528e98e4fc752f6ae7d46cb3b1ca608539594c3aa08686553aaee07dfc6d1541

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6774e7bbaba539977f8984cd53944979_JaffaCakes118.html
Size

36KB
MD5

6774e7bbaba539977f8984cd53944979
SHA1

443a59d74a1b655ba0f7cec18bd832d8feaeeaa8
SHA256

528e98e4fc752f6ae7d46cb3b1ca608539594c3aa08686553aaee07dfc6d1541
SHA512

daeffe92c239de5499ae6155f85a02f83194c3f9db3b4ef8d7369c0ec37f5bf9649ae6dd6e3dac34cc702785d42d4a72331441d60fe13caf8ac55f6b3bedce06
SSDEEP

384:WQ/kpBsH+Iuy89ZNnauV6SB7gqgEs17tPwvBjOo:wpcY5F5s17t4pjZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0AB10181-1841-11EF-BD9C-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000048bc1dde3e592b64888de640e67c38f283ff3b94f45eec3d1a7a006457a3e868000000000e8000000002000020000000a1c519579974a62e96780edd7a1f926f1144137d5e5d95a59a85613f5e2a398b200000004bf72a7fcee5a5e8f2c59f60f85974cca45ad9e45f292e894b4bf930c922601b400000007d021fcbcb1382250a022ada765c893938ada4454c7b78279c5a61c71dfe10adbd18e263889e1707066224ae582d94efa092f46f7f01348ab9f1d6ca2ec0ad06	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d771df4dacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002bed087d546c36cad20c9dda714da511085f08c2563c7cc94e8a6c3685d47b96000000000e8000000002000020000000e2faa4bcc5d1ecef1eae24158e6bfd954ae5358c7180c92b0755cbd2886e1f5f90000000a919f04fb5a2937069150e5b50108c3a3d2e1c01f7b0d141ba4bbd38f05777b55f2d7874dbcdb1e1be956c223548f930d1f15484a13f4af5bb15a56d887b99c28b790b36ca864524b46277ce2f6197878eafdb0274083d0bdd4d4dc196484663fba0bf28e48935268e0d66bdc38dec89b1152fe96a59bef70ccf2c41d95cbbe03a03a14e29dd9644837352333ff3fc8140000000026ceaf93635d188e26bae88ff6e590db74f9264d0fb036656944977e0163e045bb54bc7849cc71ae7792c80edb44fa78cf6607724cfbd31eadb032448fdccb2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422547186"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2096	2932	iexplore.exe	29
PID 2932 wrote to memory of 2096	2932	iexplore.exe	29
PID 2932 wrote to memory of 2096	2932	iexplore.exe	29
PID 2932 wrote to memory of 2096	2932	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6774e7bbaba539977f8984cd53944979_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f2fd7e81f760b5f810e0b813a9150c9

SHA1
6e588bf414fa7cea72c7243b8a6150751f7c997d

SHA256
0072318f436644376979370f33ded3a47cc7d8d23de89ab97df2e0fcdc9dd003

SHA512
043c6f5d2ca7921cd2cf0dde3b08f18765745700348300794d0ff1aeb23206bca38506b31cb6153af80994729c4fdd73ae5de7f3403260bde0e75e567dfc691f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
589386aedd843364e9a46994033253e2

SHA1
e92ca59dc86de07edd6fb11de9955536dee11968

SHA256
a490952b2e0949bae1113aefb6c935ce330ccfb021fde292d68f2a7d12426d67

SHA512
b3457f13400b66381877c5ba3e0d460e728037908a9691e50401b94f403f66360572ad3e950162ccd368fa2ce282bba730e56807f11fbfe8aeb93a879433e2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f361332476699971c0d19757a997c4f6

SHA1
5bd233fba94b6463b7bde8ef1741cd9c8ff3318a

SHA256
6663a19861108404cf8e4678c2384fb17b973ada7f813a6da56570f86a3ba5dd

SHA512
1bd2b84d2311122014e2da3ff933bd0caba64b6f031bca56b7516493689dd6e4b0a2071e40265ff6ec8077b2eb3289943cb16323e704db97450ea15eedc17471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
315b830d454d598e0c2b1ef7ffd6d6ef

SHA1
35c8e72cbbace6f339d8cc65479365f78b04a143

SHA256
45d9941517504bcb4aa696772dc18bde16d67ac7c2dafb60181ec02fb1275a70

SHA512
b20f2ef4511a0be6ae8c57e1031a90fe2892867fce1babcc07b8866874644fbf26ff600190e0f8286acc8838312a6cc6e499c7df556961abe93414549ec1698e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a5cf62cf6c970819b961a72eaf7607

SHA1
a2f652dd8e19704ad987b99ffe70ee3c775b2689

SHA256
c9ba3c1fc7457794a743e338953df66c833dbdc90a3cd71d5d5ac2b4bbcd9e37

SHA512
622b8001acfaf048b4004d9ce0fc52c5e5ce7a996c925612b2a8e354c4ce9c1245ac661c76ad48c0a74f12164aeb96bd8fccac75d07793ce2a64ba87e11a87b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4d3fa4f30276aab32eda0d3a9f1c4c

SHA1
dd6915bd37d89a3a6c229aaca9d631e6dbe49fdd

SHA256
b2362ab97bfda31528fb05db720e3bdb150698279d1dad4d37bbef560d3451e2

SHA512
56878521c6df0b983400460f8a653fdca0eca303c62d2bb43031caae1a61d4c98a51a26777dd6411a5bcab482851b0cdbca7e518511c5febacb62294f6056d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bf404e30dc7ceb798ae5ce5ed1403e8

SHA1
c1715a14b0b956e069b621531250b0c996d0b76d

SHA256
ab1ac44b2db86e9e59ef13bb0e4690a4203f635f0e1ffe790590b264278c5bc6

SHA512
3cd90a2e835e5eff34ba2fece621525b7e162139ca444e7da8215243ea967a63168ee6d09946549d4dd792096902b9c36912aab876755d74ea6217cfd55313f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b8c0a37ea114d29a15b1997960d91f0

SHA1
c5db6be79949a9cfd88b5e71d4e4374a84991924

SHA256
fe4115b08823e9e18250df590fdeeb7d777a59f48453f96b8c322ab1c18ccb75

SHA512
c95c0493513a1192ff187a934d19564b5a7fcddf35a3b8c6dac423e351095c98b218035c1cc289ef3d5606257b7604d5da081a13a10c17ac247738fff4bebd05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e1d5407550c8ca2b0ee0d9cf35b4cec

SHA1
f0ed88b943d9f7696e937c16e73789c5e2bb237b

SHA256
72f5a6c52e5e8513e11c99ab9c4914a4693e71b64d2372b59ab537319b1b4151

SHA512
66c7b2040e82699a699a433e3ad7840d82260ddeccb186112971f61643962d431de8c4ef943e631f799e491c59923d041d2db5c44f0efe2da62f85247d4a23d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ebff579fe538b860684ae4c97a43c8b

SHA1
2e9958d566185ae82d6e54de6cb53efef3a3d5ea

SHA256
09700c39a1e3bb179524a4eaabf9e2adf4c7e52e8af42b956834effa65c4ec29

SHA512
8a312f60675232832a3be9fc3be2e495144728e78abb6e38eaa734ebbfcd67eec6f9eb63e30da9867c85f01adbe4efe5c0aa227b85dc14d5390e87595f7ef152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc1e309007b7ac467df975a615471e3

SHA1
00155783988927266560c1ac205d13c9920e109a

SHA256
a17795a9f56333930a143f1d18a16fff38d5e565cfc50e202c6a3da9ac7310c2

SHA512
19b6809bb476caf1715c51013e267f9da49c9bae829402af642733e629798db6361e27741b4574fefbcc5c55e3338480bfaabeec12b4d4d4eecebfd445ef57da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3673f5ff60d5eacde7f4c012b65334e5

SHA1
bd4b5776bc42a49f0113aca9c9e4fd629275886c

SHA256
d9f8a9eafe61453a819761d19e94d3700c753c9772592052920197111b69d165

SHA512
a2ad5e27b909d345e3027a4f98ceb795fd6d70356885f046d78a3b6cb4f94255fa6c0c710c90d5523504b0c0b0b94a36f88225e2abfdcaca7919e94a2ba23393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e0595299764281a269a5c804c10a71

SHA1
17b8dc99787a8b07fdbace2e1e0b1a9f5df54bb8

SHA256
8f2af66d896c12bef86307ead68edf5e7fef4fde7e083c9c4d2fafccea12c723

SHA512
6daa889ca9ea0ffc7351d15e20bb7bf5f0acf1180a9539ce74a55d4a947845d5af77d14d85361dc38a7961ff5101760b29f446cba9fce6f314478383aff738a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01284548117ded8ae16fb367ae99af00

SHA1
4f0b0134b6388d72d669ef73eb6fc57f4b18dbe6

SHA256
a8146eda5b617cbfafd82a3e8516a13f3ba80bb0eb46425e3f07585625cdf3de

SHA512
670956908fa7c552409fbc26d7931b18c39078be586a5bf5577851ea99fca5f290cf316177a53f9b60d100bfdfde9b7aff39ce9e415360f0cd49e727af203640

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3305.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3357.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit