b987152931756f2572379d8b93536a1ab277d6f97a0f06a5584479b75a8def3e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65678fc3a7354a797aecde6345666334_JaffaCakes118.html
Size

462KB
MD5

65678fc3a7354a797aecde6345666334
SHA1

233dddd2ff836e21efd9d068878fc0c376b6ecbf
SHA256

b987152931756f2572379d8b93536a1ab277d6f97a0f06a5584479b75a8def3e
SHA512

a2bc0599d2543a5a70ed6c378810c587a4dbc42efba29d246c5f7bcac13931736f4a3361c88b7e17e72a8bab9097bf2220c6014a2c796290eb95e6364474e027
SSDEEP

6144:SssMYod+X3oI+Y+sMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:X5d+X3e5d+X3+5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBE94A01-17D4-11EF-A233-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001ca8d429fe8fad89f294bb10cf479c5aadeea37336be008def9b0d8d70b53350000000000e8000000002000020000000694e2cd3f6c0e743f7029cbd6f1a4766d6adbd351472cb961b0b7bc43e3782e020000000c2cd0a3222b25fa3f7c4e569cc09913d73b022375684e64877a8fb06fae4021540000000ba7dce1334a1f6264ac5993dd8c9e1ce08353e54dd2bfc367f845213c298a9aca0322d602f977dde3edb5073ded170bc9b235beb076b964bc63b20939cf69b3f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000be0d645c9bc53b219f25de017b1b814e5f4831eb618a9a48bbe3b0fa1f313a92000000000e80000000020000200000006ddcbeb4f42daf7379c16a4047bd48dd317a5c6e1563d276a69037a49948c72890000000da22cede2549f581ed280cdc644cf42a405eb17c3fc764a5b813ccec9671410035a8e3c6a90a0a6ab227a8496b7c7d5a8cd198d16e5b22bf2c80c8cb0d3fcdc32cb9b4e1d700b2891b4ff347dd707c6464c6fbe1b7528f1376072366755345d6895096be2c71a549affa18e79f2a3deaafc2cdb48115e7e4862b31c51bbeec8662a18ac83921b996a6049df464bc49b240000000285f56c2c5435ff3dcf88533a227f12688c1c443aff6645d79c602f8be2578530070e1ae4e6d74a8136a0d85aa1f2d2eb5da571131f833089ecce34871850892	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03770a4e1abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422500686"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1300	iexplore.exe
1300	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1708	1300	iexplore.exe	28
PID 1300 wrote to memory of 1708	1300	iexplore.exe	28
PID 1300 wrote to memory of 1708	1300	iexplore.exe	28
PID 1300 wrote to memory of 1708	1300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65678fc3a7354a797aecde6345666334_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82a749d859c99a9bf80805b64fb5187d

SHA1
a56e3e2093464f51cc0b5aa896c560ac7c57da29

SHA256
17b10acee26df9448dd136eccdcede586d860a1cb0ab91898b5e178e165baae2

SHA512
29c2a6bec98d4129ca9fd1d84fa5cf59a9779e3a14ed6046e0a1bb5e57d74c754dbd4fa50c833ea6c9e24fa855c97bd2a8f26b5f439d0b3e79297bd7173ba9c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc2f9148895fc3152842d92bf666c2e4

SHA1
169edfee1a48d3919f4628f7fa91eab1e8a6b93a

SHA256
8acdf8a1280bc97da231f8ac99c34c7730831d9d3e5adfb7a236e1ceae26334e

SHA512
fc2d1158d20aac734306af7eb5d35f30a7ac9de6ea7aa200fa6d172e2c9b014293742fd5dd7aa8b4956882485a1c9c01291cce723dd4ab3c8f0d820370e0d16d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da8d3f6d7fe369abea8f2526f1796c4

SHA1
ee665617342835fc437eac19f4a9a88b86907a6f

SHA256
7de4dd3f56f9b83148d525f1d951b71c541a4a5924fe0ecd31b140e2a8cfc809

SHA512
4c621488001b67a961ba00b683f9ba2f3febe12c44fe62ca4f9bb9ef41dfdcf338f2e948dd28fd9de0011f88441c81e735c962537598d00bf8da0bc1cf0e832a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace31973c6928062e48024a23381208d

SHA1
b99da3fa4f8266e5c642ad0044df49e37f89c99c

SHA256
650e3eee6a675c692efb7a64027df7e360e5b1c46e7602e034b8b3d20420ab5b

SHA512
3ba3c7704530ed30d54702c8692927d0341d373ec61dd552618bbaac98f2c61568dac52726a34585250fd14cf555162b13b8401a46b4cbf5920a9413a87ddd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86100b3cb8f9b064468a5d2203a6e48a

SHA1
492701ead13f1a3043a4a1c05c36f37921815794

SHA256
bb72f1b63746882bc4b10350dc2b697dd24acb367f17fe703833b472f5c9d11d

SHA512
3ff3744b0e14ce021ce7b8216118cf5a32ad60d7aa8b04fa6ec8aebb3dc25cd1e14b6d209e8e72606ff5433b2cee7cb13339f8484d4d5dcb7e123c170eeb12cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c839380f8dca2e243943a849d5e43919

SHA1
5fce49b4e58d5d48e86ef017883d102414328b1f

SHA256
9048b8fe01c75b022c476061db3a75bfbfba17992871e2c96aaed4543ce35391

SHA512
c92010f68f5801135e183af1a28fb48eafd36916e4f45ab679f31a2aca62f466b6df4c2c50e2779c9bcd6775d7383984bca16aea19de3948b12255fafcf65fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc5104df12b6fe855bd68e0784097d70

SHA1
2db9f5ec25f96f4660ff0a12373e73dc751ca4f6

SHA256
a8b5d26c40dc135d20cf56a2868a96ef5e1dedccbb1df97de3f7429fb7b979d6

SHA512
dd188ec14f3fe54b11e0652e7203e9de546d748f7eb02198586ba34f610b92e445d6f954c237398de237bbde31dfd3b5d880a47f68471aeee5b9a0ab83a7c03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5500ac10bbc46de9cf6d2dba2cf2d548

SHA1
d98d5de29457c72514e926fc0df48612b7b2055c

SHA256
c0adea4b4d928e0e292b623963f3e53959f405fe6257f1091345c43dce8d246e

SHA512
cc592f7def2c7bcd0675f2f619558c94f4f431e3e43d00b92e7f9259d7a0e74b1b1bbc35ab9babd127c6d1764ed3e8bbb07de5f118ac8ed63e7ba4e05f55f349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65fd956c05e878127c75522c092369ef

SHA1
b63365687eac86342e0d2af8c87f58266aaf8680

SHA256
5467824415462471b3b1bce1759085ceefe7bfba6173f767aaa5f76d1cad2583

SHA512
5a4ba57d9be1acd8cb0e7e4886b791f20ff762444f4a09a738319dc5967234a5841e501797af8699b336f94a58b1dcffc5d85845f26bcc72488308b2cf4cf6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81a34d3a1aa1c50f45665e617f0ac5a4

SHA1
d031517847b12f7ca68fbe62b97c24f2b89747b2

SHA256
a7d8414b0396b4cd9cc62bd6b33aa2651352dcaf52f11229fabacc7ebe8acb0c

SHA512
58ec1c735cba1290be45f4b96fe2adc8abe53d91e5cbc17b1137b3064519a707d6273ec50cae78dd9141f21a76674199466d7cc9abfd6cf9679a25cf1fc8c1b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e21fdb467f91dbdcfd8f29f64e63349

SHA1
614f82f7e3f59342a85dc4132f0d0ba67f5a02f5

SHA256
82d322d22aaec9c7335d584f49f0531abf9ee8a7779a0583219ed627aadcb999

SHA512
b09422ad1d660525cc103dc741e39721d2d16692e90ba69c90815d52e44b7d386a1ec16dc80a305636a15f8cd26f4a841ce664eb1657dedd151d32369a193eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf75eb1c8bca266f1f4f1cbda5a5b04a

SHA1
ef04ddfe4cd156afe714dabc08af445df774b233

SHA256
94df8a40cfd41b3fe7f740f8b93e9a38e5c4825e7007c0d2dc71cdcc14872d6a

SHA512
0f1a58c9c9358bd7b64a773ee4dfe57afc1fbad67e7987d204c346800dbe81b2198f90f28083645605c62724d1ae22dfe67237c77c7131fad5690f8be166a4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6449e7e073921e4d510b29ecce3ae1a

SHA1
e14aaeeec8be7baf24d11df961021e3df2dd9b68

SHA256
21d0aa8d592581e996b7a75f7e929bd0ded585af02b2d7e34a7c968b8f5bf2ea

SHA512
1f5af070d747f7e6365ee2cd7a02b7372d46122b20cae432dd642ba5570077e50c98c355d76ce85443aaf996034b75092e09e884516dc000c3605e7c31781af9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
286762a8ef9dc15e32a96056774efb3b

SHA1
5c37a71560e55de91e19963d681f5a9d73604aab

SHA256
69fc4faabc20bc198a328c25299050c322fa9d5bc3b73ac93db0a024fddab968

SHA512
87c5d54b944f197c5a7e2b4f8a42cce5a1fe8ca1b12afb25a8b42c37f92e261f7590ae01bcfc69cf070b4ee13d10485811b7e294103e1031dc966bcb439ecaa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
194ad29ff7dd49bb0439ae3599c8bd97

SHA1
e7496b13bfcd604d2f59cf519576e2ada9594ef2

SHA256
6d1fd95b51cb67949b51608af885f3c0ed49cb6e30ac245e6cd5516ad1578fde

SHA512
937e5038271bb8684793d1916100e387612fc3bb32c9e00b2adce6dee72bb8f200e104c44318170bee28fb40019e73f3527b3efbaf6d1df91791ce8db3240b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d60b1e5466873cdb7c81c5e421d56d6

SHA1
c02c5771d93a2e670191e8ed924b9ae1bb06259f

SHA256
5810a22084ba09ed016eaed20d681d977fdce79464b7ecde1bc42d36ddf4b6aa

SHA512
ab64980cf1e46c0869ca23b208bc26f77cf090cb4162ac12cde150ec02992a0ba3fdd4d5e19889022752c3647e97555c29a147be99cf38cf7cc441ec97a863d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b83161ea2d75085c1c24bc6ba2887e63

SHA1
3d9dc7041928b0ebb5727b3bf22a833cafb8e5fb

SHA256
9a763adf9fe7fc98962cc528defc9bfe43f0c568773ff35cf8086043a08fb251

SHA512
821d09ba2debbeb60c360df23729807c645c7dd72ac2750a2f8f46d15b5147575da5481d3d032bba1d8b45b5f476a320e0bca53f4bad90e0c0b5e8231653f9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E29.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E8A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit