da1030c9c00ed53d318813840f210a1d62472437e1e6c79011486d0be8bc8c06

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cc05360fbb9df3e5cd697568abf40f6_JaffaCakes118.html
Size

94KB
MD5

5cc05360fbb9df3e5cd697568abf40f6
SHA1

039c6c4c843e5b53a2f41efc97030a4408c01e45
SHA256

da1030c9c00ed53d318813840f210a1d62472437e1e6c79011486d0be8bc8c06
SHA512

89efb2a1c17a7061e1e5df1480f82da291e4dda33991374914d148477fba7075a341598d883e89e6e53818d30b9893671725fbc61aabe15c4fece9e67e289dd3
SSDEEP

1536:WMLiNVldZD4hG7LMC7K4Hr3y1nAfeFLubSZvlyCBdkrY8mgHC+qpEyW:WAiJhmBdkrY8mgHC+qpEyW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000150c286cfbf86e84055c9aad20d8e31a1d18f3beedfa162a39495c59f2c533a6000000000e8000000002000020000000c02b858d7a435f6a0b442330407c23ba8e1830b6dff852695387baee6de084c0200000006f4a7d26aa652d0e024041c356f40e64d726b5a709d2da96fe8ed857d1f104af40000000aa6239ed6f870adad383e027f280411b8da56ee0da88a286312c8dd77940328231badd295abd08ae417001ef7c0a08c23d73bb9e6cccc55340c8d2e1a697f89d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000fe452612962eccba0579d1eed3971674d085697575bed5a2d44654fb55d7915000000000e8000000002000020000000ba40ba03eaa2b368a538ec5ba0e004735617fe3a960f538e1a6492fb4f074ce5900000009a198664a0202af6b446e055d77ac6266744e9cdf0b932e4e8af2269e4ec433de40a9cae93cbd6620b38fd03d18e568f5a0e615ffd813d7756c034269d8b3d8a4b5cb7593d03bd2d6009370d6db30b144c7a9be1d5167b003dbba1c9d2992349b215b1eafe12e9aab08263bc460c4aa81f57261718421b27fae42b0d2b80c178cc4e413e832bb4be3140ae3e707cccdf4000000027c35f8d665c29312271e3d857dfc295b847c3188d06a6e778db4a36465e9ef1358b8c2ddaf318dbec2c036757f64a42057d968ca025175cda1e5123f78c76c6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422334379"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{949C9AE1-1651-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ff7b6a5eaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2548	2372	iexplore.exe	28
PID 2372 wrote to memory of 2548	2372	iexplore.exe	28
PID 2372 wrote to memory of 2548	2372	iexplore.exe	28
PID 2372 wrote to memory of 2548	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5cc05360fbb9df3e5cd697568abf40f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fb04fdab6cea68d7fb6bb1cb485ff62

SHA1
ae79a7b003f69db7e9a291d2aead9dcd6b8ef1cc

SHA256
bf2ae93c24db7a6923e67bc8e31ec7b8c332557d385f8d80a257ecf7a22ab096

SHA512
90142e6099a6eae450ddd1239d0ca27e69485bcd2b9ff10e84fbb919ec76af0512bf93a78f1faf06997dd76e02d1d8d05f37bc0b583dc1de514e827a19dbc908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e361ba036e631c4a2a60e1a9215a1ce6

SHA1
70f7073570fe829e48a5183702b4ad6da94200d6

SHA256
f62d6b81a9fbde48a71b74d1024e4f2a3331898d042774c8f3c5dd702c4aecb5

SHA512
dcb8ed269b6374d9433fa46a28d7089f64a373e0766a809edf584ec6946a136c6627a2d5fba5798cae5167dac0dad7f5ac8eac53fc4f5263563fc94c9247ca47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f312ca9ffea7c894831164b69915b1a6

SHA1
3351a4fd49ddc5b0e74e231ddd56ef814b53ee17

SHA256
bb718fdbeccce81dd641f46a868dc389cc8c547b2530b6fa10e5eca77fe2a307

SHA512
2d4c0db2ff28e5ef7229c4ec3839269128f366254f6289696938801a36c1ee79bacb302c98ae51db371369484644762f67180365a45a301645b6337923a63c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d920a946b5e69141460d5a7b0248630

SHA1
46f985ce8d262db40ff77f0f18e94e55f975a021

SHA256
99b3336c36ef9a343c21126b27f63490d80dc77fb71845bd168595b5fb8a85fd

SHA512
b34e7a3cb40addd89289fe971d909c4fda77e8a3eb30183422b5b12c2bc83e1e7fc90e3652408e37a32e079d01ca89421a00fc81582781dfdecb1473113699a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebda37c1b694d1de8bfb3958d11b131a

SHA1
f8825997896d48d31f9b0238c2fa598d4180490b

SHA256
d7d28564aa1d52c5081353a94cad62a2cf523b31f0c89a084eab4f7a1cfc1f39

SHA512
6b762802f07055e42b3bc26937a2612bd0ddf0abe8328c6dd5898a470f24178e947ff81cbf3069a6a693a8ad14bb0c1951d8acc68f165bcf420da62739c494d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58f1575678a89c53b932ccdddc9c4da

SHA1
98141079e119b12f967ed048d78e8c5736440124

SHA256
3908ffe085cca05faedabb891e90238abd33c812967ec338f9bda2affeb753e5

SHA512
b85cca1905014fa38aea34b9d0ca81f31ff94ec9295eca6d65fddc4c9080a46eadd0566bd93b83d0eddfe64f85f86bb3684418f19cc99830730bd38f314e72b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af081aa1a084bf9c9db6cfe46cd0f391

SHA1
4796b8b28e1fd1baeac6a634c36d5abb0a1b8590

SHA256
c3151013bf2d67e804d11e0e0e2011795e2a76c488a17821facf40b65878f798

SHA512
68bc94c2821d78c1f4c6a092bba1ab9d4c5746a6eef387a0baf8d5513cdf3e0012e0402fa34c78a0053809cf1e9f7e984b6b9b2efd1c7ac2871cf2b733382f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d7f91e16f23c678cd816d7c7ed95fe

SHA1
ec27d8d7051ee4ef07ae7534ade3368355dfff11

SHA256
e3bed435c99e5d72534bafc0353bb85f2e6a00656e93162203f830a376401405

SHA512
3216c4e15e58dc497bcdc7061e21f6c805be8f1abb5e03fcb6698a890f57f7c8b66b3e35df433d23e06af92659beee44b55de623c95306f47a1637a68ad9311a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb1df3aa31079414048c8ae483cb5e4

SHA1
4c02b1ae32c97fb1e810dd091741f14345edbad6

SHA256
ad55bbbbba77d365ba8de859ac97653d984af83c95690bed86450109ce1e1312

SHA512
295262db810390b8a4ca8c0271efdfb05dd3f7be1c46ad6bafd5a1ca5cc1bc071c27c388d81d7b8d9cdfe7ef38ff5a75b673b7763ea387b793d80dad86a23fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71915dadae8f9f596adc6402def6147c

SHA1
591767ff9f1fe7e78f66f2dd336e4021ef68695b

SHA256
fdd9cd15734cd7174da419a88b49271d45a682cd0128a8de38a8064b2f1b36ac

SHA512
4625f21cce8216670fb1a242199b4df44a45f9a66221709d7b04ea664eb066ec84d291e53951efda580a5320fe16afee74421c17c7bc4f04c26cf2fc52943a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb66e6eaa7f2be6d3385066b85e39b5

SHA1
8f8f24df32a98d32bea27a4d6328d2261a5e034c

SHA256
2f1e6ee02e65291c3c73e46e95af7ecfb2a6206c8cd8304b1f28973eec12a341

SHA512
a2400be0bf60bcee6ce8f876a98052ce69f800b66b552481d19123ca77129c738036a272d052c3e7814c443ffe7fb45069f6ab2e47957c8f4e5b08dad5a8ae1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4add6c1bc33fc656d795f2e98c75a87

SHA1
17da35f3f6c9224d47c62b5f151d892e9ed35f0a

SHA256
dcb1dde6dd2a4177d5923ae2174c8c81ce51f2b1069bbddf11a49796403ed956

SHA512
db7dab6cc935216b452bd0370d15a260b1ee438d1faa8d2fa98265f3212c976dc38e8b0119f6995916b557b2ee2a4b92030a85c9c19130b273e3f497c578c1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8cf8c6280ffaa96ad0b65f665364b4

SHA1
6dd1e69a500f5ff877d88f8d8867930f1e221145

SHA256
cabb5db1f96c2486f7b75f641be9acaba29105aa1c399132084851263d4e11b6

SHA512
212eeda7236c9b9d434143b24480716cbeb63f7729488b620188e539b0f182896b1bfd959d53d82ca412cb3fe94092d2cfcd4ffdac0614821fdf2e689130e5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15dadd84b57fe00d099a35bb92304ef0

SHA1
8c2b0f5e10a194abeceeda7d417ab7854772e44d

SHA256
2cb72a832f1a712a9e0e34cbb86d6044c463531312b95bd11c2d32a2692523e8

SHA512
dbce51b5f3827ea8efd76137f971946f9b27907c677f6db7f457b63b19ee2a0ebeb285995cc969fb2c49b0a6e74d9d9c03e0c83cd045b9d16fa1e93b2d60b177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc1da2dae911e336eedcbafe3515d13

SHA1
33815fd431eef5224435816fc0c6dee30e4131f7

SHA256
4051b218eef9902559e0b563d74689b84f8afeb488646765c9ed473838b87719

SHA512
b18744d02b3f344f30e9b26500339dbad2c93a270e093b2c1b31320d7e621cf65c7464e38d2ac08d5582b80ace81090568ac1e25dbc55fdd1ec889fac098fe19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ebcc866bd64a55484269d75583023b3

SHA1
f0e0b651430b042389bd695c06ff539a5bc6fe06

SHA256
6fa9851dc2a7ea1e7450a3f44ea047f68f7bd0827075ec6d4a5246c5554bbcaf

SHA512
80f7c6c87b974a373c94f5704e8d6452eef092c94437fd6d2edef51661e6c525fbd6994f9ce22a5cc535d63bbe8dc3f78cd892debe61a951bad194c179f4f0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\styles[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4848.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48BA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit