53566eb6db3d4d8580e786e38210027619f74af999b1c19d0a47ff8be550e1e4

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

502d05e041ef202392ea8c2d8f9e58b1_JaffaCakes118.html
Size

138KB
MD5

502d05e041ef202392ea8c2d8f9e58b1
SHA1

b3f9f2dd75578527831a3965405e5f852fbc1f8b
SHA256

53566eb6db3d4d8580e786e38210027619f74af999b1c19d0a47ff8be550e1e4
SHA512

77c393a3b323720adffbeaf66364d5116f081d94d52e3e4503c074f9e20ea7fad24b6185e74557e0b50024787fdc362f7767f1845dac28e367c6102b249861cd
SSDEEP

1536:DC9obcelLVv1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrus6:DC9WxyfkMY+BES09JXAnyrZalI+YE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0eda3376ea8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000186c873902e7c124249de83931836cc33026dab79941e0b1337f791e74b8da6000000000e8000000002000020000000a1da3d2c72c18ed5274a01ed05b96d0ba2557ad33a128b1b250dae1ca4f5daef900000006e9452bc985888b1d511118e9729d9f940008e588976c8884cfe0a532500450e0c8ef03a22d247b75a6fab41e7ea6218384896e3ca6d4dd43cb82de924a27cc3926b50b5ec27d8703b4ba0dd702bb914c48036190da240a7c4f45b24bce4814c087d1333e170bffefcc8a2fd1b27c61418ed928a32c5058a36c0c6c38fe4776ebcf60bda0995a10cfd807b6b3629f3454000000057ccc3429617b4eaff8f65bd259118574e0b048ec7b6be287388dde7bb56a709c4ab0118821a5de26dce06c81214f423a478cc1733c522b10f0b6aff5ae15fda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000074230028012625bab8aa38ac1d2171f3725449675a63f33f6fcd879d69cc569b000000000e8000000002000020000000bf5d68469fbdd7f8a93149eefce51798ce27b224b69d6f2f87fa31c2021c7f8720000000a5c38ae7e419ff038a76e7e69af01c8628c1810a3f6f4a85d785af2cd7d604e24000000062af3f5274e0b1dea44cf278f8f995ccab6c1cae33a6f004cbed2fd88e2d7afb73d30a1ec92cc22a7b1c2941e07e90efb5c32875304e739b02e5f1a468de9c3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{243C1FB1-1461-11EF-931A-4205ACB4EED4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422121161"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1836	2428	iexplore.exe	28
PID 2428 wrote to memory of 1836	2428	iexplore.exe	28
PID 2428 wrote to memory of 1836	2428	iexplore.exe	28
PID 2428 wrote to memory of 1836	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\502d05e041ef202392ea8c2d8f9e58b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53c4dbd14c0763114a90c3c701d93196

SHA1
ca6004903f13d756404bd8adfa1cc3b471771c26

SHA256
4d4a83f6b93b2d137980f4c3c82dd45b9250c15170f2518f0fc6c2111e667b08

SHA512
5f4081bd6f6f3aad3879cb8ac29174f8fe231028c373a285dcb66c63521d5990691c823778e370eb7b820b217da6f941f9c4106bfd72fbaecf12d76863889189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52b20eb09533c39b26c6509c6c40c668

SHA1
b0ff25dea73bb3c56bea75091a84d6c2fb78fb26

SHA256
60faebc5190b996014f5733238d74f21e54214008c097a12a474bb4e3741bb94

SHA512
604208ea86d88cdb02ca0f8c5c56ded77889281dd9e72e85e38596ca09b2bd403f003735217edd99300919aec0f99b3ed48c676fb03ada91e19f91b1e890c43d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df83d9eb1f67bec396dc76fe87e59665

SHA1
ae529ebf586784c098fe31d63251e342d80fb25c

SHA256
18c35d9b099bd4c208598bd9a03a1cdd04a4b6a04cabf9f390c7a55557b2796c

SHA512
347b61f56b2205d420b8dc291ca915f8cee1d241c83571f45ed51b88ece8e6119af03eb91ce5d4ee50128335c522c3cf86d2a2369528efa55d489154f7987534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d414ef352e04c780c25e753607e236fe

SHA1
e67c96c897abb8de289a087bd07fe63bcc82b0f2

SHA256
ca2a50008396c822ff90f559add637e2990b1caa4ed25bed77e4203eabf708f7

SHA512
f1a41be5a07a283e21e824a41e96ea48b69d566c1685be54a4a98bc49c0cd116f356420251cf011a798b09bc1838e9041d21896d4acacad75e7c2e0d0d851365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
755d87993118841bd83ab1b7481a21e1

SHA1
b475a5ec7aeedb45d639e057f496e70a717959e1

SHA256
e5864110b953aeec3338f2c93d6929b384395b096413ecd35b3e4b467689ab35

SHA512
585c15cec50152c2b2aba60d3e56fb7c8cc6f8bbcab47da05b56d1a3f03658657f4ef5e1aa68989fd294e87870b8100f6a0d2f7c120b753705900af01c688c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2509ac24563cc2eaf66a527a8869c3f5

SHA1
966a1c12132232447557bae564a529bf0f991557

SHA256
b1efbef382681f135f94846f5538019916447cadf6c4662783c087eb8a7ee53e

SHA512
35a6b3ea48121500b2be61dc5b47b55507b0619b43ae60e2c6c079756ea289368e31368228a12e54bab9ad9def2b13dddef35a0a5e9c1d0f349291b252ec2b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29d7efa510156c404a8a24434c6572f

SHA1
bde6a52d6926a242ead9457aeb1b0ae4bd8c7d4e

SHA256
bef057116c08d55485af659d61f3b45bb50d34de34107b92838cc41920f8b9a0

SHA512
d74313f25c89c224e18b577db3662f96c4b0390252967f317585581a1a463d50be6dcdc1a6b74576ac9695c7dbc08471dd2f2128b4cd5d95c4cef88ba3114e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20d54f07261b52f907c756effc1e8b3e

SHA1
d453a9d724bbf5cc35eca7090414c9d8a358b6e2

SHA256
1f1fda036f97721ff9934fb339b8e49f8a9b2f0f726ab1a616503b22efe81301

SHA512
e659353392d2d4985691e05967548d32915f7bfcb1fd9cb233db054534b5d033f4b5f7ef4e04823afb0074e7f4605eaf6db73976df0f039ad757be70c995082b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6820be43400c33f57eb73c5273e639

SHA1
2b7b7f27cf951212c64544c93acff258f2cf0f6e

SHA256
a837ec50ba968fa053147e58ecbda7535a86f34facd4c1723d345069e54da10a

SHA512
f8643b1c7974f4dd40511bde6f8aeeb631725ee9511a2411c0ba48d7592f5851c1d9988aa3dd688717c1a48cef03816336990c310b25cf3f575403313b178b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a75e716290dd21097ef5dd76ee9272b3

SHA1
97395507e947c3d571e466595a3ff3557894b4de

SHA256
49caac3be26327451abac60536809521dbae509bd65f38bb7ca577a7960efad0

SHA512
3598860e037abdf71470d74d7c500e79e31419522e03df100bc0530b7330f5ac3e9371cb7d162ca35e590dce9395a5fed3fdb6ec7085d623ac8496b5100eb3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0c39a6ad754556823d980b6dedbdac1

SHA1
d1fc09f215eff1ea940aac08e67c812340ca7fb1

SHA256
3cae35b63e9fbe5a0b9fc2bf3de33dea697bf3e4335490f81f0832f0c4b01cf7

SHA512
f5341e002515b3010c10b56b54cc7b7aca67a1a8266e65242461289929968b2126b790ddb4ee3d3a43e262ba1a1c168ddd0f56e0c0fd5c56e56d02d38f0fd8fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9030d56eb10e254338dfd087e97a0c

SHA1
42a177d6ee07ce21f377c00010c6e67cbfe2812e

SHA256
eaca6e60978bc12f815420f46148afd2791620c14aec79d2c7d50e8455baeb23

SHA512
04291117eeb92098ec5742fcf161c8201aa16262e1f919f84ad4bb05f4c791ccea8e112199aa100dae46896de2cabc3b6367af7cce08f298b35cb84a2f8c324e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70a4779506172eb9db464a61934c28b7

SHA1
24201b3341547ae7f742ede30ae6c781e321abf1

SHA256
cf1fe8997b3e48d3681979ecd68e4397fb4bdf8a3b094ec44f1bd2de4612173f

SHA512
05d9cb99a6e43a83778432b6634188278c0cb199c21376cea0531005e95c3e83a32b8bef99b1d9a72a4e81ebce62870d90660a8adbdbd8001040b479edf0c873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
856d7e46f31159a2c12b56db73f77554

SHA1
d2f7e62e37ca6c2892deedcd8fe13d0a690b474d

SHA256
cf1cf026977cec6c9df456c5eb092d4c2eb8b977c7f55a76e3962dda3f4ec6d8

SHA512
b94ed8d87b7943e8e70bcdf643fe19998cafb667411bb750d258fd0f4866982a6d31e35da9093ea41f917baf599737b5894b9967e44fd3ffe7fba251d548ffe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f79904a59481b352cafeb6a11d8bb75d

SHA1
08f5792e360b394d7a75b4923379ab5cddae7e70

SHA256
6b4a99e27fe7d24afc55b0ec46978352ddc10f1dcc73a25cf4da1d075c787e70

SHA512
64379707aebc003850a8881b19c191664d3663023d6b1f9539f8865fce2d86ae0b358fd181d7d3adf87b1def1a3d9096b7b81874f305d3e342e85ddb150b34c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d481e4d6354309066ca79bf7ac9969a8

SHA1
b2280e4440d86ae1493dbce713d5f1f725ca7260

SHA256
653296f198af613e40ecb3300aa51afa95360aabaf028e7671ff02a1325a5cd7

SHA512
17af0ad9c2965fec05fbc8c9dc2c9d770c10dc98c101bc995f9b36290242817098eb805d68751334d8e603eec52df574df5e7150ff038c08b94f94132a18d6d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06c5f60cc42bde00b24997c3558068c8

SHA1
f7ff3dde28e37bf8e37663ee3be80b9743d4d9f9

SHA256
34f8e98dcc96709642d02a91bf8ae61ec8b33d1eff789cf0c4ffadcea67ee27b

SHA512
a9140b50e3835f9aa2c0f25fb18f45e632cb73c0ea40c42c2a699950f5fbedf349c0648d3245e6b7083babe85a77b7924ed9f23962fa20a36bc0c909751fbb78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D14.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D94.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit