173a4ac484be11c80f225dc3211d808c40c5d877f2b76b5f829615dff9770f4f

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b9702277730dff2ecc7f530aece9933_JaffaCakes118.html
Size

30KB
MD5

5b9702277730dff2ecc7f530aece9933
SHA1

48a2900e7e373bc77389ef515e4117a714ebcc06
SHA256

173a4ac484be11c80f225dc3211d808c40c5d877f2b76b5f829615dff9770f4f
SHA512

7c713e74f7f0378b49759ecc03eb4529540c2b05f2188f8dbc637b8f0c12f4cbfbdebe3995ee2bfd0c0c14988bc93bb7b2e015989fd2a9d2b99a5d10d950225b
SSDEEP

384:CpUo78ek8iI7KUIvOO036r5ZDhvs8g0QtEKH51PRsyVhuZrlk0tMQ/keb55qKU:CpUfCXI+KVZtA0QtEw1tctI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709bb86c34aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9814D361-1627-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad153c126d684145bc51489cbbad6aee000000000200000000001066000000010000200000004aab71a5f7fa866e88c67ab29fa58b3a6d8deb9ec95f2ee0d43ac65a647af688000000000e8000000002000020000000b16c397ef1378501120c71216b803f1da30b48130e2e13d26e624b49e6a1409890000000c0f68129526378ca5e58326c7619db1234370f92132fdb3b837d65d634bebbc82b6c4148d2871e8b10036384d88d33fea4f29193e9a0174e65e4ceafc15c97f53f6484f1bfb16c35cb625a241893904fd44062ffbe7a919dd071e4b82225bc17ea368b5ba74592d8aa6dca6fabf89b8306f3f25c343e6b0d42585f5d5a7bdcd111a4524789319e75b6006972d94f9ae940000000d058328b532db9b0ac56558f7a95ce43246083b8ac07761d0308d70d46f5320b7ccb75c7d8c3c59d03e1f822dba9ea9a0f1ca32c41515a8b9e7b746996f72942	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422316346"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad153c126d684145bc51489cbbad6aee0000000002000000000010660000000100002000000064de065665a1f301e57e4c88fc005007663e43cc2cab5f3cef0f485029332026000000000e8000000002000020000000fe26ac02ba74dc6f0a1645c405c06cca1182574aa9cf95ef0c14a06c5745b46620000000865a72bdcf9a8d40b9be0439b91f26f7790eb5f9b5f35503b55d2637b2cafc524000000027b456f2c5529ae8d168526cfdc8f8abcb25389cbe6d41ea738702076e4abb2fb6c0e7eed5b89ddd1a10495115fa2a10bdfadea22d541c6809b1f2eede31afa0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b9702277730dff2ecc7f530aece9933_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c5729c3c1bf180ceff5035c16ab29785

SHA1
10dc5dae60063fae56affd973c24f5d198696c67

SHA256
94ea2f359a4bbf65f268ea67641a51d1ea22eeaf0ea385e49704789be8ae6ca2

SHA512
d5125b114bd454bbf0578592bd565a5b7c02172af1c4cfe306bcedef15956b06847d15ec62ec987e5ecaaead0facfee36ecbe9f44740ae3e0d313d4d98d4cfc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292149ac742d7e7387a17c99c7098f13

SHA1
8834d19b8bf3306305aacd94f987688695eb9af0

SHA256
395235e7e095714646c4b6b7b650c152dcb86236509e271d0c28aec8b04288f2

SHA512
2ce9d6fa201f3e8f9aad2474add37432faca7d1dfb3049f536052b6e4b242fb4d6a8fc0c7e90242af132f2ee813798263dda5db3cd78cc67da82157e341a6b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe1c39e287c1a3d60e3b8830696672ea

SHA1
1d7f01c0f789238fe404a6608a1e933ffc73ad4a

SHA256
738df9c8875aa95aafd0f87dfdbe86667478fafd645ab467a2d083b7d419d7d0

SHA512
363153ac6b47d142ab7564480915a00cb0de798a446d02ae5e3b34c6dbf06220e23ba412cc3f1610ce4e145059ed3919dcded9c3222e73033ffbce2ee26ed29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff96324fc1639ea808a9de9d0820c58e

SHA1
3a8d2bd98f3fbfca7ddf771983e320e37adba07f

SHA256
42414492fbba7c3921847f9eb75ceee530bdaf0727ed7c02e3075595d88aa3d6

SHA512
a2dcf519f13d8994baccb869223ca0dda4917a8b4eee75630d73e5a99f23ab1b35926e5ecd765988ae9e48af66639ebc474c82cbc05afd2f42503cdbb11fc22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b64d2df69659e34d0b262250b0974a9

SHA1
e90b3b9eb5dc01b31460cf681080fc17e0e80d9d

SHA256
a0bc27b93a4e1a98a8dbe9fa6527dbb66e7da8d73019565be11123810279d9ea

SHA512
79985750609d6f5b68c77fda99364f454825cc85019b3fa22fd44a1cc4ae627955a9185a8dc3b58a400c2309b796e35a8a847013013b4b5e4f3f29b98ec9973c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df96813401c9c5b0d7611ce92934dbf6

SHA1
44e72b38673382bdc4750756df73f967e3c8e3b6

SHA256
0c277702642d96eca6845c3d195f4626c55ab803921d8dc146119b8fbe2f1040

SHA512
06b2e14915d57fb1d63d63920f5f86f537c185259c92fb265bb408ae185c0991f1822696f7d4f5b6069e548df93b3785112979859a88a222eb4cde496cfa5a91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e1053bbac3a79cb8c3027134abb967

SHA1
df122d329b8c3a60b08dd4b622fad6e8a69e07b8

SHA256
ce62dcea503eecb8f97ebb4d2fe4c5508c36a3dca26a479b697d83599dc6c922

SHA512
8ff6aa4f54c86c4241cee82e66e362dc57851908aa0142de717f437fb1b1afcf9785184e4183330686f87c38a5c1ed117942ed55ada89bc6d5c007d8997a9cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ad54917187fbe2b15981d0fbb24098

SHA1
d62c3bf56c9356972ecf245fb2146da7c90f3fea

SHA256
1596c57daa662c2d838f0acc34c3437a78defd9e63da1d7828f6112879df989b

SHA512
afb3772a07020b23179c2fa39dd63595c38a675ead88c794d8fde10797010cd2cfc1c6daa9ecd9a7525f0cc27e7def97f077dd017d095d438478dec3900c9df3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a648111a33de2c6d48f27ca9e9d0f5f

SHA1
43401c89e25fcc5fcbc25663857950e67064e00f

SHA256
4537b09255fd20b8da4095bb112774b96c1854759f140ec4b3fc8804722c699b

SHA512
d05c8f33aa5d5c952bb4aa95870965febeca8753a951adac715f45a6f6bef2192b770cceb076656ab12f168cbb8bbbfc14adb50741e9cd20fdc6ed9204c2fe10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87423b5ba479dfb0d0c73232d91563c8

SHA1
9cfe1fbd677f857e9e4e343e4b7e594f1ad75a38

SHA256
8aa09bd83f953782aecefeef00a99992a976a76817582d29d7c73baab68b3d0c

SHA512
2b7a382d14832ca749c401a0b2d3549513d9a39c34e63e242868b97d11ddc8f0372d9947bdc1f395c3af438bc149108dfde37bae50939a6240cc29422b72dba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
276320a2dc8432e80a1dee23354784d5

SHA1
10e511799f6e2a880cb3ab36fce0f98324584965

SHA256
02d01ee7897bde413b8cf8990d97be6eaacbcbb4064b4ea983873e1f0c2c7b30

SHA512
86de0ce258470219e63cba0aec959d7e2afe4b041b4a5666f1a04dbb41a12850d71d71124d75228362396374a9948fe2f5b826cb4a005c2f826faf338993f822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3337.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit