4f8106600a97bfa6e04aa7b1bb0fbeb92b4c3e14f92fe39b19475d9b7b4948aa

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7289f4133276f0f975a3826f1c1e3590_JaffaCakes118.html
Size

25KB
MD5

7289f4133276f0f975a3826f1c1e3590
SHA1

3a3a63c5cba977fb818cdd9c82cbeddde1ae73ab
SHA256

4f8106600a97bfa6e04aa7b1bb0fbeb92b4c3e14f92fe39b19475d9b7b4948aa
SHA512

f3ba2a53235c43c5a114d7ebbe77e98853e334b98859df83d42d7f07b6a40dc3a9313cd92bcce1e044be835a3eb15dadc2e39e7c7f208abb8a3e4209db79f3dd
SSDEEP

768:0nnZ/o9DuLtY+cfQVmkcWuEiFxmg+Z1oP:qnIEiFxmg+Zo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EE5C081-1AB2-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000073d0f84a6d13682b72bf73c727d4ebef2f3241d59d5fcf63284ee089a69a9ea7000000000e80000000020000200000004e70d5cc9d1af34e18215bcc4d2726a7fbb53c3bc5ea28464801ab54db6873032000000021a29a52d0e4dbf6d7c38df0343be5219871ae789c57f30d124652dbf224ca2c40000000271f5b57003ca500b05f6cfbaddadb011d5f608acc8e60488e982054fcbfea398dde3f643aabc007f3b5addee53776b9ef351f11cdc5e417be9a280c6533167c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008387075083ec1449024cf771bbab3c94794e59f4af8f3ded5a4860838260bf39000000000e8000000002000020000000a00b8d493eec4d93389466376d3f49de51a642f95c8b99d3817c0194ab3b72a890000000f4c897349ef20aaf561bfce63b8b5b67cc2d811c16c6372dcac3ae8633d43cdfd9ef3073e505d1307c2d6425107b3854bef94c3bd40aedee6582cd626a27237058ed8951e5d9783b25f5f311c1e959b22924b08c52eccf294ddb26e6c1c177453ce41fde7d954dee867a87abe93de7c78ca17937ab5cadd4269a14aa7d566d9931178ddec397a43bb38c12af8b54d74240000000300758038cde5b3665c2e307d715933aa9881069f78769ad1536e78432c2b51c24929e28a57a28e8ae181eaf840f639988e0493b7cd6af7398c9c4c347f80db6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404eb021bfaeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422815701"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2616	2400	iexplore.exe	28
PID 2400 wrote to memory of 2616	2400	iexplore.exe	28
PID 2400 wrote to memory of 2616	2400	iexplore.exe	28
PID 2400 wrote to memory of 2616	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7289f4133276f0f975a3826f1c1e3590_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1bec25f3e8a0bf355435e6a29ed3ce2

SHA1
33d86389cceb6baa4a9038be7abcbcd0994fe088

SHA256
ae262e701063bf75a61f4beae35714d7e4e5db485da1f69d5aecbf1e92d1d767

SHA512
26057b3a4fec7dc8afe1ec7cdcf132bf1fa4ae71fe6cd5ca3cffbe17739ac9ef02c347ebe788cb185a9cadc0c8ec1ab5c58a264abff50d1d5be0da1db61ecb55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3282781bb63355683debee79e2d7498e

SHA1
0e402503ff67ef498f0e25e180f979a137781cdd

SHA256
5b29a725e6ae1dd7cbfaeb79faacaaba65c120ef5cc135847dafcdb8a09a5ee7

SHA512
c3af5f5a135cac1f623d753749031e13ed1f52f25cd9d8d4f4d3338b150b5c57a6c891340014af440e7fe9be9c7386edcda63f6f7b7702c172255b71c06af687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f20960d63d1a0c35fd25f3fbd853d59

SHA1
6d368ea09319e882ae3e3ddc92c4f728452a7fa2

SHA256
54ca5ad551368389f5d4c0bd23f2e8df06c184def351b8afe7e0045a003dd033

SHA512
e633b25df1c244cf8f689a063d83e0c7af28003cf87a7b70b42af7f94f3c0098ac667d045c87ac7058a8fb0f3b8250e471e2539a592475aa96579f5dba325ba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5920ac9f1211c5cc42bc0096aba9bc67

SHA1
113266933183ecde6c0646b7228bd62f38c97d54

SHA256
b1c3dbf6725d2b529d574a412e1cfc5d8f8ba7c174dfad511bf949b134a72767

SHA512
b432db38b06cfcb2844dc4a3d53f2b524ae654785a9a607d9aa0ecbf3fed5d3c307d32a10c613874550098e9d67e05d9193b785811e20f115537f84b92a1bafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8056cdc059f05af7a32f35f7e9e700a

SHA1
ae70e1fc2090172dc15da25d755d44244d73145b

SHA256
1008437154f08bef365780006e5de9b1ab05d5cfec3662fe7719b8fc4d5981d6

SHA512
a4012824fc7d1b5857905dcc2e0c24c63b0a1e9676614823858d89dc0a7bc9b5e2a498cb99fb571b4bad889541bef057f5aa198dbf383fe94162b2d9a98d032e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf29a6bb0759179a1912c0ca0cc19bc

SHA1
9276a71f5eed55e28aeb879f75cfba770f06693a

SHA256
615744b5974152b7c51e43e611b302ab4af48ebcac18e9dbdfa1c574d5c7f1de

SHA512
1376878aab4055882e231b0697be715e6eb7728c3a74e95d0d5bafe4a850a3c58c989c624ad4d1aad35a5dc898b8c9ae2abfacb5297e36b41b2bc4d99b9299a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af7f1c2c9d966a9cd957c30b2fe31916

SHA1
9afd40b996107e27d304b3f4a34fe86346a5bee1

SHA256
772708b6d1367d17c5062095241cfd6e2659b3690a5acb199451a136954e4d14

SHA512
aa03d3a386e11253b16a79ca1da6e7c735fbad1ce4a5dcfbf4840d163744172545a56ce81996e4056fb081471c118b3ad1371906b8188767e9f399a44083f68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac29dbeb5e912482d27d58f69eb43cd

SHA1
59852e4a115b13ad0015c505f5b77116bea140b7

SHA256
0f47fe20ecb22d0216f0c5909404ce2a3c2d18d567b0d4c60b553afab349c745

SHA512
78f57862f3cdfc485fe3021b4b7f4dda19db836fafe1afb71f471f4ceee57d5389bbb92aee5c4743f2ea3eac29b010392fbdf709d403df3b1c0cd6272cb08efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f53dba359ab1be8389eee222fe215e3

SHA1
be47f1f531e7495d6070befea651b6b28efbd761

SHA256
6794b7ef9121dabe5669d14f1ec5fe7af25a63e1773cc3aedf3ae286a0f0233f

SHA512
2600710aa205ea04305157a41b0c4ec8950695e761a79e77504ecc50b08eb0fffc2f5179c72c29a745beca523681e04c586a9f04843773be86c9a999e645a99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
963532cc95ef629009f802c8029fd986

SHA1
63f3b5b03d898d7b337eec5f62b70c06faa115f2

SHA256
3f3c3b0c19f37c632228d757c68a6b3cd063195e4608191b675f9b329064b183

SHA512
3fd43f64e880d686be6eb2e68cff24699be267a3ec5b4b9eef56d385eeba268201154bc571190d3577eb9d321ce98f14fbf4f753395c75dfb19999075fe5e734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
330afb4db7922c835bfeb3c8752f6057

SHA1
b000940ccbfa88c3760eb1a50c5bcbc2a28ee8c2

SHA256
1a3d7cd3e4eca329d1b498b3d3de230efc23711b4e7f229fb3b478f2adf06652

SHA512
06b047cee32c07eec845a401507a4459f08bf9c0fb7d403c7dae141a916607a7b3a378121706400d9d4010af426dfb91cc8fc0f88bc94c9df383e9ca076e3dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd8a4bd59cb43473f78ade4cd664ef53

SHA1
2446959127262f9d31adb27fb99a0037146817ae

SHA256
70cffe657713b142e60374b95575096414ec524473665dbf7dd7abae08affd13

SHA512
db95ddbc59953f294cebee725a0eca3b9ab7e301fb5d9a8750b108aeb4e76fbe192e49e2f00ad37ac1b063aefb54cef23d1bb1a5f9b1a48140e4dca75a28cd6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52G8PVLC\prettyPhoto[1].htm

Filesize
795B

MD5
5d8d79c3cb9af023240b1be6f5057aaa

SHA1
df22980677b134e83d878893f7c7984e0d78a240

SHA256
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6

SHA512
66f432b622cee0bcc06cbc0f833de1471ea36c295b4cd93eb848d97e69c2252acd2fc8972db51ea35475a424f4d6cb5001325525fb04f71b8704eb24de1c4008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B39.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BB9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit