65af85dfd71e3c86e6a78814786c26714e9787be24564330a0d5d1ba90cb3178

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61e98ac3ca73ee0f24df62fda6ec2e4e_JaffaCakes118.html
Size

68KB
MD5

61e98ac3ca73ee0f24df62fda6ec2e4e
SHA1

9df79d96164c3d99a3224072518533d4e84b0927
SHA256

65af85dfd71e3c86e6a78814786c26714e9787be24564330a0d5d1ba90cb3178
SHA512

194c9a8d860338261573963b0135d05a48667b8d302770d528483a23bad5d50ac897f23de2e6f903a8d2a8dfe291010b828de129d2ba94cd224665e41efdb721
SSDEEP

768:JiRgcMsSZ8tN99OIsbCQNzyT8oTyaQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IK:JDW2gTdPec0tbrga6cuNnzIjv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000505de15d8f3c3d8354a7df4755cf8fcbb9351f343ec891481ceced749a4e9d02000000000e8000000002000020000000e0bea9aa6d849caeb65598014fde0d7df239576647190ed68b1fe126cc30e3862000000087075a5158849aab353f0cbb6622a66129174517cad4923e5734de7b50b5be4140000000320ca3e4012bb39f74c582f6f471a4a5eb8b0de4f983c0511b1aa1eaee5985e31be5534797e71e3af30d45e01e9032a20448906359e39f5c156c2089ecd9b419	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b1009b5a2f2dc15812a2db09bd391ecc3f7c6657483c4367325b393744ac1480000000000e8000000002000020000000f13da29ac8c8f0ec6fae0316a81c996ee663654d89c81b89ecf6fd1fdc6dabff90000000541ae5b4ca37052737cc44ec076deca96bc1a45ba7db18e2a4922a67c6a1d1db5a5150e55e62daf75a3b2868e7c504cc8542d7212eb95b978e2d972a6d6dabf6e99f9eb33e3bbd960946f8a31250512387a07ba72ed3a1f1a66092304a2ac185067209e7fcf4dccf0aef8c58c55b5f7a908f0c64238b83926d15bc26132cb0e3b5b83caaed1ab2cd67bdf59ade8337e640000000c517642c181fcd27d5a1e5ab3a004aba9d4913516ba12eaabfbae6c298076716548970605acb88c014f2d4fed8e28499d9e00317632edacc1540cdf529e248d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422424660"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8E70421-1723-11EF-88AC-F2AB90EC9A26} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702c959d30abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28
PID 2248 wrote to memory of 3048	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61e98ac3ca73ee0f24df62fda6ec2e4e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35f052190f11a02dc43e6383e2bdcfb5

SHA1
42182b8b9fcd96b36686a962090bb3905b8ac4e2

SHA256
f4975114804f09cc8214fd12aecacd0b0dcdb9eebc54c682e306033c4819bc5a

SHA512
cd970ba28b88fd1e9d324a496d9e20a44dfb8b765e53acdf0a1b4c3f1897ad4809af093f2c72f61a724eceb4ee2cc9e2c3517b56c2c023180c0767d76f55f269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1840bf4d253b685d5afc68e09f3b318b

SHA1
68649546a3512e1b4680564a611320bb9ad9f98d

SHA256
5ec2d4037d3ab65a59b79af786478e8aa1af693dee5f8b9a088d972ffa74a328

SHA512
7934ecd58aac0258c241d49f61c650be80f7ff2f77954f10436aa7968200aee665949280993906b63efbb9eff10635b271eb7a997544474f81b78fe871118dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdcd2620a9edfb5ea81aa9e0fa0f39b

SHA1
56063f7e5a2af6ccf356e54ab2da8c693fc6d8f3

SHA256
dcf76d05f19e2d4c62beb56a572dfacde0a3630d2f22f14125594cd04a277427

SHA512
7d190f98fd5ffed24202faeba2ba9a2d00536f63065399975892caed7236a85efc2116f051647a850d300f6eb3c85814646948bc17fad57e9eec1051bcad032d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c082e5430916b083a85e48cc99a7d16

SHA1
c7dc2de6948684aa8aa3737b533b7ba0ee6fdd37

SHA256
dcaa441773a7c8dce3fcfe513ae75337711f85c0ddb1e1953069c28d7a03a4a7

SHA512
6e95841f479fc9293d75cccb08a7bfbe9c20a44282cb820438a9e42554016e6adee2151e7bcbb8aa42d873873fd00fe76e4ef3837a35e7f08d925fa42083ce2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9114acef6c2c00bde1948d5931f1ca72

SHA1
20cecfd247fe5a7e0871e0a97d8ccc7e42ebf37d

SHA256
34a110f5652af2ac88e5dea50b6be835fed18c662a2e403d152ddf4e9e8299c5

SHA512
563e5e008348b335bef176465393d5f8b015e41854702e90cf23aba55dfa22d463df55946b4fba0f21452d628193fc339f1cae8d2a57157fda0963f82e82f416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19ed74d0a8cbad093bd98fb9d6ce4f76

SHA1
1bd9a6ef45caa9e9f91dedff39893b4074455fbe

SHA256
8a612af9cd4b5285388b8022769a4a27f8a2f50e4559958bc9f1aa34e58ff031

SHA512
1cac442cabe8b265923ba24a1f12030ee91077c5fef410721fe8f205eb8ae833d9b4a25a553f6a4601cfa0657c6c76169a3556711752ab1d7b84cf8e481fed93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8451cf27da320722ac24506d36c5ccbe

SHA1
b92d1e95baf056e6f91bdfd144162dcf67197a39

SHA256
7c69ba0c050dbf33e73eeefc9b3a5d71a121d5f9295f3fb107dc267b2f519d7f

SHA512
3ae01c8b903184eef7897a23dd9496ad56d098e6bacbbba5e983a17f4b930529ceb6a402b2b72748f3d86767b56d9efdedbe496e1cd6654ba1e113f73a8b4e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6193cafa590f113f3b004ea400852f15

SHA1
fb67e65adb9deaeba8834d6e7a7c4d5189a6db1c

SHA256
f261363b73f564fd068f5ae5dff92eb3cf53cb5e5c2b0c23e9914bbd4467012c

SHA512
377a3fb2b25f528f5de363b00d2271105d585667ed4aae3dcbb9a018c74a2465017182428d44f78b8e2568f1b78a31d3e3608ff490a43654ab868aff68a4a5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbd2efd776e5974dc1eebaa0ff116853

SHA1
f1f9b2ad6e90d4aceb3a547ab570fdbcfc81e94e

SHA256
c37359244b5d944dda3f0dc77337328044d94f2b4ca1b582226afa2e5d57a4df

SHA512
a714399576e1064b8226c156f0fdc5334c259ab9a1ca9faa7c50cd68bf3d7e4f19089ef0057db4aa8405d24fad39cc51d0c0a5cceba4488b5c6048f4867b83cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9196ad208dd7d07624be8d40b8bc5f4

SHA1
e4748c5839afd9a82b3fc0420cca03c63bd7528b

SHA256
ba9ac19225899c20a3dfaa783f6a590e7ab1cbd8ca4e88ac07a340e07a9322ec

SHA512
aeff37d2316db9b3a4bca1a80888aa763ec7b222b4c638899ddffa18d2c4711422ccdd3170b6e3aa0d5b4a62f63e8e0fcac494ba9d5d6643f0996eb18de5c054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b03ab42f28a635842c525150e486e0e4

SHA1
7dc0c4451d9e92810b9d76287ac376869b61bccd

SHA256
874ad05b2ffd38e0c655fcfe4270b2515841fa235414f0dd757d724b7d87ed88

SHA512
7fe6343a3300409a2a637be9e7b59df96a3ea3f32286273a47ca18d5c57cb0f7563e609f3d1c482b4a72d2d85d7a099a009934e212b8bb167d0884a3fcf19f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b52794c852614369eeb212dd59a7f3d

SHA1
ecfc18ae4653de7f531ca36f3b7e6d1956e50efa

SHA256
5afadad06b0161e9b229dec0f7c300eec07b2824a46fc2d62b7d1ed789422d28

SHA512
aa2678241f84d36729c3def886d9d796ede14464671f2bd6f907190e23e648bb0d85969c9a30204af315bbf1b6d9dbebf17e64e5f485645b2b90c643a126c4fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fda0e586e995dc2568d47c3e521124f

SHA1
cd4f2f94cd47a2ca3dba69610c97cca942c31368

SHA256
d656d8e7e848af32aff162d78f337a4cb549ac40e695a1ad67822d54f8286268

SHA512
7cdcf1428ecfedff5db3a9999c12df7e4a04a898f4c35a07e5c5359a28cda501ef775b7f738323704e8719a95e461f1651c84b0ad30fe684b20deb85431fbbc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e9f0fdff384e5b8fd9f345feb3964d0

SHA1
f6cb068c6b568bb47c47b1d1d1ddce0ed39c347a

SHA256
ada89824324368ee6d045e3b6cd17e196ad1c9d4ebf907db426f6329ff243e4a

SHA512
7ece3b8cff10c03cb72d9aaa9499fbdbb643259c2cbc70a81aaef7f21fefc747b54f9010479ec9417438cd2c404413ffabe864d8507550f666e61c734ad79b43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b2507c9c814128786bbff74f8e45d6e

SHA1
553e849920cb3232cfce502970746d2da82627e2

SHA256
b1405e4cbfe76572b1c3e8b94940182cbf49193de73ec42d11b1a5a7de7b0aa9

SHA512
21ff201d780ef296798c7197314442391ca4dea96a3602ecc761b349e0555134f364068339e1b5ec630660b22059563116c40178c8db868077bd34036522e893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc469feb06423ff3efaeddc362c0589f

SHA1
a4621825199c9d6bd8201f3f7a5ea54348f7b627

SHA256
4c34b2acd31a8cf0f92046a59ca2c0fc27268af6935dd24a64dc7d74d6152314

SHA512
da7a444fc19caed0567dafac179bcb24b9857efaf763c4bd0ec52f155aec829f3d5b664b5ca98850782832c5b8a344b4658aa1ea0d5515dc5317fb70a00fd9f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb3ecc0a5508191646afe403b9cb764

SHA1
3a74d5e15fda267dcac917c0013270771b05f7d8

SHA256
1588090ae13d4b759ff5ff14a8cf95badc0b0d6462f919bb6f0b545cf93b089d

SHA512
996c7e3005b5fe3eeefe671c196ff8c79d52c4ec36381a6ad68bdcefbd47404efa49071b647e081db6a02de51004ea9be1caff29ce2abed20ba2866ad9a89147

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CC6.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D28.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit