3b98fd4082fe5559d76f1ad8a0a55516b4c8e51ccf2c13234db19eb1c9890ba9

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e439855dcd0f7994522b32ccae01528_JaffaCakes118.html
Size

2KB
MD5

3e439855dcd0f7994522b32ccae01528
SHA1

7b9e01d1a2172d11e838a70eaa79884eadd4b7c5
SHA256

3b98fd4082fe5559d76f1ad8a0a55516b4c8e51ccf2c13234db19eb1c9890ba9
SHA512

bc875af15f765fcc614dbda1e32adf2a9f81fa27a04588622ba38fca031e339b93a31aed911f2d5c8c4ec92c8de824d1b0e41a6c41f24773361163c1e0d5adc4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000252bb3927532ea5badca2c4092f90c2a0759510c0663228c8fd1d663065d1b6a000000000e8000000002000020000000acc114f8aaba79cfa384b03841fa1a98718fc2627104856e20b7cf68f52fae1e900000004fe96c45b92991f1e561340c4c161607667f3371bc001b80b19aa9482f1fdf972f4f5df647b678c2908d860e424f2602d3cb6c4b076f802648c3dee60e3078b1e5e6d06d6f5ffb24fdf9150c428b8da412e15d94874993ed5ff3a58ef718d3d62b2825843862ce77c377be3e5e86914eece24c114e35ed1b2a7454662b2dc5dff06e2fa945db59591c0ce4aef9cfe8b940000000f4447d8ef44509b819e1e5f4873bb50645c850a4cf441bc1cb44a98d8be917542b31bd76e5f7471634eee650405ed8a3a892f3372b3b3ab02b155daacb54121c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d52c7803a5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421745567"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A380CFF1-10F6-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000715cde8e0acd27a89eeda9c0bf5ea5de3283d19a7fc7003bf782984562bd4581000000000e8000000002000020000000117bbc216ee6acb4a14606a3b2e666654394d42e50d6800b5a5c051ba48cab9f200000003d7ab75d900ad93877d16091159f628253c09277fd3265b4010f3a573d31759a40000000672a69a8ea8e0da7bb078441f0564b9f2ff61d88b6535225c7c39a034558359e371bc1500d90cfe6b5f8d616135aa8e43b59f563e8f051278102d7b3d0607ee4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2912	2436	iexplore.exe	28
PID 2436 wrote to memory of 2912	2436	iexplore.exe	28
PID 2436 wrote to memory of 2912	2436	iexplore.exe	28
PID 2436 wrote to memory of 2912	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e439855dcd0f7994522b32ccae01528_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5080c7e88944f279e70a5f488adc4aa8

SHA1
57a5aafed2ae7200a830d0451e4b4dd8ba72f099

SHA256
756585cc17a701a2875281221c39923d502652924388a4d6ca43339425ac2aa1

SHA512
514df26dd9f21762d804c25e7dd86bd77a7637917791a1bb5ff26e0bd3dc6151d26c778104f1874a40d0d9be0ae10afb3acb32ea087b5997f5f932d39766fee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62f4bb3b527cfcf2ac30bae9a95480d6

SHA1
16518383a7274059ffd34a8e31467aa65c63d1a7

SHA256
6a9d3205789a9a8659d4aee19351c8223e4a95fd8f106ce387301b4d9347b3d6

SHA512
500d46eaf2f9029ca230f1f6fc95b3a114510c5b1831f207f3f7f5dcab6bbd6b47c0eaa493c6541d2d089411c1b96c05d7e43cbd8620aea1f60c4fff180616f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd09cfe03fc561c378c81418fb03be4

SHA1
5100961d689f5e3321775f701c1675897cb8178f

SHA256
6016fb06b7ddaf8aac127afbc99efc475114add5302ebc8c49072e0aa275dde3

SHA512
fb1caff5afdcce65fd5175db247a72137a6fd8e87f885dc2735a7ecfb763c4d6167ce28ecf6f24f5efee98196d94f026b67a6419e3ea22fe0009caa49624c43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83170061d1d5937c6a71f40df6113049

SHA1
5b446a9db65bd4d7fee879aae4f76797bfd395c3

SHA256
930a4c9314dfcf0076ef2dd5a433a4261b24d450668d932a7bac2c85a454200a

SHA512
7901f227521280d257acf5e02912d67045b9db0d2acafc508e08d4415fd50536116cbae8f9d288e0a07768a9f79fea3330b2c2c9b2cdf1bfff990e08c5d9cb4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531f598488256ef34182bf697171cbd4

SHA1
c717e4b0240fa9efcfc92d94135521d6121835b7

SHA256
21d8d08e6318bacb9def797abd0e29ad8741dcc296030c273c91204f18501f77

SHA512
39ae70c734ef756edfeb13c08f9117dcd338a9ce1f6dc794a351bd9df1cca983d4aba84ed019cac474f3aae63b806f590ab74b30df25f8ef7c43f9c52c8626f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac3ae87f95e352a4c16022766508b071

SHA1
2e6fef4f7ef3bd362678177022f64527e312d550

SHA256
438a01a981c5115fc586ec72af84d07992323eb7508edcaa35d836d6980653a4

SHA512
90a778eccac20068439fbcde3a15753a56f764fd05faf0642b283eb0a82fa7a325bd754243e1833568e6d18eaa72b4fa5c219e8c0e27ae7b33d3ed80b46c819f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed54f5c7b03bdd18bdd103ff670c719f

SHA1
5d65d1404b35ddcc8508985066d36a03d8e43205

SHA256
5bcdaf24d43f7252993d54cdfcbdbf6efda610292fbddaae9af5207ece6f4a82

SHA512
b8910e49e199c709543d4c639f43e1f21fb2d65a4c15e8393227b78c91c85ccacdcc6349f39425e02cae25458e9ec78c7d2de5abfc7dec226e1e052e445acf65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab1ea5e41f2fc6e54bb4a8d27d553ae

SHA1
bbbf8d035e42f536b7b1fe73a6d868ce4af3a9b0

SHA256
0a3f2c080f84919d205c994511c9c9c250cf1a34a1309ab008edb8eba3be368b

SHA512
11a330c372a702876bf28071c45f15880fdf0b22bdaf13210af452c06c4247a9f1f9d47944e0580ab9f68eb4b0a4c6608009cc64e9c1606369ce1cfa19ab18ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6175268655f3e20642a2b7fd51e6dae

SHA1
3b99c9a486a0fa8e8a169413743612852230bac8

SHA256
56b763b0c3e1fee67fd547378aa9777b0fe04e41172570f1ca6ecbe3e2750a48

SHA512
1a12af262a2b3505125b99c4871bf1d0e58fb749efd7392ecda9913f4195a4ead661a8fb84f6ffe6ebea39e261295e06ace6bd66269e8d3738e95ecb84b9319d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a832905232083376e4892d30cb4fddb

SHA1
0e8ca4216cc6640c9461c846604507568cbef4ae

SHA256
5f095f10229e10b3cae7bf12de8bd61d102e61a72262bc80f6e122014cd008f2

SHA512
355e06435e3bbca89122af92691a28b92e772f8946690a4439b7e2969c5f60c27eadb8ac6e796f2054632c6291b858c1d3b0bdfb50257d951236919b95bb3f31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a30f24f3ff94fd0fbe237e5200cf006

SHA1
5df30039b9f2491d10b6e75f2f7c1521fc11f8ed

SHA256
f09944c9fa3f2d3af4e1c17a2d97df3b75c1c982de577eda7b0eb17329be6aa3

SHA512
8933d3193a85d3cf423232e714498ab88cf7e7b02bf40966c7e6f45abca6877729cb5474e9eb20e011c2e639cd3acba6ef87337da2c129965e50a1cab94a5c32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5111bbd979076a8fed7289d546b3d7d2

SHA1
4612e50daf7bde93eb0a1ab6c788997b423e4a8d

SHA256
b09b632930be4d59fb861decf87968e82670b3e553d05273951ab8561b10b3f5

SHA512
68c7c9e6de782db2ca54da636c0809ff6b24c19706514668853da7404fd56b2c7ec7ea40d16a9c725998f0cd2a49d5004d75487894fc4ec8c952e003e103c54f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e6068f03d755b9d57feb24182c4c0d

SHA1
28dad29eb81c5774761d731cdca28fbdeb23cd3a

SHA256
e3beb514c87716b0e794957c65c3538e2fe4ac5e67630e143392d7308ebac41a

SHA512
4c59a975228629018a7928334b5306e60ddbdb015d2590bd50a07a0c2398654bb9db57022c4d3c4ba9f052133abbe8820f72a8d90ad71b8bdab85307b77a3b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2abddca3aaf62388f451a14a952c6fb5

SHA1
aecd3485a86de6d46be05d6fc9e800b78af18886

SHA256
c6669aca47feccf7364eab5eeaa2129db7c61b1e4d41af4e169a0c55131ae2e8

SHA512
e19b978cd75c6a61389b3dc0d43b07ca98f8c620247b1467351d6a251a927fa3535bc77298106dbe4800dbd1fc9d01f41dd85746ed5fdf5e258e0bc4a2883deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bbbb845e83ed2e01343bee34a629f73

SHA1
1c635634d8eade1c0cff280428f7c811c2a583d8

SHA256
5665ec1cbda6fd34d94adcb4ca895925b0de1aec7c8cedf2827b44220ac99995

SHA512
7d53f87af29c372cc9012a357c3e54b6b3f79cd1c8266f65a4808f7a6b36990cf8989a99cb5ec4fb71bd11f54c0661cf12dd83957251f2eada3455ceca870f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae6d496100113e6aeb0a3d6f2443d19

SHA1
999435ec50f7e5658146af59fa98bce291bbb238

SHA256
35ba771d541eb5b8e01a2b772756a8aea884ab5c05a4b46bb50660c00f72d529

SHA512
c35cfe4168327449ab31af4671a66cbf82bc81ae6950fe2fe1350f94b372c85a3cfe537d8011e6ebff7684563beec3fbd04c6a8127c990394498fe51f338007a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B57.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C48.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit