d7afa3d60a661b22818f89517677e80cb75c7866fb8c438596f0c9b6e3d5b79f

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

677e90786ab71d595f614258e0560101_JaffaCakes118.html
Size

6KB
MD5

677e90786ab71d595f614258e0560101
SHA1

d730537c91bd3f8cc9915520f8577dce644f0cf2
SHA256

d7afa3d60a661b22818f89517677e80cb75c7866fb8c438596f0c9b6e3d5b79f
SHA512

33c69d546ba3602228be0ada4549c528c2576daacdf1231de62b2ea18dffa3d41fab4a53b6030530f351dc91e18e0e5f4efb595a0f8fe8c8b04f18e28e7909de
SSDEEP

96:FghM3sHfpR07aafsyLBLQGDHWhWJEUFMa:2hM32XyLBcGbWot

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{139E5611-1843-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000023a4a9806eb24f3048b35146ff1d05d7c5a45d27fa7b6882f2be18b5710be9cd000000000e800000000200002000000039145ec71127d7d98ad9804d658b8530da8bc3e56557edbe6d48d0e7423baf8b200000003c5d550f6dc2453a45c67a87d4ba56fb2045323bdd3e5d23ef1694166679415e4000000067421b5bcb7528052998795d463742cef0e77facdc71af2590da6af3657437d311d93625519cdd5c4bac9cafacb572e7ada21dc51e840648d31320f87f516422	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000004d0fce419a1a4434f4f46c186d7a5c489ebe0d08739b478ea43c950ea62cd00f000000000e8000000002000020000000b5e371e0337c5e8b225ce9f32c872a050a31007bfddf3a603333ee7f8708abad90000000a92e7fefcb682e1ac8455735bd9de49e680cd8223f081e9da21ecef12cbc0c064416395c1d8481c9ebca9350f5226748df3c13564fe06c69c52a4460ed92d9b7216f57656d81979be22bb50f2bea8540199db20d91a611265f000ec2bc66dfde42d51548fb4917fc2a3d744aa6a11d9a84b4438a5863aa636eae163abc4a938e57432e9660ac7ed41975d1d1451959bb40000000d078995c605b179aa270f25d21060889d71f24b4634bc7e95eb05b5fb213ffe178ba6571015b6de86ae623d63e0a09a4e256602512b093d5fad93a8ecc8b9d81	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422548051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c414e84facda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1872	1688	iexplore.exe	28
PID 1688 wrote to memory of 1872	1688	iexplore.exe	28
PID 1688 wrote to memory of 1872	1688	iexplore.exe	28
PID 1688 wrote to memory of 1872	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\677e90786ab71d595f614258e0560101_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c4f0f335574cd632aa634e8c3968ef4

SHA1
e4da41dc5c4e7ebd1749abe85f64be2382cff311

SHA256
2c64bf268489c9dededae320ec219b92c018d7dc3834db9909de1530072c004f

SHA512
9777ce4bf74e4e1ffe6abf02f80ac46b603c2ce927f6393415a82276c2b1949a1a488a897ccd81800fa5b9cfa88b19d09f6f688ce6e28bf3c8963fda4a493672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e25b484b7c9a8ef44616fcbedfef4c

SHA1
df832098d01b178af673aa342d4d7029e481b152

SHA256
7e2bb6cc9ab85262b32a62e9dc823231a339d8aa8276dcfd5d342b296129c501

SHA512
0b08e20a9b85749722bceb74045346a396a1725786c5582d8876be89c2e6adfc97d48185f85e474c9ee6f9708b9a42aa03e6a21ad7d3e518f3d25f447b3439da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43e23508ba45985c44647bf25c0ca5c

SHA1
d16af55f2eac6261308a43ed67de05d82d0515c4

SHA256
3e56373a2053d60cddb9288a8170699f500c89a102fe68ba63ed1665ffcb7b7b

SHA512
96f127516c1335041036022bd2e1f083626328d835b9a990c1af06512331eb2614a5a1cd4626084754a5336fe02b93b0de0e76e2d6678d4b45cf2e2e853de4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e31e74757b407e5b28bec63dd71f65

SHA1
8a374da3a9e1b9d636a5c29366b7802a1579bbd8

SHA256
aa56409fc8ec03bdcfbb9fff32a2adca814e2184113ac9c131dfba871374ae89

SHA512
a0e3f6576dc1cea385e13437f291b6da349ebf9f60a0b1b6f7a0e86e8b25764bbfe28e14674607e664932cbc035725fd0c9d714eaabb3cabd1efbd8d9cc0fcae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc869234107d4ee6cf271185a89a0b8c

SHA1
cd097ce8745eed866e05eb0b22fc536250d171f6

SHA256
6d6b05e575d81c454ca87ff8ec2beab5b6460a25e41627638f4d2e36cd69f63f

SHA512
f71ee0552fc0133c00130e74fe7ffd677ac72bdc5f1ade872bea4195467606426bb466e6bf698c045b62f7b650e0fc370e4aaa5bbe94a013dbe662d863cb3f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2d4757ae43457fcecc053cc3b289c7

SHA1
576b7273d56f36d9fe1263f5df4b9dd7a6b4090d

SHA256
5c7a90ebf6660d2aba45fc708bcc135d2139f5d3c828ba72c20d55bfedc7f510

SHA512
b709fafaebe841c3437fb0cd01aa7c9f23bd5e085251f4bbf60900d96af8ee4b83c3d946a0835b89ec70b6cacdd132f94a26cd32819794d0c5502b7445da79c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13186fb3baa5e9acbb1cf187dfcd66cb

SHA1
716ec8eeb4fdf88eac8c7b817dd0c7703bcdda18

SHA256
da5d8ad883665a5fe62ee30503cd0812b1e518ca5fee3d534b427270316bb3a3

SHA512
39f88d612e2c2f61f7bcc9ec336d612bdc6d7a92f6f87b58677344119719f51f4d7f22d60f555c1863b0412a2ce4d86fefa55c4cbd455d669b6fbee8699786e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f86ebb56069d7b2d5fd11358628c5e

SHA1
81310fafec23cf41f021cafb081f94030f9a6e54

SHA256
466577ab349857705318058fe290a8157f6bfa83493cae51e5ed82e08ee0991d

SHA512
c4c040ff9b64b0d4aa3ec01cb247654c23f2a25fa18df38d9fc505b944e91cab2e7b594ff1c6c07459c0a81e55a96bd5c86afba577b869f23707780569699fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78d382d0e5caba8bf0d7b1194fd0548d

SHA1
ae2f7e4119b980ecd19e7f533f089578840e5445

SHA256
3bbb8a7a06414dc17a8e8cdd1b914eed15045d960c4d9121ec9cebc65f0831c2

SHA512
a9073bc2d9c7cf6dc2cc464b32cc280f95cb97e34c481e4016c7e6fa3a9f076cd5ffd1c600fc029a2e0b1f7682c0e5635ff9156e1a9d702a8fdf32cb0c26a57f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ff942d5c33787ca0f55e6316c2f9938

SHA1
bbf7c4c1f326490594c55ecfa8f79ac77b44eed5

SHA256
c02c5c4792cca3220fc226ba8c548b6f81f623cdde33f4f4b2207493c9497ab0

SHA512
e9f0ba9cd366b05aa02e23b18d83dfee0e49a6decf15d1589d47bf80ada3203edcb5eb1e9466080a41a92d93d2b65ec0bfb310d3f20cd6969be6c547069ad3e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e003b4180dd811f20a0f1c47c58b4a

SHA1
a45c17351837f8973ce0f40651450e402a3ead64

SHA256
9b978be062acdc953cd63451bd2847dcc00917fd0ed3beddbc7ff32dcbd92628

SHA512
ea809aa592fb53cba8d035a68205266cd947a009b17919c8750c53a169847a180d70481e22074bfdeca38d77619a08221a5909766bc0b7209ea0935804eb453c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4323d9b96fe807be9cc28333100019e9

SHA1
33598c74cf8d9ef8112bd1b12ebf97b47c95a5c3

SHA256
08b9f050adb6c11b2587ca9ed8fe2f66d29641663fcb32914a9b04294879e9af

SHA512
3f531257386dcc68d3abae637e440d56615777ca34a49128c5cf92859d6b09274e7fb2b75dad5c8233ff3df76db1b4b78d24cc5cec13fa98ab7d0a82220628b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da5bd4d93113805476b21f280bc5e703

SHA1
d47c70559c32f051b26d75b185317cab6b89fc82

SHA256
967014e866140e7131c5e15af493b69d8be151d7b94a25ac4eda94c1bafb7ecf

SHA512
ca9e3293c9e2dab4deb66cf050baefbc4e5b7252893461f9ff5a936c30281f7cfc1c6c0a98fe4727f5dfb546fcf94451f9dc21b35bb1f73cf7ff995344dcece2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
373e5f9115caf778ee32a10c498b63fa

SHA1
9df3b99a9189097c1a3dd77cf25fbda1e0357ee6

SHA256
f5c73bc021da85632b45e5146410661c796e6ec749ed0e30c42fa5d271765325

SHA512
56a2b6c2e1c5010177a567c9546cfe9f16a56a2a1850af8618521496efdb2a3ec354b5251b4dba896dcf04992167e22c74e51becf8154f64dea55289fb42907b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9b27e4095166a974ed3ac1e1dbebed8

SHA1
43de937a09dddfc8dbda983d7e1c484f1205a447

SHA256
fd47e6e972c4c38ae054039fefba45a10da52ed210de99defec72cfac488e7e6

SHA512
d97b7fdc1319a19dc4b5a66c82233d7c3f63ef0ff49d48b5e781ce11984e1197a1dbeaf2c3b475670b5e7e51e0a58f09e9ed20c36e3f6c6db3bbb14b5f3e333c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cf5ff62de18da1983ba0d37fe06396e

SHA1
9e7ea55aa9c6b24bb781f5af0ce9ce0b58cf9495

SHA256
0e8e1b5338e04da1a6111c736a424f0548071ae74d2bb15b74ddbb28a967f4fd

SHA512
2ccca112409b18a4abc64bb09209494dd0788dc370ed8b9d05ffc2611c2c00595d8b2a2bc7238309b4cd1bbba432da19d6cd0f31986aa8d6394b5cae85b4498c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47CC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar481E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit