da732a9f2e15d7d12a61a3a3ed3337cc55fd52b6cce8b8e12cf9dea79d1e0592

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

462f4c7ea94f7c66b1e58ad00630cbc1_JaffaCakes118.html
Size

461KB
MD5

462f4c7ea94f7c66b1e58ad00630cbc1
SHA1

9deeb0bf69df8140fe8c5c6bb4265b075759da27
SHA256

da732a9f2e15d7d12a61a3a3ed3337cc55fd52b6cce8b8e12cf9dea79d1e0592
SHA512

d824934d532e6e5eba0b8da5bfcb7d1011e97f3aa6c340e708e2a3be1d12d5c2e5611425873f91d8a1ae5d2340945f09a95d1a247026ba4b82e7b46c34b676d3
SSDEEP

6144:SAsMYod+X3oI+YscRsMYod+X3oI+YinsMYod+X3oI+YLsMYod+X3oI+YQ:75d+X3T5d+X3i5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f620336586bca11122c9dccb014df1f20c13d41cff15acb6f2bb7504fbb9bcec000000000e8000000002000020000000248f7a1fc5152e2a51c023d47822edd583d43a3251299cc6d8a4cb786faf991e900000001ffb8cfc559d762b436e5d98f5b02083ca7ae7e7103bc82d433c659d631933a8ba880645fbd3d66b20c2991145ec5d4fb4fdaf5fcaff290f130bbdfcc7b623a435e741ea9f11cdf369dfa21b6e769a55802aa4e623ec8d7cd5d97f81542ffede8aa5a85237a3b759eba1b240c9e8abbda3de6fdf7efedb88c974710375f1ad6fb2c2c539b87f99bf09fa3d6ff27333d040000000848f6ac0630380468306ceb9429d4c799f4aa21b72157263378a3562a7f09a8084e6c111383473381efbd5f8c51468c63540ddd663020c846ff54216feb09d9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421938085"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807eebbac3a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E257C731-12B6-11EF-831B-46E11F8BECEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f8e3d8d7a037eaa465da7c74404a0ebbadfed7d6664b8e60c49d198d4cf40a63000000000e80000000020000200000002c2c92841ab14a38c0e13683cb8a895748f0ee8dc50d35a4c7de8900f729fdc2200000009b186eb2e124952a4289d0d28c79f5cd520a59f382ce83661a764b0da9f61232400000005941e7758dde32d1d2dff1728c6673c93df816a07b19d3ef76cac8b20324bf06878e075fe2e8eca57eb48564a1ff5ef2ae3e25565cc5e217c27fc812176dc567	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2944	3036	iexplore.exe	28
PID 3036 wrote to memory of 2944	3036	iexplore.exe	28
PID 3036 wrote to memory of 2944	3036	iexplore.exe	28
PID 3036 wrote to memory of 2944	3036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\462f4c7ea94f7c66b1e58ad00630cbc1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
525a1b721f2d4546fda9632c7aa09a23

SHA1
c13b24c4a63ba321b3434134f9eceb0372d6ed2c

SHA256
d8030c2e5f5b84e30124918c23899d1cd42087b63092eed91719143bae580b82

SHA512
690d033c86a0e297094e5a19382e235ede23013191858838fd76413f4923a369f8485ed0091f65f83d14ddb5a1a9bce7edf019a99cf62469e8611aad575327c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
577ce93f79bc1d7a7f785d6cbb503262

SHA1
deab59d72812111fdb477eaac2037c5a8ecc2f32

SHA256
ab2d1abf66de80b07801cfc1d18be6eab62456e96d7253b5429f04c1a3139e85

SHA512
6f0e4bb0f1f5bf8d254527d343d1626182157055c1ffd31a25be7f33c5eb5cf2cf695903db40670a2c85b0101abde910dfd5ee6cd4294426cc26d4ec54377528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45a9a713fcb5168ba11d2a00749b0514

SHA1
4d63eb517a55c3b6fd20607b67c8b0ee01303b90

SHA256
66eb8a1454ad9e3eccbd81b690edc455f3c54dd38dc760194166d3f991cc59a3

SHA512
4c9f8ed5456e121c251ddb9ed6ff287ccac6f5dcf3a0582e38e1b3a5d036b31ef02599e582783c7dbb8fc1aac86032afb995661cdffbac6caad636e40b3c081f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b0dc2f332d0ab61d56e9235aeb186a1

SHA1
1dd0c0a52f66379db7a5d9d5de8342de59ae8456

SHA256
a380f8dfad6968f380cb5be201c37a4a54fe7394ca7e99d584001c0485201680

SHA512
c72311b97dd1bc58153f729678960040bb8ed94a46db3ce0751b5f1d7df52f0b771e46d1fa35f4ab42c0da4d742e00a51e280568c3cec6da2bb30e5a33fe351f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3c28fed449a292bfc410585847a9d96

SHA1
e4c52471fd7a2735266e2b3659195532a8f35e24

SHA256
f3fc0e8b15a93e9d825f8f9602efcf17d42a1cfb54768854412aec7f467ffa91

SHA512
dc8575e9240a9b9d62012f1fb4fe02054ee2b7c11b2808e946c1ed00297bef5bcb036cb6497354c8b2daaac6097cf24fbd37e499c830f26621603e7a4e70ffa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d258c8f04a5748bb9ff31d8a451a9eb

SHA1
0e2f6de96666f3a0303369c025d2faaace89faca

SHA256
470680b007696010d8a1f9453f56cda48633bc048452e4a7aeea3a77b8ac5140

SHA512
c8736b0398258c6f60ddd57a3476bbafdab1b7d6eca108c8382bf758b438ce95aa5d22dd41650420596467815037e5befc3d205a845cb831eefe4b8ecfad038f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19e5188ee79f8a7ac105bf43cbb5a377

SHA1
67890a53bd5dd3d8f2a8477b6f4ab0bc79c48cd5

SHA256
3c0cc91b0e2e68388bc535e3af172bbac3c45495dbf4a32e40fc7a3e98ea5e63

SHA512
7ed4566f08c6d7fb1d5be6454031253f4b56bd1734f9f873d5d6467be0736d02ba825301315d56bfc77928d618910ab784437538ecc71ebdb81cf96900c0e5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a7a4aca3392825f97d45c969e61b574

SHA1
9690cd64716c06b395c1c2cf072b6b2922d2e661

SHA256
5b2d610cac581d0f580864211ed4fb4e9a1ee22011e3c7d97a596f73eda69168

SHA512
0e3749e885b0662a58a0518e502c4d24325404ff85295acc07a29427d6b1c8ca8f5e732e20cfdcc00458a351255b37c6b761d0372a5782cee6e83c090b5fb591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6a4d4e95e8e86329bbb340adf428118

SHA1
9f003adc13e893cc0903e2da16b58f3b7cedee94

SHA256
233e1d3be61e22e6b4a87484ca6584fefc13b1324046404b4d0f85b7cc1ac9e3

SHA512
846a43a46894709f6c222b6cca34b16afe15d6ef52357370a82cbc3f57e31aa845c37e4a1ed2a47d93bef9d47ceb4336e76b5afce18128d2c863f4f1561da30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2106b52b34df558057b59923a4ee0301

SHA1
f5bb65db34d699e4151fbe362e47a7cd41f0f7a9

SHA256
f7df5214646d9b8df6848e2bbfeb9699945a2d0b6d5b6bc010cd4e92f62ee524

SHA512
542e50aac1703a5f3e83fcf1cbeb6a5bf7a4c95bd69bdcc41f54226411fc1ee21b1e0f32b9848b11bdb4b902726a43a6b29b13a63533f4330befa0d8788968ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e90bf246c572b35169a9c23b2764a4f

SHA1
5640587b543fbe91e04a66ee5711183b8a070c34

SHA256
4efd213315fe2e0a8ac25140d893f1ba5a44992c3f831a0ec9370d40a11eebe9

SHA512
d99237f5b874b0c4dab5b0822f7f94958acf757390152016fb87af6e65cee661499ab72fac07fb40b1da7981623cc1b1d038be189e527047653b0b31b705850d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc6aedce00549a2fba0f4117a09690d

SHA1
1c978a909f2b4352cde24a1d020420a3c50d3710

SHA256
cc75dfe10507ac34c1424e495c6494c64f179e7bf80a69bc928026b044fd8866

SHA512
f755b6399296a184197856756dcb816c1725ae0b0cc0ef64ef24d0cdbb0cb9dc13d496bd689cabb1d9b09e679047658ec5f619af041ec80ec3b65d5ee3356663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54e9a671390aa0284fb9f9cb914038d

SHA1
32bbe7a1105c50ae83e7403d3b7e6fa30fdf971a

SHA256
dec69bd5a826f86eb75c1399668ebc10c4dccd11593133b597c45339747bd657

SHA512
4ddf29104be52d54d41a5090003bf46351a4410b9f79c1f30485955c5c478a85b92630e00e46d04f7ed5007b575d20c82f0c1c051b3ffb9d4537343de087e6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b06a9c80a2fedc4cfd81baf102f1e540

SHA1
1256a9734750e56766fb49f1bb30dd2e074c1d29

SHA256
5f3b3edfd494078671491ca08a012da8bd7b49234b2791b71d87e351a532ebb7

SHA512
09a951d6c5c549c4b4f611eeae47a864ba25952fb7a2f5ff64d579ea851bad403ee0e429cf57cf01411ddcdb7a8d22fcf0d3ba32bbec4f66fd48c5bbe77e5b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a00662d062c6429d2c54c03b16597b3

SHA1
139a86f83cdeba0ff1d87157ef97919d673c1f11

SHA256
bb52dc0a961874381afc11299b5da883cb660c85a61f89eba44abf95d9abd33c

SHA512
5845447c22e6971552ec1160a25d21c114de1dc07eb5fd340e9556c44ccfd2ba028b149d5b24413a65c2b2ed8747cecf7fc3fb60fb06ac32b17bb5d545005599

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5100.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51F1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit