4d3394eb125e6a8c9ca469b93e88df170d72461374d135354103dce2f0466ed9

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74229e9e46bd54c7a624618b86ff1541_JaffaCakes118.html
Size

462KB
MD5

74229e9e46bd54c7a624618b86ff1541
SHA1

4e776c21e966bad715df094e8ebd3404142756eb
SHA256

4d3394eb125e6a8c9ca469b93e88df170d72461374d135354103dce2f0466ed9
SHA512

22bc4e2053641364495ec18ba83047dd2d14a8c453ef5d519c076db9b7aaedb289f9148ee094dfbc95ad920fb153b400bc3169eec9a0dc46a0301edd99783938
SSDEEP

6144:SusMYod+X3oI+YTQvsMYod+X3oI+YZsMYod+X3oI+YLsMYod+X3oI+YQ:r5d+X3Y5d+X335d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4898B6A1-1B0C-11EF-9449-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006e7ae77849d42ba8fc485ea8fec0293fd6e85548668917c5a3aa0b72a2db5821000000000e8000000002000020000000ca97d075ffbcd2c25439b1ccb285c5c2b3ff08d58f6dcb5ac5c66d79f4b5d88d90000000e2d7f92633d3c6d6a9c574ef8fc87e4862495b49fb453a2dc315bf62ec9b741030864f0ec7831ba13431ee7ba3c7614ae3ddda4eaf7e5986f1da1a3ccd0d64f54b6f46d5655ce28b1d1708d351e7aa8748750071704a8c45afd8040ac7f17d8f5b2d3d990883ee3ac984f277a45e14d9e6e5554250c81421c6276ead3cb0709f88a6cc964d834eac9d950b0cd46514e240000000279aaaa05591af252915deaad1b98c0d1af6731b5e83a6b92f6ba84f368cf6327ed88e4b9fe19cb981423fe2f330b1a5709c27900f45724fabe5e9bc25cbe56d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000065ab97a9bbf86bafdba2a104165ac351424886ebce1b92debe28d707dc478906000000000e8000000002000020000000dfc1d45769916f3fc57eb852f9275376f2022a888f540b654d8e5a43b0fd47d020000000dca996c4c673dcf1fccb98c247b87eb1610264aa1aeafc1e40998fe69549827440000000a09f88e7057fff9eadef6939f803748612ff0dcdc72da428144227d2f24b2d0953e57f89af94c5a5846a3c6267497c95106174f000329591584dac2d8814c3de	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a099192119afda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422854374"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1588	iexplore.exe
1588	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2112	1588	iexplore.exe	28
PID 1588 wrote to memory of 2112	1588	iexplore.exe	28
PID 1588 wrote to memory of 2112	1588	iexplore.exe	28
PID 1588 wrote to memory of 2112	1588	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74229e9e46bd54c7a624618b86ff1541_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e66d4c3e47cd1c67e8d04409f3ad5d7

SHA1
b324400ce97b3c6f79e5ff614cb166002e9751a8

SHA256
547a4296ce4ee2a0839d972537956bc0a82e712ec1a9795bcb2c05789fd7cc1b

SHA512
c761ca93194f727ad94a10b604ef7f0c4e11bdef7d23406d28e090e081905f89a996445de701caddcee52bacff9aae5e8dbf390fcb28bce541abd463a8f285cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
755b4c2961a6e3672d54a4086bf3a405

SHA1
e1bfdfe75329e73c9b9e149549e68450a01dda09

SHA256
058f3d63ef2e74e207cbc39e2a2608a3c09b128247acb6a5bec21aef9e1ee551

SHA512
63a9a4354f1fdfe158aa811e2f1dbe56ebf38a7b80f24bdecb5bd9f01178f98a61843c863424a2b6f1d1eb703024b850d475d2ee5c5e673ffb17cdf502cc4c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df767a29ebe5ef6c2c4e9efafbddc3d

SHA1
7870f2e33353b6ae7d575c6e14c4f04dd9d5c404

SHA256
105679352eafd6c22ce1b0eb546fec880d06d294490198d51e746a9d212e9590

SHA512
029624f7eefa914fefcdb1101bd3d2e9e6cd0069da32fdaf7888706be5f53acd5df1b0579babfa25cd83af5d88756df1957ba54b0dad1f806ae52d684c9f8703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60a893a13f0ec21921675c61cc6c45a1

SHA1
fb66e0c2f331b9a3e481bd5286dd937faffdfb77

SHA256
3727d5f8a078181b63df7bf66667db99775c5aac335df410ba771c8b939f378c

SHA512
3323ac6140600dcfdd7f6e7932b1270ca23ccc4d8bd13cb728ae4863336cdc3def678ad677a7cc568a58c1a43cc7649b3ca5656762ccae8fd4b98b276cd502b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d776bcb364144210f7270eb1e23c59d6

SHA1
b5bbc341bfab0096ede1d8a8b05f8076e62bf725

SHA256
0298c25aa150dd3f4c8eef441efbed3db50f23f57052e8403c85d9ad11dc5c27

SHA512
c26503c6fb778bed5a928e3c5329ef70afc4bddf9d601732c63aa95a792372fcc702141d87fe4da441e5e433040692791c294bbefd293ef9c3efa9d54bb55c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b96bba83a846bfc69f6f7305865014f

SHA1
0534d3d32424e2f633e5b406d39cea9866e74152

SHA256
e1da7b7bb0f62426aa21cb8e000ed54c2971cf7cc2071851896d5ee68bab2b5b

SHA512
2347711dfc4d5b8188bd819243ee52451ef82526bd1f94be479644e6222ae2d3ede4582f15e4985bb38685943200d034dfa7678a07e70d5b15b23073511a9c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34aa7e79b6a1c6840c66efebc78b506b

SHA1
da21e8407d4ead6b93ef8603101eef2cf9381851

SHA256
9c525dbecddc73eba6d07416b11b99dd0997cfb5d89e1fe794b15c67cb570107

SHA512
e8961b4936a9faf436572b2f825a0d91dd6ad50afcfb7885dc5a075fd021a1d2d0e92db98da2f626dbbbf7c60c0bae7b39375a3fd3342c013fbb7cdcf0585e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
527ad053b4d5cddca510af618fd2a1ae

SHA1
9317be7eb6feb22f867fa99d4b345807e244892b

SHA256
b88657a9f67a7acd164500ef04bcf76a73c77f2a987b8aceffe14dd87523b1fa

SHA512
82e998dd8d4221a78dba3cc6b34d74703210b1442d892013d4356f2c3fa93aa3910a66909aa015dbdb10d2a6a4970aed69d6d81e56de6eae538e15ab9a68d2f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e13d822132346dafa9aeaaece0092952

SHA1
1a4beba6a6255f8428bdf3426649efe2fa79480c

SHA256
82327dc8d2dcedae987ea862c3f62f9ea8c5ee54133aa4dbf2434c70e29d681d

SHA512
b1e9754595de51f86e09a6756cdf76b15d8e687da09b2b0fa4a84ea7ac0dbb9ebfd853c872c917adcb960c8a304bd952a04d03c43b448c6c69b60856b5f0d3e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f524e8aa053725e88436bfe8e1e9b7d0

SHA1
de7b2eea54228f9a92c5e7eba0f2ad65e219f8b7

SHA256
31ec7cc6f4694c9a80ae5bac9ee01adb389cbf4828c44c7266d7dafcc223b9f7

SHA512
8704e5a85b5772a648547f6a32a7a24c0f16ec4fe5eebcb5c34bec49b41b5aa23625df85a88ee8b11622ec7cd0b0cfeccde364c40bc73cfe35a986adca13268d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a7677b4b4abaf14eddd9548ba05fc86

SHA1
464f361851f1b210112ebc83e0db5e2fe3f271ba

SHA256
76107f4f499b71fc0425888df1502a7fd4f75785c957123416b5ce331929d2cd

SHA512
09fb39be1e0246b13257344ecd6673ec7dc0704d8f7beb18d0828d6bfb45fa043c15bf5e80a4e9c93fc90a2d448ec4b53d7e372face8496aedc114ed37362aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a80597ac7c6de438e9f44fe037dc73a9

SHA1
20b4598160edc71b2f94a34d72a7fb3ba3c25692

SHA256
6dc2d968bc4d82be9e3b3a72fa830eba2e32414c9d55583390b9bc58dd4f7f07

SHA512
f0a783f1946bd1a7f36b5a977da9135198740c990dcea5122ba1e89f8e7d00dfd71520e653d8e7d0b3ab69296829811ac574da8f3b23e6310702558cd13ac924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c846be24b6d77fb956b5cd9f064f6190

SHA1
bb8680964bad86562a4202a1390ab047bf6810d7

SHA256
61a29c52aad9488dda498210688315d97a8660ed4c91ccbd235059b1a4b6fc2f

SHA512
121fd1c6d5bd584a2848c410d1d668e96f8d27f181e9c30df3d05c150e836bd73d0ccff47da57e282c8f8bc7e1efb927720aaa70f7433c5e037e91d32bddb612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76f3cbebdb6a481d9b6403b9be73c381

SHA1
3c729752587fdb56ca90736c792fdfd8a66c0a03

SHA256
b2e2844ca65b73a1b0cc8c4666af3cc3b8be80d917f9f3381c36e72b1f001ae6

SHA512
66f9b6c25a5acdfdd477ac31a946ed7441866a7a3fde44c66029b06b8bde6e3d88d771ddfc218f9492156b67189ea7fb7411cf30fa5f80a22b4370f8f408d7e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A89.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AEB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit