b14d50d8fb55e4166513d7d3d04e3277b4a93f771c51f8c24820dde9f971096a

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82494e6571b661ac13d30183ca7cfdd3_JaffaCakes118.html
Size

94KB
MD5

82494e6571b661ac13d30183ca7cfdd3
SHA1

20239cb66121d15967e63e6f1d0eeffb9a8b9b29
SHA256

b14d50d8fb55e4166513d7d3d04e3277b4a93f771c51f8c24820dde9f971096a
SHA512

b00b4c6eb845e5fc6f65560e8684ee9d3e204eb709430a49a20fb6f7cc453e267b9c42d03d75f62edf0e7ff5c18ea6832557d0f9a3d097326e5feefa3ffa1e07
SSDEEP

1536:WMLiNV7LiGf1LkhU9MQcEnrQpsw4eFL5ZO09iyRBdkrY8mgHC+qpEyW:WAidGPBdkrY8mgHC+qpEyW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD5361D1-1E10-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423186193"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000081a95fe72c5937d264f87b47955ccb6258c7b4f1c316b7d4f7c5f0fa650621ee000000000e8000000002000020000000977b55883b884219ccb4794e0d50280a927bb217d4af71e7a1083a89fee5097b90000000d9e738f65f6f0535c93e792448eac46947b997b3c1ed54ba62f18430e308de0983f6b77c512d98da76339cb82d198925feb16e09f628f08d8200b0be66e96ac57342653e9ab737a5e59aacdef82cab72d7221b3df1e87dac72dd25b51069bc4ad476ce1f8a97215c76747cd75c0de0244e867f8ab29527bff0053c651861e0aed754bfeb295f96ce1a3cbf06d924183f40000000783bf10768ee7e2a8b53b3ef689387f12c0eb7be51aed679bb82511107549d93be700405c1b07452f51674cfe888adb433337b00f27af9db47004b93506346b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8040dbb21db2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c5d343209be65a56e73f7a8844023826bacf7173b0272874437884327001ac51000000000e8000000002000020000000779a3751f1d17b0c304ce0bdebb085e4b5bcd1d86e67917ef5c597c464351a9520000000b64be795c9daa8b3e46f0bc98b85380e1b61f16aad44163d6ad3152a197e306240000000c9310465f366d0b070c1c0ceed370a39c7ddf246acc20bad2c6e7e8a0cce00ee45cd25e29e34c8572872286788cac8296a0767959dad7f791aefc5d2eec8961f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28
PID 2232 wrote to memory of 2832	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82494e6571b661ac13d30183ca7cfdd3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81f515454cdf84d4d2e3b062f1a4bd24

SHA1
b656efce7ca2c04aa27c83a778526cfe9f51364b

SHA256
b9fd4b5c9a38986022e87bf455204f5cf03aacc003742b721fc5e38795283f5f

SHA512
2729775d4759a106f97bffac4d72895512a344461c59467a4cf756c893d27242b20ada062b89d50cc8ed5092bb4a4f54aeca7252a3a3c17330f031411dee14cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd64b505a4ab5b96da753ee7c49ea61d

SHA1
c253f7af8606dfc25d97f9b7adbdbbf19e152881

SHA256
e6c6492dae6204e61bfe4c4d12d2d9c89e1fc608d4d37125058d1495473b4f96

SHA512
881338bfbcbfaef55f6cccfd7b6281d40077be5548976ed254135e46498978fd49b55ae406b5d0f1935c34e1b794b265c6309b5c871752a904f11500dce86329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ba2fad2c62b093ed44a4ad74d0c147

SHA1
1303691d6333705ab6be05050bafd1c26b72b692

SHA256
d794b47a1c9f71c12e3686d4837882fc75756f2b9697c26cf1e638b4cd7317ba

SHA512
b23ec7e7a35f4ebced9cf9736acd8dc6730a6c14f39e3a037e13c48194b7fe9e769c5e0bb104c0a2bfabf4c6c87601248970bee191515d9faee492ece496cdff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80519790ab859e452b52e419488e7dfa

SHA1
42b47641da82807680cc82cf31d2d1d2d1883667

SHA256
77bdf024d8107090f0909b916d8b9c5b47f8f56749dfe299b057ad39893fc63c

SHA512
d1fa17f0ca37ff2a43b5d1c0af3bf9f32e63683addfd1ce1b0e649a56c2479ca46bbcd102acb3cb3838d6183a61a9ef5431b50f42e82916d8c7a62afe9e8db4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dffdb077eb77c012ff5902d926ae6e2e

SHA1
d3933090d24e14aeb205927ca55741b65b4fc11e

SHA256
58d208082804eda1d1cfe9936e02c8324febdd3368f0b17af6194d21c7eb6604

SHA512
2d1a8604523948729a25de9298690318e8d10499a1477bf37061eef48858d573098fec6673dae2d6ab42e8def0bbd1918df41c72d971185bc312c4627f861f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9d28413efa36d7fb65c625809577de0

SHA1
293024a0fa38dbc384ba69419a4bfa457703a622

SHA256
26dc43bb41260b267e7d104afb3eedd8d76c14bc7f077be9c332a639bef2bdf2

SHA512
73a40c252f9b3f5854b40144b1e82dbcf9b4b378308b11ba0f002fbb8f227a805e44e40550b26a030e740b224f2dc288cea14911e5d2c83ef1516b2a73a0a1d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecdde5f607a8541568817ec437fad28c

SHA1
a5b94e9bd10f21fd749005573d2ce5acd513f233

SHA256
5485284f640822e2e929630783ee57e7d33a6da1a7934ffab21f85cd0504cb6f

SHA512
a5781c03968973beb4a0a6418043deb4223858ff480b09b6fb11a998f3b42496eada566ef97a00fedbf7f2255173debbfe1379bf0a7814618816050dca28c753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe354384163ea0f53260805d6fc6c351

SHA1
df9db493ad160de23049a65fc31102230848be45

SHA256
9a981f1670b2f486a485c899c00d61677804cc7b54f2bace66ee729f68b425da

SHA512
955b46e5da29bee7b65f2d78c398f730afe8cd66ce571934b1d8420f2a2e63ce3549ea2f8899650864aa71246aa83e5b3901c95d0bb5b16fa0ad6c413dec2577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03953f58754ff59276a211f98b04842c

SHA1
393d686a1d0615521265bc46abe836b53dbd16f1

SHA256
bf8a53f944bdf899a015a905901fbc668d6a8075aff6bad519156acfb2963b1a

SHA512
520be6a3cb5d0bf0302d723490e4c594fcf69392780990691ff2e0b6af6af277652be571ba55aa66fc21277d67dbf0ada45a31c4c9dd681c772f8b4f1e7e8219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fab50e2c5485b1fde9448074fd8dfb4

SHA1
e0f93a04751aa871b66017ba63ecd17907058d63

SHA256
98fe506742f79c66d1708efd2b527f51e039a0af029b5520e248c59067a697ac

SHA512
14fbbec3a05947e81d7cad4b058d20048334d261bb27d35cc5008366a45ec3e28554b65bce9f96890b5e5ab33b3927c73be510b592e7ab53311b03cab3a44c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0119a16dcba885cbddb930281be35bd

SHA1
48c3e4f18aede7735e37df02885b6e41338d48b6

SHA256
ad713eeb2843ce58b510a53f7f9d686be5cc0ddc1cdefb41e580d0a7f47c431b

SHA512
1c836a01d128de155e69edd8c93d1dac4e6a6aa3dae8ac66474ea4ca8ca2cbb1981005be557cc5820277e3b4191b3505296491aadb20b08c074c8219c50c372f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb11194fea0ebce958c8368aeb9419d8

SHA1
132d55e7c3e796230bba9be909c02d3b01f1f3fc

SHA256
74a356f858c383790673357ecb2bc13f563909da2f03d81af4ceff0da02f35af

SHA512
c2b2c5001896ced5400a4f0c30ec8f86ff7e946a61530934fc40dafa8910c4b0ef213a6f83a7907b53d983b71e95e167d181de44834449a2e0c8f64a2a041ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d157257e8ffc88915f90fd03f4f46f5

SHA1
2def3731449a48d8246d705a6c8b04d83f03713e

SHA256
0225a65e37f2f536010a4e9f5105250d5749d1b9f778f497c45a0a48e92a05d0

SHA512
d7306c5cd5f881a89f92d590232ea05d2571d1cc1ab2201a4cd536ab16ac4fb8935f694a240301e875978bf01f21fc88679157892d2fabf65764523d5787680f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2ae18c3caf4124166b2fc4eb1d49b4a

SHA1
a14cce99397b205fa49cec20758af745c0054399

SHA256
95358d431dbea3c597cad6058b230c903c18cea5b540a49478767adcaaac9a34

SHA512
bfe7c1b8953a2e92ed51c830b3b7b3c78a722d320b03897a098790ae4efe09f7d2e37a07a86c90f4416b41c0dd644fba222834f4205b23461ac4674c9e8c02d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cbd3c182091aff4fd1f512ab00c05e6

SHA1
eff8fa5fd629215778c1991199ea622a67205ffd

SHA256
30b53220df9a9b045dac0d78dede6e6fc59b6c73bd42cf71ec6691dbaf89aa98

SHA512
5f9f7ddbd2d6445ace0a797e6f0d25bf3f33914488ee551100ff217d034c67e88ab8b454b2f39f6931e665c54d188700831820d02b3e9959c35c0067540a1de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52G8PVLC\fonts[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40F9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar419C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit