4dda91da1624aa8e6a813e0daca951299a9161d3d9f0be22ee7a92654a007adb

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72978f4697356561d2833e0f399246a1_JaffaCakes118.html
Size

24KB
MD5

72978f4697356561d2833e0f399246a1
SHA1

85034108541816eb500ad0a8c51c48118b5d17b6
SHA256

4dda91da1624aa8e6a813e0daca951299a9161d3d9f0be22ee7a92654a007adb
SHA512

10863043742ce593a13e74dfc7aeda6b21a5f84212ac5843fbc766a8af760e0c365ab486ce6dfa2368887e52971adc432a16292b29b0f8ac5838e1007e2d3ac7
SSDEEP

384:D2h+5XFtT4i0oPUqGbjDjBMgoVE8ZKRGsrdhVCsQ0bhvbR3tIY4izXJB:D2hcFV7nPUqGbjDjCTzZKRt3h1DuOXJB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74D52841-1AB5-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422817080"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c067c24fc2aeda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005c085e95d4ed96a72cdee39c76a2e69c54b67ca696ee563b60f245edfffc796f000000000e80000000020000200000005c420d975d435b763f20ea27bdcdf96c41b3cb650221c9251754956ccf53a56090000000e55eb32e774eec4c236a31ea95b2e2ac265432b3eed6a9e51c12bfc43e6b354d28eadec2336dd0d7d5562ec77441460dca2c908ffa06a97f285af998fc221321cfeb81b9c4d91702e7009609205461d614e3e13364e4f6593f11e03b5fbd4f2ece99ff6837f1957c111797578fdeb459de17d181788e968c61bb6468b5e7cfb09af781de75cde5396f142bc9e4d936ec400000000df18e18c56b1f2921c5f0aea34398104f753db3f99eb5a47cbae497c5e7f6ea3b41cbc71e2873d3975e5ed10c15486d4087761cb7b58f7e26901418b67f444e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b1446d6860fc87ddc9cb2e168fd8cb03a4d21d70b3e0687073ad39b4d61e753d000000000e8000000002000020000000d7939ab8f701fa9c9fb490adce5b76c3546d2799e6d6247201d9cddd6581c63c2000000058b50d82830d308cdcb39c1f6cd49df96d976ecce869996daeb6a3368c4c039f4000000062abd97c7ba358bbb28c7169773c6fcdcb996a0c913e77d9e824b315910bc80a9840d4db918d4a96308c8f770bc602997692b8eb8752dc548d7383bc35e0c489	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72978f4697356561d2833e0f399246a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db0dc93d57eb42616d03708e8a97221

SHA1
a075018dfc35a2373accbdd33f1187aecb1a47c3

SHA256
33b9f329fd66e19976b4cc2358a1e49a63a9efdf9a1971a8810febb29af5520e

SHA512
a05bdd59c7c737b229996ab2d83ea23f3b2d35c07463e787d74c5785ed36b9918c4ad4fbd66d97729ba45a51759010556125315fe9490c053b199304ff459f61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
374a6ce9ef127806f58b8f546d23f556

SHA1
4e068ed6de86d026433745c959aa3b3b9ffcb1be

SHA256
94d97e96f039a1b59da09e17ef47a9f3afebacd42cf160593558359ab2ceb182

SHA512
a960c0531ea148934ebb2ff21e82d465fe90f1834d902c7b4d1fbc7021679aa348a6592644ce141d8d8aba3287bacc60166e32f5945d33a26ef4ca8dae077c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cccee6ec71ac458b33c5b7440d8396c8

SHA1
120686b7ba062d851ca1fb3182373aaf25985042

SHA256
b282aee8995b083b8dcf94491f100f4e0d1aa52ca6a24d88664ae4c804d39f7c

SHA512
7f45e7e1a023df65d2d54851929c00701fc83e03c737002045bc59e0aa9c09547f3fdc694d926fbf3c34bcd9221d7af73585488a5291d007820e266f6e9c6d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb44183472f8f9d08c14fab9cdd98439

SHA1
61090e8d6c6fac9b95cc9b2e2a60d1c3ea586db9

SHA256
afe1ee0c92af8997d43de56b84799a826161054f32d05ae9ce72076cbb941f6d

SHA512
cd51f7a86645a771f4935a2b9a635bbc31e138991e55a1ee019cb91c77d6c3c438eff12a12448ba5ff845e334a076956637dddf2f63d4676ac5e02119e197928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7092ab17eca413d9156dc5a2c013fd

SHA1
68d0082b4dcc57c3924e5feeda38d234043bd590

SHA256
4abdd31c7d442a345f752382afde344bbdb5e88189220298477b050b6be48c52

SHA512
1d8a009da3fb8252f253210576e28a88f3f082666e5affea614e4b4bd8a49d8bb39bf3428e58da000c57699ad014b1b0573c01b3247c02809bd9f0f43600214a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
befc4630cb105a36a76199f956b1e2d9

SHA1
0550ba249edc3be6b5e800984de67346d7a2cf3a

SHA256
b1324a37f0c19f02eaa09820798a50557889cbee41d59729adeae325e81a0236

SHA512
96ba82f270b0988fdec9e0727414e5adc5e40d05d1e39d11faab528ca8db9933faa364bd7922f09de42097befcd4b74fb1384af008061a1695c704775248d139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d676ff081656aebf1aae3c4aaee6b10c

SHA1
6ee37a3853178cb2a070676a69cd1019671b5220

SHA256
1be3d4744e07703a784547cdab3e0cbcd4181ead60e8bfcbbee67787466a1809

SHA512
1c8d13acae35b9b4ec9af998de072d2a3bb5a8e0598139c4abf38408892bcbcd28caadb3edf983773de8d901179d30426fe9e0f4d7a424a098ef9447cdde8e8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2b638963025765c7d837f278936e3c

SHA1
0fc701c086f087885c0d4269678cfc48537fea09

SHA256
07c57496335c4a7c3728c5dcf333bcf608e09dbd24850ca95374e1b9e8a16521

SHA512
cf503e273eb39af0b9dfcdf0196f4c6e12fe35595c47bc239495051b75a81d6bf3e0f3015742b505a9eaaa24f2a0160423ca085434eb2809aca72bdf7f1e3766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72585d6f88f439ff82bee62ab0298816

SHA1
843ce02524f50806c2de98d1e64f484d2aeac1ce

SHA256
560c8a5776f09be61d97a8b56d5f5fc8d1789856ac06e86e9ead7bdf5d55417a

SHA512
4abc186cc35cbbdc160548548f4547c01323879e4a77a768874fb854fc998f453b1c47ab610ef6d24865015210d24d353f40d41baa4e849ebd8952bdad7427c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
023190f1e9fb1af9a7337f3f2a45d690

SHA1
96a468760df61c95f44e3a7042dc3c49b310064f

SHA256
57faf10c32bffdc8f94f38bc286bfab35d74077ff355daea6ecf3b449998303e

SHA512
891f007ad0417829bbd04bd35b385cfe8729f5ef30dc8df017234de907ad15935a9b61a5758841d7575ba4d0c3e14d1ae375cc5ef99d340e2e21e2ec0cc5c8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73e0d7ee8832059daf4d4d287048c9c7

SHA1
3c974013761f9f9e699e6cce0123c20d39345370

SHA256
a9f17238791ba81ab1197ac2d63bb8fef431a2c37d5a0f2ab68f1904ff818b70

SHA512
56b76bd29bd0dc767863bca29b645ecaf5f24afbb97e347887515f554c69bcccbfbaec3767f6af94655c11527f6cb8be9e6209d9be7148b36be85481bea7a6ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d122f855b2e2611fd153f1b6def3596

SHA1
56131cae17911342b5f7e1076f6e373814af3b88

SHA256
de4ac1893cd70d52a861b7e5ca197b9019964e7776cc4c9d0ddb5cbb0cd6ca6e

SHA512
fdf0ca48593e99f6a6699c5919faa9d592464fa59116227a71a09fdbf5ebe86c2764b68240bd74254173e0be04ff166cfcc9f79bbfa1fd09feac163accc3f95b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38ed633af727b3ac0636ca41d0d67a6b

SHA1
3a3edb3903d22f6d2ffc88218e7b94a1d0a4c9e2

SHA256
da625e55362f81453dcb1400249a700f75edccd71e993d5d667368d1951083d1

SHA512
a8b0509f4990fb7bb0ebc5b875da079f8eeffa9ba0a07f7e7135e213f87717e288b2b2f5c03597dbdefca6d812f05003fe840f79cdb7238f975b1866df42361f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637531af5f9bfe909ddd1c20848c554d

SHA1
a5f76dd327a0eff5c72cedcbcd6bdac401734287

SHA256
f95dce009bcf4fb15d1e077d165a9186f2860475b3dcf126f17ab9c305badb73

SHA512
aacc5b3e57a2ad779465d5563df14a14b9ca9d8ebd393425c734702baf1d66cccb6e1e07c92f41daa3daa76b2d2eaf9be36482180b3aca733526e5931430c444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8fd4b66f834c5f36d38874ba9ae068b

SHA1
79a17fccb94dacf3cb31582bccf7beaca4f265d7

SHA256
ed42cafb8112ec7fec8b3dc0bf797b1775e75b571b400d31ab6d866c7517ee64

SHA512
e191591c1d69074fba90d9a6559f94eafac38f13061e7d65d63ccd44bc712ae066177d6dcf319d6ed7369bde9819981ba237fb23780c56afaca10a47bd2e21c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77844cc630848c0cdb3509d9625e256a

SHA1
33d01f78f5b51c32d6c91bcb91866e2fd0f2b2c3

SHA256
173ae8e5ecb23119c984fea9ea40d8bd53545133932f3f2230ddf69ca03f504e

SHA512
af616102e56458af8456bb4a14939034d2ea910e7ce53a2ee5ff0042ee396c2237a9719a6d7a4c6770c70743db19b71d0b37047fad7ba2d19c64e090eab7bac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdcea6df0096ab8402b2266c53c83862

SHA1
16f98fe2e33876fcbf5a30286d7c1bf6ca901b44

SHA256
a481c927fa7931babe487df1754ca10b9b615e02435c5ab7e8d71786cd7a02fe

SHA512
1d7d09db3f6a26fc2047bab2e640616d59692a48d2d98bcf40c84a6e3bb84f294da1f4cb19fe3f36165c5952bf2a2c2fc274a9848b05ff81a265a95b70629f50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49CD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A20.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit