812e16730a315b35d46315a5bf12b1eb3bd1609131327f167f18a385affb5b99

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

301ff702ecd55a6df7bfa9381e33177c_JaffaCakes118.html
Size

7KB
MD5

301ff702ecd55a6df7bfa9381e33177c
SHA1

ae180e693b5c23f2dbf676e01f2be00ae9c34318
SHA256

812e16730a315b35d46315a5bf12b1eb3bd1609131327f167f18a385affb5b99
SHA512

b5470c4f2f37cc9279610c1a6de1968aa00d9964d5b4f6ddf1088203bba76c2a1136509657ee4af2f871f6c414cdb1d5daabb49708fe9898f69e1656bcca858c
SSDEEP

192:Id+D7Q1bRV6IUhhwo1rzRC9pbgEQmNcfcqQdruypv2:Id+DU19EIKhbR5EbN+QdFh2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fd41a4fba2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ae3cabb28a6ce3cdf31ae5e329d942128ac0e1afc6cd24a446da9097487d20eb000000000e8000000002000020000000e3435abed12801c1a88f6feed4fa89e6f1574e4f20c8d68f21aaee814e49a2312000000000ed6a3a9ff1de637684e7dcdcc3bf4d4db00f8eb98b033aab2fcbe62a9356cb40000000c906acfd9148b0483dab1b1fd322d49c6cc5150cf594965ad0944dbbf95393c83bbde149e656e057026e2175a91d591ce6941a1890a8a5052968148105928423	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421522299"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFCC3A41-0EEE-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000775538956cae2db970e9b0901bb90ea32b11795594fcafda3569f4fc2003b3c000000000e800000000200002000000011e3fcfe0788ade80c21a8134f02b014dcd089279e95ef7207352b665c2b0f96900000001722a21ffa460904d0df375c328b96d0e30a31083a9a05076d9bd1276485718c8bb04aa34464523b59340dea75b8e1356adcfdf3956f0cf13caea49c197f09fadc1e8b71bf71af9627e14bbf395efa3243bf4fb584a75649d65ccabd3540800304c6caf1d864b6c27d9e983ca39206750e5b8c8c95ad3331448c1fb0919d680e7f58ea20760c741c308016f70a01869340000000895ba5829ae93e34d8266568c20f73d3268e1fda1c88fbe956de298475bf9ce19b727deedcaecd13b7777a61c903ee6b7dbcc1324031b3c4cca0d31ba18d4f02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2096	2288	iexplore.exe	28
PID 2288 wrote to memory of 2096	2288	iexplore.exe	28
PID 2288 wrote to memory of 2096	2288	iexplore.exe	28
PID 2288 wrote to memory of 2096	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\301ff702ecd55a6df7bfa9381e33177c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
744cdf52e6c3c8a51e1101bd7a9cec71

SHA1
1f0e23df402a193451fac4fc4c36dd4da7fd3af7

SHA256
f44e59b50b0b7053cbdfb455d9c3a188d35846710df29a1353f1ee5e88c54836

SHA512
ed5c5c3970ea6b550a017f8f3f0d4709739977d4c72e3a44ecc68ffdf70366ca62788749663af163f1e0edb5ddb393d52ae183a9d3143eb50046872f67f0063c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b34627ce12b35f80e5525c18d4f3bcd1

SHA1
65f5d2bbd71dec942eeff666a553695916de8bd4

SHA256
5a0d3421ce54e07ee674ba7c49e312fa72353070d2a740021a17e737a03d1ff0

SHA512
1c02f97f0aaab7c8f1587f1348651910e66919001f3e1c089affc8668ba208673dd4d1c16062a40dd9e9d060f7d38b2556020a8fdbadc376a4ebb5bf47b7b56c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a413702b69090c2b9cbe12cde47c2fa5

SHA1
c8bd277020ecbef7386ec83549005bf95dd3adb2

SHA256
a6b8973fb1e3089933fa9b123245672aa2c2b49406907cfff23596e04835eb96

SHA512
751c71dd836431e8c44b318c52e17e3eed00520a325b5295ffd27dd7bdf2e78e3eeec7ff65b680f200d27a051b8a567383b4b724cef4e0717c351867e1a8c47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d3c674e57882c6dae38ff5db5a043c

SHA1
d5220c1809f592a2bd58613d77f3ca6e59bfb395

SHA256
32e95862a11310d782703bf030453c6fef239b3d928f25e4820e00de41a9558e

SHA512
56d486005458e696d8653238772202ddae796e2a36ac9cdc8eda82772cc7684470c9493e4d8ed6d7966421c4d4d350489b8f0daab17bbc26546dc6c148cf29eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f82e7a7d667acc80119aadc9077e21b

SHA1
dbebdc436b161af7ebb086e575f05e66fabc5459

SHA256
8ddd50be52a8a41a34e0ba8751c189b8d44c206d0df62a1bb64f550c059201a3

SHA512
a77d6b2f7fa1170e45e452a80cdb19d88a4052a962bdb6c74dcbdeaa4b932859967ad33b05e1545461a57d367c7e6307e66e6550c0c3d6dbadd514192c44924e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b63f3e63013358cc7defd5928b7ea7c

SHA1
c512567d6bf5b360ce8d27d31aeba22ba170d34a

SHA256
9041ed1786a83cf15304f5000c792acd4002fffb90d8dd3e360b46ddb64bfbae

SHA512
97345e123e8c44c366aab766e3c74d9061f60ddd66a3eb7558ac8cb74223153e85d0386b87b81827b52197be0bdce9823b0f3b90b7ce0211fc677cfe511252b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db782cd0a3bfff06b6f7a1253100a43

SHA1
c4c77dc48ecffef8d9063e8fb975408a970cc4d4

SHA256
8be6611e2a3aa3643152aa41438d2cc48c14f368aa8170283ca1d4b66971e8d3

SHA512
251b725e5ea5f52ef543b36486c31fc41d6f40719341dbce8c4b748f2b410836502bc7de595222530e56e2d78fecca9c33adaf3379239f836144ffc1f43b888a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e27de83711c7b7b963dae24e48eb8303

SHA1
67e5f336857d9e31dc2e522975f81133eb9697f7

SHA256
e127de34c8e72e34ea0bae63b55ecfcf67be6c9cac7ce1fd146eb1cee4f457e1

SHA512
18fc559f434682e6a1b6c9b525522de8d938f31a83bd2ca49041f7f24a00d6f45b3a46c01af5ca93ec3afa7b43404779347ddbbeabb53312deaf32dce2198684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63c7fba8f8ef0da526390980f298bb29

SHA1
3c23bae6a4efac3cb06f2dea285d7ab5dc9f86de

SHA256
6cfa9ffe6a7cc28bfdaf50b92528cb6299c81515847359965155f193009b1299

SHA512
eea801a493a53fb049fe361724bb1f3c8df4f97763dfd27e702373149fc560a46ebefce9dd3867f9feb8c83e1b552a3394daf60c23f549351395d19b9511e4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4152dff62ffe726a69141acb3b531ffd

SHA1
cb8faa4ef22119163c9c316b61546e52f9da2b3e

SHA256
9118a617bb87a1873c519db4b170e4f08125cba45b864d042bbedefa7cc9fc78

SHA512
e3ef3dccf134dbe8ef6d98927201b737dada5bad729c86d6cd2aff6eec1e51980dc90b074468e231f0a95bc838361377b21f8641c6cc792bca302ae68e1cf45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
106c36da67737b7544776a879e93cc8e

SHA1
c3e2a6d48644fa9d388740aa7a507fdb6ef0340e

SHA256
dd0a88b74be8efd9acca88682ec6c02e7e8cba4c3101edf5d34597d7a269304c

SHA512
ced1ae418ebed69ee11b31a4e208689353b18cdf66bb8beaa171dc51fe3f00d9d0e815d92fdb156ac79363ab6a95e487b0416270b964e9e22a184ddb8ea7ca63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acd2106f110481dfbdda76087b4d9f5d

SHA1
2ebc51d8b16f9edeaaa49b343f31258b265124c0

SHA256
85afa566ea80ae1c7fa9e3bc4880f795d14a86f442dbd386cfeaf59ab0b19615

SHA512
baacb9f2c4f32a6ac5a49289761a27b1f5827d9f6b9f7b3b8d3e5f8b6a7c5de89a71fff31c08e878fe20c18b1e2c92f7ef33d016e25e70ccb08c00a92fb67ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37321bb02daf997cebdcdd462744c9c1

SHA1
4df7b8a0826cea14aa8405e71bd1e874a4c3d6ea

SHA256
de22c5ce5e56972a27924ef99bef5b94ee9a3540e68bfb95fe904413d73a6a3f

SHA512
9eb648de36c8e5ce432a789313e0110f7d8788973164833c9e814aaab118692dec77283faacd3b832bd14834a1e7d1d39d1fddbae78d3e2a50e6fcbdf3775313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464f51b64668bbc09d75dd9d7209fda1

SHA1
f5a71eb0720785ac82fd522dbacab7ff33a8389b

SHA256
abdcd2ce95b0c74b7fe6b3134fac2dbed44b0b8bfa175a772323a5eefa9f1da1

SHA512
4d7f712ad64e50bfed6d2ea4d48c97d784bc1b01fef9d9f4ea72635e1f18c18d89d98e77567f0dc71a26aa1e3935e204056fd9f674da7763a6d35bffb8b08311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d8ac42a8840f88a41be7d93425d1f15

SHA1
3318ce9ddcf7dbf678329c187f58f4d1a100de34

SHA256
e16d08ec251b51aa53c4ea90c6d189bbe3541f45f2802e3e324fe99c0ce6ed40

SHA512
6f37e8b1180f4e427dea2390732f3f99efce310e8095182c4c7136c9e86a84815fb591d9825b29f3993515a890a523a37808cc3dbc4e44e2438425d338ca9d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614915b1bc279be18d807f0942a22ef6

SHA1
d3c06e68b4c4748fe8744e52ef4e249a8815b16c

SHA256
08dd09ec301060f3ed7363c263920873fab9acaf97772311c254895bb71326a3

SHA512
06bd92fe1a5d7b1e5b3e0b46d995472bfff8419446fc3b5f09db2933d5dfe98f6d97bf3c925954edebfcca4f938353d82afd5bf458568b848e2c270aca82312e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cfe8b96613df6f5b4bbf365c5fcdb12

SHA1
6e9830e6c6b098cca34a578e6f45ec460d6dbc07

SHA256
af38cceb8e9ef7f6488840609547f2459864e901db3453a3282dddd7afc97f28

SHA512
a11e15a8051aa805847ba1b5160b261a28bdcfff3baf21e0ac893ed803298890a393d7a4b3a030d16d13acfb91545e04bb89fdea4d0353e299a91b3487af7de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24A3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2514.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit