5e072dac514901676d29e7435d3a04ea019078c2667d08ddd830d995b19c08f1

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2607c2d62f27e0458623179b583f45_JaffaCakes118.html
Size

10KB
MD5

3a2607c2d62f27e0458623179b583f45
SHA1

373ca6bf6adc36441dff99c1f0b46f1ae4d32195
SHA256

5e072dac514901676d29e7435d3a04ea019078c2667d08ddd830d995b19c08f1
SHA512

6e17a887063909fd55328a32f20df550fd560431ffe8693ff9f8129930f639f2992864728a935f3d8c23accd358c2b0d6867a64b625dc59f6e2be1fc3fcf613a
SSDEEP

192:epJElpD1lU/ijLOTciZ6jB7nTRUO3rAru1ziDo9x/r3usZxEua:QIE/iOTwjB7Tau1sGxj3usZxEua

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421679324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69606781-105C-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1848	iexplore.exe
1848	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2080	1848	iexplore.exe	28
PID 1848 wrote to memory of 2080	1848	iexplore.exe	28
PID 1848 wrote to memory of 2080	1848	iexplore.exe	28
PID 1848 wrote to memory of 2080	1848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a2607c2d62f27e0458623179b583f45_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f56724742695a4e2294d1639eab4ba3

SHA1
0c2047658b1209a319d7aa1861173d84516261ee

SHA256
d3c0802f1e949756d46d1d1e8bc1790c14a8adb5978e0b2352e2f3eb1decb49f

SHA512
3b1c48d724f26e3319cc0b0d0b02ba6e2e9366f13784ddd68365db1212082378a1b816a7dcba8750898ace1f455ef63600e23c0aa69a2e1ae0a4c850331fe44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b5ce238eca2b7c6fb4422ee86ddf44a

SHA1
b83edf83ea05165589d6346c3697a9a82fda0144

SHA256
3b440d305e992599a2c6e82cb99018ad6c72ef1a4a2459decbebfff792000664

SHA512
96ce7ce0cfa192521afa2f3954f2ff710f546332b19b298c3d6dec84b6de5b0e4c8d8f7013b839e61984f04bdd5c4d580932964256803f5d9e407569d10a5f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
249b7e64375b8f84040e87e8d24e2ddf

SHA1
f5300c1095eaa93902ffdf9e1a66a78879992564

SHA256
f9f0e009705b545a9b13311ed0ff587dc9cc73da6259c729cc85c296b4bd9acf

SHA512
e55baa402896548b68cf8e56c0a40b3551b27cefda7b768027828c04321ec8ca91163eb5fd2d5d1f7a9569ce73e73e4932333f32759c60413c22edeff8f17d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3c419fe67b43e31dfb5ec05bdaf1847

SHA1
c57bb20308e0a6b41155913012ab81155032bf16

SHA256
5af699c8d601bbeccd848e31f0f54d3fa8bb3fd179893db43545b9fda057538e

SHA512
e7cf154388bebd664f9b7f04ac17b95beb3a22dfd5a3d8d5a328eb4e335b725841f72d1268923052d034ae37e405b5e998922f867164ab1316ab7a1c8681bc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35bc823fcaecfac22989776819c4f08a

SHA1
f6490288a33df82cced87e0fcbbe136724864ca0

SHA256
b44f6a4737e3344d3ec84219ea09bad715a76f34b1249c02a36da93b49d73f8f

SHA512
2e0b10f178b8cb1746403ca065dc8087de60abfd5c7270eb658e47afb59ea29f6ecabcb12371a7169f54d48d972a0258c6b6fb7626cc397fbbf953c8b5ed8def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c45e0e1399d30a664a8a754f696245fe

SHA1
8dc98e98f7cc3c4c6e237c2f4793833a9142d958

SHA256
630de30ad05178be8fd27bfcf6b2c73ab2f0742dbee9c98746efda9fed873825

SHA512
cf273255c06672f8109a74f69ee053f3143fbb742edf770dde580ab198c963ab74034b56225268ddd6dd91164ccf8371fc90b3168ecdd4fb8400c2bd62fd4a98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eadd036ddaa002c20b6c8f33e1fb7a39

SHA1
fdc19e998d7de46902e1721f8fa426368c170cba

SHA256
462cd2836a1bb3a9c75df786384c64ce77611a9ff0a272c57a2df28bb036fee5

SHA512
9a27276e9924acd1b6ac6e52353e4132a1830cfa8fd999a2c92949769b50a8756ba336b3aaca4e768f06792a10adec3d9d58c5161ee756fac2dbd8adde1962d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6859ec746a93edd6bbf1bb6f1be2114c

SHA1
548d5ebee1ad9afc8a5482d3369df4eba857376f

SHA256
7b1e354a8f1d0efee98f61d46fbed31fe63a9ea5eb7aeae932e0e20a23f3705e

SHA512
4560a3614acd30a9361bda974d9ea5152f2e120643c3c2429a9bd937347e116ebef94f815326b50d3f5bf72457e810e3b8c6bd7cff47f0b8511b1fdc6be1ea35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bd72be807dab73dca94eeb8e005af3a

SHA1
be95abdb75aed78b2a6f334ae5ae374c9c385cca

SHA256
bf49b64926d9c3adc30f262b096311221879e372399311634617e88e4137f253

SHA512
1207fb1055b5bd18039652040928e88b423c07c7568d4e22676886fea8e88a8b5e09506b46c4ad208e8dfb4940c42e22114c1a12045f124aa6cfdd4acc225482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d706c62c7edb737fea725b8ff0f5c16

SHA1
d52f010d5b709b4731b5ec0682264e5f7c19425d

SHA256
681a1965ba911197e2dcccfc5459e1fce57d57a63307087de092b609fd1cac68

SHA512
7e7cb63e8c9f501fe885c66c626619897288bc09cd4b83c7982106917d2e98a14e30a4e009f40ff11682bb7d7746d5a8b4879f7c044a9b8c8ccf69a7ba919515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11982add5dc2d7bbfbb22e538cf9fe2

SHA1
3d3bf8f0067bb1ab3f43140069abe9f4fdeae1da

SHA256
6890528fc3ba86b1b88260e561e3d9d90967d6ae41a12a6de08e7e261889038d

SHA512
3be5a9b715a5bc6bdea07c569d3e2c4b93c9cebb52bee2b45abe97d8058d1269ef6f54d69c814181a1bef9910cf2d558e33831ce1319906912f5efd408166e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e781eab01ba02a7ad8e1bc6182b453

SHA1
b18ce5d38a86f59028a310c758363d0b664dd1ef

SHA256
1b6031ab46b46b763b60fe49bf1717dd98156e74bd1bc2b56d538c28c546ed27

SHA512
cd1076f2ba2437636e2c98952d6984efe75b3a7e93048bf8c06278e295a26340c0831a807791d574e4cdd5815f94339ecaf63a42aa0098b027030063f6752724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ce06a00a36c247738dbcd1617c19b93

SHA1
9b33857e93282dac1b8a76c41d91c389378f2191

SHA256
5751336a729c3ec1d6a964912082317dd7fa661eaff9d7d7cbcdda70eeb01886

SHA512
3987b388f6b0281d1cd61ebac767cfb257ec7a6b2b65f096157b135bb03235407a781b9cddc6482273e9cc683c584882890000b6e4bee048456715969020712d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4f36ef731badfb44aa7eb138f653df

SHA1
b7f5c600d7d0b827d898cf935ee4470d1cd4f7d1

SHA256
3efb09a2482ea0309bae5974d17b7bfaa3e1a7ef37d18476804882f80f90bfe8

SHA512
c566c6f47a36345d82391a83f037754c71ce77adb1f25dad42289c881ff5e7549bb6d7f3454c5f2b03c2322e74c1fea11bb8db82dec18000bc8173e0ecc30c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4013e90aea25badc3b4ca1f223c2e216

SHA1
8f4e2112a1f7ae238d5af45a539b383c130205f7

SHA256
38796cd2b85e78255807e4ff3ab48c12964f321ffba082c95ac83b37f7c902b0

SHA512
1dcc22058f2f65a0cd5a95f172250b8d55ec35d186988a2d36233848debbc951841426a3c0881954093acf763d5ec3c266bfd8e993158cbd2d6a6d26e350a2e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afabf9cbb7d0693154f636e850db45e6

SHA1
9d2763b104df339e89ad26fc62648d022f091f6c

SHA256
43ed9cd1c1d69cafd3b9b8d9aa8dd4dac340b060f4992e2c2f8fee0ebcabf514

SHA512
f17d24ec4513daa7b4672fdf33b20173a99b90399a3ed20fd2b47917a4219a2de0953ceade501e97c0688800d5a9570561c90a71f87932bdc366475862c7c48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
687be8dc8e602b7216be717db333c930

SHA1
2c537235e85dd74a4427e90a1b96f1139519b953

SHA256
bb1c71961af64b4e4c9094db64ce3c246b51cb2a420df1c86ecfa14f09c84d96

SHA512
9efa52efd8bf0164a9ec8ac14fcbca8ce8364d522e14ceaa9ab13151191008e74c10fb3780cea8c1011faa17cd36b11d58d2b1e5c956fbd8da57586482d18675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57cb81151d2b0e1b56eae7a61af96544

SHA1
6ab408ad7771225986e78ea2423860e4705962b0

SHA256
2514e1948e5ae44fdeb2046821bc3290d5882de3392e1a9df510447db40e06f4

SHA512
d8bd170ae74f9fb980dd15d1e7d5b403c8af4cc554cbd95c69cf5bb42370f7c1b1f019b4ab91e925c0b8b581eec0a6e56229a8168fabf2254c7279af944c5ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e140c44ca82833afd3bc8314e15499c7

SHA1
4bb4621f34914a0ff4b0fae2d1c7c9340b455f23

SHA256
7d9552e2596c7ecbf983da75598671009041e2cd7238f35570c3a1c40f1caac5

SHA512
0c9dfc2ba992056737ed4a826dcf343c4fe8f3498fe742b0ca239fcc70c6ba7c8a01fbe51dede2f2ea8db2497d751c53cc1ae1c73fe47aa8062eab471bd4d3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1989d91c01dceba3f3f0bcf008b14c1

SHA1
2128deb23e05aef8a621b5d7010e0bbb0a4237b0

SHA256
0769ce4f424385dc4391571c60ea6a0bd1639caae2dadc4fe54fda7b539d0b37

SHA512
eb63f0f7084c53cc38de6edfd24aba36539e141f0abb5961f2147eac9454dbe7258ad7075598be33ebc92076cfc4046c3246ed6d6459981493ce4d1a5c018ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab209D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab216A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar217E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit