a62a971ec77b92a0560d006810c9d51df2c33b7a57af85e080055bc839026950

Analysis

max time kernel
119s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

495acb2f1a0ca2084f5d90c72b111383_JaffaCakes118.html
Size

8KB
MD5

495acb2f1a0ca2084f5d90c72b111383
SHA1

ed2cdd66dac24b18dab357e89c864c5eb2f4f23f
SHA256

a62a971ec77b92a0560d006810c9d51df2c33b7a57af85e080055bc839026950
SHA512

c9d0c623bf5fdbe346d9ddebcee67dba48bd704bbdd1c8da647e4937b5f9186c2cd8e75ff4948376c0ee96d35cd9f7441ee0c961424591a3761277ac5a4ac267
SSDEEP

192:VF4a5FaJFo0WWcu+a947TrWniQGKGWtDI8fyNLdt5qXBa5:VFlvCo9WcumOniQGKGW5sLdt5qX85

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000811bc8ef821443908454889c72a3ab8aa400f771c8cae9d852a8be5ab77fb67c000000000e8000000002000020000000d6506f95636243c059f6c0d13fe17aadb4c859df4045d2eff47ce554321487d290000000b3f22d1c22db2a928b62754c1fbb2c0eada52ce7f7b1b887d73e5bd847dc49a7ed427d18c61d13eef3fcc9272c0ba3ae502311163cec96609a24514bd6558efae5c70b27cdfc14b5b5a2ac7725d4a41746a4005ede76ee5b716e4ba8b4722ff98dff96ad15c1dee401e298de476cf12bfed0e5341272d6230bbfc6cab69ad6d5fcd7fd90c979c9839a7f50de539d7cc440000000bbf0df804a5d20c10c572a9f401dec5c5c120c4f4cb6215366b918fbd4d7f62df5b348cfcddddd0cfd51ee3beef426d53033cda229495995b2faedbe57ff35c4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008baf56542384a7934367fb0aaa22dae73eed00b5503ea78e3f1e3d5bde391b5a000000000e80000000020000200000005f76ea37363d99756deddd91e4d5ee67383122f59dae43870c59fc96cd7c4f12200000002bd8ab6db7347a7c47c3d554546a07275b8bf49abee4cff1a37f833d21fa946140000000df6fced2229d6d9bcbd0d260d057072a59e0372bf17b148e75ba7bd8e4bdeb5e21bed01c3cd41ad40b52e1d9a9b2ff62c6d252d5bfafc0ab71811d8a9acd6058	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c761a245a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421993885"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDC39511-1338-11EF-8DB2-F2F7F00EEB0D} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28
PID 2408 wrote to memory of 2596	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\495acb2f1a0ca2084f5d90c72b111383_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95395b79ada01ab534a1d032821cea35

SHA1
1a39974db699e04c148c0b4bcf2786fb2900c6f7

SHA256
9129e96e4fcc7351c0ec2e8f9b004a6125c74a9a047090a36912e8a3942b0165

SHA512
7adf25bc323d83b3c7e8c3c86103d92ebcd73c96f67755881968c90d83a197244f9e97e3af9e4db43b2138efce8fbd7338561b37a4b8fffd90d8a9ef843bff03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e242fbd9fce73b39f2c8173a620fa704

SHA1
1fea4709eada9df95c89f013d8aeecce4720d0e6

SHA256
4eea17bbac0cc158f3c4fc02b11c4025ba72f9092efec277724301cdcbd69966

SHA512
0fcd3d4a90ffed156b04b472a1f1388bbd8dbee29aed0522bf8b34aa4903ec71ca86f27caa4dafaa20354eb58a956e52d34c1af912aa7eeb257a39d5b9c5f93b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d819bf030a4326e58d2bd20575b1a91d

SHA1
a8962c2aba8dc169d0af040dc325346483501dec

SHA256
2c70f6ddda3588373a770b773beca36ab6f229d8c4dbe4a2170a8d63817f5f42

SHA512
9581a2ee0a1d365999285e15277bcb8107c66a6bae6050ac297bc7a1efa6417387e29f2d3dbf2f567f656407da082aac6b9c20b0ba7076970d88b889e56dd54d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec5c290291e94fc27eda0b096b67c7f2

SHA1
d8b9dc75093dd662db4434f211b138cee78e30c1

SHA256
6df2a0e3978ae5f91bc305393ac1fb11a7e5827111d07be88abc4108ef60ce7a

SHA512
639fc05d37042cd4d6434dabf01dfcb6679d8f16536976424643d17124545d8d6046bc63ffbc24f57253d59e0e73660d4369a1f8f3793f911db6b300f6eab3d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18162cd9637258c0dcb130f7dcbf6f64

SHA1
5238cbb42fa4106fdca31123f62e36c835ae3d34

SHA256
20cfda28e9bc51ba444af0a2d89ccf1e0e5ee8ca929df4e1c86fb375254c0cdd

SHA512
5cffbd4fc8bbdd31c1223a897692aa91703abb44b474eeacb3ac0a3dc6277d6b304e5ea789648bbdfdb087da5b426b4db9be906b7d2503adb2cbf1d6ce2ed966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cf9a9837da981bf123ab1e12367656e

SHA1
2c3c519c1115004aabf4420b51de527865f7c158

SHA256
a3942fc3fc44708181db38674603e53faf62237cb571e40210efca0dba752c78

SHA512
ec2c71afcdf97db2b05d00b8cb8bb8ed1ffa841bbb251b9449a52c577b6e218d6450d9bdb4eabec87b6b40066910a6f6f351972e7631ea16735ff67618378074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd5450b17d52b062e5d507add4563a50

SHA1
328f2303a84127f151f65b85b98f3bd2ac6005b3

SHA256
3d2af302bfdd9f662f1a9200417ef8a03b3995cb21bafefc05425f4b90007b6e

SHA512
025a9c6b4bbabef31c84e51a3c2eb827eaed9bd37e2cce3db7aaa110a75c4b2840b035eda4b78fa719408d3d6a83496f550bf2d2eb8c3df6d41528e7b571a762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c955ea90d54db41a306577049acdee

SHA1
4376be2fa8759b6f3c416ba0d9f034ba3f26c797

SHA256
305a667616f016b53f84690779c688e9a46cfe174e1eae58094ddf5acd9df412

SHA512
d9772ca3e6dadce4e401d6a39d57f2326e425180d2cd966898396016dc1b4c96f337fd6ca3fd995d63e80807d77106c4a7d5669813aedeb58b130442d2f778fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe8bc8872801a90c11164be8b273747

SHA1
26d82db0a0556c5394b1dc4abdb6f9d3f3fa4fff

SHA256
ce89f77846f32cf192aa051de28181b4164c032dfbb3bfe86776365c1762cd44

SHA512
fd29c4ea7c9e232c47d16a54f0607cf1a6e4ae5036a6fd982292f64344009965162158c73914a989a38e1bfb6ca336667e762d70e761c271f42e69c4c5a36009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a8b5c33a94468751c373614e9fe4287

SHA1
1a826d490f894ede57286f60fa14a6a2623c07cd

SHA256
5263e50c51ca03e41b935f0bbc1e8474a6dd11a0175ca7e41d8e814038ae5db4

SHA512
8eeba72c21a9d22d496d0861d581428e1239a820cef1756744681617899aaf504b42578504c22fe941a8e4fc99f184bdf30757c4faab7b29e9458b0f0469d3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc2af69bf587fb525cb2642bd94ad6aa

SHA1
f6214d26131c4fd56b591002536a521f5f76d1f0

SHA256
bd542ee7474dc43f35e0b57452d331a8c8d90db368069fb13312a2aea3c51b4b

SHA512
232d5d8dff1be78dd78b281420b024738c958e6775ea6e3311b7502c28b6849bce148fa0270370f2fbe4f5abd3c87a496c6aef9f81f78089e99535a0157a909e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b69856f4df1001eaddcada6eb38f45c7

SHA1
f20c4f3acb3ba2338cde42f5e13d8c67afe3d217

SHA256
2d76b98f4d72472c4f815114801478093d542bef41db16df5c69d8143c2dc40c

SHA512
23421491df32447c9670d251630ac1eb0ce3649b710a6970fb1390f77e71b8916381e657076c208c8e79a3cb12cfcf9c4e33c5df412ecb6f6c362ef3ebeeecb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ccc30a0e2d5a0033e901f8a9e0581d3

SHA1
4ad987e21a9e9f8eb8ac0e358f39dbb7a347f808

SHA256
3ade35c98085d874f7e2bd5b78b6dff0f88852998467682e4001efb76009fad5

SHA512
77472efef20b9fd9f7919b1b5b6dd56c37f7f98c87577724d428cb97c51547c07a309cfe40713be32acbefef6c05c88e4ad4c92426b49c925eaa84c947b46f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0aa16162306908eb3bacb7f02977325

SHA1
87f5bc5b7e0adf7a806d2142fda58b348a6905c4

SHA256
2dbe43cb3084c30dab62ca408813c5e1de72d275cd33fe933075de42689fb902

SHA512
7c52ec93eabe01eda4ca84fc71824fd50bbe2f108876148394273d6a6b064c79de19007f1da7c40989e947ffe3b5c2c6ec8201e8a551a348acd4a16e54ebb864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db0570f2f0ad46f9f2cbaacffb2a69d7

SHA1
d11cb369668829b87e9d5884bb0495a562eb6471

SHA256
a37cc364a09ac0e73df6c06215030d138677858bc42b36845af0c6f9998a4f34

SHA512
0d03383b55461ce07f150f4923704d1d87206999627fec09a038f71cd195426cee27b19c0876a78ae44f55f26fe6598cc02ddbee388deeb4064fba75c30b1a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37B6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3817.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit