559b20ec336ef4a637e6fb6bb38b38a4d060e81aa1c550f39b524d5516a26977

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47cc630c37519fb058087b1edeb95489_JaffaCakes118.html
Size

23KB
MD5

47cc630c37519fb058087b1edeb95489
SHA1

0788fb0dbc9bb8e5e33d34fed37e3ac1443deeb1
SHA256

559b20ec336ef4a637e6fb6bb38b38a4d060e81aa1c550f39b524d5516a26977
SHA512

78020c49fd8d0c704e08654da1c728b7ef7712255608703db7bb7468438b6e19b6ad4072bf2974d88d292d912eaebc276683b743e078d014b640532f1f23a7d5
SSDEEP

384:0MjAouZ30RCGVRqmcHyd37DzVXm0XrGlhtJeg4AEJcTb2/w7+9D7mD23oPLpI8Tc:0QAouZkTVAfHy1NNrGlTkg7E2/uwYD7Z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000a5621a6a51ec17902a7561ded7b8478b6fc38a481bc4469a59a52c825d6bb4e000000000e80000000020000200000006fc230b010473cecb4e68c0167ac74c25819c00a81dfe8d24d35dde3fdcacf7520000000bb9792f3eab34f488d6e79c3bafd96426dbdf10d6f4012619d7283d8d20cd2854000000037201c4e0fbc1fb27b3087b10814348cc3d606fd327fe2d80bcecc163e2f6015053810b1b791905b752b9f7cf57721c6a382b43c90103d9883693d76d9605c54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f0d4f402a7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421965251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20404B51-12F6-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008de230c6565c7d39d1c3b18251c5bd68cc059c364d6aeede139d6195544502bf000000000e800000000200002000000090bea932c92453249457c93e6bbb825a0c1e7cb1c3642fbe78d43fe400230b18900000004c079521818ea4ccd8ecc0d8dbeb0d58c8dde396573c5057c574f7510f26ebc3fcf8ca978716b0154601140e133233bf23ca96b4202217bd17e33a44d800abb9cab0b37cc54a3587613400a5f09ede69b31fedd95424fbc65df662b569f532a774ca2e7ef18da56b8917337248887759ee73514186cb55e006c83f45acb22ee23ad50cd93744e1a2ba879302d382dfd540000000451e5825aa44b6463a9f745e64d4d9184d6ab7498164fda4157226283ad95927f74a30222562943940830a204eb9ea36a1009b5becdfd099a7e64b466ef86581	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28
PID 3012 wrote to memory of 2052	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47cc630c37519fb058087b1edeb95489_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63e1fa230a3be5bcfae3e5bbcfc287f9

SHA1
c935a161aae9ba0be5aa6414dcb66cc195c2f76b

SHA256
f5951deb36e308a45ef16cb75b2cd5807f25b9fc06b3633184d14bde6e9712f9

SHA512
1078d198e7366c7e643a5330c4554b7e08842327468538cd6546404dc78ee9699ff076b3370b4eeb5943d4443b5a900ee1c243748044968d84eee1ce02df9e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef8710ab65889b543a67888fd650b47c

SHA1
86b6ff77adcfa83e43da7a967084dc4f5dd467db

SHA256
4b779260839d47c198dd7c2925280519fb39fe4660ff853e68a04f3fca2335ad

SHA512
3308414cdb44fc25d5a0dc8b9af1c6588a70a92f26af350a05c4101b6dd55c39dde175c6e17faed8bc59148f49daf3c9c01785bfba2c46b12c3dfa776ccd8dab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4db49b422de32876dbd2931e0c2f38b

SHA1
972d4eb0e605b78a9d9d9f9fa04060698d6e82d9

SHA256
f0a3550cd2c28d8da6bc0179b2a450a497b28addfedcc4559c6db9f27016fee1

SHA512
8f31a2f602e23279ba754ffb862b068cd4f58530e10a91859918914615a1b998214dcc4cd9f1b04014a01116543aa4134645678b14d281d5b4929ab51980426a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1974d6acf1e861a822c4fe95483766e

SHA1
3f3a2359a590396269708f461ec30b4617e73d8f

SHA256
5a55f3e08be761d8af039be212b51008f443c34de9445aaa4f8f9d52e6bf47b5

SHA512
f98a0626cf234a053f7d35124c9e9d3a0b60a728b71871dd6b5418149329284d22f7744b46dbbf43bc1a27c76dba760d909a07f090c48164ac74fc8481053c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b3d87c718310e60dbd53f114c0ebe93

SHA1
bdbb40250d3a376776d6b5b7cc432e850c748224

SHA256
4bb13165d9479e1941a1c2a90b69e29518e579ca003041fdd02369e9aa4f4607

SHA512
13520ccbc65f2c79595068e1e3753b958fec9ca80c8917178bef1fba6a01ea4a169b66efe7debefcf9f6ec6125b76732f8bca0587abc7e5c5fab6f6d8b652ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fa5fdc44e6c6dac40bedb0a57a41907

SHA1
515538fe11e72bcfde2a9b69d2a0287b3bda4d1d

SHA256
deffe2561d91e615dc11ce5ca0060d008d29006f6b7f03bc9a1193803ee60bc9

SHA512
4e5779f44cdcb8e4b705c8ab764936a000c0af70fc9f3c3da97ab578188dcf54e3366d24a48fdfd152d8387bbc1161d5f253a08a39b3da4548140dc1fddf422e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a044bf3d0774d1d6c32bdf746febe95

SHA1
5060e334ad98b09511c6a5be1efa86190d0aeebd

SHA256
88b9cba6a035ba20403019adcd5b77c953148ac233b8b90085df765a0805b8dd

SHA512
08136c7583e2116c4b07cd0227c375d1f908025c73bc5f25c707f463a89dda659412fca6c86acafa0023295d8bb438ce09adc68a25f80f19240a49482b913949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16c6352a050f0096cace92751e3efb64

SHA1
b24bd82fe184e3cbfe72c70d12387bbce61899a4

SHA256
d6af8721a513f5aa36b3c9572bafb3a197e11d592842c03415258ad3fa526ff7

SHA512
4f280b23495df181d1ccdf742765e54246dbd3f9d4ed461c5953b47fb3a4147c5ab267b7983879eb0225e837e6a548f0bbf2de69bade95a9b69610597fa567b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43041fb6768d7e299539ac05c9b55ba4

SHA1
0367cb5477a43f1cd574a64c2b39d9e6fd2cda01

SHA256
03655642e56f6d20b1d086238c58738e521cdbe9846a17a4a5a47c28d91891bb

SHA512
edeb58c0fcfaead29d0decb601a5757a8db882009239884e5237afee71b9a653c423da0726a40ee7ae4cd50cc7f616754623f0faaa16029cfa5f4b3a97650210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db481299000227aec7cda68f7f1a4b92

SHA1
80257746ae24ac3570c7e59b4aeab6a835b2d24c

SHA256
005c659b0383fee53ad012970ba074f0c9974f4be96e3a85c9b05670b556c422

SHA512
5c2e1ff5184ebc8b80037df6068c7a1e333e954367878ea3c918e71e215b5dbe8c0e2e5e1813239608685ca7bee87bb64486f6e0af661f881522cdb8e5c3a6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcbe3d0deeda39d97cbb84365f463562

SHA1
87d5e3a0b833fb586c92a7415e090336f838eac9

SHA256
f3329b1ba899d3072e061739c1afaa7e5b2fa4349bdf064234c7026eaca85ea0

SHA512
73c98a9c690d60b31da6be09a0123af0e081a2f303a2fa4c1e0e94e0f2780dd61641ae3401f2857c1252b926bb44efa3ab3a59ff442c3d033cf182fcaa316ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9200baff7c1ba6a7dfe8dbf710e3b09a

SHA1
b8605ff449b70940ece5f6d38b7ebee9757e0d64

SHA256
97e8cf3e5ebe3735e43ae71e5d8ad10ec35fc1254639bdecab2b2164323da3cc

SHA512
1a192efedc636df164b54c7b0cc780de82c2cf3f9388b65f3b52437b8a5fddc5fc192da0c95c3bde8f17f991271e5b787f81d14ba44b4713fcee54c0063087df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58895f469ce4ff0690439ce87c8e2d8d

SHA1
11740e5cf5597fced3c2edbbedaf842bedf18165

SHA256
34811fdee79a609b1a6eed86c61e1c78514697e16f2a2544d3ae1d2787d9edee

SHA512
c2f13fff860e8be18e9fa4ee6656355739389b3050a2bbde7e486b81b0a6ae292ea80a0f66e140c080f68e809c2ee3e544142f69af0df8f5fbbc52f061150844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f487f0ee17381c8488c1fc59cffd8ec0

SHA1
769d09eedf2d6acef7f30c51d5d96e7e37e58268

SHA256
f0ee584c7a215ad895f4ad348be4e79bb72eaa6421e0532df36e019471801376

SHA512
fcc9f7edd18112fda960bf28d931cdf0271780fcd1509378408b807ab5abbc21633089066c39962f57550baa8418becca70ea003df690e45b11db457fc82faf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b8c77595bc8edede38ee668c9cd5bb4

SHA1
ba0e6e8a0ccc9b6fcaed87c51b7bd4b5c6fb4a85

SHA256
ca76453a0a5ba0d81876a947713ffb964e0a0e0a8c889582dcaf6000fa4c6f83

SHA512
0cdba156865ebabd87bcc77e1ea91e4e7abbfd0c5c7c2bce6c026c770903a1855b57c9cb5886e267a476f2eb46b3cbfda2ea0edde9394a5dc99ee6e0d0061f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2bad56750337e00340903ec044857ff

SHA1
b74b47efd54f2e05d17a606c4f9b73d9f42195c5

SHA256
a86bbb5d0f6717d149d35a5391b8181df1669e656b964e2390bda568e8dc27d0

SHA512
0c52ea1d75f672e7dc06fd0e51e47d4cdb6b30440960fa75124fd9d5f5cc9c0a1881aefa1d2cfd624deb84844d7c4019a93b3156099b7e7740346f870563d521

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46B4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4724.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit