b63a4e60c3776772d512c818c7286a2abd2bee0b9f182c1b6ee6adca2f08746c

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

358ac965de2d5243cac979968c37d696_JaffaCakes118.html
Size

5KB
MD5

358ac965de2d5243cac979968c37d696
SHA1

47b5ab14c3c25c21f6a3f19ed9e90172e7045ac1
SHA256

b63a4e60c3776772d512c818c7286a2abd2bee0b9f182c1b6ee6adca2f08746c
SHA512

c0007b88a20ad7a4f4487afb64ff27bcaa450f8af56ee73db61e1ccbc97c92d3bee0cdad20346422f3be9ebf8692158488dc7ffadb0b877a17c04a3f5dcbbb55
SSDEEP

96:WMylullfHkflwSGSjLzpOqg/gM4/Jzli5RawVM6WVy+6qTdPrB75Jns6tJtH+:WMxvD/Sboqg/S/JzNiN+bPrB75JpJs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000922491d06d94dac5b055f1b01355357e4d8d87e0f31f9b514c7be1338020a541000000000e8000000002000020000000ca363ac8237b0ef25234fad1f2f75d5a8bf8e9768166704e6edd1c1dc1f0e9889000000074d10bab2ed3eccdae743d190ce60e20201ab28e31d28875997173c9369d1c7027eac835102cff986d3c99b65f26038791a57e3309f25af08eebff770802fb31e5fb464b39abb943168771d4bea036a5628c918b1dc0e07d9938fb4a5334ac063945347a544ccf516992276d91c49a6137f63497b0f2db99894cebe1c27afffe66791e996b11ff03cbc1be12430731bc40000000338b6352b68b2e1e16d99f019f57fb16aef8ce9e12f11a2529047f7ab0860f74dcc386f79d97703c767c69942747d98303657b8f7f8a35053f7c6bef2c044d7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB06B531-0FB4-11EF-AE27-76C100907C10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a4b185929b1da3801d65b209ad30db78cb1aa5be31fef1e3a2fc3b78d853daf000000000e8000000002000020000000fea1e8eaf5234479c0c38d1ed24eaa024e67a8fb80e4d0154627b6c70971c189200000003413ce7f4982fd2a11fc96c910fb54b573a9218ba0376d1ad4fc064719de9acf40000000a065634bdcf935773ec7ac48f8be38bb42fcec0743b42af04ea9cc2d5b2020c1efca0f1c26d231f0d1cd191b45089af741d1c6ce670017e02b37cbd06cf43606	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cc71c0c1a3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421607386"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3060	1752	iexplore.exe	28
PID 1752 wrote to memory of 3060	1752	iexplore.exe	28
PID 1752 wrote to memory of 3060	1752	iexplore.exe	28
PID 1752 wrote to memory of 3060	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\358ac965de2d5243cac979968c37d696_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a549749858adbc38b8a35f31eba18b

SHA1
686072edb96a6ef0b061933419dd03d8a681ce8a

SHA256
1c7fe4fddefa62dc5894aed4d64a7e680dbc83f610f24ccc04b6d73a9b942812

SHA512
6a1196dbe3b7c880c2c6afeafc8149e36d2a769c4170201b51f805f27eb5da9ad916e60d40e441e13a88563493c6e0886b5b643bdee54634a01371adf3f129b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028af0aecf7976c0407d53b8c43245c3

SHA1
9d33c23f67d8c5cb796f46a49f738cf10dbc3a1f

SHA256
3247700f2f3f60832ced3bbfcdb1ccda7549db5b8167dcdb11b89995d0fd1f0f

SHA512
ddf61ff66c29d841c9dbac49c0fe7f5a00d57420f6c94e58ea4774859567cf4878df38d9fa3cce876656d8cab61afb4b38494b49ae18bf056b6100f9a9710ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0e636a16d144fbee4b956cc4e6604e

SHA1
c6f1cb4375efb7028d57ad9681528290f6f31da9

SHA256
dfcd58b530be7111423682d85d7a134163ce121bb8f44ba9f0a28062c5cfbf5e

SHA512
e33e645be5de42805a7952ad357b39568af16e11823d13a24156e147c423f4d99308d055db9cc60e6e286a42a2b61743ef1be1b723966aae35a1fd725f5ee768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6667e7823344933063515d2cb12f8141

SHA1
b3ee98d0f5bb083d8c65c9762e0c0b259d017609

SHA256
e05bbec3a46d99ffc11d3a8e2ac324b7ae18c34784ab4351b71304de0478276a

SHA512
11965a3493b11b393094cba247181307c32c889f996f500b107868b3e5aff9039d46b86da7445611c5205dee6da2e66df81b6a93ee8674394f902947776b8278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad59d9d6ceb0aa2d4ce3d4d09dea62e5

SHA1
2b7afeda20e08797598e8c75a69b1225ba155d7b

SHA256
092a1c8c1f3b0ce5afc593fd773b7b602a5ee995f5c68c62fd222d4e93d0b01e

SHA512
07a5f8ac2b6b05ba0e5dfe42beb3e494a7101fd41e66c371a412a66c0a39f0fd118b108e874a2d41751f06bd9c9330ba064be87bad157a34a8b80fd56e570f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
036f67ae17d21b2572dcd8145ceeaa3d

SHA1
e61db75c974d4de569ecc782628d275690795a56

SHA256
213e7766cda1df1019a81f61c2f059ee72be7462495bb6cc9bc4ebba1962dce5

SHA512
4be950f3a61b55874337f2f67bc43a6fdb850f5767cf7e94bd4d3a50082368528d5fdc1ef57305d930b3eb8ac7385c5f7f35b69ddc06fb42a5c200e764d124bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
030e266cbce26b06c6666f786eb2a3d4

SHA1
c160cdb8e2b79cae0d9585cb5d6c8fdfa1ae9927

SHA256
8964bc68b4a06c5d76cd92822ecf0ba86ebb3b5a8163cfa70b4efb142a656677

SHA512
65c705d00ad2063390e068107ec59c7ae85663f5a5d3d0f7f16ad812aa20714b353b54fa5da259b7386a19289d64abbe738b939238eaa88ba005d82c5459ecb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86147eea5c294e90e27e5a2f68eeacb8

SHA1
9277cb6b75ee5a57392d3dc767aa248dc69856c1

SHA256
4a14aec8f704bec2ef67f085516559f0620436141c5da4a91e97718fcf0fcc48

SHA512
fe716fae0494ac55131fe83d108b6057efe57ea40f2430d44f9af8342221901c73f875c68912167bd8c2fd8966cad569352309917369e47792d4a6c719ac8035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01618e583db686104db6f009150f3e66

SHA1
34365d1c2d52faa385d08a582655445b555b1e72

SHA256
796627a9503d66916f646e2ba52e00831bcb379f4a4903bb9c15a95c10c9d03f

SHA512
fad0749d5c65a2dc175ffee24f3f533d63be81b3e8b04f8276398135bdb0879fb61ced2f1f1febc714c2c519f4e76caf001362fd345891d1194d69cb2039b671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec3f0127f45767a1db6a5fcfe6ba1125

SHA1
67a38cfd78f319b3a91ed5feeb521a34051bcdb3

SHA256
e54ce84fa9d23ee1482671c33ff080c732d0c12620271910bd0f47a2ea6013b2

SHA512
c1e2d68153017639843eba2a5d2c67ec9728352c7f5c295e56439ddfedde674cdcba16fdfab98536c005ef4c144b401d298bb8ec4cf56a16976edf371035b454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a201e6c2e6525c9314914fe9c94e8c3

SHA1
b5cf0a6670a69f9fe7bc3c6cc62d6994feed6512

SHA256
a77ef510397d389039d06fd69244a322fa19e0c9f5080b14de2f22fa1a982832

SHA512
fefa9d4fb20ee528cfa50477106a642015d71c1632e61c337f67e46e71e9bea09c530381229307aecc8578bb1e2162f08427e0f2c755986b88e406ffa6d75894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58776fc64a677393b57123e1a3df0c17

SHA1
2d49ecd90a2d7baae6f2e21c12839092976bf478

SHA256
c650467862c621f2aa860aec8564568273aeacfe2a24fbad0ab4f0652ed37026

SHA512
1da4f29b020c8eb12058466d5a182a03f69809eea145610332c75f5be35a6e454b641a3f222e0278a2d575e6627bd0c7308f5b91fe926d8df588f93c066a3f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c0d08171bed0cb81d72fb8580848591

SHA1
d150a49ca402c4fa177546dd9252d54f3ec2ca55

SHA256
43fc38841be37fe1648efd0bbffe2a6234e988e74bb34fbdf2fdd710f36deb89

SHA512
0f0e9642b4132a2c7b31f8f858858c192636d6743578b9d353eacd5aed86060d461f4604171267082e6c08169f1235d27cb782addadd664f51fb59e566ca7bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e45ce901e97b298256d46863787bbc

SHA1
156827f22c1479094d2c666bb49df1f2dc93aba3

SHA256
82ebcb23930a930ea8e2bcb44d7db37c36f0ce58ed74b43321e87bcff2fcb963

SHA512
82ca063e387159e2b42f5d45b21c8e3b7281868079a40f362b8cd1c420c8c26456bb6acd05615c770060ece77f2e7e809834c98cdedb835acab7f8fa2d34d9e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b53afc16b8ce89bceace63dc22b4db

SHA1
40d617c92afa4de8eaf39e1850d5fbeba64c882b

SHA256
db71b4ad0e9cf669a32455049efac6848687c8c2dbc482dd055aec56f46b0eeb

SHA512
589aef886c667da65ad4d73d0141fd3719f008eaabf08a1cc9cb3b1051b658bf148177b22e2f3504a07ee8be6e15a77a42529b5e2130854027896f55868a7412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f93e35617ad9d1093b121c24065ea69d

SHA1
83187c9307cb6c1903cc79b244c1a2c1731ef12a

SHA256
ed603b344e3dfc1e5c448a7727ff065888d492ab6e564da6bf2f4d2ac721cd09

SHA512
b4b16ac99d906019b35e4e46a56ad7d8e681d26798e8ca2a796503b0173a6a3e228080b2a055240cea05908e04316ce6d359ab380a396226be932b05fe72eb77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49ff420d7e11b8890fdb13d0b2beebfe

SHA1
a07ce83c1a87d92571a254e1740e4c91be4c6ca0

SHA256
c18066542c1f396b8084204ae0605feef97a4f0c27079b9c3b56f4f3ad8bb6b0

SHA512
c5701901f20a56d4eca4ea07b7cbff73777da28bbe5703e2edabacd3079edc76c6f7c4309507136e77ce91ca84aa594313b2357100b3a2fc917bf16fe572ca71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE05.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE58.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit