1fe84274092f27b0e5bce7693a6507636d5bf44a41d830e9620f4e181e5329e7

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

754cd0230a647c45ca876c80d9790613_JaffaCakes118.html
Size

463KB
MD5

754cd0230a647c45ca876c80d9790613
SHA1

ba89090f04afef012995afa90ef83b8d1c0d8677
SHA256

1fe84274092f27b0e5bce7693a6507636d5bf44a41d830e9620f4e181e5329e7
SHA512

5baf8126acfdd8f1cffa27166fc6215127abfff5d99657c7d5843418f2dc76c89d46e05f3b804daf24786218ca2c48ba57df2d874e7aa5674b7ef67ca7930904
SSDEEP

6144:SBsMYod+X3oI+YxsMYod+X3oI+Y4sMYod+X3oI+YLsMYod+X3oI+YQ:s5d+X3/5d+X3U5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{617141C1-1B51-11EF-BBEC-C662D38FA52F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ce023a5eafda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005303733edc3510f9f7367731f9c3ef7cd3bb3e93528b29ad9035394d09982070000000000e80000000020000200000002d25c12f4d317ed022398cf93100d2f276e9fb15729df30229ebcd47717369fa2000000064ed658fa5333e13125b74b2d17c4058d5b0292fa92c79fd8e2fa842d7f842244000000087c6d3e24a130fc2b8c1e18c7ecf154681fdf681e5021a098f7ad3b07234cb27cf4ea9dcde5e3289f72c5f838bcca57dcec935e1638d1c7fcaef1d019b5de0c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422884048"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000324f787b3f7c295ba0f80f8912e0140940aa6f08afe96867db967a708e62cd79000000000e80000000020000200000009661af701a7e7087f71c9b4741873e60895e64ea8fdae8fdeb1a7aee99df53f590000000966a305caf90898bf6b46837b3399a26ad268e51b14d778303921030f1006420f9cac782db05bd51fbdefb98be58384f86976df0a48ac9553e0546a8f6b2dd6e11a4e6e9bf0cf3c2680a9e461275eee608315ceef7a85ce80627e5d42ffbf3720e2e687bb9a047c9f252fbc3aade917e6b38fc6689202dfb56d79717e5e062d28ecd4f1a4f9048aa4eb48fefec1ac163400000001bf721406733512991f1bf7d1827ba6a51a56da9c83efd1f5608cbdc6ec737adeef04ac708d2f7321dfc36ff651943df5c01eee84a6a51a9102fd305064b434b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2148	2460	iexplore.exe	28
PID 2460 wrote to memory of 2148	2460	iexplore.exe	28
PID 2460 wrote to memory of 2148	2460	iexplore.exe	28
PID 2460 wrote to memory of 2148	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\754cd0230a647c45ca876c80d9790613_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5f26007ceb06c9349b885b33e1e847

SHA1
c359be8bd370db96c88c4938f08244138176688f

SHA256
962f202a41e3e5742c6f3f2deb65ddd1a7f268a5c44e2c9f6d4436ca061b25b0

SHA512
9c79b6be91be9bbb75219797ef0887ba309930f3d1199de8a2e673b0ea9bb7ba8d03d491aa63b9b718c022308572ab1190af3a0ca855f610c1a5c54bc28e6686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4185e7e57217ff54b47b1bfab7220cae

SHA1
b2cd1ed76db753492056630f51d6cfe3286855f9

SHA256
16e7d7c4b0678b5f714bc02f7a2cbe54bcbdb004ab149b3ff71db9408e4f896d

SHA512
4725f9051d48b70a7e68451a496caccc776511c443e87bbe86f091b641b76183494940d19ebdde34104d9f7cbdb514d44e1057b5d0b4317e89b0f3ad976c4b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0a0f2536a8b8ce3ef692eea55efe0bb

SHA1
1d9240983c0083de1c97a9593fe4ac2a640428f7

SHA256
9566c3ee2ed2e2db4cd7ffbf3dab6d44fc9e1907cde3b9359a0a8555e9339c72

SHA512
a753f2a688499ea01237ef43b303401ec44dc1e20e1d96e6993bff454a4c25fca0b5f9c5ab3ef8f6296b4bbed72364afe88685f8d5630ea69ce818db6c369e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b1ae9fb2849f01af03392bc06fbdfc

SHA1
3d4cb57d9b5dd89b78b722e20bb2c2d6b1d62380

SHA256
64f264942c06707938e0285660932f3d961972c6089f4a2d1371c077f5f86469

SHA512
24d3fe5498c1a61232836143d3863bc54c088da344a531cc9046f4f8126bb1ebe617ff0ecf65477729603d78c5948b2fef4f5151819cc097e2de37847fa9fa7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
372a0097340caa41cc9243512ad1e7b6

SHA1
dbb58077e6cd294d4eb8cbaf434534dbf1c087f5

SHA256
e8c81262a031b4558a5f7faa88466784a3c4f4d86a8c9073335fbb645eeb4244

SHA512
7e2d7d5b607ebbab6fb2d3eaa50c08388a396f11028a7be9a1042d641d95df3d04a33ae808d7ca5ff7204af910d3923c71fcef78e22021f705462aa24ad2530c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f56d8f7e51212015c5367ce1f800b69

SHA1
eb0c8cf477e9117ad28c6ae44c8c45e140fe631e

SHA256
dc43586a0a6c3e472abf993331240d282f7629a2ae81116effacc35b693849c3

SHA512
ae27a3ca45d30eb9880d02b3bdc642a2394c33fcdd3042a410e963235494186d4892348b9e3c1d2014c57850db6112e8a1722777c2d712f72a1b5149e1eb8b39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbc802fd416a30697189970f42798582

SHA1
94e2f0876c714635f087e4cc4b6188850f6ec7a7

SHA256
4f5c3fd49083d474c312f3684fa69eb0318d266b38d1c65ee3dbd341022b0a0b

SHA512
c63cdb46754fccf69f6404e59a2b620a75e85cbe7e56b5f6df163dd8875ba565af00cef8df1e9cbfd94f82ee517a0ab9357bd9e43ea8f6653950d503bfb16b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4736096e0d04a7522f4e12c656a233

SHA1
52a84cb05d65712655046c63415d6f1ca9a1b030

SHA256
efea75c14a8d59f28ec068b96c8db327a6e6d453ecae9c4d9f5bba8958aa2610

SHA512
8c85b6d2e6b02f6348a20213d9ce0ab59715c54acde8506882dd1da5f6603e0eb0289b026ba6b1edb9fadc2ee789778a001d9c7af014b6c914c8fd3358852a1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b53d67ac292987008100f75f07cffbd5

SHA1
0e5af8d1a07b3c3044895739231281928de68954

SHA256
111f0bc4fa8fb4f72a6ed372c46779c18f49ccd9666becacb194b9fb348bf958

SHA512
e6435d989207f5dd9209b0925441a2f998b2b0005e6031190df8fedb6559b665ec15d89edd3379f61addb8df33c6ff8739de9f70bdc5b4fb7c0476b94e2197d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d2365ffb05bd9ac1cd99bd020324bc

SHA1
4884578e7eab8d9a471c319177690082a23d5347

SHA256
2dc4b7ed60b4717982aa3e2f4983db636e1b59fa874a738e61065a2cb11c93f3

SHA512
3f582ca5c3742f6601da48453804c149b11fdd47e6cfda23dca4a5bbc1eecc5bdaad2769b91a15ab5b633d0c18e5959597ca69416e6562e0db4d6f32b1a41a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f87670cc0bf4706e8651b70e1f3937

SHA1
a7c62e7d3c010dfab8618d0e6db6f91fa4d08377

SHA256
945049e37fbf382ae64f8044c68fe19eaf98a19c6ac06393e73dcaeb05ce69ff

SHA512
2db77e965710006a539dc950945b4385d68ca482976aa0d118979d13a29fdc875bb2482f5ddda92f6dd872bb784c17f2837a0281e9481f28c3726c6a4934e20b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1ef2e70539d7e0b597177b4b87c5d12

SHA1
c6950dbe969379df527fcede9dc2129c1d5225c3

SHA256
359d9e3551c0bc61352c128f9c75e3c06d0b7e22610173e21ebdbaf983293706

SHA512
50d36ae84c2ffe8e2426c9b538465ef6ac077591392328ff5e4f4e01ca5f60fc5beb65075d3321ff8328f517c0b47a9360ea092064e6bc4a922b83cf41aa5c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cc923d0bbfba8800982504e7d321539

SHA1
acc8ed095e97ecaa16cbd667985e9e518f420500

SHA256
84910e80a6fbfcfc23e5934b8f942cd20c17b9745e9eae2c1f151aa0a39eb5ee

SHA512
7e4c40a1383c3d68741c1291126b18f17acf416fb8ea2b989394c7765f780d76228d5240a44112e708961db9a459d3e929df597b65ebde687f5a06e6bbd1964a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49FC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A6E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit