43f4e417fbe1023edfd80406342285a20dc361b6521246d590bf04e76e24ebd7

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86fd6407360a38815f0d45b5d3f2bfdb_JaffaCakes118.html
Size

19KB
MD5

86fd6407360a38815f0d45b5d3f2bfdb
SHA1

9ce01dbf2995a39d4b45e5368d144f4fd1b1cdcd
SHA256

43f4e417fbe1023edfd80406342285a20dc361b6521246d590bf04e76e24ebd7
SHA512

a12f6097020fa531f3fe62f7b155b7a7e0141b44cfe1e7c9995c47f9328b0b20047bc4499ac44bdd2b1781e6639bbd66b8a36cbe11c2ac4b54f74e62c82131ea
SSDEEP

384:DVmF6rXKXqanjCiIbzhki39eihzU+Wk3O7WVXmGJG1mjNACjL9Zyr6eGmAxhyr6R:Hr6aanjEki39eihwLkJ61mjNBVZo4ob2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a6ad14faeba852a8fa174832752e359c40932608b53dd2ac16ba2851e154542000000000e8000000002000020000000bc7d3d75259ba57fd933f342e05f2a79bb1c025dae839c7fab109b9c6cc7f92520000000a840f5015edd9494c66a13a0ef4bf827832f223e5b056dbcadd9d8370a7ef944400000009318bc771deb30e79aea73de7f6f6077ac6f470df1de46bc604153ee3b2a3f352d93ccd3d462486ac1ac7d641c035b5df9d58d299221ad6a5ba72ab11857af53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96612D01-1F48-11EF-BBEC-C662D38FA52F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000013a8643ac6b4b4f24b5e0bcb981bcd71db19d4b3372cc2b781655c56cb3a703c000000000e8000000002000020000000f4ae1a9e53db604c8ea1ae8dcfc64643fc8d4cfff5d6344115a0cffea5734a67900000008258381776749853578481c7133581059b014cef8b023e3c778775fb8b4ed637c73dbd0bc47acdff976dd162b09ed3a791139b910174f2e1a26714267d8649d77de1d66472da5ca6b606c8a6818027f820eedafac8f6516a9fe6f39185c9efe4229f872fa70a37746c208fdb804f87b819fdd2bac008809ffe7cf4942853bb798347a811c2c53661cdacbaa9c7e28f014000000044cc31e8211667134ca1dcba416e4a10c16152b958fd0ab654c13ef51c8eef528e81bd6bb02c67a889429b0957e8865965a678c8c0c0bc728df9689ebf7bd815	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d8e36a55b3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423320077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1296	2136	iexplore.exe	28
PID 2136 wrote to memory of 1296	2136	iexplore.exe	28
PID 2136 wrote to memory of 1296	2136	iexplore.exe	28
PID 2136 wrote to memory of 1296	2136	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86fd6407360a38815f0d45b5d3f2bfdb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f504aacbad70a05d9662fd45570bedb

SHA1
4b35df10259ce383cf8924fe39c5817f54247dd0

SHA256
e0f7e301dd1ae1fb2133d9899b5a532615121edfe34f38adfd6f7ab909c2a104

SHA512
b062952908e3548bfa3c2e97a7fa9720bba3ff482272a408c3b474816ff2b233978f04d773ce8afc0110f86dd6dfc40822c520cfe196ad1c7e34632b6fd3cf34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bc26c2c1ecb48d0fe8dc68dfd097537

SHA1
4a4c53f64325a71bce6759a241694ae693b95b42

SHA256
370c9e5d109e49b6a577a9a4afbe8b41c9cd392a7799ca89a8edc441a621ef70

SHA512
113fcb0b4e62f8e8cad4947a3cc4e5e9c4158b75d18e0e0595815097e90ff937939446698108f3e7e0c31b0e6aa47cf4da793f1ec17c8f5ec68543e1f04b4520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a958f8a761a3d68f98166c2ab542f5c9

SHA1
4f2d67bd8a239334aab5fcbad8bc3a3df6b34b44

SHA256
04036d92af3bff4d34ce95cdeb414080efa4a14b0f48d2e36e1352ff9eea4ba0

SHA512
fa4ee64834369bd1db7cf234673ada0e0551eaaeaf016fa8496d4a6dc01c31054173b89eb38c29ba5055a7a562cadbd18f7048972341d600d9a12aa13023cdbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
069b7603c236ce6b0d2632fb630eebd8

SHA1
9794a1ef99f2c2aa646a9754da1a87b4a62e4f5b

SHA256
5dc573d5878ad38b20e735c2b6c3b3cd0ac28616413011e820b20f7decd28527

SHA512
26935a87f970bd3823dd2d5d8ff6d345c3d4a8d61a25832cfe496a1c044d6c37821fe9888c6c133e9dd1951ffdb2eb240709b8e3277f8baecad4b93bb02a142e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b023f6a6a2584b551daa84f819cb129e

SHA1
030a471627f593375a59f923ab8810a324460d81

SHA256
e73f6ba5e36d6bd30acf8b195f1b91291187d3846d92e71aedbe563a6e8c9904

SHA512
8e2e10e5ffe983a7985e0893d1927e38740b39d36610fb49e74b6e6ae12822bf76c7571628229c9377f5d875ff85ccac3e2e3f5ca8f77097b465d0def095bfe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32597fd583961b0adfdf176fc0e3d4ed

SHA1
bd85020a043f6c174428a6d131c16f826d1ff379

SHA256
615b902a0a3f989dfe03db24a7d2df37432c23e482c732f8ffc461b0cd5e89fd

SHA512
e6f0eaf4a970240f0a7c6a6b620404a784c7c29ab278ac91af39e1cf0bfc201ae80b8f154321ca2f1f1433fa98d2263fb2ef6a7ade2e3955ec5381ddac953efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e5348d377ce70f93846c523fa56e818

SHA1
deb7b6f29cfdf0b5198251213cb6e0948c7a928f

SHA256
dba26ac7676b76d95ab4bf887b7a9dc872feabf9c52f339e3b0a2187d2484565

SHA512
8508ee9dcc69c6e966e668c64d0f6ccc9b6808ed2d2d494f21309a0060075009451448d2e7754df25887a85ede3065cfd5c3fad29adff9e6170e37ad1de7ddf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
059bfc2d413e362f2a703a875279d4bd

SHA1
e06464554efe2e4fb45ceaf5385cccd116cbad36

SHA256
8e5cbd002f022e3fe9563f6288a765d37ca97cf12e7dee986fbd4646d9d22a13

SHA512
eb2938a4b621a07a60cc6337d954f851c16610af57b20b7c927d80b4ed2e681acb34560099e275856baf857db03ad1d7742ed8b21bd45a62b8afd8709966b04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bcb608feb9d1ec4f6ea1f166763b474

SHA1
e5db7b9ddbdcc5fa229356b164dfd95470b6b1f7

SHA256
c3e5820845cb78ce4a68c5ea52ec310513fe91a08f0e285cfff8ac1fab3fe091

SHA512
6a1618199b2e97f327b9d8d483657b899f8c97ccd6e213ebb0a6f8f4d33791d2a041fd015bd60bec6dc85718d259718af41c6768c88c8f4bd4260accb277234e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92215900b53a5ef03d41a1ed265248b8

SHA1
7471290c8c0bee149686483b4057fb9eec3110f5

SHA256
ee4a07d24d5fed67c0a77eaba98ebf8ce19d73eeb9ea63477328c0c1633ba1b7

SHA512
606767c4dff74666264d0a266f3126ecf77f25f3f06c35d2c9b2ef2e50fdd5409eed53102138ee8787ec01b9abcea851fdae15f21aa0e5f24a5806afdff7c32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19c506cb676cc57fb2a07e11a825fc5f

SHA1
bf4ee0d8f29b13473b5871fc9911a9cb24f87d0a

SHA256
c5f0f8eff96e66a6600f263fdab0215c5741247ffdb3f059cb02addf1e0044a0

SHA512
fd1d6fe4c86e3e201686c9699823bce95af718783f9e0c8f0d1ba17fdde3fd25bf234b1d834617cfe6eda99b685c9f99ee731d2e799a610296271cb611bbe97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e022ddaaad603483c81326f866fa133

SHA1
0b7fad03f5195d537b34f4f80b734ddb352f0d7c

SHA256
1fd1ad60048f36be91e6b1b90af059de9ce2169f763781f6a71714cd759e2d41

SHA512
a3c68af9ca3c2ee989bcdf33d74401ccb5591bcd947f2c6c53ddfbe3fbccd3044e2745a061cdabfbc53917142f2c2496b6be7dccafc7b40cc3e5a85de3102576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f6cbd6f5baeda2e13e1fa318086351a

SHA1
c84c9de4930cb5a497ada927dfa408b5d743678b

SHA256
31d05ea67b69a1e402cdd3b9c3a849ab7892648b6c73ae715136454fd346877b

SHA512
a8614962030a20057a06c6d20598e7320bfd2fa13a94901dfdbe7400e8e6486bb1ac92c8fd1d8c70897930a93f7a398af9d9f4a9f5e26c3857861e63602a7bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
801d9d381d96e5525ad222fb3503dda6

SHA1
f976624c8f92139858668ca730b95635df533ba6

SHA256
993cda73ed4cce934e496dcf7ef7becaf9d9e7bc3fdbb45c1d5534f8eb670d65

SHA512
bb507a85fedc7b8585d0964c091ad67f61b4309b14a6343431c64685c51b22bfacb0e942eaffdf1fd279a76c3095196b53842404e182617361e6423ba0d9ffe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca8b7233e771480473cc5c715d2f5363

SHA1
ea31e02285bf6dd84c433fe529760b29ca9f1ba1

SHA256
e5fe3b0507f12d6b150f510b4729e4517febd248346bfff9bcc58a13283d9031

SHA512
09d2e731871fc92e3615bdcfca7794fa36ede5aff3610d0092ccf70a874d30b4fdf2c8349f4f28e0692cc05e9672e1666dfe8cb9babc3b108689d99ebda7edec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3165.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit