2f3e06731562ecb0bb8ab9b3f3661a50f4877f2fd6da4461b69622397a640a9b

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d5ab2e36232ff54de5698118ca1f50_JaffaCakes118.html
Size

67KB
MD5

62d5ab2e36232ff54de5698118ca1f50
SHA1

5833c455229151b4676d59f97adeafad61c73735
SHA256

2f3e06731562ecb0bb8ab9b3f3661a50f4877f2fd6da4461b69622397a640a9b
SHA512

2a94cc2bbe8556fac972e691b4b7491c548d740661974633099d46a9608733aaafcec92c0a51507065204f237779e7d73844176d327e491c7117c1e67eaa0216
SSDEEP

1536:+flBcxjRKCJpl/BMB1/Ge4aVYcrIrgpoZiOXXpAl0QDMSfmYQErCNhwCnoj7ThAy:okjRKCJJeiaVYcr/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422446192"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000a36eac7257b8b88d2cca35f1047699898b87ed2c074072afaa9cbe844505fd8000000000e8000000002000020000000f4b72120f9bcf54a8ded4d392dc2b5e45a4ec98e168e34f5e9cad5a61b438a0220000000df50c1f3e788e96510fb47c492dfd59f539e31bf2c99955c4c888c7b84f05462400000004404bbe4a7a1a0ff82a76eb0fee4befb9ba276aec8d9bdb48c8e729f499376e96c06a5aea0eaf83cf4258f913b232142c4816abe49865324c6008fa15ff9d258	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000eb5109041cbb05fa0bba9f485a89cf7728d3c15a02c61e746e2d271b6f3bf69e000000000e80000000020000200000008f522c4ca27ccf164abc8767a2a45a7220fc4af06a992d1455f20b78b40b4aed90000000d52b2c0c4b787cd3c70892e6e5c5046db1c9a916cc69e626b0bf733aed6008735e794e8987346b2c6ba2e49c30ab50c9570c39307795a82a5e4e85a7546d16d7567a0b5627eeb907b095d56b6180ad57e2f2d9939ef0481c43e3372268fd369178cdc27ca9ae84481ac0fdb0e813687264471cfedbbec9e0c9c8997b51c3d62b9df4173980a1c9d392914256b9157fb2400000001c65a3cc58d14f63c28fe1dd9c3d02fd529c1b2cd43cbf277d6744d24274c7dd4787517dd6a4b339c14e36fe74fd8c557dd409bd3f66273961915b63a5f593f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA5D1AE1-1755-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604d85bf62abda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1532	iexplore.exe
1532	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28
PID 1532 wrote to memory of 2704	1532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62d5ab2e36232ff54de5698118ca1f50_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d701451330c842877d32c2017fb0aee

SHA1
11ea2ea9bbafe163989d7d26cae090f898f1d08e

SHA256
bd650ab0de2bc78a56b4c20b8f0d0e73fd11a284518b1c1d3236e437866f32d4

SHA512
a5eac9d6a00367cef8d8d74bdc9718399cfa3ed2675298090adfb7cbe3057322a0829eb4e2913a73351579212aaccf68f56e5edb713ef3a6c252c40f6f08859c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
918f4360f2d87a6ebfe5a4cda9ef63dd

SHA1
3ae9b17cdaf37e0c50392e232e4d74c7126319db

SHA256
4475080f0da6625b9420b3adb1f48e7c350f8fccbc5d95da57abb3dd661a9b38

SHA512
64fcf53003be26ceddec6e410577b182fbb86760bd8802105886f47f861b6375179a43dd419a4865635d50076e4f0cbc06496da8c666b3a532faaf4b2c0268f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50cedc7b61d15bb0ed2cdcca361bde80

SHA1
683312830b6b22555286a5671624c9046be88fd6

SHA256
db62d2d5c5c8f66c55327a4537cb4e57e05fda29ec9c1f97d019de99dbf9d65a

SHA512
96af35b3dabf6307e34c9975082cc6ab9d66dfd8f5393360e39f664fa7fc9e0986fac42ec7a402c7965ab8a4158160ee029946b6a0452f0fe68c1cae11312936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a170d25d9574de47380d990bf1db5a33

SHA1
974fde52bed145120b962ba52efaf9b2772f1ecf

SHA256
39eef1b127ba38c34238f8e6ca1492b065c75565f4e327d167b9b69878d88f25

SHA512
a433d2676482f97fdebae92cf867dc1a6e58ecef3c92bb0f3a14b7a152fa62cf98c32713e07ed9a6ff42a0e25e7b6e1c591673cd0b0b6090721a2c73fd7c37e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2929e04f31e80c630571b502bad8f091

SHA1
d85981c7157de3ae2fb169d2bd7a939c6fb4e1cf

SHA256
e64221318a2b797bafc157f54e3d0d7ff056546aa65ffaeff1dccd42a4f5fddb

SHA512
7d0ce71802d2d6142d3dd3003b57694005d288258841cfd079f01d3c0ec6226df479f5f81853da44e647f65326c2b39a1c8f1d25af88c733f54f2afe1d3a8091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35b094fd12e6c0585b0c60e1ae8b1b69

SHA1
9722e11f5c1a3909923ef2d04bf651d5f47aa1b9

SHA256
208bdf6844cf87dca55d72edf907900bd478ced8319d72a254fddbbe6188b33a

SHA512
6961b2baa4ba243eb6ee8dd65727e387f6ab1a5d2f5dccc2eb8af3d6df252bd3e0c3a51de140cd4facd02d7daddf2c3eb203ba28081b515d782736f5b3a52c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d378fbe263e111b7a48c0cc4b3c4872a

SHA1
041e61bc7b35445ef7ed0fb42f6e650fbf0b4376

SHA256
d2f769da7d024056aa845df1af5bd138d2e64140195c718d65200bca87d88a8b

SHA512
8f0ebee98f73ebcfe26930a663656cfc6ab2bfff193532bce3b1d135231192be9d271d112267d3d1c425917a688fa8aa3e85ba0e275444922c952acfb62c3019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9747fa52d56fa347e0921ca55b66bb

SHA1
a685017c4795bd231e51ceb801d12623b769f43f

SHA256
1a015d86d95334def91964b9a01edf5fdd8307e4a8255fec2e5b0c70d20c155f

SHA512
2ad7b83015938c50ced99bab210a71ad92b1a1e3138ca584885618846af1605857c7d18a9941c0c5ac85997d8332649c0d926ba68ee3812485b15f406c54ea38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f4bd0fea2c4ea7583a49ebd09fa4877

SHA1
64ee660d7d360ac8433f948b3383728213e9eb21

SHA256
27edff77af5798b87c3176ab11d1ab25f7a230f2f6521ffa038c8745b77931aa

SHA512
d8b089542288524aa327bf948736aaef5e499bbdc9ab147858c6e6bd61a5379e042115f22f2ecaba5d0ce6d03836f7e4da5c31b89738add396744e6a7523a2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20ac1db51db76d3ebc3e8954819f0eb2

SHA1
0a07c17da604e2c92ab730f28a781ddcbc0ccab4

SHA256
097f2013589e8674d2eeecb9101e2e4d3e4cec21960075f3159fd0c6ac151004

SHA512
416e5d18ab602dbe1200975be5a2daf47b9f6a790a9fb18ec27b7f8b5479923238429f78e29ae72d3e5667889f9cc8ad3d3bfca6e8cee61674afe3e40a2eacf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6c7a83c14c4b748ae392ffeef720d1c

SHA1
fe8e54de6bccc5511d53ed9fabbeaa78b261b705

SHA256
20a619f40e68cf2c6840f982885faa5412a326594e8c02ba9999e218efa69ae0

SHA512
ca4429bd8f04b9f46f4263bf2602665468d9e1df5a75a9b3a443ef95e73e576ff9baf34987d687c37eb380fa661b673707332d883643303d8893e721d885b4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af47a89a67e335680f043376bd88c93f

SHA1
14cc7cce5e8edc7a55f61420b5da2a5cd1e807c0

SHA256
0392966191fb8f0d85ed2e0450b3aa9e98b65b14fbd46020f77dc7d1f32c1d7d

SHA512
4652a69ce8c35a4ec1fe6bf0b51799cda55306487ec88ec2ed25fff36437644f12614cb7439c5f77f28c14fc456394d4124675607eb23f136ae74791f20866a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43cb55f9ee2be1300c48750b4d49472

SHA1
6026e67041b98ec854c13ae81ca776b92629e0a6

SHA256
ec527d9066382f221cf13c7a6752f629e249b892c9f1786490a91da68a7ed4b5

SHA512
422eec42ba3a52c393648aa8c2c26ebab52259523bb779a39e72a1fc9f8fdac08a8a1daea4d5f796758659d1aa7d728b50849abc7c83a82fe79685caca073517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533e8260c76e512b2b439578525bb0dc

SHA1
a083c0cf3fc53675e802c9f81c4deee5ad40e9d1

SHA256
8f93c229e5ed7dd6d55843a3199fb3ad8174377ef21f2e9360188d887e56820d

SHA512
3aa476d84de7e0ae9964e6ddcb2b57c5e0f4c6a47ac0a062b47fdf8b9b80f37effb0478cdf83e68b0db4c14961676a22c08da5bab509d7a572d0f8661894e20c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
920ba9bd83831ab7f20db34c8356fc47

SHA1
008c76bff12c63ed0553b3a4f9669f35849a3436

SHA256
fb23cb8a2be012715eb21f5ffdb98ac78c6e0ea5610e9401511aaccf854a6480

SHA512
3d22a683c2916ea978d50121da29448c26b50886e8cbafe73cfae0ddebaa3676a3694a17bb35ace21df12de0fabfa423433dc72ab020d990b49370bc66065614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd0f81c62b09a281086521cdd6c74d0

SHA1
221e92b5ddb42b1abdd87870e7ea6eda0c452959

SHA256
2d6eb3c63a1235970342e57b7b427eed301c225cd0b46cc0ed9050bf010c6985

SHA512
45cb7384c6063bc8113c6440ec715407e1431201e9b38d78b8c6db9d2e73b41bcd9434fe8744028ddcbf9a8d2f087eee5417e0def04fb41ee257a88b82e336f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2416.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2429.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit