d743654886ded0583c0e1507615ebddd1b8a5fc3bc2a867d819d66a21e59be79

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d98952b65253d693603ed606b40513_JaffaCakes118.html
Size

213KB
MD5

65d98952b65253d693603ed606b40513
SHA1

e4d19f3b87effcb0a2e9fffd920f7b5e581f6229
SHA256

d743654886ded0583c0e1507615ebddd1b8a5fc3bc2a867d819d66a21e59be79
SHA512

17063ee0e4b95fdde12b1f876d28cc60237e02ed18e576a45088444e8dbecf8361f89c9f0436d734164c54feab5ff534d99f7d417069c42a88f125957de789c9
SSDEEP

3072:S31WTSlF9bZjyfkMY+BES09JXAnyrZalI+YQ:S3ZrGsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CFF75C1-17EB-11EF-91AC-F2A35BA0AE8D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422510271"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2844 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2844 iexplore.exe
2844 iexplore.exe
2600 IEXPLORE.EXE
2600 IEXPLORE.EXE
2600 IEXPLORE.EXE
2600 IEXPLORE.EXE

pid	process
2844	iexplore.exe

pid	process
2844	iexplore.exe
2844	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2844 wrote to memory of 2600	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2600	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2600	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2600	2844	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65d98952b65253d693603ed606b40513_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ac62153fed0fada9605e4815ee895b0

SHA1
15a9774bb389fc7a57185f8c2cf3a304394f32c7

SHA256
e8dfe45c944d80dbc284c7a4e019a67221b09b92eccd8022f2ad1b3e48a9bec6

SHA512
e3d19a9ede074b63b917d9804ddb1efd83658469ec03a3dfe30635dd56758576ba7be68eb2d5b6fb31d73e852aa914b7f95b0e8ed02ace07a4bd7321fd0e3c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb62598c50d4e81b07881e266b5a6950

SHA1
c015eaa5726fed0e8fd49d9ad8206944aaa30f43

SHA256
1457900ddca5cb1c798edc35931f96de8d33c44ff51cae9998f97984080e2ea0

SHA512
50aabad4e74c2dfe54301d4d057d9996e913b6745a1958d31c6135f984366c059c16105d909db7fb5c764b42b6d82b507e15222d9ccb6844a1d500d2f8b62ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a788589b6f74379e6dfcad04bda9654f

SHA1
a69ce9cd4437aeac5a30b22c961ce2ec6619afc7

SHA256
843bd849a772796c5cda54e46274d1c716861f514894963f973bef4f109a860f

SHA512
93d481cffbc52575d0b051556117c1c34ee1ecfc286e32ddb06d8b3d5487042ecf671b95722f8f53e4a5dc895ca6bfe244c64b01a7a1e27ecaf9265ab3f93cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0740a048a4c49385c427eebc5b49928

SHA1
51dc3c4a6016896d1ee86382f0032408ae4af19d

SHA256
ce4434ff18c8c19d17f4b7f630d145f7093c58ea4d48c517029a99c8300ee23b

SHA512
682275d29dfb3b8c3793a0c2e46c7a2be6ce34c97b38d2b211e2642502f09a310732b70c8a62843a4af79efef8baf2e41d1642900632c11937dcf3504824e2bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b5d669bbc21449d831f00ea4bcd583c

SHA1
e836061ef3acad29aa171a3c7309ca6086010416

SHA256
06a98fa47f7ea6c11d0d997b921e5a7fea49ddb7219d1872b06934a8895482f9

SHA512
ec422fe9f6271a2244418d3e0315f820492e65595e9b0805216b6a3c64768a527f0806beb82d107368fcdcb38c9b620e95d4ebb11fb052ff0e11c4eb80378136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7652128e0422c6bf8ef719a84b8d8f

SHA1
cd01a4dba0fee42a8218fe16b948ac3996dffbfc

SHA256
7c9893c2cc26c0f38b69d5010b8d9a7ba0e4e2a28e93dd970ae02962469332e5

SHA512
638473b2e38762b723127fc0585d5ce6ff8aab245a3ee77c72624a642c373c391475a4e342ace3b186b1f72b574727691d3b699f7d13611f99fcb5d72c50e891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
764578af7a80997e1ced5ea20c818a2e

SHA1
ab5a21f84be45dd160fbdb24529de14adeb1f5f7

SHA256
9bc394ea85b7c0a06ce3f894f410f68f91738c4e7cf3e26883a31d47ba5268ef

SHA512
fedcfd902b1b05c489de6bc0fe9a8bf2944bb394ce14c90d73bded799eb465dd1f80d89327a20de713f2b1ba9aca24110366d57942b2e7186cdf09618b33c3c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ce7b12ba11db6219afbcf8662f06e61

SHA1
b66e41ce3920e67756d77f750f84c844d0d1f79c

SHA256
2b3e9d9a278d1191f1240000e807d1d35c5688f72ad387fbda2afeccf4f28025

SHA512
406af400f63244a13fb6866d4e5a99ef8a8b49d548011d6b2e2f3b6a916a988556e79fac23bea85cb4325f74da18d07b814ea13bdbcd4734379515a756758a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a56272367f4966b64b944191dbdecbbd

SHA1
2e28755d40c7bc45ba6fda8713bcd333753abeef

SHA256
6876d45b9768493464d2f7f195032bfaf80ca75a2e3b8344e717168c23d0ee73

SHA512
24b6ad69f2e7618949341c5740cbc86c0f6796c704f0ddcb04010c568f3104da1e0890b6bfc93fc970106e0791a2700056bc8c6140cb7125779379376a44b241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e6ba089969663fc8988d82ad2670df

SHA1
0f0153fbb4e4faf671dd994f44b0599123a8f9fe

SHA256
c4f0406141081bd78437ecbe93ad489fee399cd483dd11aa621faa76b8858691

SHA512
8e0b8ada8554bf73a8c2c8732ecc29edc72be674ae15ef3ff85d0537e87cb3dbb7b0125b617b5781ee56779615e9cca7835586eb3a6d1fa64d23f67db0386f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77147e986f1aa3ba9e726ad088f88a67

SHA1
4694afb535f79b8ea6cb7982617c85530da2874e

SHA256
597ed0bc554c374227552a8ed81b2486b357fbacfa8696a2a877a3984fa74a92

SHA512
c40993680d2f17c86185882808fc43cbf1238f18fbee6b868ae2b30c8ad8ed62fcf12e9334eb659c2cfc4bbace1c8c7ec06c63e703b4e5065ada4e119c660f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c48ba2493bdc92381bab1895e40b38a

SHA1
21fa82b3b480e3a6c28282341048542e17c5c02d

SHA256
3ba57055718ea3bd12b0dad0abf9c43ad4f68b4b11f228839ff2a43b3745e83c

SHA512
d8768b048b4e06e8ca50009829c5ef6bcfbebefd62cf66eee2df4eae93e7fd56e488a34dcda0a979b190f82766082775cc606e482371c1b85e9e58cabcd7776f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e535de0550ae295a749f4481fba8ecfe

SHA1
3fb892a0abf8f1fee3d1ecbfc66ecc8eecd98b76

SHA256
8903761decbbec6b26f03c582b3d231c175f6ad0df5f7f344d1acb3a608d1c68

SHA512
03cbdd40868c915e8b9fb2b493c2ec692adc19f34045de47836ac79951877f019f97d19e9df301d51ff9683c37da5165626a648ad0c650751b36300355ea9fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ee1b861a72ea4423085ce2390833a5

SHA1
1dff88e9d60452aa4c34edeea0d78058c5d3d9af

SHA256
522fc1d7c06ebf265992b232f831566893326c581d74ab4e810b9ab7c54f4c65

SHA512
27331500c549351a27ccc00228bf6def56359a644b18b81f2f5b71a9ff304d5ee507ee6be9e3910ecb2893b8e269309a563df1fa02445ec00d1a544a81944752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca66fa5350683a16537be86897e2db35

SHA1
f4994de39f473b9e19ec9a56aa67fd95e83023a4

SHA256
cef376af0420203f6389809b079fd3952df6d23fa3479554ce1e0c3f137c7fa6

SHA512
26912341b31fff325ba7a58cf01ad9dbe7a29f0da8ab7610a44f2fab553dd8d8892322b48769a9be16ec186cfc80d779a1f74eaf9c2abd709fc02c85a6c3b1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd5b8d726b2f77307f9f9d3ef868c628

SHA1
82721cfeefabb4507a997730cd3d665ea35f4c99

SHA256
b083c92bb5f4f7826f46f2f874952ce4dd120f5d87b9708a3db08bfff7932666

SHA512
5eec5abe0bd2f1ccbfe028028fc2f0dccd1fe5a209b05de4fcc7f83b8e3645d2e3f73595ca90ad034624e66aaa8ccbdb1e585d7d593abd511b27de63ecde15b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614fde7184ddcd2c83383642a3e01286

SHA1
f39b1d964c88d7e92c6e385669eefcbfe764ba47

SHA256
acda95c0a6a862b2922e8bf15a238d83134a81ec10ae9964e0e9118c38f335f2

SHA512
751536d590e6b187c22862c72460050a1106dfd54908847fd3ced6a4efc9d4f541f21dfbdb392b9be7288ae6e4a5f3043d876159d5d50801a014aacea9b99c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e0025794b28872f887fc47efbcbb454

SHA1
e450d988ca1f55f226a4bf7fa3c28d33720a30a6

SHA256
7be0aab0af3ef825d9999c7b36352351ace249d763dba2136451352744c4a123

SHA512
5700175bab72c4650272b67e8b8620b9b9024e7165958c7b8e4b96eeff023bf817224763e9b2510746564e1bcd8c242b88845d884eda670f6fcdeff883081749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bc995b797b8b73d36e811ef86c38af5

SHA1
8daa5955546f53f0082915a10881252ad46f9128

SHA256
637450c5ea1cb7d1f929657f9263e49107f00c9259cfc7f71756f473b4c006ce

SHA512
b4baa868d5fdc2f0527924e73bd5e9e933d509f72a17dc64eb2cbbd252e77fe723fafd2b8bd69a3c4c5ea3643d9a9d0d2ea48d5c466052ce20220f5fe5ca8f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B02.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B43.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit