255ea7cbff87ebc2a294b663a114270b6b74906d488a271aa0c496e875d9b02533b071e849c8224a8726769e4f7a8254a2ca8436904cf2ac2855bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5d77fc7c41fed75a0cc407a4c180e58

SHA1
581051f1a8e62ee3277f5ffb20756b9393494da9

SHA256
8d8067902fcbcdfc287d08ee371210fe2d908a533b70f941b12a386e35905954

SHA512
6d07b42ec161fa2aced66eb5b2720bbb4a54678eeb20c00f8228d2f289fb2099e4ea908ca3a69dd47b497b94fbd74306efe9eb555f7655508a9a559cb175b609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1064ab539f38a0240a24f5bed6156d4

SHA1
a74ed02ea8fd7c43c00a03a3f3495eac29dbbcd9

SHA256
91f9d9907b1a8dd04a85afb49bf2a7d17dc89903e7a50825c6eaa4a42ef35ba1

SHA512
834cb25ec2eeefa70dab94d2af368540b0270a8f3917a06dde9e6edc76f53fafc3318722c84bc0efb5bbda7c5b746e8dc10bbeb00b74d6e97349c585004a15f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b5d760a02182f67b2e3f8ae3554b301

SHA1
f4b3ac10da00d1baed916572d35ca2b5a59d45bd

SHA256
b9ea1610f7f1de8270c5b572488b0f69620b0eeea921ae2608fd890f1e2c9f02

SHA512
ba44d07cabab8d6344cd874ac99c4d28763a4f486890547871bb32a40eb9fe91b1e39a7b50b4f7bb4082d81f4aac0ec059574e6fbc86a2ddca031a9494d4feaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ad5fb18f53301d8e040d9ddaeb52bc4

SHA1
977cc690037a4401d24371dba318ea471a68abaa

SHA256
61c9f072812ae07460320e8384ac9bcd469ba4ab2e5a4be15f771ad9324289cd

SHA512
bacd6ee6dac29d97b2e76f93852a5b7a922ab4021cb4d1907cf5ae923397d2ccf7eb1cdf3669fe218df959abadf2bd1d791ad04955acfcc8c4ea4eaacf2e262d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\suspendedpage[3].htm

Filesize
7KB

MD5
ad21748e5640ce95568a82386f98b397

SHA1
fc21d084dd6de49ab7cb4eb901d618f8ef17e573

SHA256
54ad061bb94cb8a8ea29fee76cd86259b204a77e975a89f2d4549fd51c2bf9d0

SHA512
f6525ffb04d0b4228758ff0efebab60b0a0d36ea88d9f5b9560e8fb2787de96113eab2d679063d17300d28ff68e9741a1ad48ddb288a24e0895857b1a856b1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A15.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A27.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit