873413d2d3cfef4c989a3b15bede1d0d893c93230e49ae93c2a466c2fa326831

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6924320c41b8111dc60cebcd415f7141_JaffaCakes118.html
Size

41KB
MD5

6924320c41b8111dc60cebcd415f7141
SHA1

9da1d11c23ce4c40ab5a458ba62ef6a8b9c7de64
SHA256

873413d2d3cfef4c989a3b15bede1d0d893c93230e49ae93c2a466c2fa326831
SHA512

497a9f6c6ef1c36a4285ac38d49702a81832f417028bb5459538513f23473a12392165fb69bf22a5cebcbd509751ba3b17132a9fd860357b7d7e4e31607a767d
SSDEEP

768:+QFRkij2OP6+TxrzQ9RjoU8pM8/8esYfV/UG3iyZnUpMViisLN:vkij2OP6+drzQ9NoXpM8/85YfV7iyZng

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bed827a8acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422585952"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002c4835cddc25fb9d9c9398e1c3883cea0082093be10d0cba6563fe9ed9900174000000000e80000000020000200000009aa74775f20e72ae382704adc8371fded2709ca61376e45620ad0b3c8f6d26d52000000054347312c2794b960e8d44f6eb0905b5d83dde1c55899208d2a9ca135a44720a40000000235725d6106f89cd21b0518c2a472c04f41058f4c0744c7f76c9762f1b03eedc1592d337b8c11f1daba576ea6e1f57ae7940b71b44c07426eced3e44c9070e6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000017932c48db041b014f87088f5f85ffb1916b252f5a250d92b73b590c904ce58e000000000e8000000002000020000000083fc6a03e0ac0c2c421ae2a771b283c0996b300701b89fa28317fefddc32f3190000000d421a4b8d7e99cb6e964840d37b11a10e1dbb14e1b6bc485ea9bf7011e13b5d03bdec6d305a4e4b1b947219adab67e56928da2a6df35d89e2841d21b6440e27458d84ba73a65df1c7ce5c40c756ba4eb034f34c00006e7592cc0d0c4dd6f8c450a2fa7c74da62af54e0090c8f1f57ea97147b3197f27c8ae863d6d7803d9213489a348385503ef72a83c88a8b835a283400000003a079408aff197fc4ac91a2fcf5ef020a923be1fb602ea1790f1c3c0d69327fffdfa71871ec203ec3d2256433fd41ebf7557b96b0fe8e1c724ed8302158c87b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51DDC2A1-189B-11EF-AE43-7A4B76010719} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2028 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2028 iexplore.exe
2028 iexplore.exe
2656 IEXPLORE.EXE
2656 IEXPLORE.EXE
2656 IEXPLORE.EXE
2656 IEXPLORE.EXE

pid	process
2028	iexplore.exe

pid	process
2028	iexplore.exe
2028	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2028 wrote to memory of 2656	2028	iexplore.exe	IEXPLORE.EXE
PID 2028 wrote to memory of 2656	2028	iexplore.exe	IEXPLORE.EXE
PID 2028 wrote to memory of 2656	2028	iexplore.exe	IEXPLORE.EXE
PID 2028 wrote to memory of 2656	2028	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6924320c41b8111dc60cebcd415f7141_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f803d44821cb8e1a93897dc93752fe6b

SHA1
791f3367d02aaadc8125e8b6a8011246f9ef3e35

SHA256
81ce3e714322172a319b5edecb1a6b3fc6f5dd5d071f2ea7e59695288f324bc8

SHA512
b621bbd103d3bc40e5515e2edea8e4135ac09880a83dd799756aa7c5c63818f49366d3eb57a8f10dcc791808883f2f22db8846f24dae755ee16dead0b79773cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d9ba98cc2b7abc602aa592bfa08d66

SHA1
7c52896164c5e98005f42f32a39ea1358b5715d5

SHA256
c9c01adf0dccc94469275d56a76037320a088db2528b357860ca96a1526e79ea

SHA512
7299e7373fb2459d2a141a734bd10176878dec7386c1b37b8326043391d5c56b72b258679cf20ee00389da516bbbf26faf43308fdf7a4e8c05cd1f7c84a87c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce9c8b7e1d839e9746c551c6958c752

SHA1
780ffd720869f347a90bcdc328851143f9b14851

SHA256
e8fdd3bfd0510b82e83575027f4dad0c94f07170d3d80e151e9893452ff5b7d2

SHA512
af40554e6c58865e68dfd343f3dc1c0f11f3673b8277643871a246f686d6b732a05fb5f13744e6f7dcf139d19491f16993d4101e98627e3ad03179f5465acb59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0059c813172951726383cf5fe2bd2712

SHA1
53c2c7848c157cf488a8d23b9f20a4134e161127

SHA256
6a74d2d754c426bb6a6296fec13ba61c2674f3bf57d841e66cf3f1f494a8885b

SHA512
0637dde6d97ac838f63580ea193f6b4d9864b79d6ca4bd67ce05fb1291cffe890fcdb15d1100616ba35640bde4ee15edc1cd6256397d62b1bc10917fa82fc657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0902221e4cc131be5661d5df370403c5

SHA1
3c6ce63ce4b437649c186a57dde3a44a6ae55415

SHA256
ed5a91537e8b26c6bf59fb92916dd1c520de21dab5368ef7e36bdf9bc7fd11eb

SHA512
e0649e64b09098237534d12cc48dd4733c9fd308c516d907b8aad6e856a8155243fdcf7216f726cd71450d805d0b0b9b586b2ba03e04e1dada43615b7bbad49c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44e6a47e909e7db6f8d158b5ff8bac50

SHA1
ae5955b44d8ff66de7b5150b206a7e049ad975b5

SHA256
5f63c9fac04a6c8f4fdebba7e66b032dd8ad5bf6ce13a0af0f464becc1e4e9bd

SHA512
421bafc17f503616d1767436782581dff79350c7a962bfeda61b7319b7c2ed88e8432ebe57149e1edc0312b354c856679c56848d2529a032905fd1ac92232cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f4d184c853ed11e5bda1ff0fd632ce

SHA1
fdd088136b0069314b4b7a011d0773b968d6d7f4

SHA256
bb8c0be7e2268c57f44f314ab655598b734ccd576b55b97cc8ba482ac486e4a7

SHA512
48611a2fb81493568954f369cb59ffe4254fdfcf5ce5c0959a307adef7d00fda2a349004462f1f39ba1db9ffd9c0633cb9b588138d2bd64c5d76da578932ff6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058de6abbcf5cd4aa0eeb26a5a78ff72

SHA1
d08fee146dfec0f15807d0f5d20aa979a875a6b2

SHA256
7a78b30432e4286b9c21f3f5529b6a90944778eb9b198a0f6f8921eb0fe01945

SHA512
b5a2dc00394bb8e1c9c566303b047e64b9b16d9fe3e754ffa3315ce79c3cd08d7b43e9e830350a37c396374f2a939138b2326a484f8379deafe06af5efeb3935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f28d11046edb808f2ec8879252cf59

SHA1
73b6e3e340e2cf991f3115df6f7d221a717573d3

SHA256
df76dace2ee962d3ad3e1a871bb071821229443b0121d71199a3dedf7237d905

SHA512
5598ce6022c17fe448e96dd68ee44c42ba9a424d5d4c57a1b13a7b7c251aecb0670e4e81fe6586c9dee2d1e7c3ed059f66833b05a8683c9dba82c797059b2a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54eaf034bd57496999809a1a1e29af37

SHA1
a826cf6ff26602f2f2808f851d45f20cbc4947ff

SHA256
43f069505b15f5bbf724860965517340716f919d2575eab2cab78ba6fdac67d8

SHA512
0d91beb56d845074fc89171e97c8e5e4d931722751a8cd45690052d7ae4e29bad1dd21803a01a20605aed1bce098d20fdfe48f9e96981fa51f93dc6d5892ab85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12927565c4678e25c92ea2c6dec62460

SHA1
9bdd3c463b0240f9ead45acb0a7688763036d0a7

SHA256
c258e5bd352f926fa01225d1a9c7c41e033cb33b192ebedcafdeeecfd342c855

SHA512
eed1fced4258782acb4e9e23d0e10eade5fad8f6c9d98ec68a3595f31b2bc86aa13a07938bca0911ee2e2788e9e3622ea92ef496b0cef81d0082d2469c49b4c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b9bb5500dc76c8ba61e373c93edc827

SHA1
3dc2aca4b1e7f23ca2c43a7604ca7430eae52c6b

SHA256
b6d851f7e3cd75be968be20aa8e54bb990474cea517a8b98f8699cdad00cde5e

SHA512
ac88e01d58c61255200b8c1be68eeef56a60d3819904d4f7207f15cfe8b2d6b83d9cdd87b39fa12de3e579f28a3fbbc4e7951a34842b29a9bbbf9a234c5f3932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1197e84af891ac3058e216bf5ff48fe2

SHA1
6a769dd93701944f4d2b36c8d131e320be76e092

SHA256
8a019c626e83caad811dc938344d766d5cbf8e5d1e9357139da8a26463b2b8f2

SHA512
09dd573e3d5ee19ce30102cbf584380ca6c1928d1e7a73a4a5310b3f37761deef017ead895942b5d0e3a8cc6e66c0c1c38b9e128c159e9a0fce53aa3b190ae3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39828c72a09726be701f5ef7f2fcf3c3

SHA1
5c6c7c06365ec95ce44f32689934068220c2f6c6

SHA256
6f898fd4f08124973976832c8f4cd8c01af7d076bf83ffbc8f2edfcdabc02021

SHA512
d1692f6b025b511ba9261486d5038ed93ab84a8e4f36775c50b619a8fd4c5c29346281a2f06b2d082f58ed836c1cd758371d5af316417234ee2cc4e8d82007cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed24028d2b8c85e25cf28fc7eb7358d5

SHA1
5f9dd5073a031a75c3abb82d12662ad0238b9a4c

SHA256
78b6172d8143b6fe8d7de93b2be0508aa6f0fa74eaaff785d5e82cbe52a66729

SHA512
5195c09fb505658ce76ecd9e668106cc9b6ec8b7a0e5f96c79c56b72382555758076dd14f5f306bf82ef1eae59baf91576ade3035926a16743c5811fdfe91e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8683d51b3176fe6a820516367db5cc67

SHA1
18b7e8a8b418b24d90310f14ca615b1923fd5266

SHA256
ab2ca201efb3cbfbdde4df7137fda681a9234636fd774875545c570fe2884c62

SHA512
12b812c92939be299a5b81392ba63fa613323145f53fafff1933b5d9565501ee9ae82babe4d164483d5a783d39011d1a43f4d8d925547a8453350bf7c539f314

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B5E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B71.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit