0ff34e9aa8d88f72fa49f51f3f341d39fa86c52dd67dce9da40ccd2798837f73

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

794254126d708de0d91af9b8adc406ea_JaffaCakes118.html
Size

21KB
MD5

794254126d708de0d91af9b8adc406ea
SHA1

42dd916fe09f3e6b4939a058bf0b06b92ac828d7
SHA256

0ff34e9aa8d88f72fa49f51f3f341d39fa86c52dd67dce9da40ccd2798837f73
SHA512

27a3dd41123a36e4751c49f311d1e63653a7305a18a63c1b6fc1a258e610b1e7b1c106bb0e38f04f3fb922f83464460fde6e1c365da0c2954e72c7aad8e1d24f
SSDEEP

384:SHsegFiqUPs88uDCwPpFrRan8MnNeZKKZqKg4rjbD7b7IhETl+HupBwbtAc/jmL8:SHsegiqUPs8fDCwPpFNan8MNesKgKg4g

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a204215fc131185090ef23a6cb430e783c798a0874892bf58ade35651fc24bd2000000000e8000000002000020000000adc62f9eac865d9319937d209b32f8ebe3240c160955b1102de1b3916b708a0f9000000093d9420dc88f9010f7b05b4f715657ec8c015d34fde8371bdf38c79eb4e02ac7aa68f60625626be6a872f41498afc5a2d33263d8de899baafee47f788e6ab2e03ee184e334855583f5b8fcd5c0ce11124b6aa4f337b4d89fe690849144938ff2c162315157e70e1741c43c301dfc37dae215771f92d5da7d70f424990f88756ef01198040654e13f9c325f21792e0f3540000000ea22f275ea75d5a2c94ebda58edc745929c6a6899bab77f21f5a0daa12b6f7b630dca658fc643b05d67a65b0d2531099de95b38a0c3523e4ab4690b47ffb9899	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28AD9001-1C2D-11EF-B44D-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bbebfd39b0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422978443"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b930e8dec0718029707d2b49e911874720141b5bd20a4d052df6031a19bed405000000000e800000000200002000000014511b3df9837a02c674dcaaf821af4ceb0ba3a3b9c053ec17ee363e4a03ef6e2000000058df6df50fd4a0fbaed9549087cd387e686eb61a50847e86f034cad5f3bb8fe44000000046f0475decb1f40e57e4fb63915fc24c2550caf69dbcce537294253722715b0f345cca1cfa544965e174d49be38443b5c1aff5d2ac38ddda8e98ad14fd6fb361	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\794254126d708de0d91af9b8adc406ea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ed0e98e335cedbe26f8762f79765212

SHA1
65ae8cd8e4c1c1550c62a5cc69ba9ef95016e503

SHA256
507dd145ba6dba0b1a03cdeb5c318b3c3224b4b264c2c25cb10080452dffd468

SHA512
af4ffba4974716c2fa17df726bf4a391d01ed77b371ccbb4c5631bc254b1686d13f36e8251989527c9316aeec45f686b56efc69a70dab6c099e480b978791cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e44eae56218313fc9b1ea80e391a59e8

SHA1
94623896ba79b2c6038c2d42b16f483038693d03

SHA256
74c323c812080620d3b8064c34c8d49568f221c16b233d93537f06481d32ce7c

SHA512
09d2c08c2d205da4d27f009773dcabaf44800ac8b0d04a95bee47143ede5cde593308847d21d2c6170cda4dfa6920c597b18d13e8d0d714e6932bf7247c70bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1882a062340208ddd99b78b722def38e

SHA1
8d4c6e3c7d1a5ee51a7c83f486a1cf893755e4d1

SHA256
3ad3be1a40e50ecb0adf101135a09b723808ca51c53dc122341aaed07eb837c1

SHA512
ba776b38237fb4e7a2fd8986e734e90d178e86f28e911af8a27d77211bf7d0cc3dc2d9fb43dcac7036d9621744208f8e2b335dd7a75405864f6c8b0fb8daf61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
185b152e55887b172d53881af8c5b613

SHA1
832951e33e8abf01ef2f34c6519d57d9921986df

SHA256
9a61865f845844a80a96649004f19a2b4e5504e4e9047e9e90c083c277ec433f

SHA512
343ec535da700cb782cdbfa3eed532cce7dc61c18090eb40e9e266ac072c6ca0b1be32b2dc31dea8e97a9faf2039b03945dc17bd7dcb8d3f44dcab1e93baed0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b724791e709c5ca2eeaa82ef88c4cdc

SHA1
378d26a797f999184a323e03377967fc4de22254

SHA256
f83b2fb5de5a5ff2b08dee0a738426bfc87e0ceb75f979885a7b0a9950e88725

SHA512
91c3ba040b9ebe5dc2f56fb8cd92a067ee9a132551a22d18374ab5292257b4b5c58a93786175b6441359d481f7dc958b5f50cde99e46ec4fb0524cbfcc28edee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44214ebdf169e5bb422efc00b7dffb9d

SHA1
0116c3f20ca14c75909244fc708114e1697338a4

SHA256
60e23737a7f0e350b665925b3f9835c2b5cd0e6997c15aa7c861792f4f016434

SHA512
ea38bee9d70f7323e318441b9c5493cd859d9460a8d2be04c34de2e49138701a44092bfc7ea536b80c19f1894437d410408a65bc40c17b4985df579eb6c2453e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a26ee048c6b7ed142d3e7532fa2aa4c0

SHA1
18a954b858ff9c83fdd1ac72f99154a2fb3a1acf

SHA256
8215811c52926c046cfcdf2883e0d12bff97fc2448986aa14d49a065428af500

SHA512
03ea54ab47e38718961f3f632cd27121f8e31552a19b8f4737c28a0b3e7ca1befb1cbe9014afda1c215f8648ccdbab97654231644d1d8fb38e0fba3c201f175d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f11d4cfa344a87313c7b6d8799198a4

SHA1
28326f3ef3e8c7f878374b1bb9143aa5bc5b7854

SHA256
d560f955d1a377fd30d4aae6dc5151c9b0399c3ff89b9d453a4a618fefba75dc

SHA512
e203b93ef7a052f947d8f25bcabb95c7fb20ad744bb49671a7f4423d898a34ffe55e51c2b639876ce3cfe5c6453d43e0b49cecfb4eb43afea97bee56e01d7795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de987173be334deb912663fbb61aad4

SHA1
e759687ca1e2381e22b24276077a9befa1ebac41

SHA256
b93e57d44d82fb313dc7f720fadf3945291c41e26a41badb51b7e4586682e224

SHA512
a4639a288d0796fac071bb6c0bc9b3706805708b69b62f214df42f60bb27e7d50b695d464a456246396a7a36ea51f3ea4dc984a50b18a36ccbe08c7137fe3a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c51c9da3ff773b159ac9df0b70c904c2

SHA1
759c50bb96dd722761327d3179df741619ad9816

SHA256
7c88da685ee1fdf776fb8e01f0bad0cc8497f4849c18fb0f982497088e1cb1bf

SHA512
4809e7c41ba7484e802a146a0acf1cdddf67d2a5bb99e0a67b4dc97440854d31f22cb4111eb6801c8d287bc685171f51145e4ee268f5f6832971e6fc85794452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70bce1985200ae382df9dbeb0d33f252

SHA1
f2192e4ea79fb4a9d131c32f7ea9f2b9c5bbc04e

SHA256
0d53cd39a37721027a00b6a69c2a92cbfce99751356b525d0ffbf2e3b408ae24

SHA512
96ceaa9ac95de152e2ebcca6d5585510c492afcc4a40b0897737c5cb300604866dd516c2338872da58b321bc463bff9cf5fee0fb8a16b9691b27b196772bf383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5682b2109018a7d4d41521c79a270c

SHA1
ed54b75e9101bbc3f3f52e0c6df6a24800930780

SHA256
2b8f445d2c2fd2c254d8e27b80a00a52be2824d145aaa9960d2ca2eef042403b

SHA512
ce4d01be7526868afa6bafd5525d8752d5c01943354a33dbd3dcf80020a7e82b76b86ca78bbaf4eb0e894d727c5ba42846ad3f49b5a0a82891d237ec0713babd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\f[1].txt

Filesize
35KB

MD5
34a00614636d5c18eb6745ea7f7b4786

SHA1
eb976d614eb040cf8e266a3ecbd099c58998156e

SHA256
d03b8ed480f53789fa91844ade3418329d5b4ea6dfcba65db9b80f5b1cc3bf0b

SHA512
1a6c6026f4e7e57322ee501c8dae8c718fe99e1910f14e9d438dbf8352da56ff4d76096e5f980814e29158ec6ecc96429635ec9e688253c93e94a0c94099c4b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C58.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C47.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit