1eca0bda2ee81593e0a1aa5ec5be948d32bfe0fc5967f221bbcf0997328bead0

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36198821a46e82fcf49702d566dcb397_JaffaCakes118.html
Size

159KB
MD5

36198821a46e82fcf49702d566dcb397
SHA1

b5f82c54ca80ca7cfc41e2e7cfd835fbda9ab3c1
SHA256

1eca0bda2ee81593e0a1aa5ec5be948d32bfe0fc5967f221bbcf0997328bead0
SHA512

943a4bf3d0d7a613664012bb603897105f162230e8d840ea7c463876290d39af9ad58529741857eeb474262aecdc1d735ebbd2148e9088160e639bbf9793f17a
SSDEEP

1536:LDKwJ7xKfQjI8xgLu10YSD7ba+0bhtQCAdnwdf4qSSY7sD1QS1/0sepKqFc8/I8f:LDKwxxMQHiJJ6oyd9YdS1/Gw82wUIMRq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e735cad6a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003057acebf11f51ddbb18ec84f4487db68d3042f17c477393521a3a9ee94ef80e000000000e8000000002000020000000b7aff9f72bae1046d6d0038b5ddd4f080af1832c236392143e38b6374ac24eff200000000e87334c3ad7f5880b481a5de1ee14e843c1b1ede62e043f599cb1f46e20a45840000000ab333118883a9d7fe0e1867c64494b3e90b774d5c3ade45b799e53252634e8cd4d50ddb74d98c30ec4edb221e34c0447a61d63e3501fcb94671471f695f1ac98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001aa6a01c6fb005e9746748c0f97d50875052071efb9a867d005c5287978bde06000000000e8000000002000020000000a836248e3606ea2483a485ab90cb45743c4fea52eef815e5e480c4621baf9f42900000004db8358a2d49ce7a58639573a7610bb4ba97c12c9970f526678ed2aecb91140118bc0553ff73fc08cb66c51342a8671a4735a2ba080cab031a91172aed15a703f048d69f9d7bdfbdcec97d9ede00ff52222e814589bf17c4d0f5c3cec1911cb517261b4bf646e69096ab55098a654418b023335a34b1aef0c9ca1b158fd82e2544f5fd02e6abe2f7d7aa3adc033208dd400000000384978c297b8b732f3432d3da18b10356b517e72d470ff91ed23db15f813a10def17a2106c728bccc1a8f2c2d4636911a1447bd72daeceba463b0c2e3d21d42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC7895A1-0FC9-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421616380"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1200	2980	iexplore.exe	28
PID 2980 wrote to memory of 1200	2980	iexplore.exe	28
PID 2980 wrote to memory of 1200	2980	iexplore.exe	28
PID 2980 wrote to memory of 1200	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36198821a46e82fcf49702d566dcb397_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0be2c5cce0e9a8a11ef74da653423312

SHA1
ca7ca2f340bcf19c237a16a04319119f193ce8d7

SHA256
6cece7856b5e29682cacc68ab0d1482710510e9a10550abe19febbc7f228fdd5

SHA512
c709fd3b91d401de02013332f4631d71a3d87d890784556ac81d538788bc7ec7279abbddce2fc76bddd7c596ef4bfc7b191c1803bc517f4d3bb11b5188c124d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d53a60206a65c8f58267f8828e1e414

SHA1
22b3a6f539f50a4c69d6a9683e46e661281f4168

SHA256
a57aad3d6342039fcbd5f5b834fbeb4ebb1c14ea5a311eb98cc60985b3a2ebb0

SHA512
72d3adef763b16e986ee40f8ecc8af7404c68b8645cc67391f62ad5d841c785e345421a7ed95a007db90ccc2f67eb6ae5a97a32a3a9b38d7889c2ac852e47801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcf11308f44d86b01eabe446637d8dae

SHA1
c8463e529fc8b3ac8ae52677b290f27ea8f186a1

SHA256
13b060e8a36af82aa70862657d3946b2b7f19a3ce1b59bd479506df43587d559

SHA512
76e1aba0fcf3e63e0db050c0fa205fdb1f938ac7817f009aef0f7be1a6ceeb4ccdaa6d28a8296d0209da343ae1f5cbc960477b113f2e356d58d6e90533c6152b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3a9eeaa78b25182cd30ae8e5600cfb8

SHA1
794d998c9ad6b51e47d0edd1d7ca11cd48fd7035

SHA256
b21b735584ca6580471c406ae4fc318123a4f8247b561c2a6a62deb87107740d

SHA512
c91f772639b4af82b1eb3b1340a2add985b831f0729e32c626bc40539dcd2dbbaefa4ef7ad3a83d8881799a11100c529c7ccec5e39d632b5a9b0c1a189fab032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
591d9c216fde04d6468c22d7c8abcf1c

SHA1
7f88e6cfcb2b60ef67d720ad492393c7ed974a41

SHA256
5f58f5c5615cddf84e74aef4639b36bee99a9c2312192db176cbefe998b4691a

SHA512
856d8fc14d80d36f3ed394aa9738c112ae0816eb3b40228345571a119545ada9f58bb3c9286127406aad38c7d0760b4c1e09fbb7336ad4cd5707194bc63d327f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd6e4e279eaa7d566dfe56263e404878

SHA1
d96c473973b134de98287a16e01c224a1d0d77f3

SHA256
f92eca31cb4c7a718bb302aa26074637fa68baf565e4fbafeedae2554c30fa6b

SHA512
cd88d324766ce2af4a814692bcf9d44f7b084e57a99cb60587e1153f3955bb8f34469e391566425dcb6e6b1cbca58c7ccaf4471f3637740c1e40b91f66babc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd1de6249415f9259653a89aa53e8d6

SHA1
bc9acfd3c6284700aeec24653a4d641e98945312

SHA256
5aec2fae69c0e8e69cf09a432a4dbe414eb91162b133ff6e1f470199916274ae

SHA512
80ccf7f390782bb6c3945bdad34a4f292c37cd766f42599b765f23ef567e7f32fe6d398ea650913e7e5bd8b804984c56e229ef8d8e89b65817bcc4b7a633c9ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a37c0d7dfc6d54e923878a27faffc5c

SHA1
636c7c015fbdd1c5fd954f88161b9d97c8848f64

SHA256
58f37021835a3374263db0fca609c4cfb0db28c3fb4ad5c6a5041af8db493e70

SHA512
d122b38c3e39edda773f1e0472511af3077bba7e3b00314d2035fa5c0e96defe235a57b460b051802b10e5b37112def4b032b194e6b0704940c6d6e1941ce167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
241346b603b14da3d4a96272e914827a

SHA1
5c02b5619c5b6c20e39c347b6d66c3ac42f243f2

SHA256
aae2eba484716cf8ed0831e54f5da95a19e772855c9c65e770bda6600d38bb6e

SHA512
f56ee62e312804fc549d5c60e6a4b51806d86b7d32954b5d097e51af66b3efc04322bab2f810ecd5f3440224751887132df601e40834fb635ea008ace51dbc75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ccf5a469a2db74c111eed28b3a4206c

SHA1
58a50a6f8682caca4edeecc6bff710b40a2ede54

SHA256
ad2a9c18de36e7749a6d14cfdfec8461013aca0181bec416d404851aae7058a0

SHA512
3e0a48d65831349ee16a832cb738a5482b99ae7cd9b6cf58417eb4fa9ebbc746e20c10f6e6f11075dce151c3cd6e868dbfa81eba1ac0d3b34c1ad717fe86851d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7984962f1091c704312fc9cc1dc7d0c

SHA1
5c3efcb860aa569661e242249537db08f7314cca

SHA256
ef8bc3fc414a543a6ff0e90e75153608ec89fdc5cd0e7379d9f782792942a0e8

SHA512
e98518d3671de1d2aa4a0c64552b67c510a6bd29bb94c463b4d2f154a9b7c0b506b04a3bdc17db17f4b4a370c992376d1bc3f0ce0e39583a458f37100a8c762f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3c284c07bf0d11886520ee8d702cac

SHA1
b6f02641f7f8a7ece7d001d655015be85f3dc26e

SHA256
5d5d7022e44638b8dde1ed555ece2e6585d186699897c278c7809629b90af7f0

SHA512
5d24d323efeee22fdf94ef0585fcfd88d2a1347aaf356682ded19d01c82793b7747eda707974d17a71560935ae72665bd2f5d9942821d115c36366eb362369bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61db8f91776618ad031b317ba2b22832

SHA1
f92bbbf87500d00f99282c2f22e7423d6030db5e

SHA256
c1786be4e92b3375ce6f1e606daec51fddc7d014961dd66165b1ffe02a7d96b7

SHA512
2b74ee6d2018b4579e41e77fbd34bdf6667cbc493415ed848cab390d1b957fe0474d8db359f35626c555cba357752d23b39a3e6f203b9469096643d4cbc0b930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25a75612656a9675a411c88c0687a6f

SHA1
d2d4151a14109e1b974cf005ba7f5c514a16c9e5

SHA256
c6207483fd1ff7ab7eb3102df21df23415f3300cf0c31b1f4ad9d47b0461e04f

SHA512
c4e66b55346eb6ce7376551df51b464996dc81bf12abd3c4f08dc8916fb776b8bdeb13adc689aa74f660c2f1eeb5078c3ed31f510ce6b730de09569af4717401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf47013e68783c9168e033c8c1986ce

SHA1
e4f7c5bd78eba83343e50427a96479cf1c82d9f7

SHA256
812afb50a637fbde974f0e701ff60b9bcfe487f284e3e275a1d1e7d4f7e2345e

SHA512
98ad0d53bc86c28ff7a9d8a0b3a4462a245a11652079987d5b1736e53ccb08f41bf5c74c40ce284b187afa1266015fd80ca8b3fb1c5222f49b2797605b26fa88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f83448d0a4ab4f5abcad610905b9f595

SHA1
0046eba27c847f1915ab002352ee147d66840efc

SHA256
8025331d46502f5768507a2d0acc1ef1ab7ef501ad1831e4d7c373394a628398

SHA512
4ac21043156127a48818f4eed49fac3acb4c624055d84791cd905401c1f039e6bcb1ee5262041cf6b3ffa59712a74a085ec700a441c9e257c956d58d6348d943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9c0f7608a60f512fbaaac925ff43a8b

SHA1
dd7797548b88a4ce6a92e8c8b339d1fec267b11a

SHA256
673e6604b5aa7a444af7a24995a79c9a7786b712e9ceff9770ed9d71c51e5cec

SHA512
4c16717c86fc25ae3b2baf90087ad64ee6b83a4dc62bd540dc6e5eee4ff78461e73ecacf06772c76694d4c9310065db0bc46a4f180e70e9e14862af473dd4ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE17B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1DD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit