e5ff97ce23a5b2575ce5e497d2f3ad93b572cc9f497759a57743faf4bd143344

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69dfcca8650f303183c1df8ebd621af7_JaffaCakes118.html
Size

36KB
MD5

69dfcca8650f303183c1df8ebd621af7
SHA1

89af4d06f3d758e3a31139afd31dcf824bba920c
SHA256

e5ff97ce23a5b2575ce5e497d2f3ad93b572cc9f497759a57743faf4bd143344
SHA512

7741c0e459118137d01747471d62f065c677e032f451aaffa7ab5737ca510f4b61114f5e6b33b747b5f792b88ed0f57b5ac85e00996861a6afde99daadb20f3d
SSDEEP

768:zwx/MDTH+g88hARiZPXpE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRC:Q/fbJxNVNufSM/P8zK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000000bebf85347525d49e674d58cdb3a8c8521a00d93cb778139899ae2c04ea29bf2000000000e80000000020000200000004215631cc916b1a38f1a4f7811789aa15dd7679066a23bf3210c80f7ed60631690000000816f4bb9371400c0e5b773235ef8e330f7140b1373448c45e59591174ed47aab7adad6f6a062073902db38122168cde132549e11e4b725a947412d446228c03c608deb2ce0184989901f3d6b75313ec976556bcab10b5955c445614dbd85096b08e9b38b3272a87f522b25bb392e757f83d2bb2e1bc08d110e2c37d6bd9d10a6362518ad0e9e6607be1bc35ddea13c48400000009f2097d31b4b62d0e98f403258adb2a4d8f1aa9099ec1769261a98929a2f5c0995b06c61d38bfa488057e1810d04191cc9363d11a0b94b613f517cd47521908a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D25CB391-18C4-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005cb587b1e420e6116e163067a4643537e7e0a255edb25170da4dca94beb7b540000000000e8000000002000020000000d609a9f056ad47e5838e7c959a6c71113a9cd94138254c5af6c0420208f4392d20000000616270e37dcb8f569e23f390ddde8d5011b5158b226f02967cde71109f4986d2400000009b84e2fbde6e9801582603428ee1784a79c7cf60cd338318b6fc3c588c75d60c5b7012c81d69d5190e1a872ea2dd8de65b2794d77f2d0d8221868cd3e3733ec8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60429fa9d1acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422603777"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69dfcca8650f303183c1df8ebd621af7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e4cacc9fa4adc8a6751aaf917c99e447

SHA1
d27c0b41d3fe6627c82ea3e6e762b1474f64ba51

SHA256
6ebb6b38a3cab01ca3d714f8df8b1d1dc0f159922fe9ae5e104dcd27c59eaf30

SHA512
fc104a463bf08270217f88841c8690dcb264abeebf8bd78dfda2dd2bd4fa85231dc7aede74e427483065ef3e6ef3f2c7e73c1c67dc274861da3421ea35927a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4d806cc8475f4f8b62de67d111bde3f5

SHA1
d8db597d7293ea7994319d1492eca754de6743a8

SHA256
948f32a69bd9e4d109613d2a5188114f779f63c5b6e6de36ba198623fe17de51

SHA512
3e5605c8716c945bb2b11ad0e4482ae0ba84dde40aef7c53eb4821e5621c95c26637a90bd13067bb4a03de7aae58abf6c8f8d480890196fbe5bac2aa7331e335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b82c49d77dce58bb807a4f9837ca880

SHA1
7ab31eaf36203929fc4e392bdc71b8dee45bca32

SHA256
8166bd53e8bd1852a2b6841953aabea6791bfcd4e5e31a77c9a86110720d4def

SHA512
fdde0ace3908da75b9553664332dcda6b88a553709fe01c397b02a9e28c548f1481e2fa5ffb6798abc1737d7b454d34aa3edeaa588f6678e3c62c21544a03aec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709b36533c9f1676b11e462a037da4a2

SHA1
ed34101d1efbf18b80e74af191511b53bf41c322

SHA256
d5a4b633dfd40ca9de25bc9aa978f826faeb0ff4db46b0b21cb4e6b8a0bb41a9

SHA512
675d3cef56e1ce58c11eba120108f59dd9c16d019ee51decbf94d6b1aa18c4365fa7a3082200762b72ad634a86c4236bbbc9fe7bc91e9733f309f9c7a824f520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b45127c55af072b6e9bab5f59cd2fd3

SHA1
8d391c21160a8b2bbee062d1ad3474bd4a5640c5

SHA256
fb3a91dd5323769a17d0c8ca806a0ade626564aeb1cbdd84b9ae52b641b5b2ad

SHA512
a64efd77e01aedbfd01bbac31dd1a6db19adcf40eb97f281ac11c9fc05e1e0e921284b94800dc66600a6512b94acca8f71040e1a2d19a868a51cdd33cd9e875d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b42c78b3a1ae020a942994927008682

SHA1
3120eb8b233cc1a51dad54a0dbdfd556811f3171

SHA256
ea2c99567b33793a008e7ca712de5d68da99aca574332d95ff1a8c60eb322907

SHA512
0058f260ec37827b06d6e0fb882a7497f8d686283f153b038fa67afe93c347a85d4d468bf7f5b064fbb3047580cef76e5ce8b33bea8f9f304c983f8d9833fd1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28873932ac06817607985cac7a8acc12

SHA1
909df8637929229588e233a505bfc4673c960253

SHA256
15d71cba864822567ae36e5d453006538669177166c23959c6a69896dc3504eb

SHA512
ade2615395ef2fba73a68ebfef3d01db6f93060f86e015f5d171614a8a7d3297407fdccadbefedde2be8e6899c9a44157d342a22c83aca11c77a404589bad7d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce17b6be4de3c58642b4ced3077fc6f9

SHA1
4115ba29fcf3f3381184fd3f3b21007f2c751322

SHA256
645151c6ee9afb8cec7d4e7f73051759e5aa17937e1c40cc4573aca8b760b18e

SHA512
b9dedd6de7e9adee175442e991a9bbc77616f0628d313ad06bb2ac87ebdfc9553bc772ca2fc48c04f557b7f8816f3ddcb2ffced9a23dc738dc0866d9243c6638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989e7188fd7638050afacc9fa87198ab

SHA1
b58ac49880f07f9a4ab5c0ae80e89112d4ac43a9

SHA256
d6f517529bbda2dfc230a3c0de0e5aa5ea2d8ab2687279a3b41667d67c35ac3b

SHA512
e245f95e46874a975ac64c10345ef83f105456bb2cc5039ac62f010f9ca33adaef52bfb1560eb8984aea0b6ff70efb7f110d39f4368356fa6ec7b2f2618435d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc095761a419efb5dfe61c198da2d9c6

SHA1
9ac2a6c1ecd4953317a3961ae43539f8c5de5ed6

SHA256
77943074b0862bc7a57c5becf9c64ca119a73ac9eb0c1a4cede062e69b387762

SHA512
96a4fc50a02bdddbee2ec57e2c2ef282f364b16230782189075b2a686ae6934a7b47283aa3a357ccf4b6646f217be9a4d464f64b737ec2832663c8e7bc0bd179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca4b8585b1370d2e66edb3140fb00fe3

SHA1
77e4a27ee37acc0d2cf3dd1c7f5bff7f4b0276db

SHA256
052e660f7cdaa9df838d149f28afa28c53598c15ff5bf59a018aa0f5ff5b1665

SHA512
8ac45cae3ed3cac921f305331e82b48f616fb1ee23ba5e802b8582228a2c2a625f3cfb9a0dfd28e8de6015c61fbd5c4be45b19c2e112823d1227e66f80aa7397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e86502716e4874a06d5cb47ee4a11d84

SHA1
ed30d9f938b8bfa19e3672b9e38ef132155a170a

SHA256
4450cc26076c2b2797426a4a3c8c4d550b7db0edfd428a5e43a3d1f0acc35742

SHA512
4b97465283c42e3eaf1f8d8b54190ca64da57cb827834d728eb620aef44d0a81bbb2d0706f47e71f1f22d8e70b08aa8ce1c015f29ba046c567180ed9c9391c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6655849a02cad22d7d176f48de2d549f

SHA1
82b6d9e70bf67da0ca91f566be09c9ee80c2868c

SHA256
7e586514937e90edbd24f06b0f39154adb6a1a9e058913341cda8b27ca73467a

SHA512
37ba783702addb697624baf0e90d2a7facd41c3527e67a636ec8fd8fb40dccd27f1ccd533c950d3ecf9e34a218e2a42024fc7c3c7b9df38cc51f268c19fe5e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88e34c4fbd87a2f901bd2a1f3c40870d

SHA1
003db128a49e6c03a9835f3f21ef534ff57b0148

SHA256
09ee4053c2d9b51da19213ee77512f7155e29ed75668175535b3b6191a97beec

SHA512
3b84e8056148360af671f41a6fb10bd19cd23b6b4900cd30d3f951fd14de9ef528144e34b9c961d3e7211b537d92470f9f63bb3a47e639fc89595b499eaf98f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
981eeacb1551b6d5b8896cdcf7172d49

SHA1
b23980b8abfed7ba483aba6edf84e13854657e08

SHA256
bf8e202efa85a59b5bd6d4ffb16910c87c815749fbc35198656100230a56a086

SHA512
81a4ac8c591a4dac4d795ee672ff781e6f65f8d8009e42c9b3e1ce34038d591d96671c552fc49243d1fc44f13eb1a95631809e5b6c0302f978d782db86a41038

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D7F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E01.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit