47535d94bbb14f55d4c1f649b762cda2d687eb3b613d8ad0bf2ea1f455fb019b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d80f698d3a59d7a103f1097145cab50_JaffaCakes118.html
Size

35KB
MD5

4d80f698d3a59d7a103f1097145cab50
SHA1

fa93489fa62dda1e9320cb3def2494c12bd6d4ab
SHA256

47535d94bbb14f55d4c1f649b762cda2d687eb3b613d8ad0bf2ea1f455fb019b
SHA512

36015c52a1bfae7d68ea8ad94cf679c4565bb6777c0cf33b6290c658131b38a8f3c3c73264e970c8b0cc1ed99cc4bb6ae328c3c5109fd747fa50caa3d3d3bc84
SSDEEP

384:aDwF1NsBTC1s1XY1Vq1yVeqKVEFpef/VEBDsDQxb/q2kls6yWd6HmIDt8eWWdxl/:1NsM6e6usiO6l/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001aedcf9ad55bdc99969bfa8715a4fd698ab321185d12596692d5453543a51bb7000000000e800000000200002000000013b5122e846c47aed613937941c5a36b3abf7eeed5e69e1b072a924e9948d96420000000ca1c8d782df9d5185e48ff5cb92923bc06097d96d2a7c31a4c9fc98cef5f637e40000000e016135e99ed21e2a2dc535be12e727a6f9ef2e39c2ec37ec07e22306b50d5d7d6d1e7189e1fb61e10218567e58bc923f9d6545d691609e1dfc1f33e8bbd4525	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c4aec558d7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDDAEA91-434B-11EF-884B-46FE39DD2993} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427279778"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000dd7a32ea5aa55160e5e9fb319412178d071e23ef9e7f940dc6f606c1397a606a000000000e80000000020000200000005f881d4bd97e83d8fa89d6f11a628087b0c88a9dd95aed41b250c9ec4e109698900000002d6fa3f52490e7f3f064927194b6fa812b90d5410fd0b78e3ddc9b896ad88c2fdb0b5501314efcd262a2b036a9e0d67fcb93403df8b1fec22022fa954ead3f4c4b9a3d9d371012772015de386adbdbabcd0aa89e10fc91e28b1c9bc02f98d48620ef93a015ec677fad592f68deb5e6cd7ab488d981b8357c7816e8586b30e60ac5730d71479da6fb179f4acd72ca877d40000000771543bc259153b569688d1d1fd310d08dba1f0a060dc602b7062e83273d9689863bdbd3220c590d61ac37f68a70516115468dff0a6a805bea683be5bf41019f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
668	iexplore.exe
668	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2772	668	iexplore.exe	30
PID 668 wrote to memory of 2772	668	iexplore.exe	30
PID 668 wrote to memory of 2772	668	iexplore.exe	30
PID 668 wrote to memory of 2772	668	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d80f698d3a59d7a103f1097145cab50_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:668 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e9b9fe92e0e194be943707ba2554ad2

SHA1
3006135633fb3d0622b8fa418a1fea2f1dd1d7cb

SHA256
7977b11f96b77e859812e30ed63d83c68d289ff6ac8f2ba00200aafb0c324a21

SHA512
b9161df30a105bfac15da1262af5db9ce70d62e85025acf7a228f9afdfb352ff253bfc4df73eadc4c107d34fb4048abdbb653c84b0988670e00225c70f4f927a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63ee9325e5aef4d7a61b955bc5b58583

SHA1
e77080b8960628209d5dc59da7b5d9fe3b7ef1af

SHA256
54f8ed275d0bd8c6b16760716dd3621411f2a84231229635b0db90c48ef9e704

SHA512
11771f6ca82ffa6dea526873646102e3fd6372779ac7ed3aebd696145bc190ee197ec3ac9107ae984a2cf70eb4f474a9cdcccd04bce76b0f0326e507b44a8a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b533444ced2901b008ba2fab9ef568c5

SHA1
c97d11eda27110208980d1ea488412f4df47c49b

SHA256
5f79b4ede38a04118cf919a5edb174b3430ea5c268830dcbed1243deaf779c68

SHA512
f16feeb69f595fa51d852f2a52dd6d60e6edc11ee5b2f5e64b1a44b7e5c84bac311ca4248328fea1598e92e376527cd4ff06f69edf98bd5b34a7ba52e968eecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a963d8b2ec2d64d5a5f09e8d4d508902

SHA1
6f85d86e73b7ece17084102a61f6d2b38c5ae920

SHA256
dc7e8eef49f774930196cdc8ea876dd3eeba8cc0425e2302e7390ac2977d3e9c

SHA512
38ddda324a6ab19ac407be340d4f73088c0627366caf2249f8d77f29154a8aef4a8192b868da6192afa7a8b96c6569098332e4f6c232d6ee1ff18f236e349cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5194701ababb9100b91c7fe02f14ff61

SHA1
8d9f0d47f279311736dab073c2a4f0cace5310d8

SHA256
36d8ba159f39dda33be8037ab4d990e5d6f43f634cddee586cb7061f85a2c63f

SHA512
a28a639de2021b1a5d3dc4c32f6437d413dafda6e2265736de9beb935ae5b57fcf92161a910d6b370d83515bc4fa5cba6ed77a0c1a3f33f4b565804e07d6ed3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d15874be3e66cc42b00fd07a08777f6

SHA1
1e84c0b0a79c09566f63fa34de1f0ee0ea41a5fa

SHA256
812c59957e04a2f40a259d33ca19208284e3658540a01bf6db5d2d116ee468ef

SHA512
36f3c34c7e36b780c6c5df50d33c05a4379a9223c09fcd89f437499109b7f199ab8ef4b718d4aa8fa473d902505596c786762ab17fa7db3f640abd56bb9fae8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3603953ad2f83841dfe8b346e22d7e31

SHA1
9516fbe15ca419bdfedeec72d60d6943c1539e57

SHA256
ba0ef0116f8eb72abcd460a8320245de746e1a3611f2b2448d7efdc3c667adb2

SHA512
da46a79a06493572d00047351d4990096cf0b73e0aa0aa56498eafcde2488c145b7c711a68847adf1e61605703a6c31d348c4b4d8fa8970ea17b044ab9964676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
475351eff662ea8c589544bc13c3bd9f

SHA1
f40aa87bd7a6268a9d515dfde3746f7c718f1e8a

SHA256
76628385fea629391caa440485d9bf7a74ed5be86f2c74d125ec687dfe228f98

SHA512
bb369187db15421b6998ea5b2ea7c165257a05e48a2d7956422099aaa64f0bf0aea5acdfe4a6032c21e309cd5fa9eb51ed0ec93231972a631168810458d04634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79d02cf4231ae49632eaa8418deffe25

SHA1
abb5a7c580353eae25ba47d733a751f1a420f87d

SHA256
11ce4e3ed48938ad756137e6f1fd19539b6f3a44621d97b6da01b09a8eb569fe

SHA512
8c20082810156c1a667dbf1ed26b640b51c0f1336fa9b99ac95dc9aea93c5a0e562af0418b31894bb442101289acd6a50ff5442f028d29edbc4859d49c4328c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78d688612915c08805532dec08d3d214

SHA1
41a60e5975b1d88a6a0322c57cdd8ada701f0f1e

SHA256
7f98090de6be84d3822da35354fb04ad9b3300491dcb4aea53a56bcf6b9e43f5

SHA512
3220bfb1f5e828320babec05941e19116f76efe2479972b0b48cb500166763f1f7d5c5d532abf5ec9738186668941a0f705d2084e4e32011129c8530a3a1bd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44e0f4a5e187a9969282841f0f186445

SHA1
24d62943c5603cdb0f1aab0a3cc2ebc90f3dd17e

SHA256
4ab3185e58bb8b537962d7caefe8103d79f60c178b4cfc76c9c15e427cbf7c15

SHA512
2e7bc6820f8266e9529614f2131a41482ea32db691ba640da1d9a9c0f8e60695c3caefc28c505f02eab9839bf6903ca56a127bf9de55864ea8bd9e6f03c201cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b300241dc2817dd913bc80d5028f6e4e

SHA1
35dfce520d6fce9d5d18062ce2db22ff5fc55c30

SHA256
1d1ab3336e40054a82942abc6f9d5a2a53a50c2c3eea93ff270a7ac78b80f2c7

SHA512
049d521ee1ca7ef2cd51e665684cc44dcc02e191f1492a5bd22d080672e7b0b4f7ee834a8afb8dc5b86f24fc1b26ed7541f0e327d821e3a80324fff4b8735a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eee86708628e442fee90250caf18625b

SHA1
19e9b6de53092bd7b01b4a0b8e442db251c5b531

SHA256
188ff2c5feebe13dbae095131c21efdcd9be0109bde306eb8d44b7ca94a36609

SHA512
0dbb9df8bfaa8217ab4b7117fc4c1cbfaffb1921ece8992245fc2278a1db66653ed52d7f4a127336c9f70526b5268ca5e6747be329eed803572a02c686089931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GE5J41S2\dnserrordiagoff[1]

Filesize
1KB

MD5
47f581b112d58eda23ea8b2e08cf0ff0

SHA1
6ec1df5eaec1439573aef0fb96dabfc953305e5b

SHA256
b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928

SHA512
187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GLOK2QLQ\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C83.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7CB5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit