21f7a43d71f45e7b1170bab1320eec67d0824c6a795f5a3138a9fee7d18834a6

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e4278733898eae0a4bb43098fddb78_JaffaCakes118.html
Size

460KB
MD5

83e4278733898eae0a4bb43098fddb78
SHA1

7e7a85adefc873a5fc2a3a1a8b9c1d1d9e69f6a8
SHA256

21f7a43d71f45e7b1170bab1320eec67d0824c6a795f5a3138a9fee7d18834a6
SHA512

f7eda5e31141dcdb450a7b1881a1a7411eebbbe56f858b940587b20dcc72434aaaec4f7fd49ee50932cb7194759e87bf7fc110f4192bce05d22e5c632e33f7d3
SSDEEP

6144:SXsMYod+X3oI+YN5sMYod+X3oI+YfsMYod+X3oI+YLsMYod+X3oI+YQ:k5d+X3d5d+X3N5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5094a6567bb2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006a59fc3aca9abbae170a3c53e711e322a3d4f1f15994ea6a451ecb364b10e903000000000e80000000020000200000006f746684f66a347d5cfaf77842cb13f8540c4a61ef87062130005d2546ffbcff900000003b71adf98f3352bec961020f21519db264d162967ccb246860d74f912904241f93f23398d17af0fb394c2f712c3b9a8324a7958469c6c106e4b3f362f70246ab10fdb30b6fa1296a0c7e851fad386b2632a5624909f3d049e289691360c60a1f9c3c4a43f4beae8d1417d12731c9ad9629439e97c3963bae88bb421354caa13a156861be8ce6cb2c5c7aa17ae2bb58834000000072b827ecbe388642b4c44296366ad796eac4b74654a7fc96999eba264d56ac23d36c27787a1564a0072545fba2683adca953de429962449eafcf1fc80266820e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E1BDDB1-1E6E-11EF-9B71-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004d3fa3f77b9533cd8bc6326b5cddeb042a100d5fe43ea4eb49657b1b100d2281000000000e80000000020000200000005fb412418e9d9669d7799b6975e94f3a5e68240033ebf62a11ae5f7ad2e5af29200000000ea7b3dea2a8c735d796e92d45d0c0b30069a0a8356cddbe96a759c7ffcab1e440000000d6009ee4447e551bf0ec6a570d135f551b08562ec00289f64e131b6c3f8fa1cc691549c2db6fc251d479e405575e91fc6e19f5e3638c935fe814a66f132ddbb3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423226408"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2984	1956	iexplore.exe	28
PID 1956 wrote to memory of 2984	1956	iexplore.exe	28
PID 1956 wrote to memory of 2984	1956	iexplore.exe	28
PID 1956 wrote to memory of 2984	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83e4278733898eae0a4bb43098fddb78_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
492d5b599e75c2ca0d483536a2af84e2

SHA1
cf892567c024dcd6b708d37bde95c104155f8eb5

SHA256
9e6dbcff58df2872323a695163099c176a64152a10a51701d4b15e35d1bc1680

SHA512
e779f9767de5e4a4d2494945cfafd036de36c9caef9e3fb195195dce439ad3a8e46f30be73ee059592ce2a551ff0a4a4270d25d68430872cc1a4e05bc67cf4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae73d32f41b393d044cacd6d268cb0a1

SHA1
2b0a589a320c7fa102646dfa152a34c76deba8e9

SHA256
35e304e69581593194455ca6e7c82439f39829f8cbf5a5c082c7343d4a0acd92

SHA512
d71b74a43e906a5d6a7a1f9f3c5a43cff4c2e39dc66733d7e6f499ba82023220d1ba26d134090d2d980ec4b56793b862e145d3ceff9687532063efd75edbbf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a25d3439ed756e596fe1be74681f55f

SHA1
1e37303d424446090167480e101b531d60af8acc

SHA256
b2feb78c462fffdab9cba16ef997a6479d4957c779c9a4b675f2d1c6b8360b77

SHA512
866421630c1f8f28b4535ee17f557de9fb9074adec3b4697e0a04be6d9317044b21441d96a263af09f6c50462dbdb51245768a2748ec5c9280eab4a2b3b8364a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca4c70ecd5939675cf736cbfe9c9d472

SHA1
234c3812dccac868039d94e544fcae73a1f1e276

SHA256
04d261fe7a6586db2efd18a9ad9a5dd7504d74bad88a934adac48f0bc00b5f5b

SHA512
c60d76d68c94ecd14bf8bbb3467de0c8866a5759e27f47e3ecad74def114f8f8dc6b8e04b762b58385589131adb630ab5b339e26568595cde27836a5257608db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db0ea6e1c340b21700f57bfe765f1d0d

SHA1
73b4d3f5525b887e9d41b188632eba0024da687d

SHA256
e41d4d3a25d4dafcacc683279b49ac82aa53c79111bafc76c591f8c6f8b1fb95

SHA512
52d166aa3731726339d0d35bc64d59e51f20250ef8977a13e33d76b0e91c527c92777fa6b37b17662fe2b86a1273134bc087547d511050228b4ec005518cd19c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d29497eb5104befef6ff5c1cf9e1f9f

SHA1
e7c38950ea3365a810ec463c86262e9bf44c7cb0

SHA256
6609683611f044d90d01a65bee95323e19a0255aa0e24cd6341b84dfe76113dd

SHA512
286369824a058bf575b2513a79cc27ea99075959e7556276a29a6332bb3ce3b3034cfaf38cb475a4e0a5939f20b61007230d336b0525d8f363dece271be1d692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4532ebcc4cd0c9f634d2475012397f78

SHA1
bea1fd4423950e19838f343fa5ed5ac1332930d5

SHA256
fda607c7cd0332ac9bccc8c9c4da4494829762452aaeb5cd8ada8ad54eff4401

SHA512
937b4ddf7692fefe13e8ab3b46a4fda40060959561d0f4c4af60223662c3338739d63a9b908e6aca88ad81e1da85d5eacd29acd66347bc973399a03aa439ba6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab8cbc44e9343b228a8b7a313dfe3ea4

SHA1
729935c7a8072b3734a5ea4d420ba757a8af4e15

SHA256
9522c38c304e2d85d2c37aac2268d868b74c7dbf2833f69a2ac30b660fb88a02

SHA512
883af93e366a78a6bd27c3438444b6b01c38b9e9bbd6d2bf3bc3f087589715f0ef64b677e2b0c92d144fb9de9ef4b2bef48e1d557580fde06ef399ab60431c35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd29b93498a17325f3715984a86a26bf

SHA1
90829b4ca756f16f1de0eae0a1927c6e2d4c472a

SHA256
3de1b44a732a906d13f328a75c86b996fb21f3eb680727918c5fad54b3b332bb

SHA512
eceebd12e45b2c45096620046bd9e0dade0d6de5622edb69c89da766a09ac512ee104d1e8dbd18d4ee197e25b2397686137e6ffe591356022ab160ff994320d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc2d68cb0143c4c258eb17bfc3125a59

SHA1
fad7add9771a73a912f76ede20e9809294fa754e

SHA256
4a08ab0137d0b334a31f7abc8bf53e22b2e9bdf9e23dd764d4cc8154dab5e659

SHA512
ebe5aaa1ff678a23f055b8a217d5d3a04c7e62099c0e7a04c56bb1c9398a19ba8c521408837a476fadc6487c315d729455b8166e0aab6653080cbf1c70b6edec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9d82c9b1ff517020c570d338973c98a

SHA1
f297e16c8c79e41bfe4830739d22d773a6e3aa5f

SHA256
bc0db3ed2b007e7d8d6c2e6e879d11042f665cfd517bf20bfbf19b2fb351ee09

SHA512
2ca0b4831d244c2fe0a1b7b19b23fba162803032ebf5581873cd1d732dc15a185d939c5262124572d8455f8b3eb56a91f04f5a2c885d478b6f5a59f094958371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c3b6d7df042abe90e7f8b8a603542e8

SHA1
f0e4cc510795687b978b56b276bc7595c44affd2

SHA256
133e663277282cbed25fce48a27776bb481d0289bc620f9fd3df1e449bbebbb2

SHA512
98d4958122337f24d72ca816f11123fc4a133dc87783c5d9e2661d6e6584b729058d00d049c9f7c58696ca5a67ed0d2e9014b21d1bd592c0cecfa3205eeae186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c67ed276ff68ba1cd1ea2c253cf4f9f1

SHA1
0341cd761b633e2989e6d393f00ab49e8a6f6af9

SHA256
c4622f2f75dda192153bbc720b77066c06143f839109f4ddbc7d19646613c315

SHA512
9c7f3a73d3b0006de55661485ad2590c79bf1da41e73714347510ebad3fc3b01cf53a9231593cf832d8af1e006728935ac1f86acfd7382ce2f2d770bd5c69ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b8e8e8e808fc2867656f6a41fd2c9ff

SHA1
c3fedb655af4b0c39e0f220c2bcf2f065fa50649

SHA256
d0522ec7449fc3ed1b113ae24b974ebb49bbf315aeebdc613d73af7fec6de1b4

SHA512
2444d2ab505ce0209b1bb9e9d179c850e2313b4b6671c3c04a492b8b79440c0c1976c1f20339d7dad4b8382e5d6c4659233d1d214526af75b7187c329d62c36b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f967d71f8b1428fba8b34d0ef75de43

SHA1
7ca542593b2e5d22e903d46b6b8146ce4a02e947

SHA256
1a15ddc3ecc21f8d2225edef79a20142168e05a5fddfaa6d8c40985f6b2c5be9

SHA512
1a6c64b697aefc19379182ac4d688c153c021b44b1f8758d1ae6e7e1bd842b1bceebd0cb87abc1d6528cb4d70645ffd147136b7885c8e3ad8bc11f667d3d19ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CCC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit