d7ba0f795f79e600d7760a54e337eb8aabf9515f155db388ffa25ee3c6281d27

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4540508e6a4d6a831f345d44e21b9fa5_JaffaCakes118.html
Size

4KB
MD5

4540508e6a4d6a831f345d44e21b9fa5
SHA1

2b681789135ad0f0f4ec7ba786bcceb523ed342d
SHA256

d7ba0f795f79e600d7760a54e337eb8aabf9515f155db388ffa25ee3c6281d27
SHA512

4d163fe88e4016a4501b7110e83cbc68195b56df56b0ff9bac664a8eceac851b16f530351f6a8783358efe25a5b559a8e7c4c061341cbf0a35f34472b2e56f23
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o/7k6d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d8ea509fa6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000ef7aad8a86a108fe52891be34c4a8c0babc50166fb2371b1ddf95602c1801cfa000000000e80000000020000200000005dac4304d88d6696184697fdaf8c242a6b1e5ef6c19586b8703c6d42a036760c90000000bdbfaa4ab230a4ee66c22274648267389e91527ac8c8ffc551ef118e91102bccbd122200aa4b17df7f99b1f1af64d8c84e790288295cdf01e75353b69c875820167a5f77f3c4933bc4a047c5467ad3a70ccfa9b346c2a98f163c81c87a8fc3fbb4de465ff9ed52a63ddf776a997649a957bbeedb6dba376bf7cb621f3dc9bb91cb436b807866e0e596ebafbae0e6e58840000000f082cd083d76a521fa8ca068edadf6309ba0fbbd2cf89df18f56a3676e67488e4da6fde3629ed103ba004528a177e7ceb783759034c18e899b00809efea0d8a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C627071-1292-11EF-BD10-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421922451"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008a59b9b7836d208e3fb2be6a814205cb7a3a81990d0b6ec86e8e49ecd9d658f3000000000e8000000002000020000000610fa2293e7368f83e6e9d4bf7be58110d150767a03a9dcc297e40269241bb1e20000000783719fe18d18a41d239e71773d28a3e8f3745e2ed71a98ab39914b44daa8e49400000003c73df8070c52535775e8f4d2e6f3d2ec04112b52f33c8072953d9ef2f1312afd3298a1d1ca2179258de45b98c8fbbddd3b5e3af6b7007da7494887b0ed0af85	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2928	2084	iexplore.exe	28
PID 2084 wrote to memory of 2928	2084	iexplore.exe	28
PID 2084 wrote to memory of 2928	2084	iexplore.exe	28
PID 2084 wrote to memory of 2928	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4540508e6a4d6a831f345d44e21b9fa5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ebcd3425f8809ec39a46b5748d34ef1

SHA1
5b7796cf6bd740f39e8f5883af3a52acef1962a8

SHA256
7c93339b67d90683d1fe1c3345f4677d463cd32f9ee943647d3c5af1f288dfd7

SHA512
a2b25435dc042a41ee81a1c226ae3e57c7e0db3861b79f3f7ad77a0e07c1a28a933223bab34a13e9fe71714afcfd1654a90a1fdbf395b7cf1b0ee819ef2d666e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec4a3bd7af1e438b2de9ae2fd784d1d8

SHA1
11d6558f3512f3c3be943262dd15481d95c46b38

SHA256
d5c25cf6957e4cb31a54decbea9a499fd6cc3f2fc29756b43ec1e478c747f323

SHA512
58a7c0a6fdc11efb1eb60c3866bc3f39b9cb8ec073b0358611ad77b5c580bb707c566251a657b43ec6dbf18d6fdd4ede0466623808c97c06a6c0b8a28bb04299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5df7b8b19fe515e4d961594ec155f6de

SHA1
fe43b0bb16aa2ab2bb0660518177cb261a019125

SHA256
90c967eee5072902d2aa223cd43db3c75402582ea2b1d4a919824281ae570638

SHA512
02c38d564c45d874aed30b0b7087be98acc51e46578cced2880c5c74607d90f3fc0732a041b39525ae05017d9a84f19c917822227560d17a718c3c04b969de9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b46d132aa03ce307ba7d492c87a73344

SHA1
d841722702b63016a63e1605940df87905dc0921

SHA256
c0fcbea31a37353cba7db40a85ad3ca3f032f28466f58393581662f55ec8525c

SHA512
615bfda3690a3309870109bbe14e2ce6f4c42a6b31f69a22728ddfc18d79e0c6b8f70f5d804e9fcf2cb0e2b66fac317015c63c81d0a5d9954239e9ab7d778ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb14bf786acd34ff23b6bc4112f57b32

SHA1
fc18c5c458fa5695b43e2b9c48573d8e4d88151e

SHA256
acf05c34b876d6ef61e0ac85238614b959df1fc5a24dd2e5f6f75a25536c5349

SHA512
0439bee67c6f8329fb1859b9e19ee89653ea87529ff9b39ca1841f5e19c0450bd70730d4ee98fb8d66a2189c8c3603e4954f4aaf9f5614ee7f27de3dac599fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73b31d232d819faf6a5068307874b2af

SHA1
5e740ea4a078bd4a064a1fdce563b98f4a8525a4

SHA256
381bc045f96cebb6b144caf592d4e599c68a18de5b3a437e64f0219b5b16a3ea

SHA512
a892863e2c01588a3765bbfbb6d73b40f50c0243a5c1337c6944db85c9ca6713f02489fa330efd51dab811ccff6db68306fd8a8ace77340d3f30b8fd1e6f65f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe6ad5b23fe64f6c1a1b011aa3d99c60

SHA1
121ebc4e19f6da2f06bcb86cfe978570d0a9ee69

SHA256
7c324fe62241fba8df8527a674fccc6b98567266307ca821e3cd24cfbe452b28

SHA512
73a0be6a9f5e579f72facb67fd058701da5decc10626b24b4a0f89b88a1da3e40b26c375c08ace1e785777e8cbdc754d8daa38948d5853fdafdbba58434dfdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f0b71cf17f27c22059612b7e90ebad

SHA1
475610f80f6bc2607b6fe998cdf1c2bfd2f462bc

SHA256
9490d0583488b20cd6a22b27e73892e1f83bfecace744b2a6b3c95aa0a37f470

SHA512
4dadcb4729f3781b8dd308a11fe782ff572f9a15329be0c8598e40912530279686966ac666ad671fe0f6e5a27b1b864c4a3a963f1db81200174d4ce3582e238a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a2f1dfea80e13590de6f1fe8cede7a2

SHA1
1897f0a1f4321b7b7f23e2fabad82e8a6a766611

SHA256
0f6a7ac110f797e0465e85a6cc2c9bdad07db8dae4b6edb38e069163445e6da3

SHA512
f0e293241ece2344b5c6b69ed95fca51228e23a995d6b6abd7b32e1e23ac75916529153edb8c6e71b43c157e2dfd6daaa9d61b642614579ebdae5abaff215d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a1810efed272d16bbb12688485b108

SHA1
8ee1e716c79140d6d31be6a6593a266f828f0b5e

SHA256
81e3c7c08dee7e9b71886977b05d856a2b6a17a297f4e801244e47769b0be29b

SHA512
98d730a1a0b552ae0e469e6b8395ef973f3ce4b1e833952c80e0ad22ec15e3564cb07329e5b1208f1ce7a708c128333b2b99a2a1311b9d6464f071e21d9f8383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97c633e79a2ba37e5e74c3b8674c4bd4

SHA1
77a825eb1066a04b8020abcd39af857752e905b9

SHA256
241e3f6e8892310818fec86f73b49617deed5d5a96f04354df92b572d6031360

SHA512
4d32b6c519847e809d7e1f524e41e615a2c58adbe0149eddbc955ddb9c2974bf2ad911a59cbca33cf0241fb96b6008c009a5008fb2b4343ec3ec612982695c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883d63bb3deade363096486900917c57

SHA1
e047a07c03d52ddfd1c1650ade9f3022fe474058

SHA256
fb6062c016e2cb3e286cfdd6e786e866d14762ed2c69ca8103423c52f5340106

SHA512
9777f246cb6796b9537a56d016e6b0fee11bd2fad7b5db20ddd0aed04ea20bbf44394382b159b7561150b9d9252c847eaf61565f94712149967665025d830768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d33e638798cedb010daf6ed9dfd7c25f

SHA1
0f640f70de2318223a6b65017e9cf1dd74c97eeb

SHA256
710842fa924b2b004e9caff0baf4142648acfe354c743b3f09d8ad7bc7ab5f63

SHA512
1c3f6b9e681d962a50dbcc4e0e1dbc82f737f78786e3733b76a9cdbbf29ee91646a8ee6e6fcd8c3cd8c3c803a8a7802478116656846c25dee5379706c7c1e35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f27bb715758a26c26e089615d3d1b571

SHA1
6f5d11605705392acc7e4ec42ba4b8b2f7fb3963

SHA256
14821062c66e65c1b7d069e08cf9cb1fb8fd1b34c93d31abc5484d8e2149e8d8

SHA512
4e19429365afd79a06a203c7b7abed483d8f7b047f47ba94452a53925270df6f8c4354c970a9ecfce01bccb25469b2a03979581da26812deef6336fd86fe7660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7588c42e6b9a3b70d1061d4ee1c42473

SHA1
6ed98c1aac8af578b08a5a5895a3772681824d3d

SHA256
5f934b5d2175f5035b1010efffee4bd7727c2f17fed7be761feaf04147afd3b9

SHA512
f0ce96726c58636e94175447cb24236426b1eae2c2b9b57033ede1202b00ab37a58a29f616a041b442c19258b73c56d3125446399a8afd42fbcad329276cbb13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b60f3cb8ed8ecf7613aa663aeff58b24

SHA1
2b940f8280a51e74c583f2cc6c8b8f6e5731ff9f

SHA256
465ef5ddafda127ead8f59e295bc2280f96a21ef2ebaa538262e656adecc77c1

SHA512
e174d7c8f6eb1108b33751f1407d0f79eccb3e5cb5418e834db7615b41a1ebbf743f19ed64618c4758a63d197ba16c6cda2453697fc26b3bde770b08ab824fac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar298A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit