690bad75b47b9bfc7dc5784390dfa0c5d6401d718942eea35ed1eea8be1c29ec

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32e25bd29cb0ecee8419566ea1ff80f1_JaffaCakes118.html
Size

213KB
MD5

32e25bd29cb0ecee8419566ea1ff80f1
SHA1

a77dcc4502c2f9a3bba2d9f94ac7882107bf3bc2
SHA256

690bad75b47b9bfc7dc5784390dfa0c5d6401d718942eea35ed1eea8be1c29ec
SHA512

196782d412865264b659b1a777133b80a963a8873535465beceadcb9048e6ce6adfb3b490c80e0619f835a601e00aff56d2d17281bbeb82aa2623e4bcb95bac9
SSDEEP

3072:S6Zq7177HrH/ryfkMY+BES09JXAnyrZalI+YQ:S6Z+vOsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421566085"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1B031D1-0F54-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2528	2168	iexplore.exe	28
PID 2168 wrote to memory of 2528	2168	iexplore.exe	28
PID 2168 wrote to memory of 2528	2168	iexplore.exe	28
PID 2168 wrote to memory of 2528	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32e25bd29cb0ecee8419566ea1ff80f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5125267ff277f1a0776b0bb568251f84

SHA1
438d0fc5fb3c7bc28fc246165e0c5215c83d8508

SHA256
bf76fa4653c7f2292c820de68b2c28398a6b5d016afb76db77cb7d7be4f6a872

SHA512
a4123140fd7bdf3ea68916bc5185970975d6840a31f6f25fbfcc57646181ebc1f32a5b67f9d8e35259af533e6f1ba108f85d4fb2784f594f4803aa6cb8ec8328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7aee5f4cc8adaea09264c56c5a0c44

SHA1
71066919a1df999d66b503779e70c95c8b041999

SHA256
c3dc9d8f61070dd412d77cee1cd56d30e654081c94c534effc69b8dc2a1c5c70

SHA512
73ecaa2c97409a19c897f8182bf1c69578dee97929088c6e4fce86ad9bbb986c85f0f5c8fcb4592be32c5b731bbda3eba5e6eb90262e5ec4f86cff6b006c55d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a38fc3b803f415d871ee2eb85ccde27a

SHA1
ee3e1633adb41bbe30d79c4ca8035ddb45c27132

SHA256
fc4c3dc0ee4f5f50d7153140138684096145dd43f505ae124a1c1571533796d6

SHA512
1424ba9f05fcf0d0fc35e32f45e241adbd059b91b1b72838e94c7c3c2f2abcfc7adc9fa7136fcc401788cc5f5aa9e565f2a29901325df30e6bd88055315ab45b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab4f2f0321dc2486afac2239dd6f0a7

SHA1
9b1a94e8539fc7a669b6af33f232502ee17eb5dc

SHA256
04fa47945b3d11fa903649cde20f8eb3a361eca12c55afc48671879bd7b7a73f

SHA512
e3ed7dfca4264658d449036e07108a5802ad798b8016a394d81ed94395c9c50fa72b5016dba7aa5b3e1e5fa163a8ea1b620807400c2b2077a3a68a8d3e76f5b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ceeae31e9d81e6fc84640742ef8c01f

SHA1
bc2f211dceed55bed166cbe993a3fcad6339ce9d

SHA256
f4357019918035ec4679c0d7b9b29e9c5cbdc0d878cb58299d81fb803c97b565

SHA512
7c546687a83c0b07212ca98b67d5aed2c96fa8cd5cb51e58760b22cdff5cbf099c42ef45cceeb487bdb81d72f6104dce56e35b9b7cb784bb365bd1964392e40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31d3f6c9f460f4ae4253d785938e4e55

SHA1
ea81bd6c0169f95ecefebd9509cffeaf18ab6342

SHA256
7934cc6a69399d20db7cf520bc02f2e35430efd06abcc201f446f3eb0938dcd7

SHA512
37970aec419796466fce3d0a53beb3b54070710862173ba317ad8fd3d10eee1ae30bc3c07dc4fc9dc443dd44c494867e46a14924780b64ee9f17ed52ecd50aa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c6afe0c947c703d1a6c0a92f44f6d1b

SHA1
b941c06a052d2f4415f62324ead853c7083ded00

SHA256
1023670a7180f47cd17b4d8d71ad6128ae5a167d621a80b072401d0638c780ae

SHA512
03f1c650783ce2b14b1b49ba5adad57e9a4b5de0523e2897abd020d1e0c096a49a9ee71f8ae5f812613ba71fba0d98a63f3be8c29d79c4b18d5b40b374b14edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86580f468543dcaa9818739735571ce

SHA1
bfd2cefbe20fa10d0018fdd306c3766a5567e4c8

SHA256
5ff1cf200e8f3b52a45f2ecb4955af334798979d9253b9401d3e607ae0f1af21

SHA512
2fa674b59e053c164844c567093b7a01ca1f82c4d8dbad85a79a3567edb75280e05ea4b4cb208def782568ade3e5ad6eabb9a541b693848d8e59c955a629c0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844d766ed8d4988954945b1b64ae98a0

SHA1
a5c37101ffd764f6c41e240457a1ccd058e2bc2b

SHA256
a900ab28a565c02476734b8c1c6fc367b9d11f7dc8050699db2fd5bdd9b47ee1

SHA512
6e1d07afd6658d70a6c98de0a2d74db6ff91594e14ad9d79785adf26b50e7d22b9e88e4da6820fa3e4141d910c8920bd634b5aca748616ec3c95523c0c45fa4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49a5b4371737f70673be8152a3f8e124

SHA1
48a43133ba136c9be06400600a7f5568a9aebe7c

SHA256
f1748f0758eac45f0f202a5ec5e49d15e0bf542cab332e5df18d05da3908eb71

SHA512
fe5d51f4d5c31d5316b0ea671dd5e1a21d208dcb5019999405cd83d7b6dcae53375562e6755030d6a3e81a99809136a54ce90a29cafeac7411fc42729b3de3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b6a9c210e311070f621849a5ebbae14

SHA1
ac38be3da4efdb5d7806471d76b79eea40179544

SHA256
252e5cf190637a2d0c267b14910be1ae916da82361eed82fb5827f5192d38fef

SHA512
5274cb60592653527fb833c3697ee93492f9b6844ee44d809198c962a00430f59bb147b20a0f675a3a955aa9386c86170d4c570cf165db13c49e8d167858723e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66152103a6052fe5a702393be97e818e

SHA1
7835a516009feac6b85cbe582bac281f26b93307

SHA256
028358b49750b7811c13ea8ccdb7a2c40a8114a3846c76a49eabcad77793191f

SHA512
ffd81f4d0690e469183670efddddcb1b4c25458e20ba674fcb08b15bacc32719e3fa1ce8cfb24656affef440dcac6838cdcfa41dbb67e5a556abe182a255a980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a67b0c1de711ce8a76a4213d31efbba9

SHA1
072f4723be6a05684fd20ecb17dc13827a8f380e

SHA256
18aa849bc1263c8f25b6d1ef9b3117cbbe7049748a692cb3335bec74d43f3bae

SHA512
7e62b5c0e49044e569890842e18e9417c0a9522d7218f78997abf7d5040fd88d0e6ae2ee3f6511faab2d0abe451e38d32a322e8d817637c7387c4e676f56e68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da23d908a8bac406a8ba2498ce5bec5d

SHA1
b44b321ff40aa96beb95e9804ff4a62704ae44b8

SHA256
7751d646f0d9e960c9c2ded12031061a0bcff473b7049eba7050d7292bcc722c

SHA512
1894733c30fca53658a02d0dc2eed8ad418fe1e901e27a739a401a4214bf828454024c1d41f7d5a2afa05a9f93552b4c28c5b04ce87bb78940725118e77ede52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb4c55fc808e3c217ae27b81a08d334e

SHA1
382063aa64ff809c2622685c86d95ba08f072d79

SHA256
da86c503da6f67683e1ab903c31b9bcc9805b324afb56a118ab159aaa162d76d

SHA512
a879500bf5e9c67e17259ad669932c43c5fd054ce89fd3006cfbd77d2ad5b4857022e5a65b580e17210cb060c94acfb43a73c3d3588bd0edae40b3e34fff0d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad39c81b2b90e3eca4b599d3501f7d4

SHA1
1a7026d5e1e507fa3193611921861ea24dfb8e9f

SHA256
a44fe3914dfd87dd4a7e08d9672ebbdf0418828bb82f7e5e5b661f21ad0b72a8

SHA512
fc63aba0a8715205a41542a2cce77f5889ff31d1ff7a82d3f6bb7f068a68ce486b25f3d0c31c81f3fbc5af6c7887fb18138bb1d8cc87abaf1e9e4501e34a8eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66112c99128bf204cc92bef853e085a3

SHA1
f685ee83b59ee7646e1e44fdfbaa4650b1d7cb82

SHA256
d839a1ce2023b3a8fa285549b91e1cebddbd8abc8c007fa90bc8a0feb28dee48

SHA512
a59a6b78f1694a75cd4060d5d0bc2ca05c9747244779f35789d05fe6cfe8af4da12428eb6d8ea7e0b24d1fc6c6af8fb60a7f490c52568c52ca19d9dec6c98307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beb6cc67a4386b5fa7c40faad4d43932

SHA1
52546c68f5d32c33e8e8843bd57284894662c57a

SHA256
f4db6abec5aceba1c066cbef1d02b6663ff6a376c26b50f475e1c6712f0df154

SHA512
117063287cb5a27b9aa01618aa61cdfe84f574e42f52723395d2505fe7bbd61e88803c216c75f50bb57142662f6fa97abb43d9ed3173316cf2d19836cb13309f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E12.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EE6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit