4cf332784fa909f5d9156033ada74daeb55bceee69297caaa5faff68e6344975

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8366dbd63ac84f2fc9e9001719299dca_JaffaCakes118.html
Size

133KB
MD5

8366dbd63ac84f2fc9e9001719299dca
SHA1

a836bfafb0e76405194ce65af67eb806a209b37c
SHA256

4cf332784fa909f5d9156033ada74daeb55bceee69297caaa5faff68e6344975
SHA512

3b7be5306d4b3cf46cda36621230d9a0c5c94f002771dd20e4f66a9f2346edf7feee3ef5f883e9f84748f8dbade944e66e9d85666efa9bb17541a2c0ef73934b
SSDEEP

1536:yMJu+IWjILUbllBBttTTqq8QLfScO/JWpCCrlCXg5lxX25LnXyDnwXCM4G5xWNcH:9u+IW2QKjFj+aRxBoW63i

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5291BE41-1E54-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846382aa723aaa45a1607ad13335e71f000000000200000000001066000000010000200000003845472f74e22abd283a24458387612629440dd3b9f734e01436faf4237abcc2000000000e8000000002000020000000ad55c31b644f307481ab979ca815371b55544c62327bcca0c8931c12d5a65239200000007a818967e51d4b6be18c41d0232833439796297a04777dcdda18d3af07d6ab4f4000000024c821606eb54bcfc651623570bd2bec0c399b8df56537caaca2f8445ba3e79347e1eaf66393f9c8dbde2223e537279f04c049906fdd3f4409c649bbe88e4caa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2038612961b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846382aa723aaa45a1607ad13335e71f0000000002000000000010660000000100002000000086ae8c3283b5982bac42ad53905ec562a4aeef942ba75b035a5d8d92a749738e000000000e80000000020000200000007b47081748530f4f22e1a7f43f947a71f318370d04b140ba70eb3bfcc85663dc9000000095d80811eb1f50083ed55104e90e83e956e2b1427703c667bf753e77e246e679811d760cfe2848adb8c7cc5961c008c4664f5c46eedf0b6fbe0462475e2425aae85de56f1dea841c23dfbdf819fe8709e73a65fdb687793de04a98ae28866fc360ea103c41f16ef5e20b87d77e63895975661682b82beaa69938d300d4883681b71a554ac18426bfbd40c18099de1f1f40000000fc3193691b25e327002296e262bc25bf372fbf4a339e68a52ebe681d3360110b306fc27f420595bd586045c1a8659f1a5c34ef93c11dbcd8e4e324fc056f320f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423215166"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8366dbd63ac84f2fc9e9001719299dca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30933849a141c9f21d6d241154931d59

SHA1
39654543f574b843dfff108b20e2045922f9b6b1

SHA256
a9a2a023a357598837a9be6ca710fb91ba67d743f554cd76d3358ed0cecb49af

SHA512
93bab70ad3e34920fbed6f1837e828ffe240d9c83b1d69e6a66b8c3a435fb863f94c9d2857312cb87a5c97b1b4938cca0f1e72aff38b3f6d072e966f31947111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd8fca9b87171901c5f61b885b81852c

SHA1
550e6a8fc15914d719e1042836f3c8b02ba516d2

SHA256
2459b1a21a1d84770e5c94673f19c74aca59f74a7cf6e528cbc3c96107c23963

SHA512
946ae811031cab60b954769c5115bfd291eae4b941dd2de4f8e47b7ebdd5069f2c63a0f5cfec5b47879c4c67cb78eb4c959bb44acc6383cac41126d43dd0aff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f858625199fe524b664f003f255f9469

SHA1
c5955fe84490f0b56d4bf6f4e6abe13c4b2ad692

SHA256
f301fa114d37215b4c38bd8a99f86cfcb35a9472307f67093f94a21f54901009

SHA512
377bd8417c14a8285117553c8b988cf93172a3928e2913c10e7f6b915e8489fc58028415c3f78af890eccd3b72becb8a86e85729c97a6248179103f22848a86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcdbe852a596934e18c281a7c93e70ed

SHA1
14c55a1eab14d588b6329345ede605845cbb39ec

SHA256
316d08dea416036b538acd24aec191740f73fcff90f8bb58d40c6efad570272e

SHA512
ec9887a6b969257ab045fb0b472c111f534fad6cb5975a8bd0b034170aac93b6aeaa46ac5081937b67037343e71e70e3ee0ac94cc57eef8271f4a588371d75cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d379343136f0060f5a558be41ba8c85

SHA1
8e8e4d62b2bfefbea3ff4e4ca4dfbf285f38122a

SHA256
0969f904890dfa873d8675c7013c1f7aac6fab7408f57974647b6e2cae5c80a9

SHA512
d1ce04e86171074a4ccfd2925786a43238548d86d30062c51b44121257e5c7285714f2a05f2c9f6c65f4fa54522498c548222af2147e102baae39c4a940e7f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee2f5b9a3ac358b77319061776a70bf

SHA1
9d78c0a2671ddaab24bc6ab63a1e233a3e91a6a2

SHA256
d58fd8c49526e466b82bfc917ac0adbd0a00b524408f797a20e9628ac82aa9e8

SHA512
0c4411e8c203485657f64181489d73b96c03c362c6556e6544cc418ba27753772126c3c177e3b86f353f9d9a6298b2ee6b8cfe25984551f4acc62b7cf14033c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fdbefadc18e19cb83af65e692ce308f

SHA1
3fde75f675c47764f95c9030f97db1425f074ed5

SHA256
b539f24efd20275c653eb1d3bd47ce7a008b7e43028c71a2220643e608ba2606

SHA512
0d95df133a937a8233fb3714ac66849a5c0656c30da56aa4a28af7bd138ee7ab58f766dc5df2bf7eed38d4d1c5cec5ea04a5fc548d3c89a3891a4ea1f70ddb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24dff334cb3fc1ab555646834f467617

SHA1
ec6804d3eee5504b9864de982899a6a493cef275

SHA256
b1af7f0e2e4f5b423f4722e84afb9032cd95ae0f2b8ceac24e64d97cdaee621a

SHA512
89895fc0c8ee07dd74eec1e6cfe07d3111599583cd56913a409e9f77a453e51b060c0bf2bae2394ae5e445c9671d90a4bc1b1127fe80a7a0b8bca6a9cad165d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
366ee95b4f587dadffa724dea7868180

SHA1
6eac4246821944a1c3829f537f399626626a6313

SHA256
0ef6a29f813e1b5411b3273305a536cec2e6c1c28eea9834afd5b244fcb96655

SHA512
c4bf73331ebe7b23f07d00f27acc80711d8cee11e33de2bd0dbe7c239dfe9fa459e2ee62a4f8e90d5665294aeef2b0db5195b7fce3984d19e88e40be0c6c6d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb221ea02aa82aa6b097585ab791bb5

SHA1
1f1447725eb2bc47667753bba01a837444d3b8ad

SHA256
d99ba7852b9f92a15bdb48ee1b7497cf7994e615f83df58b5d1c31e7ed6863b7

SHA512
7c48345d17d968c15f7fd654c19203136ae5cdc26b167e8c6c139f9d980bcc721592166a017a71396267d09f42d96250fa3bdd15831fc403258065c15b1d8a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c63bbd3978a515b82eba579921924e8

SHA1
258ebdee3af4d8836f455d42b9895ecbc8980088

SHA256
5f5dc58310288cf27f01733a7534473dc2f217d6212b680bd0cf192b74502662

SHA512
7dfa20102ca3af48d4a3fc796b7474f3ab9854770664340fd966a0598b0b251d0755e267b1b2d4a51b640914d6650c72f01cad54e97e4077bfa2aeb530ea4b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0f423fbec62c92eb1fcce860efb4a43

SHA1
eb2427e31459373979c7a6a7c794ba6f42de241c

SHA256
f785d5cd113643d7b4e0426875b5900485ec93d635efe7cff98a640e083b7659

SHA512
7c1421c86532c0f16af1cf4ff9b516523fa5ce71cd15e18b2c3231e7dc5d6cc276c9dc62dd857e8db7b6bfb7d2727d64852e55165746f638c6e8e52de6dfbf8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10240a7540e6746e6bb9af3d773692d8

SHA1
4ca20bc36683668b661036665308615ad84107ad

SHA256
e366034b1dcaf0a47a176ecdfe5deef1e83c1fb932a559211f8306b861a3dea2

SHA512
706ceb21ffa8a55b36fd4bf4ff1cfa624f6b4228ce8b99fa13b720dbb6452a00dc53709474668b415cbe53ab7e4d0fc9a27295c5e4893ac486a7a6c1fd1e3681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20f188d9f3fd29436913fdd2c78a0b65

SHA1
094209633624f489d3f90b9141548767ae58cfbe

SHA256
1bf9cc2e82973ab593c85f58c788ce063887c9ec76858a60b12b3ed2bd47576c

SHA512
4000d046fcc2bd4722e14ca009e11781b721161918c1e34008c469090552299409890da0da72affc0ce5f8811860a11069d476bfb57b1ddbc00c533c578f93a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb059fcbcf157451b8b779190bbbfcd6

SHA1
691ee7e444115988ae57f4b878179a3322bbc862

SHA256
aa8f7beef5151f912c44f838249ede177d1b23cb59e17dd827acec216d5c3c24

SHA512
4e05980c4c04ae736b9ef0df7beefd9d6e63606b108fe9fbe5c97fb5fe0a41f81534e5062005ce6ddea40d16e99d58e62644984e2981b4aae4f942577e0357c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93121e50a450a08292f6c71c1cdd638b

SHA1
93e0a7ee0bdb17254a5ac8747f9ad6630ab29698

SHA256
1ef754149eef96d648a7aa6a0a24ed36f4248866bb9e92486febcd4b2ec543c4

SHA512
9f65de217b60bca06f472fe0fb3a4e35f6e48260e2db2fb53203054b3412b82ed2b03055ced6b0c074d73f5909fd6ae3a8c185c19d7d7c137915730af0164532

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FF7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3133.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3148.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit