e72e500fe51d11b2cebc81b123fd7bfca4f2edec18de173d983ac874a4fd7962

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f69cbc30bd7f6e976bf76340959d0f1_JaffaCakes118.html
Size

213KB
MD5

5f69cbc30bd7f6e976bf76340959d0f1
SHA1

a36d607d55699903993ac268e842b0d394c00bda
SHA256

e72e500fe51d11b2cebc81b123fd7bfca4f2edec18de173d983ac874a4fd7962
SHA512

e7593bf8ac43946c1bec6a2f1a302b961d7a86f11d316c88c0bb36cc2b543ec96ee15c73a62e9278f87cc288720988f59391f09db754a5a4ac454248067fd4fd
SSDEEP

3072:Skamn3Hnx2YGyfkMY+BES09JXAnyrZalI+YQ:SkBH1DsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422374896"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB3AD521-16AF-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f69cbc30bd7f6e976bf76340959d0f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29d9da4b87a3f2bd21cc0e110c3121a

SHA1
eab865b6df5a9ddd1eed551d9d50733a4e5c0f30

SHA256
f6f5366675004207668da41c2654c225f9431808fbac75870067f69e15b00062

SHA512
f4a679e9f5e6ca710d000e1b7236be44c1d43e900e92cdcb7fb3ca64f505d78cfb42ac75fae74e82dba242097375ed6bf3ab897d067772ee5c8785d9e973ffea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c81f3f395119b6c5222492354b709f4

SHA1
ea5a050dd61e62b4e942303d3009862f446c702b

SHA256
7a8c804f57474974fff2887d01291620c0710c8b4d44c5ae018eedb55ee16597

SHA512
8fb8571d5aabc781a3730d64737cedcbf3d9d657587495c35f45697a8250e25f2af3fb5fa88c48c1f2c60fb60a5e6cea3453f018a9377dd5c07db7744a13f539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45bb7ca5175849b09fa834a0c7f9137b

SHA1
621d745be2c5db0f71d5dfde1e5a61000b5b2c0e

SHA256
2447f371b2f9b6366d3a6fd88a3839ed7abadc0de06ca6104fa8b8402d0bac8c

SHA512
eeeb2a6b97830caf5ef1bc5b3ddd616fb9f387cabb213a4006b9cfb5b56b316ee3c10e9af6d30d9b21d07825e875822f8c1c9449945ad75590b7387682857f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dea45e447a9d7278bfbde74339d2e8d2

SHA1
d96292a90a381daac9b537955b3e7cbcacdd7837

SHA256
99f6a2b782d942b73c26965f6887e375242b7af7f75e35fe1bd554cc9bed5ae3

SHA512
b02d5a8300418b28d97781d7488527ee5fbd7ef95e443747de2f09db78c8fee5b8e13ff020af419e09893294f0a829b7a08310ca5655d56133f85f366a57fca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a17a5a3126c2a5346e489daee337b9

SHA1
78113b7a0cecd613f906813f89820dd19477bbdd

SHA256
d5a3aca1f11f73f3bfbfd5ac149fd8bf5de6011b4f27dd61ea45f82bfe0a0bf2

SHA512
68e2ff4b0c4123118bdcc2c6c898633782c02ff2f5b815385189d93397a7144a888324b23b8e82de29f4b77e36a4f2b2bd20e1bf4126dc5a55acd5961e30cc29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e660fa3f21353446e8594cff61db73db

SHA1
9a67d9c0df21b8f04c4bd82f4bdb04fec944ab79

SHA256
a0fc29e1ca4a9ad76de3ed262ec3e3ed2f8edb80d68bb20f13b22cf1d8e5381f

SHA512
f9cf67dd1ce062bc2251d1c490b0f09f6c92078c4bc13eb66ce045388256e6d29186c028234aeb1306770acb64aaf504ea722e801ce1a5754b1fb2c9671ecabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd94368343864563e8698b748ba1b50e

SHA1
074e3e1a70f21b2e285527010e5bc4be2c8c169d

SHA256
06f17deb4bae470fe85007df2ef6b655b80cd786c9a8f59e292341b1051c422a

SHA512
b5c14511c679f5d65758e6d263c2860e0aa4d801f79fdb304495c390e2825aa89672a6fadf9a09145ad56d208778942ad678b6cbf8612334fab8bb2b4e76ecd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28438701b9a9724024f86c9827166f51

SHA1
866f28a78c74ee6212c4d4825e5a7495de967275

SHA256
bd763f86139a062c0fcadd6a1d53d5dd5e6dfd206e34388931345d52c9055a6e

SHA512
fdadb0f2b48101629ca1a00b44e601d945d2f12ffafbef2d7e64bfc472635024b54b1964f2553275a203e73c69ce54a89e828c66343bb7576c8387cf7e35288f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e23c46d735719bcdc0237291ff6dca0a

SHA1
45ce047fabfbe5019bfee963c249c0175aee9814

SHA256
9c3a4c62db2e57b532bf702b4c867962a49d912e52963b20ce40891d833de22a

SHA512
6dcb1505ae6fde7a8d87b1840ea96601af9066c42721ca701fb24efd48970d4c26c1e8e7ef38af165f1a9e6349fb5391efba54c9cf75a6016e29f3fe4e9136d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fc41fcbe2d35f88c01c3c3388ee2e4f

SHA1
bc1259a5c15ae13b7ae61dfedcd23c6626e97231

SHA256
1a479b15c73bd160d6acd68b0d2cebb81ce25cb6463ee58e2cdb1f060873b31e

SHA512
f79a8d51c09769817cf74af8258f7e484077a7c4bcbdfed7a3578cf22a6a065153db23c7d6c9c9c0055538f87460bd9ed6a201b953d85c0880de8eca4257ed12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85941a8dc8547f8a5dbc80a7329b798b

SHA1
40ff9858201179f118a2b365a0b3dc6b69104a87

SHA256
1fc938a280fa28e6c396bae00551d4543c859f3826a1fc5dad39021c5167bca7

SHA512
c0b56114b41816cf452d8887600d89f58c1482d0e24d80c22a9f5ffd3de13cb2239659bc74391606c153702975cb5b87cda1a74964d797262b4a1b276941a4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43f7008ce210153b255b8fdfc6a99885

SHA1
54a2a4265d066cf3901f09164d9af003c1f5c37a

SHA256
8df5a311d503a88b29a68db922fd09b6d5462d968a4e8946df2eb0d8abd32650

SHA512
ad7654ee6c37545f261ffb5c71e873f1563a34e7bdda913f394321c57e17d9cb6a857e65a6535ded64d5abe6848b8872799ef5e84bd2d893ba816d7d6dc0ef12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff276990edd91722d40c5da6448585bf

SHA1
d73e37125cb2fb0b1ebc675fe4e3f2d7e0135be8

SHA256
34b26ba9004fcb19fe1b16db44fc7c79757444bef1d5e17c152b97f9f42beebf

SHA512
c3c4cd8b220757adb22aab0a15f2370f26331845903b545bf59465416d03024200503e8baa25d35758236ee2578fbe15ca149ba06dd8e9b3d58d9a52a21cfcc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
064dbbcbb0efb08c0ae7d1ac860a0a34

SHA1
64f3d01bdc7add4163d4f566a5122d029aecfbbc

SHA256
682c92a0ad0b69c5c826c9f867de90041cd932892cba2d3cce303314f2afbcb0

SHA512
c572974c0e8355f0045347742180b1b1a886ba7e194dea663571811254f11903a64d53a6b2b0869c17dae0d2d2367684a4157f2af7177a5873cfb44a4969c9e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3b1dae6ca9f9ca2c7f389019a60348f

SHA1
5a4aef880f70db948213842a48e4b1beb9eb438c

SHA256
b9ff81cb6bebaaa800d81ce53af6e7073efc180ddb29bb0185d9a81ba4ad889f

SHA512
a3980ec758c21eb79f6c69b67094edaf35179680ffcba7c20b4edb42f0c667dfe19bba0dcbc54b113d55ca79596da83cacd5aff6e920e673b7ec37937c19bbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d5996262c986137699ab93c41084b1

SHA1
180e08f86c1f693c1af496d2848ce75cd1b27543

SHA256
f5ddab33ad0643242a563f8074505cd87bf32a11bf613b34e35f7d7c4f9821d6

SHA512
326d05533a6ced78f68657c546cbe71a5ee9fc8c2f33d40d76e885c8f74f52c2865144aba37b00b61e7c47c2ebbb15ffd4222ae60c1e27c90a399ce63de92db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c58e82f907d0ab4f068942b41707da46

SHA1
d3a6ea9ef964c2fcb2f14475a7f4450ad5475f79

SHA256
1951d3440baab55c9993fa786f3810b7f80bdbb6cc6a51cf7f03a17b96eb38d2

SHA512
5de2a7a6f9578cce94a64a3c322ebc38eb2eb6fffe7607060ebb330d457307d0283d9a047975c0f14cd6e459c4aaed04dbb06b5959d25f28c845d995c1be960c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d16d0a07ffbd2475298c80128b4549c

SHA1
86645a5905b8cfc1a2d5a040022077a13cdbd1bd

SHA256
35ae2ffa0800b016e7e0ca0baf180cd5d58525dac324a06a5d752d2fdf3d2886

SHA512
d31c27968affd5d8fe3d42a8f62da7da2710b37c4a94d96835ba80a865807ead180730f9a238be8792d86874c8169bf56f3aa61a3ee2120c5e3a7110c39b1ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237862ef3a52e44832d9ad7bf341188e

SHA1
8fbbc070b4ce1bcd765063dde268ab6818d91278

SHA256
e91867479a5381d5894ec7f7babf907462db3d49efd6bfa1f9861b978e400374

SHA512
3f8210324326b24db9bf018cdbb35e0cb9abe601aa44a1bde8f4cc7700fa9ddb57b1323bbd7341de1976b15994be425c83c5735d7bddabae82a8988fb0533a6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2280.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22E1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit