ec3cae016017fd31dcce4dbf52bb5f471bc04b463732b6764b21b60e066216d8

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

630ca38899bc38c195b6083248ba1852_JaffaCakes118.html
Size

67KB
MD5

630ca38899bc38c195b6083248ba1852
SHA1

89c22b22a443b2273ea21574b1c7d07e37c33e97
SHA256

ec3cae016017fd31dcce4dbf52bb5f471bc04b463732b6764b21b60e066216d8
SHA512

0132f76d39f2ae7546151c5dd3483d90926fe85abf7ccc7e72f649247baccf19ac121f1678ea93d1802309db96f9ff2eb4a5401e7b9b71dc0d3ac436dd333bd0
SSDEEP

768:JiHgcMiR3sI2PDDnX0g6NKf7EyI73oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:Jp/METcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d4a19b6dabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6E48111-1760-11EF-BD10-4A4F109F65B0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000015d741aa5a4a0fe71008530d3329b0eaf088b850eb2baa2cae1c95232daf5231000000000e80000000020000200000006eda72389b8d992580574053b4b88526bc6cd01c608dd06e68688c8c6e211a75200000005949cd69729d819d1ffe1b8e0e9403f948eb3651258a5973f54c15b936c8df8b40000000314e7f62772bb4e11c8fae76a157d24d76bcc878b93a3f6c4caa493840867ebb694db149ba82e185572556f923d3efc4790d9a20a6801f5d19c86f812d314684	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000178a8628e2fc4423519910c41357eb8e08ab896c55582a6351cc786d2c5ffa7e000000000e8000000002000020000000c7e431aea77afdc9a069f3c59df00feccb733c679007c5dbdb5341b1a81e2740900000009b39dfe36cc311cad8f93d7a7a109262eb181e45556e1f39aa7ec49201d9ce1cd219b6ba7a4a637a24a21edeb39df1dc10bc53837763a3dd2f50e978dccab204273136e14db64a62288052b9dc0ab518553291b8cb702d4f98a376530612d72cd14fd84bbda0d7dd4916790ec9bf8835b3fc685a5f12fc06b73d18e3c51824e2efa1cdb539e7a3a38212815fe106f403400000000e424a4dac0468637d772336743e552e0c9bcdd25b3f3e27602692bc5d117ad0737ae5ab18412d5606040edc9ac146cb9d62dff9c21841c48573137d1ffd4523	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422450857"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28
PID 1948 wrote to memory of 2664	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\630ca38899bc38c195b6083248ba1852_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8335fb2a7b7720bf5a374468cf0408b8

SHA1
5bbf6cc987ccc022796b9723fe281affd657dfc8

SHA256
87f3e24246097b288b477cbb431bc19d5fc572369f7628fe1e79dbf686533b3e

SHA512
994605657811c5ce253a1bb4be0e1e22423cfc7ddc92b98b63f0acdf5f988e1fa74abb4aeaf5e46cae7969bf66bce90a8c4a073a10c30e1a62e528152b915bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0ff8d7a8a80dd7e6c937aba757cd126

SHA1
27bb0dd0995e8308e3e37d127baddfbf77352e85

SHA256
43d7ae4800b75d277dba2eb803b2cda698633dc3e5ed9a9f30e475e707505f06

SHA512
614d4a45cd00ba193c4976dd90b3195c322b2a3280b57d99f8eb6ebf8855028eb56439c7dbd2355efa7ff0d18cea8240b56031dea27e5549c3e762878c711367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f1ee8fc627d1b516b5d08d6dfc429d9

SHA1
b047d2e73f0831e7cddfd990bd557e9c77c60fee

SHA256
3b3e37891dbd5967d2aa2b102cf47931b4c1fd04a3e5b6914897ed69614beda5

SHA512
5da4b7e7bfba94bd74b490e623a04d301245c519af7101002150964135d3aa498f1a65958b87e7bab3989906ee6f73fd2ed148ea8b98be82ce56e6eff058b481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760487a0da42afb65fbff6c5f15240b1

SHA1
fa9592119db0293fc7ca565120f44a9c91670011

SHA256
1b1fd8fb4fa2e75e9938a56606940650f9ecd6ef8b0cf76bb6a3fb9ce9f08a92

SHA512
d32699a3b661d066ce8bc873e9dfc7d27376eef0b3fa0ded018bff2d22f07f640983bb408ce46faaff78079936d9d4669257d0d0202b821b6141ee51e57f9782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43f52bbcd7463f641262ae87db68b6e0

SHA1
7baa8af00222ac86a90701540b58386c977df5cc

SHA256
b2215f410550993a4f55c4877810696911d1816dc9772a4aeb7f83cb89634a02

SHA512
5cc555b82bbfad33a56653b60c7ff25543c13be64fc8dc9c84c490ddd53490e1ee3640a649da9d9e8fef7b8235ea30c467bdc69169723d584787a6d398c986a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9abd51caddc8726d6ff7168ba1f6cfff

SHA1
43bb77d11ce7ddef967146f264b05ff67e756b63

SHA256
ffde973264b5c5db48f217d99179082786cced8496cd66d34ff214c5916e3e29

SHA512
ef989752b7aec953fc0bfbfd3fddf55c4b01d7852d7ac5530532f2ff477a0f1f7418121845b4fa59ecead12ae29436f470ddc2931ae439b6d96703b88b32742e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f7d98a402b99f54333f350f79b43d57

SHA1
9d64c8da26200318447511046109402be44d9ab7

SHA256
a8320f879944090849e76652352b00c3d01f7b51b0b383034df09b0d5249197f

SHA512
4e5a556dc6cbd4e5851e28b6fd4aefe3405a91b4d6f0833a8952d0227280a494aed4aab238fc5bf3b9932b9aafc58de938e2487e3ef74eabe388445ee3594f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
874783ffff9511b0031f86fc13af5340

SHA1
2222f502aa6d51f4ed3b7582aa752dde2c85f942

SHA256
c14cf9de43de0f664f221b3125061ed2309598896f8c312806d6827299b41dde

SHA512
9b44ba249420cdc2b5865f612bf6d0b43c62aa40ca93e7d576fa2c7d5ef33164ef1d4d82b3d22fa065ec38c0e3edc4be1e23cdf94de7de78e43b533458408b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9585bcec7ad9a202d5b2159e3188341

SHA1
0f453d6503db8e88bfda9b06b774e132633cfb96

SHA256
16637b6e41494c746e4348c6cf18f94e1704abadc4add6ee792144d367f7b672

SHA512
1e70989a01f6693c40fee8a8f4deb758ffeea3152fb8724519db8376c5f87cdc34ee32de843f4591624dbac6d5212a9eed3400240d73e3a278a98f1913aec326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01f8739d84068c4066fca5aa2d18dad7

SHA1
da2b0feeac6b60eb97d2309423ba4f0c965bbe27

SHA256
22f8ca915abb5da152fba874eb933382a8a194fb7c192f227f2ca76613990252

SHA512
cc5b840244237c5c078c5a881d7a98aa304bff8e65979f6c8aec55540ac671d5b41f3c98cf29d8ae3aa88c3fb44d5a7bd6c116dc137517bc7c103e7ba9b9b8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25f49ee7efbe4b88f32cc946f1517f61

SHA1
254da222d290df78784ca5a2f0e1ae84453be994

SHA256
4de8aa0434217dc03eaba51ad8d5007ea8e0ec728a42653115d5628b29c9c59e

SHA512
0d59c08a03e8b2954dd95b8feb4e98762a5103e0d57c95cec736bc57b80a36af6ed07caa5f66fc765914beec1ffabc019699f66b4ed106dc9407e28f1be10072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81adb371cc00bc55b93adde3e5c983d5

SHA1
f36a84a1794973675515cc5328e485cbac1a60a3

SHA256
ffb9629645ce8598147d6d57e203c2a0036505658b85d37af927b0e57f9cb080

SHA512
cc8e156127568c8c8cc9c801b2780daa0be283b11358a9ffe05cbd81f5745786d99fee083c841832d9e17cdd7dd5a193b2b5d295527397d3aec8ac97f88e6b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ff5de432d84549f1bd14a79b8acc9ed

SHA1
ae9a67741008ae81be02cf795f3a1fa5cdb092eb

SHA256
e9fad9e5ca472e7aae1dbf8db864457b4559871ea4c849dddb1440234842883e

SHA512
f07f4a2f9deff3b5524dc73e4e75ad7b12b63325a4e5e403e96c2179d1b7a0c7136567b9ff9f402958f1a6b63d48df5f848aabba4449200afc52411cd539edb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be970ce244a2f9234cc486548a19a1d

SHA1
583677ac185c42d1f323cec40f04daa718a61689

SHA256
12c572d090f783539c9252bc30d6dbe8adca7dbbdc4772dfe527a59ecc08c666

SHA512
1f989c2db65242269a27bd7790a768114f3f39557b42aab7472a3a82419cc588688b2a10788b918b94b84215452706346f868429c4d786a6afc7f3ba11938c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A00.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2AF1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit