a3958ae73c24cf9c33c190634454056321ca9795515b32890eec97134749973e

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64ceef8aa90d6fd2bf4fcf0b600ac221_JaffaCakes118.html
Size

68KB
MD5

64ceef8aa90d6fd2bf4fcf0b600ac221
SHA1

7a250d0ec9c3773a3992b918f887e28ad9a5fdc1
SHA256

a3958ae73c24cf9c33c190634454056321ca9795515b32890eec97134749973e
SHA512

d670d8bf7a960c4641f59ec19390778f5e71e5ea95ad3b3349852c3b125265c5f3df9d8e43350a9fa7b43ba22bf8a8855264f31b58064a34161eb8216a3a493b
SSDEEP

768:JibgcMWR3sI2PDDnd0g6Lw+s/xoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVGN:Jl8TSNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000044c3895a0f92b08292f548bb1a24f6b77fe759b8948019001a65ea24ef55c794000000000e8000000002000020000000776d5281b2510f42b871c974050cf23a98daa78600d9f7fc36057dec15f7ae9d20000000bbb09347b685cdc1e29e4c8418e6ac8472813bca4bcebd9e90da99f73ea5da5240000000ed933942219e034f2f68542ce005bb3b3a97d8d27639708728739f445cccff6227489d8a620c901e7d637fc093d310b3f4830eeb4128cd71df92095d704a4c19	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708c6627c5abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000065600d4cd12893ba63e48a09f62586bfcf624b4c00866063e7db0e24667a4849000000000e8000000002000020000000eaaf3cca736f570d7d4f52a010106ee229aa7b62aba116e70971e2808dca968d9000000047d10cdb2a6a21c3d8185f5bc40a1c4d5c5c9a69159c4148ff0cd23871f3dcce4a4a5c033d3627fe6d8ec46af5c82654ad4019f4312771249f2d777b99fe11f566c5e5686bf1e702be5ef956a9cbd93710f0d6c480143aa8f309aa6579e73773683ad05e892cbf86c6fc638d6a0b6f86d4ea43dc58da359710f545965553c5270287fb990dcbc5acc097fb803511e87f4000000057712eb8622679899a54151baac82e6b0b43985ef7fa2a03eb822531a9b6ec4b0c702df39df8987ef7eb559632c64d01810e86dbcf45d11357aca5b677931216	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5248C201-17B8-11EF-B97B-5630532AF2EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422488457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2184	2212	iexplore.exe	28
PID 2212 wrote to memory of 2184	2212	iexplore.exe	28
PID 2212 wrote to memory of 2184	2212	iexplore.exe	28
PID 2212 wrote to memory of 2184	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64ceef8aa90d6fd2bf4fcf0b600ac221_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaef7cd644dae5945decb13b13b05745

SHA1
79595c3f19c472f1017d84b80ac7dfa0585290b6

SHA256
7bb702503e2a27fb99a004da4a14cc4ad80b123b2dd3d19dfc3a9a556aae0989

SHA512
2ff0f34759868dd6cd04fb005c45aee21c1218a5aa5f78393420de34d38e00c99ae266167c8ba7cf8d1041064ed0dad85dded479d971f18563f116055c77ec56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96186639997fb017793f7bd09753f74e

SHA1
7bcb4477535979a58cc1e1d98b7e6a8afef276e1

SHA256
373cfbd5c13c82b48251bdf067f6d532ff9bc213dbb8106d9514a4657a78ea48

SHA512
a8faf1342ffc1e49ad3ecf32b6488d02d2ec73b8ea75977c2d007bb120dc6065396239ba1f8658d1a97d0e25240435e8c64c6b886a9a27f15b4a9b8152de419c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8aa629bb7fd03a04bfbe0592b047ea2

SHA1
2b9452fd2a2229fdc9b8f7f5414925156719f421

SHA256
83601f00a71f143447f8e6a6348229a6309d70495bc3e7d91a7616bb2d8063dd

SHA512
937e7d710fedde1e791b79652950116d285608a70140c03852b25ee1516fd611035742e9ddc8a294dd5d422e0d931edc89934b88826749ac48043df389a65ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55020243a3c47b0298c390d58d231875

SHA1
01bdf8e53281431adb82fcd7fb30d10d8f696f76

SHA256
655f40a40e480c9db4319dab1e697a68126d76d07fc9dfdd917d9af7f4f5ed93

SHA512
a4fff7d08293b83acde0bc64843d1c4aa02d6fd2c8f06b249b067f26d84a29e0aed9c24002f8364c91c88e76bf081b03ae3ae75fe8166ebf9b1e47e19c2fb6ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bf5598e8bb6ecb864f332485ef1b697

SHA1
7f32afc453248fbb8b59efde0271ee6bc56b7510

SHA256
582d2e3f2e38e3bdf2d8daca0643feafc57a3dcd7e3254e4b8d59f5d06a1f650

SHA512
a03e98b1df7ca1c69c23af6aeaad0872920ad4dae202c69c131e53d2e8d72b2e959be43d6735df5e67f2ca8152bd53c1411fc7507ef5865e9e3953d059fbede8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c5ddf82ff70f4815be6f29f0252473c

SHA1
dacb81397afc69a3c26ffa7db6cf1b85ca728978

SHA256
8d898fde4287849e9167218d75f5e9c1cf062e55e36a16b85a3075b69c160eb8

SHA512
ebe5e67e4629df706ff4022f13c9f25832744809eb44be947181e28446a598a89b790c627ad5a308090f21b0836d97eaab30e720571a288a56e4c4f3af5eeca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e727925e0f2a6bec49adf55d9458659

SHA1
de47b1c1cb1a1373d814df28f30cc5a17e71b7e2

SHA256
bbe91f8c39e9225acf8e09e2f87ad39821e874f67de0466ad32fed88c796c666

SHA512
b516872f51f6a001b3de56421590a0422c873c69ec679df2e3009fb59da56a7b5598fd20a424c64dd0280eb79d2800877dd8fdd89ee282fe71e46c357f3b3185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abbad88a0e068e7d4f40507a0d3e9e0a

SHA1
c34f7bf2887d95a835fd30945f2d32d03fb55a2b

SHA256
6d6c3f00344e7a70069f755552068a19ee8157e96b5671feae33a1287d0c4984

SHA512
389eabf206de28e01eba4ef983534b909acdf521d85478e7d25964d4d44f8f33c788e3e4170464cce77feebea570a3e4e7daf498f14d84115f5ff9d503980da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
405315fcb271f1510e0cfff05a5ba501

SHA1
c473fe01e45f5bc40d3c15d5d6d1f3cc400158ea

SHA256
0a047748c08e540c9323e59d8e86107626338447d250821ea780a32cb7ffaec1

SHA512
1927b1a0fba076ce2cbcb5b3ed333967994530c528eae5ab7e03a9544290ea91cb38638685980c11a42768c043f103f48b16b5211865ce398ae77ef705eaa97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18f44f2b991a5567d96a46b0d7ce2b7

SHA1
72a382396a9b6de30280fb3a0cd81b19544de941

SHA256
f8522b78d7793152bf7d7f3199ae69a5f8c588e13df4af00df365d13558c62e9

SHA512
1b673c1032686124b2d7a8f5f06e07b94455955d8d6ccfd4f71dc5dc7966811cdca4966486b5c912adfba13d7ab863c8e480d16a576f441ef45876e9f59d8bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2c7928bd9ce3ecebf0fb569714256f6

SHA1
81a5964a02eb968618648b40294bf8b8c08b1939

SHA256
3ec49882d72012e5e44275f68ba63fabc3c5ab098cdebcdc397f1fd824d38ff2

SHA512
c9c0ec675464676d5419591fa8b75e4fc92a9b27a567cba176c8810a4193ea6a091b8658c2220b11e319b84dbbd3613038d1e5951d9266bb25bc5f77ab087a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f73cb4e0e8a83a0ce85b5a6db97be2c

SHA1
762d5041a32d961b6f5dfbca0a3280b7a9aaf4c2

SHA256
a08a64e33d274dc2464d9839a0918ad668b1f79fec2c97fd56000ca18d34813b

SHA512
a106b0830ffa201a755ee8176e6c31932304d9012a42c9b8e3fa79737b91749c20c4f90c0ef139518090d25a7f05b8ae89ad6f992654f8ba196f9cd507cd8d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c49196ec359eba706863e9f1bd17273

SHA1
9904f86e9216e0b1e43d49d5b1cc1746a9e9736e

SHA256
75be30a30f57146a7fd099db98fd1341c6fffa03546962f42643409e24f1f086

SHA512
162c70f71870dfde38f769272882ba031408b405277b2e00941b7abdbf6d5cb5911b5461e875f57dbb1d4bd8ffbcf53a898f8c485bbcb21b89c8765c0dc3014e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af8a88be8f4b6f635ab1f10c440a117

SHA1
678fd91701df4e3a44424781eb8c93a6efacf84f

SHA256
bf2f1b06cbe51c0b43bb6eab8f322560b2dd834446d67ff95892ed72c7a6d0d0

SHA512
c139685677355b198b580abfb8c07a2de6cfbbe0e898693e1a5065b6531d1203a1697a8a90db15eaa80eebfb0ff02d0b0e249c492eb705fd5a14033843a256ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9024685561a6cda7ad87dc8935c1503

SHA1
f9f3c814d3093148c12cc6ce6cec027ce5cd23ec

SHA256
716fc053afbaf93f3d5d47d958ae1c2405a8937ad8d912cfacd201fb3bf80cf8

SHA512
8751abaddf7250c0d1f59410cf111faa91ee8e4cde2d7905d1de22b0401af6f1b7df8015199d37a4aeadc96813a822624c7cefd63a387630f3d2bdc5961c3788

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab44AF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4512.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit