509e19a1f0924d735456a3bb2692c096632cad3fb4a6a37700995af544200a4a

Analysis

max time kernel
133s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

432ee6b75635e4c130c539fe81af4607_JaffaCakes118.html
Size

29KB
MD5

432ee6b75635e4c130c539fe81af4607
SHA1

46af4650a5435d8899c5dee6a6dacd936749a2bd
SHA256

509e19a1f0924d735456a3bb2692c096632cad3fb4a6a37700995af544200a4a
SHA512

0937873b634409072dca1eb13f19eeeb94d91ca7a47d0942e88512579b6e1df1176c32969d3f78128130d38bd499550c9adbd0b8cd6a73a194a890be7627f4fb
SSDEEP

768:UHJH/HMH4HRHAH2HYHOHPHYHhHfHtHdH2HDH6HqHJHrHoH3WH/HpHZ4HCHxHlHWT:Xd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000022e96ed5a33d5bb5fd4c2a48d35a934495961ab65630115a5c1f876a76dd66b000000000e8000000002000020000000899f265096884923da324897e103f53cfbe11cad022b330047d69befa33e507b20000000a496cb05b219a0c777341fb453a32f120eb0c9087d8ded93856a0bf46e97a572400000007e0c77e5494fc2e0981a9e21e58178ceebb5787980d01d81adf182e9f32c219a2e2927645637665e4b2e8d92400c60527a8cf6589a8672ba0386fb3481de7bc3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0612d1648a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40E84121-123B-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000890d91d44580318652013ff0c6a18c8db38eb5819ae9551636a54c9bef38df93000000000e8000000002000020000000bf4e8cea3a07b82db90ded3295c3081d4aa001f24a5abbe1ab0c29f111d2a6f8900000005c20bd1981441f46036dfbef05dd61362f9f0df4f7786035df2215b95ebbdd2e510639da546bc9fa11eaeb63682409ade27f115ea7cc8521627707282d45ee9dc803a1a63606848643aa1abeb1d353c8d9a363846de9a41eb773596b2d4e5c3f643bc61a1cd83de9cefa07fe0ed4fe1fe932604a8d7de076231da6d6a715959dd5bd00b02b91276e85dd5ea7a3f4865e40000000af5532f7b53ddeb84f5ea5f43dd60232e32f07478550c2d6bab4467bae4c676e6008c7e867c204b04e6378d030f0043dbf27d286a0b0a68dccf2818b49756187	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421884984"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28
PID 2400 wrote to memory of 2312	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\432ee6b75635e4c130c539fe81af4607_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eb9045adac9125955739acfdee0a8e1

SHA1
4e91164e247da69aadb448ff45b6ca9566c86cba

SHA256
434269f379fcb392c5fe2dc8ba1b6ccd975df58bfd51b00f2c6cc8737d381445

SHA512
58056a8bfd3136538c9669d66828f06972d8a6ffca4a06e502a5a1741f768550e0cd6a7810c9f4455e83a984f91a1ec38ab606a849ef2a3629931c5810893c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ea5d44c3d7bc11a739764f7d1fd1ac9

SHA1
a6b8ff05dbba6d4f616d44196fada23fbf5e3e51

SHA256
1d2061839a4f61381061a02690306975b64590f6fbc6b928066eacacdbcdec57

SHA512
babf570da757d387d99f2aa4cb8def1f4ef69f823729647fe707fc31b901ca6950a201f09f020f83482a8042ca7a9724311013944fe9575446ae3f92a1f9d498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc22acb09e54e7468a2c6c1fb101b9ef

SHA1
bea55cf09854c66219cf2917a7a664c04d4aa7c8

SHA256
7db33ea7b028384a36fb148baa6268f356b17820b962c821bbf36b8dafdc22d5

SHA512
1d557185ce3cd820cf9bd70104e985f71b4fcc9add87d2926d7909b2f0e894a60b8a888e18a2d9ffa3e411c326d8cb6e43aaf92d5f398ea4d9ed26063b648ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7559200b69e1ff186492f48d4c0590

SHA1
85e182e173adaa0b43c2449f50c9195594e36a80

SHA256
aa4f57687b8702f00f974e778c79a3898f75a7f28bcda27a7972af643eeb0755

SHA512
f9c909596e445f18c5f79b9199b2f04390e64e8d843a16c89b8ba2d0ccbea1499d6cf1a1c6b29c2ad48fcf0f03af4907e9e313a4ef0febc65f4663b1a18d4992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c37c9543fcbfe63e79876a4878d808

SHA1
833fbf3c4a0ed2c7e059d4731023d2a8ea849796

SHA256
4ea9939f82af5560a8cf81095651c3036f22ce65bca710290ca4eb05e6a02b8e

SHA512
bf2155b6a71ab248a2d5270cd27dee8ad82836a551cf44732ec3d97c80a90f353dbb2d42d879c6f1c84288ce41c268eb883d379dd9bbc519667e6fc7d9c459df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d5a6f67e676b1c344dfd60dbd78e5f

SHA1
8b2c0830e235a290ca9ae2c25840e8c2b117d4f4

SHA256
6e01f88ccaa6e5466dcf79e2299bd7715d3413d1361ff4095cea2c9dd29e0b47

SHA512
400ad5f7f4c0acb7c0c7fd8feb8621ac22aa0833139e0ac48cc7f1433f656aac51b3ae02cc727d337b56b881b0e8d66878e03c0e6a7b164297da3112c1b42864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aab9603d69a673d17f9865b03a54933

SHA1
31f89917e7a69125a1324d3c8c01c0c433c94693

SHA256
e4fe373f1acdc49b0f925aac0477432a78d44a0072eb2121250ef9337ea8eabb

SHA512
fbadddc5655efade864e73b5c572133729b917a15841fd530d73310faef7d1ab2de6b5416d69305eb35ec85ee11010f00e9bb07ded5980b9c5576ab8f2a19e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173fa691958521e5edd4c96013e6e503

SHA1
2934565f85e84e82ca1555d0d8b2c786e6fbcddd

SHA256
821a78a323b8c810f1c405af72ac1753fc4e58dc86bb045ff548236e51b721a8

SHA512
7fed3bc58f1a43d4180a4102334a1a05d2a2672e52e4611598b1289ab4cafa201cdad3c848dacd6ce189b669e21235ef1b6cbc70e8c8e4ed642c2be7148e4f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5860a36499f73e72cc6d3176e7c7a6af

SHA1
f04b80db91f120a464f116588cc655c38e2532b0

SHA256
1b79a745399fc02c74f8d19a32e749686702bb61b47759cd687a1204d2bb2f6e

SHA512
f52b5b0ea0b8b49ce1744980a436a5a9cfa5d17fbef1902d6d49d3bfc01506e971dcb6698e1d1c9f76c4d03a5dcc97564dd8cd89d1189322826f317cc5fa7111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4469a35f4c91b549897831a474070009

SHA1
24ad5e01ff623b5954e29792afd643e0c0dcf4ce

SHA256
2a3decb95bc4c1d03233a3149cd3c50b1b767e639bf785f38d7104930fa77d41

SHA512
529bba09d0a8700c65177d213a9410cfa6d9352433952210fa4b69f70a8601b328834cc86faf2db0bf93e716a4da3b575b7587c686c27a6b5c08d552dbbf3ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52e272e9c861bac0b36622ded95bb254

SHA1
763192c3c12c3770c0daa4430397b5f61bfe0e3d

SHA256
f79a1e378fb13f8464e573e35af7c56ccb6dad727308cde403fc4710da32e8c0

SHA512
9485f53e633297161e215db01ac9bfd492fd8408da4c2f2237a3616d0eb394f2022bead03f7bac234af84b0d7dca2ce0da9bd18dba86aff4224776728179ab48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9898349ed3cfbc7b3d3a66691a33fe83

SHA1
6d6fc184aa3cad81ea9bb10b72a00949bf9a96ba

SHA256
39b407f536d143a89c0a08940aa8a31e1dd9de7673396d485a0a5954fa630de6

SHA512
0290f3a6d81f7a5998042023491d90c847ce97059e7f7275145b3e89c2e5475919eea61ac9c64156e6340f1dbb0901aa0ed2ba6464888c1f75711a3a11643867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0227392f71b13f74b177c70d902d42d8

SHA1
1157f344cb7f96db414d3592256754a80e1e83e5

SHA256
0789aa9f3f3a1d1dc48357f592bee151379f3917f7a076a07b0d92874b130193

SHA512
a65f20e31221fde49b4717618f1bd23f3ca66454dd9efefbb489318717e13e23051b2da2d70511a96791cc7f90af13a31ad42e1fd515948636037fe1508e5890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddd62cdd97baa32257994a3990ed01a9

SHA1
45dcc94e3cec43a2faf09f2824cd592ff25f7179

SHA256
cd46bfc5519645d2eb8fb6a892ad2746430375096b0040fa7a883107e48e736f

SHA512
e1377c4adff76f82683895c3fe68284fd207227644ec92f66b04489ec57dadb524f1d8bd0405a5e41fbb287a16cfae08ff4e31ebe652d1315b894ca8c6028526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f259c00e1404248a726bb517e4d68170

SHA1
b8b0e3136921e861055aa54a9f7d7d4fbca7166b

SHA256
5d591368e01a56462dfe6cd7d61efcdecd405c3fe87239d12c72040094abd12c

SHA512
c817840d32e5ac9b3bf56e9df4fffb53b33abf79d525602b4bb2e734b294a75e5365a991db75a7f72066d168f5a7711c0186329cd6e0c88622110603ca075a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4849.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar485C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit