ba2d63258683056f3169af336e553c5bcf992983c9c572db65826af25b8323a8

Analysis

max time kernel
126s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

845690fb63f84d294d46bf67cddb8a6f_JaffaCakes118.html
Size

35KB
MD5

845690fb63f84d294d46bf67cddb8a6f
SHA1

6e393a33f5a2f9a6d79cc9766a408a94c5c718b7
SHA256

ba2d63258683056f3169af336e553c5bcf992983c9c572db65826af25b8323a8
SHA512

3a08ea06b8a77d5bbf4964c927df5d1e5035b097590e3d7a1d7da306f542598ec6dab0f54bb9ed5bd8958c5267f7fd2cb98999fdfa981f0c779d3d216f06d984
SSDEEP

768:OFEbr1bB+fb2vbeXSbU/p9bETUfo4/oGec01JO4JBYAX2Vo5IP:OFElN+fSKXSbU/YTUfo4/geUZG6qP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423238075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3005398096b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA06FC01-1E89-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a5d789c0300a25bcfa62901d9ab69a7845d5eec3225db0502772508a3db4a714000000000e80000000020000200000001157513b6178b4eff52f8bd0532485bb138b2ff128a08ed773df2be6799f3c5f90000000635888a33952c7e8885807b6ed8cd6d197b9b0b86f5e01f6cb709ac1c1b27cb48d23f8615d5e909cfe9efd5b08e4bed615109b65d1085fbaa6a5d491e2b541b6d832d51b43db00aba91802627adf2a5bb1d51eea45bc11136d2b087a85efb63531381bbbdb00c79e5c5751a378938279220635c07a506d06c118461580f0d4a6fc5cf1af0de7ef5864ef672f956c55cf400000001a43e69189156d9e671a55f36a0f8607984c2aae73b84adc9fbaddffaa68edb456bb3ab7baf00ec29ee27bd6f84b9b6baa59d62477556eb350a49a509ee85204	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007b926f3eac1b5c580b94e2db12290c8d63c519bfebbf89a0a35c4c54bc8d13c0000000000e80000000020000200000002a6fcba9096bb52027682466fe95eda2a75cb2bae36d79a46e4b1fe02861613e20000000d958b3e48cd8855a985b7bbcb66f636cd2410451e7c412275d25dcdd5790aa7440000000111bd7d7a103e75688c555af6ffe62d3ffef8f40b7793d57d2db371de8bbc8603a384f0a683deb50e8c9a631490de69d7582289a847380b7fbe545d3c49ceca1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28
PID 1736 wrote to memory of 2108	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\845690fb63f84d294d46bf67cddb8a6f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46ca73bc9f347fdbcd83e1b4a1fb7a77

SHA1
e489c5641b749aaa031c5797f0bafaea16ab25b0

SHA256
4802c042ad7cdaa5dd7885038236dd6b89ac9b9359dc0b5f893d7bfe7f452237

SHA512
b28691b24a154d1adb25656a572f26aeb6e3077cce433afa0d7de5822de3c2ddd857c000084125b9b2874fd4d59415f4a3b63469798503b99c4d2c6247a196c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bc124d8a28d52381cc7ba2b6120d46e

SHA1
fb8867e4242fa2a162eec6108080cd650e08c597

SHA256
5d8ef79eba06ea423f078b7ddc7bd06f2c4dd818f5b4e8165e9e6ec784e279aa

SHA512
e3c03d972da031a9f2f99db918b08135e89438268d5378ff3d55e9767c2c2c8dea5616709400c4ba32739291b2ea91dddb8187347873b98574c8c17b681ab32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d15a84d249c0ed530a6275e21f67bfe6

SHA1
83d7565b0f5993eb293a8eeb27271a7b3890a5da

SHA256
5fd020f511d60810cbf3c08f2dbf20c63af20440e91caae2edd38bbd04e57872

SHA512
864d8c9feaf67cf939fa6fb27903436d8c9dd5c0180d5021b0b9bba033e0d430e95c367c77d1f93c92716f4b4ee97f630b055d2d0782fed7b51377c04734873c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85b414f3f604424592eff5b18edecc5d

SHA1
f326ef6f3d3637d178588cf7aaf0f21252a2bb43

SHA256
2abb5a2e1c579c5302c65c4ec0349c0ee87338d237b3b22ab6816c8ad6b4f368

SHA512
e7a6bef2fa6f91924eb242de05afaf57c7946faa2223c1dca8be6e2373b1def898c6193452ea68d753b9f77ca2916277ccf3bd66f676a7d5d51451d8e8ccc8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15753c1c457994347347e322971cd8ee

SHA1
49a51d9035c4dd955c4284c7806d58afc8b59663

SHA256
78a4100f1318342c6b1f3e34382ef8db1429f7654f2dfc22bb6b1eec62d2f59a

SHA512
e33876ea84f19d4925a0829e0988886170f4388039988c980549f4ec45f319c979975762ec4c8121eed8381928d2e8941bf0f5de5e2f7b6b48058c16f12b4fae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68bd0386957a39bc5f9cfa686898b2bd

SHA1
a8975e5faf760629ab292ae05f56cb5bc718c457

SHA256
0d14b2f8096a57afa6b65a16e586d18916cb1953672a041b330b0fd1b25d51dd

SHA512
39469399caa09c899871028cd046baa68b8bab5ef43715aea9c391f112ef247d06f938c03568fefb1cf0242d72246810161e9116efad17182e83d9c52633ae52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bdb72e6fd9f7006e2b5bf636c951550

SHA1
7c0fd0723a99a2467c5cb2533117695ef083aad2

SHA256
55d737d8dcd0b513cb7b07202c5c026a936d3e4c9dac4a317e2ec0ba49d7666a

SHA512
54cd8c7a949d6731108d95a416cf4e34708b61b8f4cbba8a5de35d628a1c16cab8a90aa6319f6cb126db32107e027378fde715546624c0a056687e47c04c0ced

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b13401b41b06c607a1d807a91e495ce2

SHA1
b6a7dc8c7972306f0e6b8dc60a35307c5281719e

SHA256
ae749731fe31090780cbd5629933ef7e7cd81d738be1b1b00d053ac7b68fd589

SHA512
c473429d9b76209a6b6b5042d9567e6099b98267de80f685982bd02f0b23a5ab3a79b76087c5900a84063e67abf2dc3fb7d70f6790a65ab31bc15eb979c64a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04a31960f5cda4e68cee22a20e3bdf5c

SHA1
c02db6efc5abb9679cde00bd3dd9fb97a8d62772

SHA256
5e8935921b22cd0c929d10b3fb2cbe6e82b243505db28b80caa688ca095874f1

SHA512
f668106c602e88fa7d47dd535e90b70ac8918fd50459d07e95e763d3bdfe2908da27b2bd945dc6156ec81da67ca0cc5b2b0fe21f305f5339f60a0ece00f1421b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d7f30b391432c37406c6cbbcd9b72d0

SHA1
008dbf940038fe93393c772b1e1d4cf44208a79d

SHA256
6c565b875162d2e6e4aa4f5a647c21805cb7ebf9031c6a38c44e1796f8efd57f

SHA512
fbd7a4ca49cde53892fac993a17aa8f2c242da02062a206b8b1d1679d413be3dda7c30a995b68e58dc5531af82d564672013aad97a2d57957356db50d135c04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba177412b4d00a20b2bdf45c1c7c457a

SHA1
72d255871b95c08a0f66e7b9648bce2d22d776b6

SHA256
e04d6b390a40f05013cf7a21d74307497f327c608653fa8ad2ae83480a32467a

SHA512
81e587c034168c16a726921bc530ff18712391d7dd329d49bc073742408f35cccdd3d06513b5392087b409feec512d1f45bf2bcc0a5b1100f9bfdeea9f1eef52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b75ab3214a12c22ed90b24eecdacdadd

SHA1
de2998e6ac65b5ffce6bb0f62a50e9d62dfb5da3

SHA256
c1c7545c303e38d45419efbf8406c8dfd29ec0ae04154af1e03ba7ac18473f75

SHA512
4c25b2c572430594c45e359fd546ffd102285cc49af5630653b10055c4186153158d17068ee58c6255e4be9f2f73e1ed7fc78a06545a6659556ac70525d2f145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\3604799710-postmessagerelay[1].js

Filesize
11KB

MD5
40aaadf2a7451d276b940cddefb2d0ed

SHA1
b2fc8129a4f5e5a0c8cb631218f40a4230444d9e

SHA256
4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2

SHA512
6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\cb=gapi[1].js

Filesize
66KB

MD5
0fe383a7ddb9bbaefc3105b3297f5583

SHA1
f80c9d789f251909c7560bd91a9e1b9a10c26362

SHA256
d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683

SHA512
31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\rpc_shindig_random[1].js

Filesize
14KB

MD5
23a7ab8d8ba33d255e61be9fc36b1d16

SHA1
042d8431d552c81f4e504644ac88adce7bf2b76f

SHA256
127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5

SHA512
e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EE5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4010.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit