591215bc1758be33e186ea602e1445361d61c80c42f4ce39104e72a940097d75

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ca0ad32e9d0765060592fd6367b3303_JaffaCakes118.html
Size

13KB
MD5

4ca0ad32e9d0765060592fd6367b3303
SHA1

49fa791b83f830b04f5b23f398a4773ac254fb48
SHA256

591215bc1758be33e186ea602e1445361d61c80c42f4ce39104e72a940097d75
SHA512

c718c00b95f198079f87a5c79aa690670cf715f8fc6713dfdd259e360ab77500423debb80a7b4719e407343b4934a33bed4e9a202e516f39f132de9d57cd29cf
SSDEEP

384:S0KH9XF0/ej+rWYbeSCgltu9k+6AkIxznU7315jM:S0eV02MWYbeQ7uc8m1C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3080dbe4c4a7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d03a71ead208296e949dba2b4fe12182419f7b69b6bcfb983d235a8ebb889f05000000000e8000000002000020000000f639282b649b9758c717f504f7e91f712259132bb0a57fbec2794cc65dd7544720000000a92e4701c1493762fef8a5cf66279ba29dcc372540a1cc50d4c89892593e490940000000c91740ac63eeda4c59b9582355569a5ef9f0e627df4cebb66305b698606b7284561e2e5582a023ee104647c23e332be6583f8c9eba77d1e1ba637a64614b0b8e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0955E0E1-13B8-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000013f620399d7d859a0468d94861f2cfff4cb61557d7288ad1688d42afebc90212000000000e8000000002000020000000ca2b08b2b949b29609339c26e99ea4545081cd5a9239d9fc417354bca3241a9b90000000b2e851b1815e3f5ef2d7246996a06082eb63a72213d0b698d31ec83783381ea5395e2c3a8e9e56525fa655d1be8472c10b1560231a7b45e48767da376d6b5e76d863cf4a3aa3e05069ad0a22e210ad96dba2a4f44bd8ea18f21d6d9f87001d9b525d2f16b324fcf61e8158b782b758f1e5862a5ebf398edc82569d3214e22f130fa0bbcc04a12b965bd2013ec1f52dbe40000000606fe6703358eb02c5ed590602ddc4ad9fc74b57fbed0f5a010ae721e05fb2ee8dd9d2c1b7077df25768865d17bded04dd4b3fc2d49632c7ff16ac2bcddc25f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422048529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE
1276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1276	2392	iexplore.exe	28
PID 2392 wrote to memory of 1276	2392	iexplore.exe	28
PID 2392 wrote to memory of 1276	2392	iexplore.exe	28
PID 2392 wrote to memory of 1276	2392	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ca0ad32e9d0765060592fd6367b3303_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e911f554c5cf9b73893a9b7229ce7ab0

SHA1
23146107e81fde239b0927c5b515408cf72307ee

SHA256
15480499241a713a6bf745af240051ce41bb805af6b5f9f90115b4598ceb6a34

SHA512
4df64cc8aa1f87acdab98fc2325208b68b3c7ceb2c3b43f4d8592f3018727b4be0f53418f6d9eec9ad669029f648417b395f1056062333fe1a5dd88d1d1a8763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a615f312e6ff3a551c93e6495a92d76

SHA1
7fc05387a6c58edf96efe94797bd1c6baec2e89e

SHA256
b16769dca935c8dcd6f25fdc78feafdda02617ea59a4a6ed80a0f0cbd0be97f0

SHA512
d45c3cb7db2865738fbc13cd5d85db4c95435924894ead9b779d276073e23e889e35fc07de95119c0191bbd637b74f1e8f8fb9b26cae8c36c0f194152cc2a74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe2c3860d57aca9c3baaa14051aa876a

SHA1
0af048be8d9a1717cdbc346d97113dda7cc43aa9

SHA256
d9a3c2597b9c21e3b6109956f1e1ed567d78d9f7d917c9e1636bc60f627fafd6

SHA512
800d1873bee525303a92c272fcaafc5720852516d65ddfc959da0d7bd7c040519de18e3a25aafa59724ffadc2f607dac728a05481c31dc9148288f81ebfe2304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1993464a92c2361560cae3db364ad23

SHA1
81af2e46a6d0a4f9a36cb68e81f0c436aff14a0c

SHA256
6911ed4b1d74e30eb3538ed53a2cf2aa8efb06bfb35ad0c86201f16ba4ff92f9

SHA512
1c82b7bd273ba2a40e0a66cffa1ca432f6bb62884a2ab8653f8bf049fb78ffffa1a02717bc4cd18a8d75ea3193c3bec602fc7484df8bbbd4944546a88603caec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37149c7f8ed3686f0dcd5d9170c522d3

SHA1
ebd7e220288f2ede7ff607e5e5a2bcc1ef99323b

SHA256
04d3f81f28fef31848cd9f8f25007fef0766ca1ff903761ef647c3692bbd70ee

SHA512
255ae4270ac1c1b7543abc617016bfb354f705f5d03a17a8f49c3773e3c81926121b7c1ad9ab8ae0c83c162841da2e4d4dd6e4e370ca77283a57e2100a5d44d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9686fb086e7ec951afedbd0710b5d8f

SHA1
1855ae207149362ac89e1f2170a24d79b764719c

SHA256
3d40d1b6bc020fb0468f0ca689e428bcfc82ae8b3de681625565a7269dff2b72

SHA512
2a2c52954390436f51e37c18d5ed7f59d814cc1946b3986de3e226d74e28f04cbf675440c048353b2d8277e73065ae0612c2ec600b3f492837fdb8832f3ca6b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a523248eb8b76611646180d586fdc7f2

SHA1
ee8d5ef9ed6d3e79a170648866c68e4570092b96

SHA256
a5d4630b4c1f0d7fb8cd99101448e3fdcdb04574da24461cff60927f4d76f48f

SHA512
05f452b1fd45a90350f98e914c53a41b46f489de193014d54adcaa176a1343c7790d34373218c4f7b17009582762253e4bbf715001df4369ccbc61bb58b83fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01435e04a5b55564ea3ef9063a781ff2

SHA1
652b7b284fd7d8e6cb1ce67db6a9040622d9e0cc

SHA256
2b13429739add8b628c94eb8d9937759f1963070db1a6b2491ec0ad667db4400

SHA512
4ed67c9f4755d27586d35e51bbca0ffd73e1d931b10d3e99235818209a7b2531989e7cfb2178fb192dd49e258cada760772d008de2ca925156c415e4d37b6c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b9d2327bd12bde691266768c4444e27

SHA1
febc08ca37fa7749d1df86c4119b12000a76a544

SHA256
6af833db54f63c14b875772b89b2d19db8c4d601d33eb1424c0be07d30473a92

SHA512
770c83ed6feb582bd098e12290b1889ba1c63ab883007c0b35b501d3bdafe283430a8b22dd789d519c16bd45374ee4f909eae98b653faefd54b20282af67fae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b492c9063f2a216a34732bb992d2ebce

SHA1
2fea233bce79eb270798040a6c55dc3246c3576d

SHA256
e8dc66c0992ec579ec945ff17907e3e59151a1d7278ef954c3a21d227820554f

SHA512
60855ae766cd17609cbbeaad74fd72b5b3f04a934f09ea6f138a180343200e12789189edd2e34912c28aea644f6191f307b20f7b5121cdc3737146e7e310a2f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243299b397717052c2a4c80a47ce76ab

SHA1
8decbf15f8b95f69d5bf17c8cda611aa2ba7202d

SHA256
37208f6613ca03e0c5e5ccab77e591a89bd57fc7cdd013a125a0f04a7e4812e1

SHA512
00d600fdd89d5879bd14a6760cdea16f4d59d827218a0323301e3a522cf900aeba3d2be8bef0e04de365af9b9206e87487479a35a05af915aa4fd65d5ddb84f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c2ef5fc66c3854309f7c23e90c0b6a

SHA1
b172c2ce7bcccc9bdc396151655ca4bd07ac38f9

SHA256
9782408553146111648677ceb26eb858d157781d6d1e789a21f5c7e1f79efec2

SHA512
784158d97f60e0af93c3c1738977c1250da7dbc834eb396b94cb88c8972db7c66ddd5228615e65ac0f148875dfdf7b06fe394cb01aadd62147d5b11ea888b4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e60cae932c32a64f453dc3135bcc5f3

SHA1
64d78819858c56823e400311e7085142f2f6d67b

SHA256
3726a85d25ec6670b829ebb38b065369bdc3e857e368e5531843af7516d3fc7e

SHA512
91f3b22edde273c297a104bedc0fd21537fc38140278d738574f25b9a14999b7ed674e085b889fc67696d7e2e48b88deeba86dc39c99508a3cfc96c4cd659c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5abc3d4d9745be6224dea7b7026e67a

SHA1
6a39edeba13c88663ee5d267b907daac8b699709

SHA256
5e0f3250ce3a19b2f7d0827f0ba2e67ac5f7e73cfc6dd5484e9d31e35c8089d2

SHA512
f218aa7a40d4f47ec9bff6af1b7e7a810caa129e1faaeeb335ccc25ebe2ac9cb7ebd49ef9b5b588e8342bae9f26956b5e9e4fa608a4216711155dc208742b497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90175b34ee5eb92fae12b023590f4d6

SHA1
2bed94166a92f682f2810234875b18c89b8357a6

SHA256
cb9a4a9b4800dd53182386a5f2a15c56c548049068766af0a6b7a69ed4da71a9

SHA512
5e451f36b604393b812d96f5d0c9530455a109f642a48ec86230c24549d8762661850ee059f26a1b7821b2579b21a6bc5ad92a97043e29df012927928ef46cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54137432621ca69b44d170328efe94dd

SHA1
25ddc78bcd3115bae303f6f993f34de8cf7b2c61

SHA256
d8211da20a59c8d9ac38fcd8c04b49c86232bb1ea28a01da7e26bdd81aa3eab7

SHA512
567cbd3317d4b615a7600d1cc3111ea6c7565ede201eadbc7bb337b455428d699a7a675c02e183b24491a2e0f756af19d370c67de8a5de20fa51d3511dbf3b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3706d1e1f99ca5f00070b7bf265d785c

SHA1
2172c802f09c2beb44f4c204ad24b0625c24c5f3

SHA256
130f73c8485155635e3b301b283b116b6b7c330803ce256ac0c3f8b3fc7a540e

SHA512
2392e996beeaff78d3f61c1e856bbbb7a33018476137a7ae660abda2b463e5ad608f88e04e4dd877b23c7ca702a7c0a27784f1946e2332cf013204a59ed89c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DCC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FB3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit