6229c9f343f9732db9f08d243c777b750833a26286fabeddc1ae2845099fcb30

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72588e5c95800a93f45e28082f589683_JaffaCakes118.html
Size

4KB
MD5

72588e5c95800a93f45e28082f589683
SHA1

8139fa1eaf609851b8e1e8303ad20434bcea236d
SHA256

6229c9f343f9732db9f08d243c777b750833a26286fabeddc1ae2845099fcb30
SHA512

9d3d16bf3a7f7f5e2542c2294313d6c98ac40de47c006c5450004ef5b75cef4e16670adf77442e722038e453f3866a372e31d9b7478590af48aef48626f41180
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oTsXZVbM:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d4e2a09ee638534158530bb4be0c593e399c5be6c3ecaf6178a7f62ffdd7f184000000000e8000000002000020000000e5d2487b1bec54a085e2d03fb140f4cd14f9bbd09a7cb96ce2798647aa0832fa20000000e33074f6ea97ceee341dba0efb88df3bb37fb80e82447d06cc7f412fc60531b140000000aae8ed2d2e8d01ad82fce5ad252a577cf8359c560c18c3231d0dee3fbfb606cb11e44d3e7e8c4aedee318772ee73db93830ed24399a2e857f591345ad21abef1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1000cbc4b6aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422812133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c4a7c49b2a258ecb47792e8fc8b859c0e3a08c452bcf53de2fd722cffa652aa2000000000e80000000020000200000006b3feb9b2bd06e42db027b0605b155df32478b72348784960be1857a28fd7a4f90000000c99ed4f1b7cfd66a404ba6dfce0f1b6e4deac842c7226889efa5214337ab92f15745852143aecdd57c4fb2ef76057283495d7ba45e7ff6b7b433a013299402d3a77b854626db8afc35d17f97df34e94ac1b6a62adf5cb25baf8430a917f9b1849c809fac5d3ee4c425f2e27d11bd22b3a6b8b290bd19c478524864899a8934e2be39761f0f0c64e1c910c1ee6a4632d94000000019f332c66c06e28ff6ade82d9c83e49022ad071485f9c89fedb4657ee0cd965ebac34e0c060f1748c1a8fa29c34010bd959366e98ac239e5fe95234134738b9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0367A41-1AA9-11EF-BD6B-4E7248FDA7F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2604	2068	iexplore.exe	28
PID 2068 wrote to memory of 2604	2068	iexplore.exe	28
PID 2068 wrote to memory of 2604	2068	iexplore.exe	28
PID 2068 wrote to memory of 2604	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72588e5c95800a93f45e28082f589683_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91946517cbb1871c3e12e8efa276d5c3

SHA1
546ad2bb87ca5ce21ec0b381ec1457c6d350addf

SHA256
f3e04e860fa4c89c32ceca9d9cb98549a2f29a98830cf61869a1db7c4ad02dc3

SHA512
9e417ddbc46f3e0101dc2b6c983d5bfabd66fa84665adef3b5cd3eaa54a4afab1954a834eb259cc2b997f0329007a490791b99c04ee10bc145ccce980ce82e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f36018b5bb8911ac972be5fb9efd6f6

SHA1
246cd0524fdeca87cd2bde1a89dc495a44a7dbff

SHA256
d103736f5243b9d7dab11a53584644f4e7f710017e49bcbdfc32bbccd73f2350

SHA512
aa62a8aaecfe0b4226d13f6d5fca86672cc72ed2d706a7ce87ab24cc05ffa560dd9ef0e63b60db26d1d933e07fa1df1929ecbd3b16a5697767000b2e3b497168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dae881fdb560581bee94cc4caac41e43

SHA1
f056dcf62fdfa8805ff546f97695b85e61766858

SHA256
b75dd36650d69931316f31026af9d000d950a090e66203a2991b8f4dd1c068e3

SHA512
bac1bab228f94de955c9eb0fef792e3cc626713a8b282b254047dd9ba2e2bce72a10cfa8339750e7dbad0a19f187ffb7a4e044ec2602191fd45c974908ee7c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab47e1f42b6f2df77a5815ebaca2bd55

SHA1
662c11840cc3e88e47fffe18cba32b121afe0366

SHA256
c6a75feb1493eec1247130f0908eb4a5337c1044bbb04e5a1fcd52fd8a79f345

SHA512
561d16173872946c565fdefdd0aa4a029cf2676ecc9c0942276cf84df04cf2fd4dc3c539a5a05e55d743fb3b22c5dd89f3d480d214b105cbe7b62e5e5b19f0bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00e2792e2373efb5f4a4bd9c38e6b96d

SHA1
ad38bbacd057b442209d454e6d51a2713b6bc3f4

SHA256
a09ff4ebe973a40108066c5aca768aecf7a524455dd12156595d12004377761d

SHA512
1e8e7c57e13ac85899e322705313fd766364e5717f205917632f3652772da56e987bb8c68b3525a7a15a3cbb82ca9ef06520381d2fb72bdd8295d8fe9e2505fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
695ec944af2cb4fc2ca28ab143248d9d

SHA1
3ef433480393eb44418ea3714f25109b025d0083

SHA256
7f592dc01c71c941d21860bb602403990847776f5d930ad609a4cc45156a20da

SHA512
f56915d14fa2d9ce2f94be4fa88e30c58ef962fb767e17a0a589994044b9e87e6bb67063fb7f689016c647bb92083138bad86e34acfbadc24428af911ff86708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e980a9d5374a45679167d48f0162f319

SHA1
1ef6476140b06def4970fcf2794910d3e7bcc9fb

SHA256
94c0ce4130512df735e72f3d291eb68f982c652a36a61dbcfc9223d22734cb31

SHA512
2acd1ddc4278148d885135cc491dfa3c9b2c45a0b7f290c67759a11389652ae1bb03c9dbe0fc51edd9239bc45ea70b3e268918ad8a3ced2b072c9950c49a783b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aab7dada645ff10f42cd790fb76be5d

SHA1
612d270714d52577e4aa76cd3ad41eefff2021fd

SHA256
305dd59b719b94ed307c19d98849c55ba18107c09385cf252fcc0ecc438bd03a

SHA512
4b71ebf41da4d621ee51eea80857f37992cccb2393b79f857cd1d7b45702f6a4eeb3bf37003fc77e202ca3283bac5cc929e4c8921fe523cbe16904418f459305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
083e201de8e94aab123e1b973c6cdb91

SHA1
a634c888e56ff661f2fc0f49b50c77019a984ab8

SHA256
307694cda45746e1a09b65e887b0d5c78812578655f160bdb95ff9daba196317

SHA512
d2c90d57e04f444c59bd83f4cf4ebccd37cd43aff2c10c2de7d3a23f50f44174615bb5b0a48558d232ee29adc6d5f9f0da29d7a70df799efb424c46c0f1139ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
670ff879d99a5e3aa32386aec19787d2

SHA1
8559400edb054d9042ccbcc34e738f19916a8b30

SHA256
705f0dd73ce26821caeef7731828afa670689e0a3b172e2be3b58e6d5352c4a3

SHA512
7e46f5a4196e7314472d3f55db155905f46c6e952ee1ac09613c5dc36c137f4dac43643ee35933a2da249082c76f2117a4c454ec9c5854d7f92bb477b7460fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ff4ac4b79b3e15e0bb511c236122024

SHA1
34386ac58a9d60a4fa99b67f4c68a44369d87968

SHA256
df39e675e4cce35550cbea9eafbc38b17edc1c596d39bce13a7909569d70931d

SHA512
1f983fbf55a0d383bc6004699fb0918c97206781b61662fe6f795916d1277480d2421e03c4c4ab4053cceac613b726499ac98219d018d6ce341dd8e233da138e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2729b791554758e1ac1e7c3bf57e76d0

SHA1
d0bcce62e14b4a1b6d860cced9645c9cb8e62abb

SHA256
bc686c56babf5401c4e0082b948525157894439ca64558dec1f1a6a8e9dbdfd6

SHA512
714983e18ad6eede938b920f46e633c60c13adbe9bbefba268f8a2acde55e2edeb9764debb36b0ccac9476bbca07210ead533eee402fc09f15b2f13c70f35da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3fc7de93f82d50300ae24933e806577

SHA1
73da15c31347df0cd1618b6517932ba80c1f91ae

SHA256
4f297fbf86dffb7e390895ff5efd5985acca00bbf3c3b82e0ace179656040946

SHA512
c0f6901f27935828b3953189e12c5660fd4a39cae5ad58caf624cbcb9926022a75721195b0498608f9e276ebcc87fc0cca75a6c4d600d5d9b9df5059621c5673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6491c1048d75c0264bda4225b5c67c8

SHA1
836c149ad73d654d9cca8d7e3f40d3b383024246

SHA256
7f73b4fe5a7f04fc79bd4d2ef443cadde74777663a75ae0472e74a3a5b4ed3fa

SHA512
2be8f05b83a5deffc0aec2435571bfcb12d580bbce3973612ec4ce9ad1709428154535972cef0fb5f41231d7f0fcf2cfd9424dc8279af685b8268ed36c88b4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe045aa3048cb1ebc249d34b51f29f6a

SHA1
d00d3626a7f34ff0351294e899f1e030b503f1d1

SHA256
2940184492cda2b0eb4e1201b7bbf579af995b4e3e2ae1071f7cd70aa5676bb6

SHA512
0883de624bbdb7dd7adeefc661eb7f823cce9bfd94a2af60f3a2432023f78ee9a624159b4588a2e0d5f4759955c33da795828ecee6b04e4e8451d4ee32ed87fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb0c86ea5dc0d47abd6508aadec875f

SHA1
13f743ac175165f800392750cdcdeca8b69fb192

SHA256
ffb379812b28757c6418c6311ca544af830b192c307504be1982235ca66dd936

SHA512
ec07200b26565569433a155d5b3a4311511f173a6f75d511b5cf8bc36c6472e8ebeda9b6c3ab272166a7b5c88baa036b48f843307aeab3b6ff739a363c8a3858

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CBE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D1F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit