5ea6f731896580bc9c36450473d025e902131684f1fb0f0c1677a8e2bf1caea7

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2097cc13db87dffe1963f624b6723847_JaffaCakes118.html
Size

213KB
MD5

2097cc13db87dffe1963f624b6723847
SHA1

1b0820c2ba1819e1fcbdd7fd4f9119de380f05f5
SHA256

5ea6f731896580bc9c36450473d025e902131684f1fb0f0c1677a8e2bf1caea7
SHA512

3df44fa327c74e23518d54f4a8675fdc09e9c978409f2e8c0a3544565c8ae8604d2d59ba5e82f86059d7f021b72e37b4437509b53ee2a43534d8af30ffc1770c
SSDEEP

3072:SEljX/AAzsQ+pyfkMY+BES09JXAnyrZalI+YQ:SElcq+MsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421247603"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B9FE321-0C6F-11EF-9A72-56DE4A60B18F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3028	840	iexplore.exe	28
PID 840 wrote to memory of 3028	840	iexplore.exe	28
PID 840 wrote to memory of 3028	840	iexplore.exe	28
PID 840 wrote to memory of 3028	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2097cc13db87dffe1963f624b6723847_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e1603bdf25e631d4bcb96e13f982a1

SHA1
5c23afb26a4113ccab8d95ca1ac6f5558b20d4b6

SHA256
3bf64aa7156c64540770c5431e738cc50008dc4f597770e064498f97756ea4a0

SHA512
6d8dfd51ff71467e1dda9eb6e80c5beaf27bae4e67804a6d0462d74b5d4c526ea1320d306644490e23e52f2d518ebbd74c1302adb97932ead5b65f5aa38c40c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e705b0abdf3c08832c567d14bc4dc4f

SHA1
6ee74ca8d2bdc44921ec3fc0a1b7f19b0a790df1

SHA256
40755c95540dc1c83fb028f9b179832ebee0a3c3445a636af5df5c9b1caf0f36

SHA512
ba54bd261c2eb4d506d5a5591b007f4aaf416c8f84960dd4d65f2e874c563393d7c7f6c36ecca41df0e998b5ea0b673703c32eaad33468a2675815652305821d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583c8a315d0eea52813a79fdd9321ffe

SHA1
a473cf381b64bf7aed68a7b443a1e719d3be2870

SHA256
6e64064fad2c8a8c5ca2d6e9dc238e3f92f5a2fcd75a89aff305c21dab44fdbf

SHA512
8e0e0adcd02cf06beb8a96304a71419cb569455a597e618975fbebd85f4f21ec32d63910497c3a1b07a50f17b5036c06f88fcc4127b7a7b8b8d2ab2308d925eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d470a0c8c8e8221d5c560c71b5a3059

SHA1
025d6f317b9d0b88feb413a39b794925617d002c

SHA256
a0cbb7ad311e5188af8e8552cf588c71a5e7e79fe93b483a27ddc152cb0b3e58

SHA512
27693becc8ef87212f141a0ec9d36f4bec9f1137e7ace828e7305b5af74fd47016293b544e7b61b5808ea6d0f70e217434615db5be2ee70eddb59785dfff8b92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e92f1cb31d581e18ea27171d51e42fd

SHA1
2ed5cf00abab024f9014fa18449a22f0e3ecbc0c

SHA256
b88f38fe91adb6f1af55aedc81a9665d1b8d24d13b63cdd95b0cbee9630287f3

SHA512
11897da8a169e0904ca2f1934d58f7b7ed75d4eb3f2953af16c9721a0e2db70acce6db5fc66bd8119be1b182f7f9557e9f0233d822bfcd841e177c8d0eb9529f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda60b0fdaf45c92dd444a07bcddacb6

SHA1
2b603363a5542df85812f1c6470a58d5f68b88b1

SHA256
5b452434912a774c8c28be0bd3a4fcd25606d3a1b9ca9a5a34ae48af2bc57a9a

SHA512
4773387b52a030ac7c0e8552f066231d96c30128d55047649d7e6580028803fa0430eed8d8858740fcd5e6b449c876c51b840b6b8cde64edc6dfc5d99fcb7676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7f025358f035abf7106f49d3b97ac74

SHA1
7658d54771b96bdd46469dbb4324d8c9696691a7

SHA256
d8c1c70c1aae5b9a5adbfabf571597f9a7f5eb77d69c78863f82f9d968ef1fa3

SHA512
140f9529c42444f2e921bbdb6cba95a281709f511d793d70de0605bec70df964c78ef3834b3380fa2a5e5ba6b19673214e53729f95f946e3f27b87ac6d839bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7bdd20ab78f8cd017bd4eadcedbc05b

SHA1
64ee2e1d3e3a16d780aa48111ade516071f859d7

SHA256
8dacc0127b2a95fd348e4d07cd721647ad16951d3264e8403c099b0aaa65bd84

SHA512
28b62a1cc5a4f7f5c4aa8787bb998515626ef3b08d142d64045bae5e4db082fb9e5c478fe86418c3a1e0a097a6c368f70173492f4dc9f503ea21bbe84752f6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138725946da9ba10b03c54d704d65bb6

SHA1
edcad42b78595ed7ed0dd3444984ba2f09977574

SHA256
fb960deefee77c6247371af270ec70c2937f7a74cfc1260a75622e9a21fda9f9

SHA512
174168ec20d481d56772d7d8a0f17d18817ba907e6a813ed83cab6ef8bf441ded41e5e8cf05efba6629cff2f48433d20fc07dd9bbc55659ceb2f28b95022c272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28fc23a6e0122aaa5e4c1e1d7f731976

SHA1
628196374edcb77ce556a470dd06c0a4c312ae9b

SHA256
813e0ad9017f673d7d97c5a6a6039edc830af9ff619f77225f0c429f26795a19

SHA512
910d7ca34ffd8aed2dddd8a7c0f680dea88b532be1b3b05fd44a95e07d53040c31aa6207c6808343e0c5a13d22fd4387818b9bfc8594fde2df659801266859b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6337c9d9f60cd4f326a5e1640fdd44d3

SHA1
9192c25ea61cc1ab7b09d8da53bdaab0931caa53

SHA256
3bb5df1a60e93ac2a94fb223e54c4d387a97282cd21120ebc7b44c242d942585

SHA512
d48bd5b83b1f6ce8088545ca5eeef89c58339ab823356c7add3c1e53d0a09e9fb413c5db144c06440a5b919198c8616320b6e75ff7821e7ea89336da580af0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9461530d5dec6e3b07772ba7aac011f5

SHA1
68c666c0e9c04c0b497d688adcb67bad148d5069

SHA256
890ad186a760b1af500520ff4df421df319d6d4c9ced99d86f960b4492131fd3

SHA512
c1403fc1a1bac168befbd902e1fc954678872c209c53640918335135aee87169cc8534eb6387315dbad25409602f01aa602fd08bfab7d2f21cdb64f772e70ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44e0f234ffe136cf0ea95801f2d95a9d

SHA1
5feebf03f8d0d982280a7b0d16903317a9da8d14

SHA256
0931aa9e034fcfbded6c0056f68567f470e5e911f7504255fe0f7606eb161100

SHA512
d6651107ac21575b37c6064e93453423cb7cdb8e5ee64b424629c512fbbfd08909cb4ec7b17c772e9ac8f71e2d102eb0f4a2f0baf20af6ff4d26de4b414b88ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e33c16329b41bcac71951643c41bb51

SHA1
2fb97811c63eb5062292c483b4c736c1e3973e2b

SHA256
475c76c3126c88e96dfc34ed7726fd506b97ac6490d64cbc985fc21fd55af614

SHA512
27774890578cd105cb5d20fcea6c57db60db4e1c9961506d2fd17c3abcb1f02b54617a04519d55835d447e8c24f6be2a2f2f49f608d9af056024a8c358fc795c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1082b5858ccea86267a8510973246174

SHA1
6386c1f79a5ceb413726f297479d80ac874324ce

SHA256
c8c26fe2e6d038576ca6e3b5c49b1d911eefe11b7b1625724731a0217f94b5ea

SHA512
e26d56375335ca73d77cf7d8063bf0fbedc83f834907a0e17d3de644fd03d95a386ba06fe9b22c1314db9b7b069e4a340613ff172092e48f2ca452c647024fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba9c3c0b572ee0c5dd83c584bcc5f4df

SHA1
ce699c177fd3fd7a6fedaf3cf1f2c2d412c7a739

SHA256
24a18866b53a4a873993e91b6684c62534e3a19ac38a6beef12d27f7e10c0720

SHA512
9c0c0a42706b25f3260aa2eaf7b71e61a064914855236d2c7a4b326637773c231b843b3d6f449e2410bdef4de2df54c68cdd826059536202e38dad3cac0d18de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1aff9bf5e0a99d514da9eb88bfd60e0

SHA1
2a3df852f0af8355e7c74548c6bbe54df4a40e4b

SHA256
ef0b11529f861ff46efee073259805b967d46830f2bafee2523b62d1576df954

SHA512
f25cec73477404d269bd4a9b88c461fd0aebe1e3453ec56f12e6e0c287f3640f870acf91137954325e5c4f2eec92752c8c2617d48c9d0c6a12a07db64aa456fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7b2d39b437c68217dac50f653a6ac22

SHA1
2ed8736451f03ae38de6dab6a86a48328d58d3e5

SHA256
b048404de739d1abe17dbd6ae1611f3698ed25f537ed660becb510737359d9ce

SHA512
777e6d5d1c9a01e16819ca0ab50e4566e39973a7cd9a528a5874bb6c2e209aaa5832dedab1278b408ed023fe49723ac868deba6358abf24825fd374855e3d163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66260aeba0d3bae622a1eabdb511eea3

SHA1
96f2150718db0ea51dc1aa72aa639cd9341f8d6e

SHA256
c1cbd841696fa07307ee4ddcadd8645816dda11fd8477374248f6aba596cc82e

SHA512
641de08005490a544e25e154285969e904ac57dbeb78a9ab229b22a790f68e2111bf5461a42fcf05eeb28dc2bd8eb641bab605ee7fae06af1b23b36d02e75846

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11D5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit