725cf1f8442f2fd0d75373a16df44b9f05797a9f2bedb19048c12b07a2e46b33

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3068b19f55f956e846dcc86e144724bd_JaffaCakes118.html
Size

5KB
MD5

3068b19f55f956e846dcc86e144724bd
SHA1

1ed14b6c5b03d39e5bd7709f4555685a19050f5d
SHA256

725cf1f8442f2fd0d75373a16df44b9f05797a9f2bedb19048c12b07a2e46b33
SHA512

9784430c75d136e0c95bda304fac782c6eff5f74502555086e8ee4a83c61ad395f4ab08f7d7412ece39b8f93db2a3e8743de900ca82859a6f1b6badd6c709203
SSDEEP

96:mc1qi7yylvtyylvMyylvuyylv1yylvA5yylvXyylvuyyloi0mFfeAqIuTNT+/TTc:Deylwylfylpyl4ylfylqyl5ylml+7/yd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97866E71-0EF9-11EF-A759-F637117826CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c802a603c7e2feaa40955d066beeb75ffa7efbc64183391580405e0074eccda2000000000e8000000002000020000000f76bcba1392f4904a938c4e7eeb47d06b72ba4b8a531306cb3dca78a63b744d090000000089eac4308e87fd829cc4b47c31306b085e2a4cd4b270dd5560c35a1b14304412911e8be6a23257f8176b957327907d4d3d804d241b34053f8b5e04d6bf28dc913e7e8a83754543cfa775ede9bc9be6c0fdfaf533ad5abadf52454953b9b71f181d0787a9022e73a39caa9d22382b25ff3cad2c98b41af6dd398e4aa5c80259ebf6d45ee78f137df69941a47e81c790b400000005b8c60f5bed4f2f7cf58c58a29cbf2eb498faa40dfb45b56be37612b2cf3503d7d7e0b934aa6f11b0b331c511d8092ef0d62bb306552e5490561700818eb7602	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d094266c06a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421526930"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c7347915898a887f6573627019e1bb74e7f2cbfa863f8fcc3b07e05c5d5e0fb7000000000e8000000002000020000000a7adc58d0feedbf31554f5569c8c5027382d09e86dd27f35ab9bf654f30292dc20000000683bad64f674dc3b1a87cb94a3da0c3f57b0e7e54d06d03f36c0b5efbcd86dab4000000030a068ba58b1746dcb7586603ec3953488dd0090df28583d7cda74c8c33175fe369fbd5770ff72b9b468ecf56837ebb274e035ca567854daeca5d593ce63059d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2028	1936	iexplore.exe	28
PID 1936 wrote to memory of 2028	1936	iexplore.exe	28
PID 1936 wrote to memory of 2028	1936	iexplore.exe	28
PID 1936 wrote to memory of 2028	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3068b19f55f956e846dcc86e144724bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd2bdc5ba2820a6ceac89606dc7642c1

SHA1
2c9f7af1c5339cf729ea0687c498ac55b306dc93

SHA256
72876a754ddaaf88b513e7b60d5b674b90ca8602de63f968b5726f22d65cda11

SHA512
d035637efb545e03a9d06fc2d8ef3f008478d30cf84d64ea832ade1dde752c932fb671813d3d8c2fa9ae9b4af22f611070eda9bbdca78f056184606df44acc39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b0f2898ae87820e934858116d08d847

SHA1
65a53367d57b86176e3f75dd63fe8e364c779d2d

SHA256
58927cbda67c58e39c8f12f3aab6f72776652d9c71d6fdfa7f0c42d305b11836

SHA512
aad19986ca9f9c27b0d60bb83ade3e8ed2366eaf198891f04707f9e6e4b84bebf12258ca4b3cd40e05944a724161c1fe6ffcc1d21d577a7515bad00c1550f27c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0f3010c28bc3d1e8efe9cb7f0115de

SHA1
8afd7d6f6572501d7b9f2d5a18abae31611800e9

SHA256
7b311650680e4c8c413845be6fa565ef68ec7977a5d246928e02a477c6d53088

SHA512
77fd22fb594519cc8894bce946b9aefbaed569e18e248eae92e3c91d1faa37ea307725555ea6eb9e631687458a495bcba733c8c2b039f9507958d2d9d370695b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d878adf197d28fb7d8ba2f6211e3fc8

SHA1
ffae9faae88e5e571f8c290940d1f0f21fe19eb7

SHA256
68a338b0cd674e5800602cda581e2d996fc68c2c87279bae8c5f244e1aa6c384

SHA512
3a6fa56a4a1240f6b6883c3f6aaf94a0bbd778623e8023443d1b912b9498b53b2833d8c7d85902e6163823fb802644359fced53b1fb48974389bd6d4dc1a10eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ae57f2c0ec003c629339ebd8e2daf4

SHA1
5fc234130c33f99ce07130f0b4848ac8462a37f4

SHA256
c9908d744adc0cc9ceecec207fa22af69c0b9645d1530e516327947ae9ac00b2

SHA512
305ef216c27ed22f797e30df8efce5be816093a3bf346b1ce4f261374807e80c2414099ab253b3c98a4348049321cb66774bb35cf4660582910aa484988727c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e510ec467a063fc50272bb9acf78674

SHA1
42d2e0d1dc83c51c831f44a75d4d7d6f87d041da

SHA256
c1730f0ebb4a014385c500b16064e1a734ef6edba4047ccf775ce566cc8d2674

SHA512
9d787e977140ef55c22c5f0b6a61a1a3bccefbf1c9eff731d0bdbf8a472a830e794cb0c2557dd60a470326efbf90b9a43c053109c6f812fbf846ff46e26d7bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a72d88fc67b16cfc21705d6ae0e39c1d

SHA1
5defa2d01f2fd31ce01758bca67d3d6ca4e59f8a

SHA256
f3fee07dae2194a6f31de524b1027d0906a23d9b22a5aec5ac0db00f8e4a988f

SHA512
4f2b62be428b89e4b7b8411a2bce0f6f8ad81989151f76ffac9da56d5293b92fa1dead7c5592459bda1cad6091adf77be1caa8fdc68388332381b8110f426567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae0a28bacea02d3aab30fce012f30e4e

SHA1
0489a56bbd7d153019ddda82a0c27d610a47b05b

SHA256
eff8b0743e6df1784d092f560de16e0417eea300289dd51cb867da558212ecac

SHA512
24a0eed9ef599cdc7a851f600dcd863e0a1baab03e7386bfda85a16d1363af9ef5a85151cbef752be9642c752774da11ad8e104171a798fb3e33b91d0d3bb9f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9847d9d634b62d15b2ffb32974c9f7af

SHA1
f08cf8d2f8a81a16915bf13f719e46823c377330

SHA256
34a1d6feb4b43b06dc131583b500fbaacb897d06778941a92d1687c36cf5d172

SHA512
cd8ad801a3a673412018049d0c68ca37940ad9021fcf26f97da4e7f78bc7daa85c8f94b08a293ac90743293000473052b7cb39732ea3155b3590edb3d18d7c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
244aaa4513b624611dce1003b3faf371

SHA1
9ad155753ab1a65c108e5fed12e4fe4eeee3aad0

SHA256
36cb4474b6c5829ca417093dc40bed471b63f3e7d83f596b8524de75cdc1d1c0

SHA512
07f96ab8cf909714119ab412e54fe001caaa44141031598c31ef5fe08f89a32ac5f39f5b948859e30ed225a756d7c8763e295ea913f4577b49dad911dcc4a9c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f88064b41a18d71a90950dd1dbd491b5

SHA1
9d7c4ac803d7592eb9acf00950489910a63e14d5

SHA256
16570ee8274f51f192507dba3577c08e224bf850077b8fd13b73d0409f02700c

SHA512
071e9f2c4e290a8c9fd72d2233512cb689b24b7b7fd98421905496f55b97d5a0f99954ea1ca6bb6192c29a3244ce5eeb92a5db71e3e668296351e58f43fad5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6911a8ad931376c8cd07d0657a251c6c

SHA1
a9f9b8376f2fa2fddfabc61c1a83c1772e611b77

SHA256
a3ee1064c037343bb0189e1774fb8f0ca21bab893758f39ad279ea19bccbd276

SHA512
a60d67c1ea26907bc54435c92fdee4d48ee8122257f97d9dcf556ce9dac9156c37f53c409f9aa1be5ca3f4cde98278b8741f4f7a82632546962e95ba246987da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555d23e7bbd31241f3e29e3db421661c

SHA1
19b769f5b10308655b9e6ed43d9ce4d6cf494ac7

SHA256
83028ef35d3b0232c07f6857bdf6cab2e16e281c6088b6d40f094a48820de859

SHA512
d0ea3139a1eb6cac6ee71688cb38d6845df7509796a2b31ad6fda197927c5dd6a55669a5f4e88d4d210065245ba2edc056c6cda9a63cf6d251a6a629d84cb009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
960bc07176086a172783925972a226bd

SHA1
166c7f843514375703c51e703ae1128b9ac44be0

SHA256
3032e6b24f601ec891f760d3e6036d7deaf7d10ce8d0be774113ba53d03db097

SHA512
950728ba9c0afaba657113edff8b88e49236221612b8a9dc1d18aa31926f023c4f2b26d8af0aea3c806387fa39ce32b884f2db79c32d8640ca922ba6869e26df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de2f336e86106caf71e7808222ec93a2

SHA1
073925196608032a535e00f7b4e0f16f317a083b

SHA256
41ca45c8f2caaf94ca030f720613119667c2603b6d12da14d8ceddc85f907297

SHA512
711607c0ae3f4838ab76866a2de8a3f29c3f39a47049a6bf0f644a8e565491849c30fa5f1da8c0ef2d1a7f71d7c5015963175cd082da2022815ad80bc1a9a952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfd0799f27356416e46e5ea0004b42a3

SHA1
0ab87c2c9d42e820762ccf8a8ec9022106f165f6

SHA256
147719e781764edc2728bd2f13e71c8da92671a2c2a4b302d4b80bd4b1d1d288

SHA512
5d9f41ac77bcb10e2f5fef6626ffd2868562f6cebf82b3f2ee4d7b8ce76f48260774137c7c7bbb226d1b2463c05c86ff105b72cce9f49ead58d0d1adaa9cb82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2494.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24F4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit