ee49f08305d0eab81e42bb61b217484db6449b9e0965c0def3035ef764373539

Analysis

max time kernel
133s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c976c05af48cbdc94fed49d46f720bc_JaffaCakes118.html
Size

66KB
MD5

6c976c05af48cbdc94fed49d46f720bc
SHA1

b568843dbe0fd8fa8a7796a27b0e2863882aaa34
SHA256

ee49f08305d0eab81e42bb61b217484db6449b9e0965c0def3035ef764373539
SHA512

79c741ac801d7338e7fe809dab7ddc05ee761eea50f715a6bd7d61980c04cb31e3c0e2321e4b8f90e0f493ba1a6be84fe171a1194c7475e2a9cc103112abdbda
SSDEEP

768:JihgcM0St8tN99OIscLERVEkWu4HEtoTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVGu:J7+qokV4kKTIgec0tbrgaCcFNnzAC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{379E0A71-195A-11EF-ACD5-4635F953E0C8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c1fd007b2e2fb3351bf011a6a67bbea2d178f2ac6707a69df8519926dcb1914d000000000e8000000002000020000000d4334d07b4cf69edde375b7beca3cb6eeeb2e994149071a878728f7b20a65ae520000000a5784bbefb538c56ee9ba527769b182b915fe5f722dc79ab9bc164d9aa08ae5b40000000e1fe84b8646d7e37b9ece982f1f2ebc49d6fc0bfbc414581775eb6ffd3d2ed1e14c38d8ecaa4eeb69a048b28bd9ce30ebf213c06678e6dbe8202420ca152e29c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422667941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900c2a0c67adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002a8a6501ac1c2376c90776e6945ceccf6b57dedab90618b0a344712953592160000000000e8000000002000020000000648941b5d3d3e0d83b3ad474663808e07248e63aed83ae88efdc3467b391697a90000000a43d1f0ad91cf7b80f7667dcb246ac30ec09b1a1fcd84851365828d99716117211cf688e6b83f9dc160ccda040e7e1565747583e6f6957b74c8b43515faad6d6c738dfa4a57050c23e2447aee6d5225fa694c461711b72fd44a18c6c80631e38878a9f01e733db49483d2f623c0329318e32e1e1d573d66b48225e281cc396339dfee05892e063d155acb5e35f2f2e2a4000000078c0871de15372d63a04a2a3d553000ea0c3c3ca7cf6550bf6d6b793110a25fd7ff3ee2a7fe3e3c44eb3b91adbdf0361fddbd40a4f164e0cceeda223ac6c7c01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2924	2180	iexplore.exe	29
PID 2180 wrote to memory of 2924	2180	iexplore.exe	29
PID 2180 wrote to memory of 2924	2180	iexplore.exe	29
PID 2180 wrote to memory of 2924	2180	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c976c05af48cbdc94fed49d46f720bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5f1aef477d5026660701fc3abc39aa1

SHA1
c836cb3b0a738ce913f35393b9e456f34aef2848

SHA256
9b6483acbce0e99b07561506e1b049a758006d88d25ef10cb0332a187c5b0a5e

SHA512
2c8707f5c078b20cd253caf12ae29a2b65903c270296c311e4c11240b21570759f0bc096e5724222971ad37a4bb7e388811cd7b4847d8ef6231541b9c762acc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc6e0b3305efbbda1323319ff99e32b

SHA1
a36358c3ad02536da90a8c86c0f99b3396b30770

SHA256
2cbea76ed99d9787bc963e5092483f088209b23aa69c83cbef67eb799e217c91

SHA512
59eebe825b919f06f12422c1a8d8a48ce161df07457603934eec565a3e2f07396b6b6f376890ac847c8bc7112c6326f3d0a8204f5bec8c9a8655eecad4a4d50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9d016124f46d7dba1f4c23a658c2e28

SHA1
7e83376b1eebe72c3dfef73441f7082521cd8d0e

SHA256
0f1b70b475ae6a91d0a4b38af512c8ba0bfeb09ea6c4ce6ca28953089255cf2a

SHA512
926bed52dee1e02814cfec3f0cf0b9205cc2c99d40b6b5d1781aced41f00d38c024f9cbc8416c80cd450f636cd763220558cdef0dfce7e1bf2d2be4eaf66683a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
391f4590a060d4049f84f029dad8ff75

SHA1
10c2986f75745353c4c195b95cd4ca0870ff7dfa

SHA256
744a34b97ea26cf6b27b00d36450c58176af2d3fa45092acab0918b5e3fa568a

SHA512
fcc367bd57064176d719a85993a130384c3a22253111b3b4542611364b66f05a78aeec012ca03742c8ed7fb32aaa4786f51ba0db2771066ce0eb4d145fb036f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b2cb4eba264fc01d61a1805d853387

SHA1
8d06ef1f795e9d240b2b0152e086e791d5cb8f83

SHA256
05312ea30a780853090f83e879e28e9949bd8e0de6fcd7f5fb4c01b29ec930f8

SHA512
9439755aa9c4c6069e62052d76531d213fdc5abcede6727d78d3fcc105a1b6d042cad4b94fd8ee71a1a314fd70963844c0dcd614fe20879ee3a45c068cd36629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50a55f2485115a8040807325b89c013d

SHA1
af59069d63eebb4d250e3db7f3f3b02d4b060d8d

SHA256
f761b665dc552ebdd36082719e6465ee1e1c75c8ef1145af7bd7eb4829dc3243

SHA512
0959d2743c3a8d5ea7040a8e9d3dab9ac737653ff7e8559594da25c8f3b6c2688e8e1f2d8fef07390795ab283821fe8f83f0a356a5427ca0efc69aee18ea1317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acaea5a9bf311ae84a715012fa36ee92

SHA1
ab2430e4e57535ea15dc3538f0acabcad511e62c

SHA256
b99b3a76d3dd1d5f788e1edf8eed72c14feb9fa51845053069d86f2fb01e260b

SHA512
b5638d9dc934cad915a4ed897eb2d65a80ce6662b40ecb1fbf857549796c248d97aa7f642478d5ed6f35a2557a4b96c41d40c19430ae730274ad140fcedb31b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028da38487fe6724bf0442f09ee8cbcd

SHA1
2cbf70810020ce88e1a2673ecd064da2ff473492

SHA256
6a32c1c4e75e9061ef8ea022e297bd1f73973cf7488d3702aafde3f13a5d49b8

SHA512
9455ff7e8223cd27fac6b3891c8f920b53034a6796b21bde6a40887c9df96beac1b9759e46b2029e13187863c98836f10561f0f37e1c8528e2df829ff8242817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc34b5cf1d28cca64681b24860632f7

SHA1
1a7f2fdae4795af34a031cb5cbbb26030fe48638

SHA256
6d56d7931ed9f8888eede8ff90154684015947dd10fbbd31ab49d8bc6677f461

SHA512
06d6f3229236c2ccd782b4ebb5c04f6f176da07120462d10ac490e7cc933458779a7d4524182f5cd9110e2dd5178188b37cc7e155e0ea27a1f31039059059694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b53ab0662ae603c40868b79a232d0778

SHA1
4dd9ec447dcfdc74d85043746e839161e6690c1a

SHA256
fd3dc6e3ef2881ed687813b94fbf06df78f0c56b1dfa579fd76db4e647f53d98

SHA512
04030d1ccb0e3a5f2ee8254a024f7b18a630064dc3143465a750d7c52f48eeecb6da1a7c4e4adfb704835bdcbc6297927c719c1e71772b8d6595060dc90e2532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbcf16c59b6e8c67eea1ad52c01ca996

SHA1
e59f9f07e9c4cb280a45f3f70f8b229c9bd1b9b4

SHA256
8bddb5f20378f46682787f8d70f2fa88e681eb0217c7c45d661046ca67f94000

SHA512
b7e0a62f7601be55d93ab7973a7e3eedae693a6185ff6895fda2eabfb48fe8492b48bac0df5039d21dd07a3aec7af495c62e2ff78853407a8e979bc26b3bb3da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da578812b5105b7b4266552542df477c

SHA1
b2c58fcdfd47f6b2913f79f64669027f11a583a1

SHA256
9dd5e37bdcf1d84b0708a4b7d5ebc72b94e9c3bfd107aa4b295d095150f94df2

SHA512
67348feb1b15735bf6069bf35d95e8526d8788e585001a4769ecc18509f42f8c3857a9a98d35fccc15fa28de02adcb74de7b4287924b9608a0c6de8d34ec365e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1359a2e98d7bbc0833e1b314bf4a4c6f

SHA1
287b605b7c3b7373a87d40fde6e1bcfc17d67244

SHA256
5362aeed74a7610b1b91d0200efd69219d2f8518ee63946505e357b101062ee9

SHA512
da77cc5f49da53e9c0075b27ba92d530bcdca8c4d7d388950ebda65c288a0fcdcc49c79d7f59f579de29f92760ad3ee2df8c9654acdb68728f18a32b3d0413b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f5948b9f4d8314b4344eb19e3a894d

SHA1
2222bdf5d9de474c97a00dc88819027b0ed6f9c2

SHA256
02f439b78a1816f6843d5d68c8cea6593f5878188cd7e483d97784bef908737d

SHA512
9e9e6cfbd2145b6afe98750e3c5817b538d201999a1c393b5b0ce015d70fb01b2947dbfa0da89e0c45bf6ddae1091e804b9c11540ccf0d4d52509d131c9d6e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bedbff1fff360cbc99d5f64ca6828254

SHA1
919826c03dc5f24da7a796203a63fa42e1b1515e

SHA256
c95cec1e289241fb84eb8a87082cfa40998b74e043494decc6c3afb6c7201a4f

SHA512
0dd648aa2aae314e274f8a1e7193e655214c4e815e2ec821a27815aef469aeec5c829973a80e6a4e222ef562eb87b7e4b22fc465ae44100daec01279d66421e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89faa1abcf3e2d34e5244ecc6e3898f

SHA1
b96d472cd210ccf66e4bcb51b161b02555b7c63d

SHA256
1c1e65278bc1a96ddcf16554b00852ed1f4e98bf4cc12b2aa16e5239ea3d4be0

SHA512
d74bf422f25715a83389f3508ed639795247960ae1ea419f00ccba33519a4cf182a3b99ef1e38fcc8c00a10554827f640c5e3efdca2491be8a4cbab905afa697

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F6D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FBE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit