1e3b5bf9bf19cc10c5697b67cd2058d70e64bec03ab5188481523617cf019b17

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d5f22fd397871cdd82164a7ede7ad59_JaffaCakes118.html
Size

88KB
MD5

7d5f22fd397871cdd82164a7ede7ad59
SHA1

3dd5185e388c9c65e19a964e68cc59d211011005
SHA256

1e3b5bf9bf19cc10c5697b67cd2058d70e64bec03ab5188481523617cf019b17
SHA512

d43b2e68c084da65e55d7e95a9009767df145cffaa849d0b139d8634170cce206676a327f04ef4baed728fb215abfa4a1464d10d5be650d871d33052496ba703
SSDEEP

1536:CIzK+HY3GuM/aDgt0Iwy7qwLVV3lXgsJHVtua7i8mZWwU1vX9/34L4fjMLvQ28qD:CIze3GuM/atIZ7qwLVTXgs1tua7i8mZh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423070051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000b0a593fd5d65ebb2b8b9e75aeedf43155ca6003b17e2bc682806ef519565b20000000000e8000000002000020000000f0190ef5f24866f1a60d9983c35edc56967507584a4d9f6b5ebaeeb2995c83472000000029d76f3181e06015040b3ca2f086c76aa2e3d154131cd26b550aeabef5081596400000001178213b0b5ab5803e1f97fb5d1386ae8e9c4ebaab0e29c6c2339e4521c5b5482d845eed073d06adc1b51d68e23551806e78b156d706eed134baf27e7f35e4be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000470a15ca158170e75990a302c2ff0668ecdee1868e1dc2b8ebc9622653db26a0000000000e8000000002000020000000231584591b6a78c6aa36c590fa9a7902e7e8f1a13160cc9103b5ac7f7661d8ee90000000564d804c402cbd3683fade28cefab24ed5cf405f54efbd3645f6d11b77d3fd18ef324a3eadaa5d079d70c323e27441af03b27c0be8e5ad859a891f996f1a4ebd9b1374c58183741bf3ff0ac43de22e4619713f7086619e64a0d793439e004c5175808b30d865eecd118163538665a4d37e8ed3e855bb07d8c4b577abd06daafc6b37a8e091eae14228f2198744456c70400000008028d3a9403533e721c9eb4ca1f730e5b2f4fccf340b5565a3636d3629006c247036986f8181b65dff8be506ea4a6422165c6ab20bee3be76be83a723f23030c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7182D351-1D02-11EF-917C-6A2211F10352} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a03b4d0fb1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1260	iexplore.exe
1260	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2360	1260	iexplore.exe	28
PID 1260 wrote to memory of 2360	1260	iexplore.exe	28
PID 1260 wrote to memory of 2360	1260	iexplore.exe	28
PID 1260 wrote to memory of 2360	1260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d5f22fd397871cdd82164a7ede7ad59_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1236040f667edfb679bc079989f8157

SHA1
0e95609078c509e1e38a77f0f5e0fc71a7b5b14f

SHA256
5e8929e04a3baafd24e4585c842acdc4f2f8d9800ba1ba8171bfed9d04ed0ace

SHA512
25448b928db0534e6e594bce072aec571d6fda550f04ef3add5e32390a79992621e6827e8388482d3995580a7da1eb4292911911c8eb59e00b793eaf8a26524f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c55e1ed95e91f00e3b17ad1163076f5

SHA1
3f73b2dc96c1d27b5f0b5ef17094d5b64202bb78

SHA256
573008ccb3fa5d9883965a099d42ba4c9bd18ccef1bb8aba245b993b015fa3d7

SHA512
32739b3ba41646b879123c0100a812d2570c52e58342d966f6bff6bef5cd50c6e331c18560fb6a3c2e9e98f498ed295fcdc9ae82d8deda918cad1069008e290a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48b7e67ee7aa60b2ef6e2fe1d373b5f0

SHA1
01852ccdbbf6fc5c89776a029027780b0c2b9218

SHA256
cd8e888169df2e4989d5e97e8ab9fae01ab732a5f0fe24ad8af1d078cb625de1

SHA512
b4c07a977a2a120d1f850e996cc371ddba784d23c9e62c217bd966e4bef24c7e725029cb81f8df5ff8660158f1e67bf34db47d012a92f6c74689217213b0ed9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d49edfcf022eb2a6119bd282576e575

SHA1
ee3937528c028a68f5c5e6108a7e5be0fcf2640f

SHA256
3ff095410e77c02e5dcba4a13ed950b2534fc0ca91495c72811956521ff8e7da

SHA512
e5ea6f51fdf693a0133fcfb8d6df09c4ecfdb627b1410144247a4c0e9edb5355fc760fc517235deaf57c08a501de3a8de2df25a885c7cf8ad6638675875465b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53adda5047511d02bc65c50e2e22f9d7

SHA1
15359938237234bd115a23ed08871e4a6a440118

SHA256
887340476081dd697b17930b88ab3940bb177492f0b5e3635bd5f9984a480e4b

SHA512
69632ce867ef777cddb2235c32e6abb71b9966f9aa3ee23aad9fcb289fe777c5d4bb4e64594931cb14c87d90c28a98b4b26513b5f162f5eed08d8d5b6d78a567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e6fde926d6c23f9512809b66b077a84

SHA1
a04b69e4eb2b6c0dbed5bab7deb11ad814ec0ff9

SHA256
291b96e1dc53da67993dd84b4785e051b37c2230820ac3bf5becb739c73bc380

SHA512
8cb53e2e694e5317ea9d446debadae9e777c38a641343a0fe7ef44267c461137a112c56962a3b2f5ca40f0e1a52e20fa655c446843d42a346874e18a78fccb8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049f9b9337f6629689dcd882ac93627a

SHA1
6e995587304463acf9f6b038a272662d2fcc5149

SHA256
6b2c0b5c7cdcc6e65359c053c989e1f157ca3cac067a05623cc7591e77d9d724

SHA512
d1fca3a70902a44cfc162c5b639d714b1b20229bb20a54f08db7adc61d075e9e6d52dcc18537d590c59817e31d0a5f838e696e4d7157043ee124839fb329d908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72b87f5e992a1884dd396143ff7bd041

SHA1
997e4d7ddaa5a32577e881b5ad9e5b0271841a74

SHA256
c27a5824c176bb311c28299cb4d93320ed7c8a73f5453ec880dc5b84de8b43dc

SHA512
2e8146245812c9c6dbb5c0deb5933682009eb3599f49d04dd3a743407acdabfe24c9ef49da69881c4fdf56360ba1b8ace82aaed99ecab33f25bb8417996e74bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04e26db8df56e9a237edc89ccbdfd7f1

SHA1
9a8a4e2998bf0227b41d5d5b995b9df7cd9286e9

SHA256
c5ad30ab1e99ec7d926a50399dbf9f588c10bccd6595017afdb1490c738273c9

SHA512
591556b12bbff304ae115521fdaa5c7363395ae5e54f8507be6cc5aa35848178723d7f17840954718cca30dfa93706940d3cc77123e7d0afddf4d7318f3fc4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0641668cc63aa54bb2c7ef629e98daa

SHA1
2e76d8292032b09f53f41fe428ee8e39b35323dd

SHA256
1490be7d34599ff00278ceed6c06d7430deebbcd7e5dbcb13c1737d2ad473d19

SHA512
8cc4eb2580cfd56eb0dffc1867a613b8a3f019822e6cf6ee7810ab5e245759e1843dc9277b3443b0d4f85df572953a403e9a2a3e21918ccb4d0c45a5a33fa88e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
166f38e38f08db6dd99913a5093c9ae7

SHA1
d27f4782442e94acba905aac49ae433c3aa24c5c

SHA256
2cf43f5dbd72c22bad797424a8a12050efc772b04f16d87edd2aa5cb7e797b99

SHA512
08f1d0d8390cec7f1c17dec9634cd8fccc40349e091c62490e502a17286ee3cb93a44f10faf9af8ea64dab370a948a2f2c4dd329dcc5d276dba5cb41c9ff9ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\LG4XKM9M9OM[1].css

Filesize
22KB

MD5
50ffe5c9b54f43a59bfb0f68058792ba

SHA1
2e4e82ae14a419f52635a181011b8abfa4d6a769

SHA256
fd366cf44114212b1f606fb2da79d323332298bbeda4e161eabc39af6424f6cc

SHA512
692ce4d8587041ae433e054e3f97b234e83e21c7474c7695e0829888ee7de98412a6152b1af0b7deac5ac636613cd1e4eccbe67b17c83ea7df5251d2ff7e8be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\cb=gapi[2].js

Filesize
64KB

MD5
63e5a0b45632b3dde3694ffcaf0e3f7a

SHA1
923736d0cdc308331d5cfaa0ea159bfedc83d53f

SHA256
889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db

SHA512
5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\plusone[1].js

Filesize
54KB

MD5
fb86282646c76d835cd2e6c49b8625f7

SHA1
d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0

SHA256
638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109

SHA512
07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\3604799710-postmessagerelay[1].js

Filesize
11KB

MD5
40aaadf2a7451d276b940cddefb2d0ed

SHA1
b2fc8129a4f5e5a0c8cb631218f40a4230444d9e

SHA256
4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2

SHA512
6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\rpc_shindig_random[1].js

Filesize
14KB

MD5
23a7ab8d8ba33d255e61be9fc36b1d16

SHA1
042d8431d552c81f4e504644ac88adce7bf2b76f

SHA256
127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5

SHA512
e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2406.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2477.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit