b02b0f2c7edad03eea54a5b10bae84af56e02b0f116f4066716c998f1c860ec7

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c296571060bea80b0ca3c142ceee8f4_JaffaCakes118.html
Size

220KB
MD5

3c296571060bea80b0ca3c142ceee8f4
SHA1

53c5be23d24eb38ca124610045120df06ccd82c4
SHA256

b02b0f2c7edad03eea54a5b10bae84af56e02b0f116f4066716c998f1c860ec7
SHA512

03ea2cf6604667f2f18db017d5e6488a5137e24bada62df9b9a41b22efce9e01a67c255a5296f085a50d2a9e0a281dcf4a96ab09d8a35d8c88d76f2551257b38
SSDEEP

3072:SWgo58zl5VcEfeyfkMY+BES09JXAnyrZalI+YQ:SWEzzsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421785852"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{719FDD11-1154-11EF-A5B4-4205ACB4EED4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2924	1792	iexplore.exe	28
PID 1792 wrote to memory of 2924	1792	iexplore.exe	28
PID 1792 wrote to memory of 2924	1792	iexplore.exe	28
PID 1792 wrote to memory of 2924	1792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c296571060bea80b0ca3c142ceee8f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1dc3102dcdb65b7c59623d672be8ad

SHA1
3399f6a75cd9e2642435c0c08598f4b679a27e73

SHA256
5166d88690f92749be1b78194d56c312a855cdc2186637a54cd1c2bbf9d92486

SHA512
3f797ac327d138d9ed8706f0b5e525b9f9feb3c616f893810672fa55d2efba81d06e2d9642c4f30bcf272f21453e79c35dd87b6e72c2c610c48848f82df068ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc66e8b7aa163d8932a31f6def411c5

SHA1
02f5e3eb4da16abcc432b23e89ed68e5c8779cd8

SHA256
7587c5c52effc1428683eb5372c259f4cb0bcf8509efff8fc7286084c862ff25

SHA512
3c031e2fc8ab7ae44670cb5a51d2c8d534d58a9c59bfbbd4ef1a7532950542654a681461f30261fd9116912882a63ca774b0693b107a55576e0faf3c70238247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1953a24e27d61e9c7ba78702802fbe1b

SHA1
e83675f92f85746e032c405d001cbc04a4a68bf8

SHA256
5a1ebb0aa8ccf14c9cb542071d942a121d94acf0c0dd9b129b40d117c9bcec76

SHA512
5111d2e5a9154d116c036bd377e4f4abe534114202513d574bc3c9a602bd4afee93a160d273441d449ec0954fa3b4eb6664aa7c123a30246a3a274af92369153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31736044780c66d2704daccd3f02259

SHA1
ac6eb3e5d7433084c8f6ac43c8854b7c4066d601

SHA256
bf512961042ab859cb773b551f829ad45699ddbb26b83b69543902abe700c730

SHA512
b7430b884eeb196f65ccb775e43d93422fe0f989b95c70e5aef3cee86b5688627584d448d2a0f13402bfa652f6f6127bc1f4fa1702e8e7181c4555b63e92cd79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f68463563c391002fd27cfc7676f9326

SHA1
706de5b6c8375eeb20884eb8e6855621eec7e905

SHA256
bd34d1c893d1ad6475b120742758edb8c048fa3f22260cf865f953118d5879eb

SHA512
77771ed735f3097939b4c3e2e7f28611e2c8e499a64386f175b1911d9dd08dfa9e4d3f31a9e45ca5f2dcd5def3de3b76172c85ea0e225895c5a3c7cf00fb0b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95fe382346c6a035001030e1184a520

SHA1
78bf0882fe8229a152ac7c79527a254c03bbfc58

SHA256
8ca9e7aaa8d999cac310cec9619c2e10e3a24b584f369926aaa72a7258420ec2

SHA512
45e5274c78b79346d2e62b9c1f9f5f2b72370beb42e97e88b0f61aaea4c5de023be223f75bbe74b10095c2626c774e236741a4054f7cd68e84c6931a109ddbfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2454a0fd32504a82d5ad3be57f40d1

SHA1
0323a71eb7064d9d9570e3cf87ac6951c76ef44c

SHA256
d1c91256221b50bd4973983f687063a0af1e0d6944f0805a1b14915566a8b9be

SHA512
b7d14caf7ef6e3e64c6aa8a0982aa827f50b464486885e211db98619ab2bec12ec1b7278cd0f61a66be76087711e8aca8b8acc9a3f170a100d09374b634f569c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1ca3d916393053c9f898a7833e06c41

SHA1
a5e1eb95e306fa995849593e9375057e98e12907

SHA256
669d51f6428d75a595bd9cdada82469f7a3c61b2e7ab53b0440ac161066f0016

SHA512
71383558933e26c132c19bd929991d13a580b4750cda8ad9b5c9620a00b564caf40cdc066def07dc2ad6e887b2a69be5b72d1f8a2b7ae468d87142b77d6fdda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5beade52ed1673caa46b0b5e9c089921

SHA1
9d710b5ae4f61c310d706f704a15a2d6ba92a826

SHA256
cc11c8884b86e6556120993e21f21889d15096efc242cfc23898fcf261e9011e

SHA512
fb3876248b54ff25e58e611529a78eb2dfcaaf3c81cb391a6ee2673cdcb6057a9dbaf05ec96a62020aa211aa6220d2c0a0f912d949a248be1942bf3f8ae9dc04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845fd1de893a0039e4cde6fb9505969e

SHA1
7d01584698d89f2f1a5b700ddfc182288a3c5597

SHA256
f8dba332eb4183f69a84af810e265fa27ce64a2dd1e09d1eb0bf77dbfc4ed37a

SHA512
b5684bb9efc12f20c947f702fcde329c4a133a9a1c23d236cfcfb835d30e7a3b41c0f06ff6441c1b2044d945d1b120342f6d9c2fbb9106388f151edc308c7e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4226508e7ee0546155a1131fa4d0b9dd

SHA1
22fc679f95eb8b4c4a3f45dceae3d420d2896ba8

SHA256
0cc54850ecf6ef9d86fecfca60986008c53e2bbb7b726ac83911704d7029730a

SHA512
9ba9618fdcaa1f90a242264fd23c979b431fee7569ae3a9c043945da55763d0cd549a67baa13162331136d4d4d09abcead0ae41c1e364cb3abd6e701c3c1c688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
946798133bbf201529c82613b59b876a

SHA1
ba518f2719d4cf3edb7b92f9a48bbaa3e51ae1f9

SHA256
92ea3afbc1c567e44e694c9f0daf0cc11ed6c925f88ded299e5baa12e57bdd04

SHA512
21e5bc5a9878380e26830b3f99dabe0a1959477816adef3d648de539bb112fc97035b56b1d020bfcf8c80b539e0af2a182326307a16f6113529399b8f5548a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ee59bdb5da4f9c3cd01be2b550eecd

SHA1
bb6b925f62bcbed0f044d6baacd73e111d0efcdb

SHA256
c1f2ca158e1d42fec48e9758f56f1ca0e40d8461fb9ce1ef211b06c97f2ea4ce

SHA512
d6e491021a9e522ac0df470a04556cb86921064a35f354309924cf8bc6b2cdaf944ac0cce53e44f8de2953b8cea3ba37f0fb72f126283281ac62eccb17f978d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
099f0c6a1a8e3fc5eb53bca2d59e179c

SHA1
415ee070e70614aaea8871fd3c55b152b6582e81

SHA256
34ea90b2455f6cc8e6efb159c9d8a0d7a840151f57e044525884c071df417418

SHA512
ec3c3d56f83a98d3a105b48a76845afca1a8d502baba3095f27f42a6ea7c976bc94d92d1061045d394657e9a5d144332acfc9e73d439e5a2249c1d82aceafcee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d3024130ec3ebad05a6c80164c3366e

SHA1
2aa8f3e8abab626d4320cef7407114cc81bb908b

SHA256
aaca1ae9c1647f6015a118e22bcdc4b82db81b448b8b5bdaab031c27c4e92281

SHA512
00142f8fef2f81333c597f95626f74deef41a5067add302bb212fc7ef9ae165af6e8d0152b31478da2d566d59dea2fe6d7d6cf5d053fbcc42245645200397485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e61e6ca991775e649f79ea1266f651

SHA1
2b5097c06c5d170a2b25c6aef29c2d57d64a26b9

SHA256
48ea4c9d61b45d2dc52319e21593e38113423fca3cbd010edffe0719acf859b0

SHA512
44b5fa033e7966e026e90b3dab5ebe8caf02055d250691ff74f9d029923b2dd6166b2efe23beac63ef25441c437207bf8a3e92aa0c526ce21b86d43a9c8c1f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3164308e6accb4be007e6a8775294534

SHA1
e2c413d6e9849150f11bfaf040ce2845569c6a5a

SHA256
0bd2fdfc9d7010786b3e77e81e256b1fd4ffae369f535ba14337a672cdba1546

SHA512
79d21b201d6d41d6823e675e0a6319d29df8c6f70d9fbd6c556d34e8396aaf6d1d4e3d53642fe83499caa080231b68185954629cc08368fcb8e38f38effb121d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36be453842dd7a3a7e12ceacc28495c

SHA1
c13db63ce34cb7e393e620faf86f7340460a0212

SHA256
e76e8d8625f2090be840d43da4113a5c4af251f15c76f8d8421dbd1fcfb4e960

SHA512
9d9f7019d4de649218fac8328f56bf7196df287fa1402de10a7b5b6c7e5e26ab35ffab0e096d7cba272e4d526348caff3c35716a0866fe980496f54871196434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c347d8a740b4a05b2277d08bace14f

SHA1
68191126937e253e6551b2da8c117b11fac8d517

SHA256
0d75a9848eafba1b72bbe9aef8cc150e36ad77ecfa227b5f82337c55488a33a0

SHA512
1a0d8285f659dc1c9cf14f2cdb7c4b323bb20a39cb4f8a1a7414c7891e11e298c81a200a97c188ecdb425db21c2c8f6332886dd2b97a2d7297cd1b57fe45cecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16DD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar176C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit