2730fb305c2d46af1fcc52f6fa3bfb15e99797a41172b3b1c086a8e1a166d229

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

391ccf58e5b6585f75f2d870bf930454_JaffaCakes118.html
Size

64KB
MD5

391ccf58e5b6585f75f2d870bf930454
SHA1

d8e22d3f79e3c1fdb187f307dfb001d14daa0695
SHA256

2730fb305c2d46af1fcc52f6fa3bfb15e99797a41172b3b1c086a8e1a166d229
SHA512

0b5baffe71efe1448aed3c132de7f3ca3dcdadc5c1222d139ea6311308c3803975bd777eb82239316f9783b60e1137ef02f5ed7088dce6d8e9e062fe0efcef60
SSDEEP

384:Lc9OxCAS9igovNrgFNL/n5DWuabEK06yHHJ8ftapnQ6prpsQUFU0QWuHF5pDuYEj:nrgLRabEY8axan+eZU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000634fbe24175a380d2ec2dffc32fde6cfc640a85790d4e2b792b7f48e0dbedbf1000000000e800000000200002000000062cf899f93c34c1657c4f06a983331a3233ea19b426e1d69952cb559dd5318b590000000774c90eba7e8a91dcf720a335f8a4aa3184486da12e958692cd21f9174b13a3a2771e1004e227de6771837d490573dc4887bcbd5a744ae545b2db9a6ecd8bad69041cf80cfcb1562c3d37add006bb71d2874983320f0a12e1f18020bb3e37dd761c19ecb8da314912144f71e6d05237d108bec55c99b4abd501629dd39a1a4d43a5bd34d3b3b7393cbb23882617ff11240000000d3dab983ef9f0acd85b1f10b65c751e52c0a0d92add7fa593945574a454aa9b67e67d589e7265a6bd6120d0e893244d9ac789bca488bc9faa5f5d7fe9dc4bbab	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421663288"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e019e7bb6d3a052a739b0432af90a91e34d9f4164bcbb804512e0054f1d47276000000000e80000000020000200000008b0fbad05886a44390af810f7540c2ec93f385e24649c2104fc8105e4f6dd3c920000000a82a2f5acc5e118ebbb64c409834f317289e9bf5c968a7fbc4467268b0d2a89c40000000d0b38d61a4560e2d2b2a909873978e2818828d1bb0d8b13197fe4f8093f5182f2e10198b04e9a938f9d0fd42bc7a08a02337b72407f2f56625edf69ff95e12cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c097e70044a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12868451-1037-11EF-8C47-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE
1312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1312	1736	iexplore.exe	28
PID 1736 wrote to memory of 1312	1736	iexplore.exe	28
PID 1736 wrote to memory of 1312	1736	iexplore.exe	28
PID 1736 wrote to memory of 1312	1736	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\391ccf58e5b6585f75f2d870bf930454_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
661030542c5586302bf125f95d73991a

SHA1
c7dd22899209b8b7a4b27ac7326f699ba2da0588

SHA256
0112a40c07b6112d73c599cba497b555c876c8ca8f3998fc5693585d6c9a409b

SHA512
df051fd63c547a367946a4c1da12ab40c85812555e36fac621b1cbfe4fdd4204477c920ee19c1a386fd4ae056a59c3b3b07524212be69a2b95ee354a8f2ad370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2852504b7665e34848af502acf048f6

SHA1
81cbdf3ba4263024594765e035b0d6e7c8ca9d97

SHA256
ce749199263656dd6828ef347fef9297b56ab9c3620ac2334d8f3b78e9d050a2

SHA512
2f43f5c1bd39126180086a3e949931e37599b617be12a41a3aac1bf87e7718f5509f180158272c5a0f14e311afbcd8fcb876bcacd6b2844be4038958bc8dd8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e5f434dd59e00f566d9dfb52e6d70d9

SHA1
cca7966fa347f321ce93600137198f13e9208712

SHA256
ac6ee2be852047ea246439015e0a6df8926edff460aa2137599a8ae9ff81719a

SHA512
aa3449e603a6ba00f73720d318a5026556be8aa67c20b1c65e87e28e414e659d5a7a8c64cf1217a7642ce9ce8d6f6793f9c49dc9eb384fb324b3ad10e840ecdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
776ecc3c0af02c72867eb51f73a2d1c4

SHA1
29d744211521c2d9f358fddabcc7a6e9c18a5f93

SHA256
4c1630315b801d4ed97e78e703b558c43dcec6725be4ba30e04dcc26806807dd

SHA512
6a9315a8ddf31122866aeecb0acb9c96f68e47ffc1d4b1b475f5a0602bc51ef0bfe9d1cfb016bcee5ecf72cb6cddf229299cc6614d0475f5263a715a87c36e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20bd530ed89722905fcb7e5b898d3a4a

SHA1
48d0aa186a621dd620997a8811b23d47dee8c9ae

SHA256
2dc4ed7f1f23d8b3f581d3ecd0bfe6fa08be7bd8c654fae286ec4c478b7ed8c1

SHA512
934b35d151fe4969680adf0ae9c7eca9b2dcc82ace19d6a267c82d4218c91923708ef73e9e45a8b10a7252c34379a927e1216164ae92ae97c8d1c0fc4eae0323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
042be6eef3fa35e62bc26292517e56a0

SHA1
0127bba3733a80b2cfef2b78142ae75dcd2225a2

SHA256
5aeee051e45ac3f22c712fe73f5cba3b596163eabc3e583bbe169d5ce92c83c2

SHA512
cfcb9a4c10475fbdc79aee85c3aa0a0a3e489f78916a46f6c657f93914a4a0df2bcb95a9f6d2c3f955758e3f8329c9fedb247426cb54d76af42773642fb1c2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b8c7ca2440452b553bb16220148c40

SHA1
2ac2b2fd335000e481035be09791ba3292b5a88c

SHA256
3fb67953425827a3aedfe2a6ba499868d9d326f6484a4fdfe86f77e38d333679

SHA512
156701cb3cf717f632270d871cf520f9a34e69dcaf718896de23cfb9a750f127fb452d0a64ffb8d8c4b9163bb4bc7da5b19b3e21bf6343f87e45361ec3149bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b6b835f5115f033bd5eba082625cef

SHA1
e83f867edf51b845caf62170ab33c22143bb2b94

SHA256
9be82059eb2cf9dbe90fcb76b5f148b76b5aa2aa3162f047893f69ab3e11e146

SHA512
b166dfbbb6a0d670623a78e0d476f0c06d4b38dc1b65f77a2c6e752df9ba45b290369a968401973ce28776d99cbcb2fb4f1c52f738b8fd4c393b61050a5e1448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df2fde6bcca124d92d88ac891c192044

SHA1
8d27b1d3685b60c3f34cddde09723cc354b2c200

SHA256
5d7f878999561ec9ccf1ec1378b03a83c986814dcbdd8cf4c31bd170e794e3e6

SHA512
38576cedc034b6568b1850cb97c5ce708d5a071011611314c107444570641706aa63be4530fe7a1f2039d7a2ca9ffe5d1178f73ecf6d5df4bba122aafe33d154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee25fd0e1082623e3998d09145035865

SHA1
12451c0fce657a406ac5e0153791363f597884b0

SHA256
c303ce127175477cb7afcc77d214077d66f874c095d3ae7ab484d9d61a63a6b1

SHA512
919ed1fe30f8c188b0f136957e11836aa6a59b299f686097675041e92542c683d20bf747d2f0fcaa7081e42208f5a496fc46dc3c3e29be2c350cbf6ac0c2b809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fe2ac111bb36e595e36581ab3f55024

SHA1
50b6d82e26ab41bb9db7031a5417103e6de70db9

SHA256
1f8b4456e977c9f95f34a658cae6c6faeaaa3de493358540b7a3082905acd3bd

SHA512
3e4d76056433f85cf06669a4e77ec53527d708a45650fe50f67c0779ddead73796e6acd27a15ed3ee3b39cc2795217a9ef8306db5239219f12493670fe7f5571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01e662dcbbdc6fcc82996491d45ad91d

SHA1
0b96ff928d9e9a571fdae6725c68536a84e4aa4f

SHA256
efb5cc2a635cd22802c5d2d8efa86d3ba59bf3afd31dfa632bfa2f1a9a0862f8

SHA512
a25ee0d4232b184ed12a1778d3798ad8e0213e105309735f1d398163c99f1dcb1cffd9aa852ad56580af7bd6e0e2459c0bc38d63d97c8e9a1732414ba2b747e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea00876865195b2e406fbdeef9ac4534

SHA1
31c69d1636885549a97dc7ad650a61906f9a839f

SHA256
41255fc5f0b00fb830e0270531bc0a4c44df0af02c96ca3dfa4192d5e2c709f6

SHA512
5504552e257395d97cce1cfc0afefeb6dbe93251cf1698f1f8a808dc35eb885bc1d57ddc237a0af031e33abe5b88ee287b76f11a2e52adea1e424db7f5f96dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6cbc0bea97f3ec293eb0914a31b4530

SHA1
9618461efbdaa5d10b03619876f5313828bc7435

SHA256
83911a7396cf4509ddadc0ca1b3647b5997fc26dd8613b3dc5d4c29931b2c6f5

SHA512
54d0b30c1a4f88e6bf7d877125c1ccd43fc32755f447b95b4600bbbf50a90bdfcd7035920939d4558ea68c6b62be15258a6684c9cc05f7d0814cda1917303026

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4914.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A2F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AB2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit