595b3fefe4a63ab84b0075deb4232f60fa8e9f28f9df6dceb7e793df63d135ed

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75e46c0b1e327621c2b6384f59701815_JaffaCakes118.html
Size

2KB
MD5

75e46c0b1e327621c2b6384f59701815
SHA1

a7265bcb582bfc4ce26620f9501d944d4a339814
SHA256

595b3fefe4a63ab84b0075deb4232f60fa8e9f28f9df6dceb7e793df63d135ed
SHA512

249443661ace58ceff765f331c45343a48f65bd1732164248f1e63b783c10e39eb480c4e016a9568c666f0325137f09c9cb067e861a1c11f711dd8accbf1dd73

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06ee45d7fafda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000362b1b7a664f048832eceeb72e2f4d300000000020000000000106600000001000020000000a3183f6594431c5274d1be5b17262dc3ae6abee02996ad3a0818124a7d3706c7000000000e8000000002000020000000e886a420b95a9ca36e7a7e28349547f28c8667a0e15154cc15334c9c94c6b01e9000000027639ea78f1b9a0dfd0f4d60c1b7813bca87ba4e29e1b636ff0b9a8d13bd1d42447b9dedb54bf9b82c80a0ea806a26f5e84820d376efce7c904f51ff1a55b0d69831665ae5f020d88703c928c1499a0fa5d01ce595ce3cddb228ad02b1729cfb7d84b499f683aa53dc8ade72bca0ffbed27d5550b6a9c8e739688c1f706850d499b6e229833afeaefa39adb9c8e4eb4e40000000b9a9931d18c5f3545648661819eb8b1e5ee8206106285e7ad62e07eb562aa0a7eb904c9dd97c24abe681b3ae430009f83f5b5a10dbd1233d86eba09f1c8866de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000362b1b7a664f048832eceeb72e2f4d30000000002000000000010660000000100002000000021936ecaca9f3c75007581ee757ca9f4c4c0c38685b5a99a4bbb6ce818d670a9000000000e80000000020000200000006262e795d4c86ecafb321df0f207c6332e248a9cb6bb597c3db31e508fc9294320000000b0be5f6b8ade494ab767a9c02c0ea971e48d7886ab81d25e582105d3e3c5b94e400000006c726bcac315e35b6de28005c94e03c719a0e9bf9a9c22f16671dc352e95fae5b9cdcbe91eae1c7b340a5fa5670e551028b345aae34b3d763432fda6f55e7f46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422898289"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{892D3E01-1B72-11EF-ACEB-F6A72C301AFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28
PID 1712 wrote to memory of 1696	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75e46c0b1e327621c2b6384f59701815_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2342b01686e12003bc9fbfc9c9e62700

SHA1
374e46283fd4e57c74e89e817b2f67bf5bfbe590

SHA256
10e2a8128cc14bcdc02b298687c9fea9aa1086b310471afa55dd9c5c877bd753

SHA512
8d5e49396165d8980f6ae3bfda71b71ff636217a78a58fe16182475b5f839c334ec36e4593d5eef5f88c98e9bdfb62ebda4c292490f8cea9c7f778060324f58e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d4e5cdda48ca2cbad915bdffa327de6

SHA1
0400e4e5bae38d544e0ced1fa5273f7d78869f00

SHA256
0c4fb4c4d64a14b965da9a05b4e654a1a73aa2e6ea876f50c45cf3af5ef4dd0a

SHA512
67845c874f7b07024f3477388776b5cf59b5d941ce0683170092fd8b317101cf1ae05b5da6e3189a2022ae663b78ced90c5380fbfb4028cc3de9ab76d662b043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd59539c8ebed71ef325547f3d60ec09

SHA1
bebc6bc3d2d46ccafb1cee23cada95d0f29062e2

SHA256
e977c630dd7aa0a323d22c150f8fa9d0da6b335f5a9b6899cdcf763ba853ea7b

SHA512
dfa066e3fb80b0e1945a4527cf1fdcf9683e538cc6de5981b78ea6b385e4970123c40c6bd61aa8379f7a61d18d80ed124f2ce0ec6908cae43d5d948f09b3882c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d182bd13580a0121e8831d322f063c3

SHA1
bcebf7f0a1d5a43a08f748d7692079e732f461e1

SHA256
c9dff703b9404fab0c46133879c5dff8e9b27fe4ab44ee3bcfbada3abc14e556

SHA512
d8627b8c3b2a06882bf5fb87b136622c5aac5c05aa49f2020d4198f07ad3810fe8078efc0371ccbdb6ff16484c587f2e44ccc095b87bd50ab3446118f73a5a75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddc9295507c06306e9806c106d607e06

SHA1
71e9d77cac54efa376e85cf9d60f94028afd516e

SHA256
9af4bfc3cb9209aa8d03d886d5b13b635c6623f8c1a8e31fb93b86b942c5c856

SHA512
03a2a117c54db40d997394b26ab5b6358dee1bde05c40218639fa7afedef005fd8fc0ae904509652ffa78ea5822ad73c7ffdc77df1606c640652f923e10ce081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4c61d7ebcf4716e7961f693090b90cb

SHA1
eac757925e10083dd676cfc18cf0501c232a94fa

SHA256
416db0d6bc6b3cc1587de52e1d551378bc27c245452280ea0aefa37b7ab7e37a

SHA512
5623ef05540a260f8b2e757e3072d126d5f1ddf9235204e32dd53b51b2200f1804e0d5f34d39b11b09ad353edf5de394cab35fd60a61b481d4b955426146b588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ccbfbb93223a188aae9286c77f2e45d

SHA1
4c8997ad0826286bc2548a558ceb84508dfb20ae

SHA256
89afa57a5e67d0b6e2eda0d36ed63a400d19d3bc50cf52cd6f460acd141cb201

SHA512
6be20909bd4f1d0bed04f33d8cfc3dad1e68e2ef03203338acf39aa72707cc24c554dc06aa52ff05cc13eda9c85c0c639bdd95e8f131bebd4af302002adb4ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60ab2dae7fae471e2e40ba59a828477f

SHA1
1b51c6c860b3316c29b9350766f66a863587f06f

SHA256
f5607d6446b7057d1fbf8b445c920c8cb98f4c9378ec20cb974ee298bb33dc86

SHA512
0106f6f4081a48b6ca88c02e5b29ca0cd14d3541a3e6f29d75d58b7bdeb002fed775d2d85475395ec812f8b69cfd0574f69657ae534923b7fd08e358abf0f5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf2b96286ae467961afd2b81cbda079

SHA1
65f3d1d036b6bc461aa86e0ebcd234e3942ffc4e

SHA256
f90e26b742abd0c6ce0afd318404213e144308902ffbb770873355867529b9ca

SHA512
32c2920017feb9034f27336933d5158cfb35cd7e2d60f4a5a24107b834818879c6943c3cc4275ff8c14bca90fb88bc1dead40d36a5ed5630e4d9e6be5b236573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c027d541514f1b034ef4e7de8980efd

SHA1
608913e56081fe7ad05e1939be0804d9dd7c8806

SHA256
74f56b7df268384bad558142a86d8827150d17c682ba023cfb2f83e768168c0e

SHA512
519ba1c65d920ea0b0feecd65cf23937fa0421c9bb23e1405faa03a413a63cc2b3bb532faa2fc4f2252adcf87122b1dbee076e8863889b89284617632ad387d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2444.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2575.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit