99af8eb1fa48ea6ce79b7681fc8a2eff0dcf5aa24c336f0938aa8a62ee1eeda1

Analysis

max time kernel
132s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

511f3ec9886a4176da2bdc8f6f18c732_JaffaCakes118.html
Size

4KB
MD5

511f3ec9886a4176da2bdc8f6f18c732
SHA1

fbfe3550d654e88f28f04d540c915d5a3ad42463
SHA256

99af8eb1fa48ea6ce79b7681fc8a2eff0dcf5aa24c336f0938aa8a62ee1eeda1
SHA512

94f8b756da01bb83d081031bbf04b6def6e213d9a24d3b3b0e6c01dbb56d6c486fe650eb867d0f6b7e0ea5e9c2bc1f9280a6729365f4ff70b224c9417aad9f2e
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o1l3Exmd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0753D5A1-1484-11EF-8840-6600925E2846} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a095dddb90a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f0d2906e1a7aa49ad6cd68e384d2aae00000000020000000000106600000001000020000000d10c454f26d653627d0bb5476ebda665749964a76a78076dd80ba21af68c2ec2000000000e80000000020000200000000456ea8dcc9af4d4d1ca7cfcd265f9b92434fb9bb424168d7b0f366edb9f5874200000009af39538c0ff3245be556b11f918f7f4865d08064aae08b56d025d10eee104cc400000004e1a5457f25696830be8c520b458f0dbd19ad3548ae54176251e441ce3dde97a1572f4d5ce00bdab5d891783457959f1f92843fbaacded812854edd6819f55ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f0d2906e1a7aa49ad6cd68e384d2aae00000000020000000000106600000001000020000000b40ecabe02404c8697a95e7efcbfe622531b6f1cf162ba76a571aa0624ec8273000000000e8000000002000020000000c303930a23a93de8f070d51acb08cd116d1c5d2023d86373d80d940f94d969439000000098a4af15bbd6285f5e34eca03d214db31ecbe3c803ad9e8295004f1e6cbf52df544e7f6e1ee906a68b0990ee6eb156cbc46ba7b0f665067971960ecba1f04d59fd7a17aacfa0a1d89694a716aae0a7cc2a85366b3250f25d04a7f40970931a07ff493e48c304f88a4bfa4f22e8bcd5a0f8f21279280fd924444cf35d37e20eca3362f09fbd62aa12ac689f362b8f1fe3400000004fb1b4d56ee3877cbae18aac61dbb7bcba59fe1e6c3994a11b29d31d2d5b5f6ed77879389516ed079bf43227c9dc417f5470f74f96d251e7b373b38fcfade72f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422136144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1268	iexplore.exe
1268	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2728	1268	iexplore.exe	28
PID 1268 wrote to memory of 2728	1268	iexplore.exe	28
PID 1268 wrote to memory of 2728	1268	iexplore.exe	28
PID 1268 wrote to memory of 2728	1268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\511f3ec9886a4176da2bdc8f6f18c732_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e66d1ad9f23614e46d13ce439051cd87

SHA1
1258a8321b0d7b2cd5341756efefbf120494d7c9

SHA256
01e2b989131b13c4833b4c26288b501c926a465331a3cad382682c9e30e2fb6f

SHA512
a1809b8c9e57c40134fdb08dc5c1eada223d1d56573bc68cbd71838e66b36dd87c099dd58db9e237f217c2acb41c36ab36f166ddb80ff35b5f8fbf9fa0a07287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a5c16b9fbf21c05b1c8b782aa2cc08f3

SHA1
ebd30de5dc2a5b022ff95b997b3f4975b66eb7ea

SHA256
f2da0a933baa378e06b7c9f1a54d4a1a8b335301ecf0d8efc0406fec7475f0b7

SHA512
02ba8b88caba6377dc57cbf91017caa5f22640f6ee392bf2093b0f826e90ba23831c7c8bab79d5d789234689aaa41c2f125a089806730599272bd80cec2637ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c016981f0bbf1c7481d265cbb580085b

SHA1
1be0c4eb5bc6218af3c7470f3ddd8177312ce6e8

SHA256
1c19517388f583d869f408271e9d6ffe919ace47fa11b3742567c998c66d3fe4

SHA512
126960d86a51c7041ade4042e9cc645f9f9d12f30386c37aea10aee7c68f0827c119887a2d018e45fd8183f17903d8fd1718ce43a8d368b6381e054b5ad497b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9386c28e5d61efcb11a28e94694250fd

SHA1
6427810e9293f63c4fdee3644ee585840c8cf275

SHA256
5671312292079e819887e32df11b1c694458f81da59ee59c0cc1e75ffaa045e0

SHA512
731a6d29c6e3a163f8294c0bacfe4463b6e5764361cf41fdad9ebb32f6099d9848457024ee623e42ba153a0a3278fca87dc7ab644d30c083aec8a5aa9c0b1e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
19ee99511c9f4a88361cdbe2858d9e7b

SHA1
f91f0b20715e3339fe15e23fd9c11dc686f79777

SHA256
cef3113c2693d7508b687b1d9a47168bcee6386187e87ec905fd2f70d8081c17

SHA512
921811ad8c9cd915b4221eefad83869e56951ebad8f0af809e16865de0c5aaec5f5667c0f7db3457577fabf3002bd57dcab86059331cc6a93afeb47d1aca8197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b04add5da67b1d4f398ea2bdf62d2632

SHA1
47a358a7223e9a17f7824adb9f2637aa6319e60a

SHA256
57381dcabb4d33b636f39a8f13f8875d18e2754e7598ab06b2d595e33d6db5dc

SHA512
35eea131190d83cef34a0129451593c925eaf76806505550388a4cb0d9527981265b69ac0263e351c6feac29951336de336d03c9b2b2d75e21a2712c4622aa67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a199a2c4b05ccefa16cb0ec40425e3bc

SHA1
b857539ca64ec7c8166efabc45fcbb63b0c89d2e

SHA256
fb365602f945bd6045be0f5f5dd986417fa6cce01cdd0bebbc21fefbb9a693cb

SHA512
8bb13d2bab25817690b2fc9aa39720431300c5b5f34e8ae0e904c5225399b09341c5a61cab591137da2d7156ae8071fda88ddbe16c8d4214c5a072e3ae808738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8dee692177aab642e2e186126e2f1877

SHA1
ca2f4853a6ac7e301d4aefa002e5b6615b994f8b

SHA256
a496ba1314894c40ec48c7cb59c3f3d813bbdcf15926674ea11676ae5a2d0346

SHA512
35bd9e991005cff66a449431033046d136099cbfefadbe160509765c52d2e8b4bb56229a68b6ceb049588ef0b001df11ea5df756b40ac21a518cee8c38ca1606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
20a45cbbbb1f914816dd52db06625d48

SHA1
0476bf2cf7d9c915d689a1a8c393d9ed20ec3ccb

SHA256
3c5795f2623fbf378d234940495f20b44b4c870e6bf4eb00d310cb311a214d17

SHA512
149b50402af493db3e2999b342d67db72202f7d5ce077d257002a9a336e3612eda85aace1b1bc2250bbdf36efcdf98a8d53702b6e50b87ddf92b5937d76aa766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0ad54f4fda1890edbdf1572786297355

SHA1
4cdbfe53a180b30b756c5c85e70e20faba0770ae

SHA256
9e94a82a78765ab9adcff7823fe8d6953a7d416c7151e7a4349cff3894fe4f7d

SHA512
c77f62921a65d2762e2819089f7fbcc266a11ae74cc4e50f1ee2468bd9cb1bc45f971e1604b1572043e3afeb72135cedbcab19811e860d163e33198e3cd83f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fbb847727a9eaf77ca4d8c0f597a4917

SHA1
02e96a56894cd87e96bd7ba372dd5be803a0fc15

SHA256
4da3591658581ca488256123bca6611f1dd201047e9d2bea289c05647e7c1f91

SHA512
8d285db916e9f9e5bc2794852e7081377ba5dd25d0ed4d836796f84a45a090004457673e54510e1da4c46c44e208d8257c814a0a90b0c3b35f9fb6b8614c4f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
27e32eaad2696dd6956131d26aa206e5

SHA1
da9728fe4e59a0217cf776df838d536624d30e82

SHA256
a48f6ddf312ab39ab96e16d38ad2f3802f1f744a66cf4c2c64052bb83c9a2cda

SHA512
cc286e7a3fe1e80c910132f3cfb7ab6e1dbd363fb9e3478b0f68e24eaf21aea0b85160b0f3b9993150831d1fd40b179c3b00d8a96faae672e59ec105b826d08f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
217f762139a777c13270d2a0e0ee286e

SHA1
3e3cedbfbdf9db104e672200550ea1ca5744d950

SHA256
3daf753078e93866a323adf99e57a0a6a62aff03d4aa863846b11048f6a0790b

SHA512
ed8351425084cc71d656cd07503711b05fabf62d2285e9529155789a5c4657c0bdb0c7888880a456bb5471dddc22883d65adaf9cd948a37ab7ea15e2b893a8d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b94a21a8eed8c9b45de11ef564d6f5a8

SHA1
79634959fcd99b0a0de7ca8d0b55dd492dfbb83b

SHA256
824fcf1824d86129c80ccc1cc95a1a42fd695725b301edf2b142662383447f58

SHA512
d59a857564eff160672b30b1a8353e62576db0874ef077d02da4485ea89e87046a4b7473b8650acf1e789ae788f05c872fd88d6a5fa8fd1900a9596315b3baf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ea9825afa01bb7fbf02ae327ed0b198e

SHA1
e1916db2caccd59d374a8daf0683bf09d3beb28c

SHA256
63790f3c4b6da1b7b2f05721b2c53898b3ce02587ba9fea248b0246739592d13

SHA512
8c47eb603d5df8c6104712aed4b7f04ff41da3b5ef11808d40a7665c00258be15dc6917fbd14239b7dee1a9ad0cb39351a1989f3e82b962e6c01db434592ce69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
52a7589dd5c259f4d688de564190b2e0

SHA1
f360373b9db82380f64adbe2d67611c4e47504d7

SHA256
eddd701df49937fd7776bc929c708e3c93e3c667d80a72dd5df413859f99a62e

SHA512
40883e886d1aafe173cceee0cc8d456601924f295ce68db915daf04b85230b8669bf76387a23d5642e85d556b4e66b0faee3f6f6313ba8391363f1501c6ce4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab254E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2630.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit