507ebcef0ee153dd1546ed6998a548c41601feaa9faa8b30276c07cdeaaeaee3

Analysis

max time kernel
136s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70077982a6a64d83bca3efe86e42b00c_JaffaCakes118.html
Size

166KB
MD5

70077982a6a64d83bca3efe86e42b00c
SHA1

fb0e7488689bd8751f6c8c4357eb87cf790d6b30
SHA256

507ebcef0ee153dd1546ed6998a548c41601feaa9faa8b30276c07cdeaaeaee3
SHA512

917aa1e0badbe174aae56dc71ff50e90b9bef77b14e9b8aec6f2083c7a51df9049c4a6e534b28f384160d8e6e69c21f477a2fd7a4f5f0d883e844186274a0bb9
SSDEEP

3072:S7PtS+zJjyfkMY+BES09JXAnyrZalI+YQ:S7PtrzJGsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2ECD241-1A1E-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b6fbd1172ef13aa6219273f736127d261e3384fe9efaacfdb065ef114a9afb54000000000e8000000002000020000000d576131d871069ff75ee7c383365784d8eb763de0f05e477c665761233518bfc200000009aaf7736eb3c1b091fe9ec072db8f2d669faf29aa2b89123cc83e29bc6a3b15340000000d5822d702d032d6cd6514fecfb3672005d4be160788f8f683a153f777a79a5779c3176d863d01c00f6c7e031841bff2fcd380be0aa7ad8fc291017741cec2a28	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000e8f221c5464d80b8413e7c9caec088e3f407498a6575d0a7389d558a168ff522000000000e8000000002000020000000104da94962f87ec59bd2032ce8d8a6d78e72b4c792422126a1effb003a360bae900000006d562aec4cfa227827818a2dc5d42e8efa042e65917941bdb8af9f012ee613d9304d810295b16f9dc1eb63a4ae9b66bce3bb5ef35ad2a6cf12b76ec2349a7b66764e4ffa8f6a4a0c1f7a9fda2d6e3b767a342c54cff3197cdf2fe831c1f1700d73cefdfc35f0dc9706921aec7fa5b8cce8df5e9428259efa877ed840504d167337fa4cf071e217ebfe7585e70cd15c3940000000ef206f9473f9fa70040b6618cf5af4ad6570fb019c371437f90e052ae7bdf2e31d88b53d5f3b145a18bbff1e7595d4cdf94661a52121014b5f41e89403d1c209	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4060a5d62baeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422752357"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3020	2944	iexplore.exe	28
PID 2944 wrote to memory of 3020	2944	iexplore.exe	28
PID 2944 wrote to memory of 3020	2944	iexplore.exe	28
PID 2944 wrote to memory of 3020	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70077982a6a64d83bca3efe86e42b00c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010a339c391310463d577d18ad60ee24

SHA1
eb63b2a6975c4720d6de7bc5085f8f4efdaedbab

SHA256
a783fd3807ff038f10780de816962420a08c3dfd4984206a2a35ff5b20d6feaa

SHA512
aaa68c1aae2efb8919e6c1c269637fdb1853278aa4b843920ef9bd806950692f5174f8aca48ce8266742d2f2b2e12200c8174161b740cf090c3235610762c9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6fda55f62b823c950a7b9beb9994235

SHA1
afea7a94023975b4803f819d84c8251e974e37b3

SHA256
dab265f3dd6ce66c78512df81b708bbdd3ca7d653c84c13bc2adf1c52fe98a5d

SHA512
0466f0c6e60e93126fca2d090146e03021b8c3abf950854af1b240e7ad03277038525dd6209adaec79adc5caf11cf0ef9a4551c3ab5f9e9d936e25af637e3e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12adcd066286305e596e462d7d3875f3

SHA1
24f2806a6ee6502ea5030dc6c73a1e7a75fc52e1

SHA256
a15e6dd44674665218162c91aa7319e9d51a7e56b2df9705f468931bbcf7ee4f

SHA512
a624e38cdbbbd27b34e95f09dac867de59d8e9103150e0cf483f99b16af7e95baf814d889782c847cf86dba6f151fabe6d015b659c4fb610b0ece13f37847414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0c617b181e22e3d8e65cd3d5ac6e5e4

SHA1
ba5afbe5824f2b8dca4e10470118471cf06cd785

SHA256
d480cf8cf292665011079ca1a8f11e2bcd532e805ae1619d619ebcba66e7aa71

SHA512
b05c65515843dc2418ede1b74597d08c8547d0a27d50339eb66ab7267aa3113d49f218f214336a4a8f046abe346a424df94f74636567a89062295f1c1e185628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094b924d0c53b24c940e59722b8b118e

SHA1
a64f28d4495eb027f25cb373511ce7fba37035ac

SHA256
6caf4046d7e6c41c454db3c8c49f1cc3f733a32e6d9be628cfeadadbdbe8bf66

SHA512
28ae147bb238005e521a78844ef6ba5ff625c0f7f1efcfbd0978b6614f370c12f54f6bf4cd967e5b53970b226c3f04b35ae5290ffd2983d6320009e218802318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64aaf0e28f9b361f3e422a42b37a9b31

SHA1
1538ec7769f023c795b10808cce3e5d0affab341

SHA256
aad43eae5d46bb9945c4caec4df07386ee33113e538f8dfb8e40aeb75ba450a9

SHA512
b40ddab3ca3f0c943e0c9b4a6bea54440afe2e76326592fda9dd9163b821da1bca0e4050918b50f8f162e0369c97d6d0a1c50260a063f8125c450a5f8a7fb709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f1b51f2d950e5bf61764bb0797b68d4

SHA1
c27517a4cb1dacdcd028a148346fd8534b5443bf

SHA256
4cdd978247f99fdf918d72a10d5b55a22d802def09a49bdb5570b1d954b47255

SHA512
5cd033bc003212043ff089c92686c1efb10372a2cb96899bbeda270901b95fe3b76de837ae360baea6d9e9f3769469468ff05bded7304d44399aa5e154ba983e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1888f2197908b7d1d323a332c603fccf

SHA1
59d5415f6b8a3e68b72b7b2c1f8c4df80bb108b8

SHA256
5a13f8590ce08e4298d2c1a28f291b0270158586a137105b2576e103b6f3d708

SHA512
598c869c092700536eb5111eaac9c302dfbe95f865fbf4cb7fab24ae6c9c62602341fcb522d897ed20a968afed467597786df735ad0390d302311092dd8c5eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c5a95809781535545e7279aa979fbc4

SHA1
5385b943cf1fbccb15debcd267f9292837575000

SHA256
983bae92db6970b62d3cd777f062e3c8381addf39b2070cc1e30db6a93039e8d

SHA512
1a843a630db8981f9ed5e851ae1ee0e83b5c12576512513caf03102db6b5856f77d6ac5cc6f449ad362ef0581555bbe17a0de58a4f8e26d2395103d5d666e6f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
495064dc36b32e14a7a60387dfebeab6

SHA1
8693abdf9088af9323d724ad439eefcc93c3c332

SHA256
566aa99e2739aeb40fdae8ffbdb0225b1215faa002a918bd6c664e4d72b506a5

SHA512
2518df165ce6ade5d78d050a1c76faa72b0a8d7c3437814b3d58af72b03bf0445a3b344d85a0544014d3af626f17462ceb1a9e34769b4e05f3867f423b817efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74925cd12dc46a6f66a5c028aef288f5

SHA1
5b718554202d53cfd36e0f72939c539a734b75cb

SHA256
ef1a53af6d99167290436d50b3e7a2cdf871dfa2db0a1715ffae193fa4f842fa

SHA512
ea82191295c7d9c28224e776b77e8249cae9747bb011e46d15b559e04e20bca5fade2b0c1503ba872886a6d553cd5fe98e0a2b0447b021fd00882526aeed9fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014409c5699fb3f2f7b7f5f10eb30c7a

SHA1
530d082ce5d722e494525e47c5be541be74281ff

SHA256
9f3872a2a9f562e33d1f7e06a446fbc50a8922a2a128e9cfe5ed4b4a4e557676

SHA512
5c80c32a429ab12fedccea0ccd0520b38613b4b25ac0904c372a822aa5eb83ab3e4e8026ee2fd55fb309e8ce13ea75494d131a8cb87da24f76666fbd1c655bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ed877b187a2e7ee169684225c17717

SHA1
a8cc2539cf1074cc30ee9f594982a75e8f632306

SHA256
012aafb902325491e597596c15e88844879cfe696c1f13f9ed4adac6cbaa46cb

SHA512
6c45a2167ffcf097c972a4a947de81ec9b3584a969e4546ed457ee8ec3b47fd01e1127aa30442384971029dddc71de444b2548bd33146d30d397b8c98e2f5895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65c548708a9bd293967544e29b1a96d

SHA1
04c99a3df0276682150e14150b7390970af834d6

SHA256
da918717e9aecb46e06485b623d2fdaee316050c831b855f9d3b2400b628d59e

SHA512
4113dbcd971145313497ab65fd15fa0cd4e3514325d4f7aeb66d1e1a61fcf5f354a9c5dad23c0a7967d7f87373f209bc973c3578bb99e53cb6b108a1f5cfa5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0909201acbee4518690d5fd285b030

SHA1
8558c14cb398cd0e82a8502c3fb0e83644e17654

SHA256
750da9342680b4659ff65ca7cb82223cd13fd8fa35707dd1201f67871f2453c0

SHA512
93c471d63955055f5359f29dbea887bd3b81f7f5f9fd75731fe01833b1eb85ac16739315823134510e18f1b5a36a9bf9d95b284cb4207d2694a7e186803208cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
611ef4579d75eb776d5cde7eaf3d8830

SHA1
84d4a6e013b578ea46ba8631a7e5ebdb15965f70

SHA256
c4bc56ff1b154c9d92de23842aa69b509448b573d1f8a676a12e399794dac3f4

SHA512
5251ef3bb4d67d9284b716b6ed2c58c0c831293497ae4068bddd653c5d54b222e55489140cf0cccb7551ddf4dcbf4201bbad557e50ddfca51b301660d3d992b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15B4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1615.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit