b8c83fb29e831d6c86ed84fe7fb3fe6846e4564a7c3ae2472b6dbc3859a11d83

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a5c681256f2be111f210e63c272eb9_JaffaCakes118.html
Size

213KB
MD5

75a5c681256f2be111f210e63c272eb9
SHA1

d91c4a6e07336e570302b69a0788b089ea5e9861
SHA256

b8c83fb29e831d6c86ed84fe7fb3fe6846e4564a7c3ae2472b6dbc3859a11d83
SHA512

1dab22edd3bd0241979eba45c99001fe80bc834ec63007e7000f69c09b06bfa0c37504955c61e85d73cf10ca441025fa4866a85da8545dc4c62da84df2f8733e
SSDEEP

3072:SyDshxntZf7kVrdzyfkMY+BES09JXAnyrZalI+YQ:Syct57yWsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D65AE7F1-1B67-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422893693"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2832	1796	iexplore.exe	28
PID 1796 wrote to memory of 2832	1796	iexplore.exe	28
PID 1796 wrote to memory of 2832	1796	iexplore.exe	28
PID 1796 wrote to memory of 2832	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75a5c681256f2be111f210e63c272eb9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ea631c9e6bea9998eb649354305f2e7

SHA1
39e87f38ee19d60c07811b30dd22057f7e62963e

SHA256
a700b58e83d9b25609b0facec5aee62740631d5c371d1c325bc4f95981a97994

SHA512
0660833dee0e29f6ff9c4d89ded592c936b4ba256fa09a954a8e1bf1994fa66497c86173402a00e0da0fbc88aa97ae4618ee2821a765d75e541611bd45fa1850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c87e9e013f3ea4211875da77d2137e0

SHA1
f174a03fc3f58aadf1a2cab183a2bd9433c358db

SHA256
08c6b83b54423ff3ba39deb0d041c1fd14ae50ecf6ff76d613e1e275e48668b9

SHA512
95aa1a9841e1687e0e2a783a8768e2e90e5a706dff99518fc83bbca745460f9dc0888c6d8d3d8d7692c5bb6c448d646732cc7b152802840d40f1037b762d170b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4038cac698d06d9d6329e81561c49d2a

SHA1
3863fe3d2f8f94249a091e768847bfcc1e7167e8

SHA256
ff51f39df62ba4be734d25dfb9fda9f1678bd1a56fea0bc9e3dc69978290ed3c

SHA512
4d54ce6e9fcffb73ab134b577e66b212a7fc9eef60a454353af051a4e7289b7ca36bac6e51742596a01e5fc1cb2eef8f4e8a68ed88e7af3cb298520960db352b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a88bf6cd50d204790168209c61b3aab5

SHA1
72f4377514519b2f0bd9083777aab4ac175db7c4

SHA256
6cef335ee10b37ff609bd3ea4c0322fc4759f3f3f301381c7f7aaeee54517535

SHA512
a7a7c231d2dfa2f9595375179831888a61360382a1d553815f2f3559fdc67e4f79def8633d2477588e19a25561ef4fa358aefc661f80b88fd085e7180b556f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb532a32b9863745ba1ab62c18dbcd8

SHA1
157b19bb6f4bcf5bab5ee35cd3c2413e7d089ebe

SHA256
188cfbf8ff942bb4606ac9288ea9ea427f22c430bad20a9e45839a63280caab0

SHA512
65da60624bb4b0d6d28496474d348adf4b1de6ed6cf88f36431f76d1ad5b53529f0d735a0c1e0b04df318eaabb74e4f327be1a3787b5803cce3465ae1b72d46d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bc9936240e75196998cd54b1cbedf9d

SHA1
64ac5038cb93299907fb1cdac534d727313ee458

SHA256
3fbc337f33bdda70ef7ee7b12c13f95e36513a0e9f5b10b3850bd452a7a27319

SHA512
4c23912ef3150e58a210d8cc7a2145c0c75a74edf149e3fd5633d82f7c497f7430564e420d9d2756314833769114a99011697d351db3d8ac14ce573c817acef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bee4d5829793ddb8e5cf44c8ec1dc768

SHA1
96c522cc96b38ff53d4f277e1c17f7029bcb994a

SHA256
ddeae82f65ba61c77492622c88ebb8e8f2099445d027c0942837a0e0278fc83d

SHA512
c02ebe3bf572645d349e1cc348287e5e94d5ef42210b26ed6f39d4059946c5e6a5c73c8b70282829836726c76e4737eee23004e6592a2c04047ecf3da72ff327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62907ca1ce0f7c7aa244635ec12eb97c

SHA1
24bac0ec2c4575dc9bb8b444b92eb773a74c9832

SHA256
15679f9928706ae2482e1db488ca64dfd437400266d2c3364eb2605bbe961898

SHA512
e7064ad11f2d7f0f97e01ef3789fbaba3cb747e4722e10e4d3f6b215d5dc23770f942485a0cf624d7750879be059a9b453605e584743dfd524413edfb3e83b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1c8d1ea015929e4d0d5291aadfcecfb

SHA1
07b6784a7c04b46a839cc215a46c11b605c86624

SHA256
2349362d5088f089fd08c689627f34185074756e1c9daa6768be2ed4670a68e4

SHA512
41158c6a8682cde89d7e3e9e0f5c8a1f7132f4979655b1c7d42ef7957ec088d82e5279e73c462bdcc69d865e3458d0636a7855dc3ef4cf75ab78d1cecabb78ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b323e75e0e0010ab3bcbde239afb75f

SHA1
a5019e74b8716f6cab2273523ea7f59ba7a9f45d

SHA256
003e94e6c6055b832e71fcb969f449b2c15f3a120f2d9154f27d4cc1675da1fc

SHA512
9a234c3d173834bb75baaa616ea3bce3b96fa9c98c2b6e6ec4ba6d4d1ce63f338d494accb50ef816f885b4f545b2a03b38163463ad0bad8be18ec5f83526ca96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f24bf7bf57acf83e1ff0d401510cac5f

SHA1
8b352ce71023758f2f4d035a14bf334c9b3da77b

SHA256
82a03e39eab14137c14b1897c8910916e612a8facc70ad7d107c118fd4d20311

SHA512
d18cf29a89af6802df69e12508a08e67ab81a379a5d79b127f446af786a935f15cc1ff5b951185667b4c184c692222eebf94d71f1cab7ef4332ef6edd0293aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3604597ca7dbcb0732e30962170be43

SHA1
4a1cee8ca3209c5f06907697e0fefa4fd1fc19f9

SHA256
af0c46238902c4463b57a2de20cb74b7cc319c8fb6185d792d74c995d3077853

SHA512
6c667dc5d03343eef0d4b9c2c194094c431ae1d01397fae8cbffe256f8f5290c15630d10105327c28c5b70afdd903031e075c0362afe28864ea3814515a653b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49eaa2504b5b15390f081149a8ab0db

SHA1
2acb7c1e8dab84554d40813412a3f320e9bd1082

SHA256
ab7fd9ed6b9f9bb84d8ce0d7ed1c234c2a0c79bb052b6149399e0f4652363cd1

SHA512
ccde498845b838bb4a42145031866246d9d255cf628cc8cf07dd2ef28bc941e11e33539c8cb7a1812939113519f9f3ef9d64c357783081f3f043dc7173f1058d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1de7c18223776089f5cd560b9fd43ccc

SHA1
6222316b9cc2912f59ad7ef504f1b70901324019

SHA256
91d5b55c9e769b17ee32bd69afa57052dde5c94a25f951f82c2e95013b15cd89

SHA512
4184724ccddbe4770aac345ea2c4ee3aec993a7b1bae2ba71c22bce13c5555fc3e937258671c54085d96cde86b6159c0242d91d80293c8794d884127ebfe9f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccd6b0deefbad26294bf961bc9257ddb

SHA1
044d231be3665f25097a466d57c308fb1abcbf17

SHA256
bac12d0a228917555615096dba62fc5d86353d39e6de01f26cf7d8e8c2ed2976

SHA512
2a8932a7adf745168ac4298758b0ef03da8d85b6f534ee36cb9d4b6683fe93b392ec6a2c64a90c16a0b88ed9296dd5f30b9790505ac5a615aa007a8ff85b9744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bafb22fed4d4791868449cebf5dac3e6

SHA1
d2a49876814b8fb65ec5ef24fc91b1feb8d256f7

SHA256
c5f9eab02e17419cb9281f414291e6b368e45df0cf1b3e04ce72d8dbd9f8085a

SHA512
2afe61d6924c7f68daf7a46236d483c1b2b4ddca6702fad3e96513b5786b77c918bb4d81c90dcabb8b9e5f7597ea596665a44c8cdc73c421682f3559133c17f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e03700f9e54355c4b51bc93be8b324a9

SHA1
2d4975251135c533acf0ec7955366de548bb030b

SHA256
d2114065661a4fea9b1b6a2fa7fab1bb34c402ff5275f41efee217ce014b6dbb

SHA512
a2f3dd4d47b3ae294388bd3d2ffedac568a8f3c0b9d40dfe59ff8c9ae17d562e7e61de6f01ed16aaedac94268a69b8e489e0dc978419041f5ff5ce15200c62c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ea908cf57a68eb4029686ffb39ddd7

SHA1
69c46d8d5fd5736a8e7c8d7ba88cd9d6025c11ed

SHA256
519c65de0bf7553507a08dd7210ebe999f380868650142f6379ecd49c27b4008

SHA512
e10b13757a7354dff2041fcae7e7249e2a862e24cded7e32f9651b10ce330bbb069c2ff6c1a551a4f735186abaf90996fda76ba79fb8d68c7b7eb1fbacab1795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d95f95e9e0d74e2ef4786b684ac25c4b

SHA1
0f393001d9a7a70e65ea2c3ca27c80ad0afccaa7

SHA256
53f3873b1b4a09819b7a1e9d54d0a1ffbfd9b43ce0f048e42ee1a0f35b60e72d

SHA512
af83a69439abed4bbb51ed0bc12108595fa6ebbe717f30478b21e492521288a6dec1d18fb1791986bcdd619c0b5e4f1908ba9665ed64dd981ad707672631798a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2148.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21A9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit