57cf63b8c9eda16023c942a71d456c95c485067e39cdafe1fff94ce6bfe587b6

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

453f83e8fd0b632b1d0fdb7d86249160_JaffaCakes118.html
Size

572KB
MD5

453f83e8fd0b632b1d0fdb7d86249160
SHA1

5dde009b40c080ed3d07149b9061bec55be0d97e
SHA256

57cf63b8c9eda16023c942a71d456c95c485067e39cdafe1fff94ce6bfe587b6
SHA512

d55c4b73df9a61611e04dc615da0e4e6525d98b4d33908ec0136620fd90371bda45803cee40e3d381346065ec925469c6979cc78f6f5327743131242a835e167
SSDEEP

6144:PsMYod+X3oI+YCsMYod+X3oI+Y/sMYod+X3oI+YhsMYod+X3oI+Y4sMYod+X3oIO:T5d+X3e5d+X3x5d+X3n5d+X305d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C2F36D1-1292-11EF-9371-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80aba4309fa6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006ebd195d6a356237a8304c901fb924bf8f9eba3755d59ce8a6a9faf26c8ee9b2000000000e8000000002000020000000343465917443b187098e4ef4d4a3a38d559f52b0e4e4e376857b2e46fd6c901390000000105f1cbf97fa4f866b4d288c63ae5cbd80100bbeba83dd621d321eab7f14df8c243a79872ab940b6d75aff0a9c6de9fabd537911032125be360b31a7f19c175749f9423eac0ab12a6cec065b4de14dec307255449d8f6a4e02603644fbdd5719d7f27cb437dc80989c1847b056a4a7a137816d54a872d5b9c9825716af21b8ddf2476b56b95d93fb8260ca0bf60302d240000000e4864b3a66b017623cabcc5bb36b060dced048f988ede3ab83c0d0f9ea9ea9cc9919ff228344a8c8bc1019a78d7f53265edbd7e638fe4766b23dd324c15d0cf6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421922398"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006c0d00546e445aabefab899c2bd5fe9c97a15064395b366df788f6f96eb658a3000000000e8000000002000020000000db2df2051c2a20e743e3c15bd14105c84629c56b1fadaa7e6f996ef8ce1f76f42000000067b88f4c9792e0c698c03817f45bb458b700ec0be1dc6170726efd24c7f06315400000001fa46e5fe2a16737e825b75b2b0221c79c20afe1f81a64ce536abd11aabd1c6e607e205015e76534c3fb87bf11293a949c9c9b5e7a4fee7fdda9b7871c6a1d60	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28
PID 2100 wrote to memory of 2480	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\453f83e8fd0b632b1d0fdb7d86249160_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b96b3118f0b3f9eec0829109f23cff9

SHA1
626a445b6be878308484bab2b463f213fd50c9d2

SHA256
c4e63d8818d98f2b42758420e17404f7d59c776be26ab4ac98c14969d30be1b7

SHA512
0a24d450fcb114a1b6f34e8d285b2d82287dbdac25cb6c734d197930a0945eb143a292fd505adb1c9e1e712d296519956b9a437c1fcf70358647d26edf303616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
588d91f31c72e78af9f013952d394e61

SHA1
ebe7a161d684bb00698a0e0ac22891183bd68aea

SHA256
29f8e56b70c632c11a981e10a355950566eeea55bd93c1faa9c4ea121220e3e5

SHA512
8c081cf3419a65a23d565a7e2a6ee8fe84b490e8e646482880a8a4ae78ddea83c47e8865b5ac94d1ce9f764df4a2d6d86e2e8351721b27c6468a84d5b93af348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb649605eded98d1f93816e35b2c36d

SHA1
57c81102224581e372f6447438b1a0f94526f49a

SHA256
3875d86839ef2f50cbd186708ab4dab35f975c4d1d746f2e812c2e8db3d7eba9

SHA512
a489eb8ae70b5e91ef1cd899e02e54f80ad9f05f1dcb514e97020b56050a9b7af0ea490a33119f72e9e5d6bdd8192e8a3e2237e11424bde074bfc969ac0faeb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f034ddbd32d31c5aa1ff65ec09d64e4

SHA1
b05800955a05df5df054bc48c1c92501827cc60a

SHA256
bdfad7c0c2c1d6ba777cda5ba3dfa49b222ae3beb54f2f190f834ed944d57188

SHA512
e0f6f6a9359cdf1edee6095ccd340226f8ef9589b923f8aec2c61ec61d810e8a7f6b6e4d213cda3414676e084a8c26ec17c5bf5253ee8fe1f43966a9974b73e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52644a9e9b014e1f2096c0c7a56281ce

SHA1
a0f6e9bb798189acbe0daf24a2ca43e1d2afe76d

SHA256
2afc80aeeaf44677514d54bcb7d236314b295f2dab20fce563180359ba4ce42a

SHA512
0ec32f462db5849bd56999eef7584114b6ae47143998456324f6438a5a705a6914d46a4d7ade2b176f5cf1a9e32628e2764f98411734070377468bd3e73acb63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6492891b6537f3826163b4b30130961d

SHA1
aa4c3385b76b565a4cb2f3690eea8c035b7328ed

SHA256
2c4b99fb6baf50dbb67cea2b53f6ffddff7f7122ba8e4e2315ab6633e9f4fcd7

SHA512
cb14a8df963f10f7a5fb6e4aea7c545051bccdea04e4323e9febdebd97c59df0180267c2310884ac5fea1da1a7bd4a5c559ab1e72f93ffff76e19c245c8c73e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fdc3475b331e6b9b33ddcda2c29350

SHA1
a4e05ad8f565589d53d0f171c4f3834fce8975b5

SHA256
74a91f820baf8dc3a7bd51786057f0653449ce44c9011ea0c82c1442f7c23058

SHA512
89b739a484401a7b9f52b7fc65fe15de4d5fb9a7f01574981ba9448ec9f5c749d1b7035da1af87ce271e1e221b32c9ff830de39b9bccc0ea12e9f994c9c523ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88cb8995859cf3b54d69ee8c9e43ad68

SHA1
24302722ed34eb1314beeae4928b7cef5a1d7d45

SHA256
508fd26de3dde3b359ee87ff223bd25fbc1c181234cd97a64a54f40f689182dd

SHA512
45cf0842937f469564d986eb140a5edba3bd947b20feb6f9dbb2980548fa220243481e492a7355125e2e857d4ac1aaaebe0171c7af10abe7fabd385d96176175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84287fd97084c39c556f93042c423a95

SHA1
af41a86f304a8f981f110eaa274280c2bce6da82

SHA256
33f35af9e34d89c550461663ac68b0a7a7d094bf4cf5d271783ffdbac2d86409

SHA512
f78ef2acca6bbb16cf611e86f071fab8c09d35c75c8b6edd6e9a267353917bf2d1f983d3e354756bf7a93dd672ea1d1baf74067bf6a82e18fa614ce1e4bf17d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2291a96a97ea6b25c39a97e7299ee61f

SHA1
a73242a7b2bbc6c7aadcd7e6992e042deb40289d

SHA256
9b9404393e7ce847d60ffd93e425fe1128aaeea248541c838b245928b5ea6143

SHA512
2039110f9132e8a3b3f95390d41d431ffd0256ff3312d91247b1ee6e763f2fff8e878889dcc7cb05d4f9b710ddcbd0f477c9503bd9e31791c753bb9b558ebc2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26b1cc70ab61a0a778315d8c5d177851

SHA1
73b76864e293d206d5765d6d7f4513f21d72d2cd

SHA256
56867bd3d146d3dbc5c11d6bd336d4294c4d92d33439673bcbc378afa711f204

SHA512
eba116781bc9dfc1badea5bed0b3336d89b82e6320456538f6082a6d51e00acb6dfafdbff3821ef4589d4bd3a28165ac4ac62592275a211074319491ba7e103e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0e78a1898bb7b59dfdef9a4885389b6

SHA1
4acc91faccd5efcffdcc0f147708e7a7b1307177

SHA256
58588ae5f569e19b4de7f8e5a6e28f97eb32795b9286bd1f24e7fd697dc8916e

SHA512
b91ea02637390366cc328f88813a34fe755ad66cbc66a4e5fb1aac5f5e185ed0a82b84a60884ceafeb2597a25a97b1d26d5c9bdc012bbec3da40f7859f4e2b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bfa14c1e6356f6f4aed34c639b2ee01

SHA1
04b919c1e151b496aa411d561f0320f3d0582b02

SHA256
44f94e5028a13eb7a85ec9e4c4c05899f0234db26bd34973f116d415723766bf

SHA512
d3f04d123b1029b8b75bb5a75f21bb1959ea364312ea6b15f9e8ae220139d4ee61084af7b1e445b5558a5358439c2f8b574e10956a52439de69a4158e4eec3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e49837e29f5476e786b2263d43d6c508

SHA1
03a3477e1168dedbc2fb8163d0c37cb30effb99e

SHA256
d7cd3098ce73d17d8194159528cea18028769f03fee00c981aa1be64e297e4a9

SHA512
698e11c85ccc8dcf1999de6de8352bc9ae89121b2633b99e37a20f9ae324d2042cd4ede8a11452dfd0ff33142353678b80f19412d60f6e23d4405dd165227989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fb4e5f283aef516ae154f66d7fa49c

SHA1
3078e9596689f77f174af6164cb7731912807cec

SHA256
82784c35096e6360de1c3088aeedee41ee89313824f849793ab85755d80a303e

SHA512
badd25acbc9abe7985b7d18f6fade3c902966e7be4efa570f8387afff63d3f6fc2fc9fd3fe34109056defa41048090c860da916ce7af8c83194e7fa1fe648e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar297B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit