3ec0db695046433da27f2834f14fcedce9cd3a1bfb98475919df01ce537edded

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76250e694255da468dca5d3d62f2c603_JaffaCakes118.html
Size

207KB
MD5

76250e694255da468dca5d3d62f2c603
SHA1

c14289690599b3811ed9ce0cd3b68d4f9b0d14ba
SHA256

3ec0db695046433da27f2834f14fcedce9cd3a1bfb98475919df01ce537edded
SHA512

8fe6479486f930c38a5880ed28301e9c3f5ab0d4c767e7ff58f1a215c11fb9b53a8bf816f2d5dc347874361e682683cd6dafdfb8c4b1dd1db4a30f9e45527b10
SSDEEP

3072:YMckgS7USK0SKCj6yfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:8jfsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e085a0f98cafda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422904139"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000002986ad8514b1f4cb1189621121b3f33000000000200000000001066000000010000200000000dda23cdd0883ba74b8f56b38f9030297d4e0e384b5171ad16c85d297d6b4fd7000000000e8000000002000020000000a8aebfb0fbc5df0b6cc450f232ade3e971d35a03d0c3da1979b27920865f45bb90000000e4f61865a0a89e80d21fad5ad2cacbe8f9e323a896ad707c7168b6dfcdee7ad5996a745793e51d58b996a80a96e3cea7905c46e977fad3abf392a0d965f92cee5d99b722ddd87cab0dcf8e3705454c88f2e669d201f1d869db13b0c806fda14051f7a4c7e73219b908fe905d9b5b7c1b89086c2d31c20b8838ec776e25e3d9439627f8131600c63ff3d46f305518894440000000512b414af8ac4ef85873b0f8b490a848156c4f68f73c74f0cca70e2022d508025b3436f732a86ddb722bf95fb319a884864c0e14a58a773624e149142cc5a0dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{250AC791-1B80-11EF-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000002986ad8514b1f4cb1189621121b3f3300000000020000000000106600000001000020000000e58dd7bb5cb25ab631b8503101c9fd98343cf4b2bfc26b613776dd0319b6af2e000000000e8000000002000020000000f05ee9ffef410bb3187940d2d0225adbea4eba488fd9c830b0126eed42d4c1f0200000006d993ae4d996d9e0520063355a7067b6529a80a20c2b54fe8bb664090787ef1f40000000396c9d30389f1835614e97ab07ba12db6da6d0b476e5ad9846857e7dc6e970f8d03096f6449fccb79fa015d650a5981822ce8025c2ca31401272218d42cbcaba	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2444	1972	iexplore.exe	28
PID 1972 wrote to memory of 2444	1972	iexplore.exe	28
PID 1972 wrote to memory of 2444	1972	iexplore.exe	28
PID 1972 wrote to memory of 2444	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76250e694255da468dca5d3d62f2c603_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d70262ce255e2a68ef3f7285b00708cf

SHA1
8f6e45ed1e258328bcc47a20d285a26351abf540

SHA256
1173d5920c9a4b05fb7dcf3878b4a0c4b32ab06acd91aa4b694d61c46676cf2d

SHA512
ad110f696a08cfd328b093eb5791fe964b0b430c4cb12485451742b5c8ee77d07f551fb473c90205dd23129304e9f2eaeaa9a604e77850668555b3a16f106f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
786ab3d0988848c74b7228bb09394f5b

SHA1
53bdb255ea45ce77db21c5a51eed24ad36121ade

SHA256
bbad498e1b4f99458fde11c60318efc46c5177539b5c7081bdd1399b2e915f91

SHA512
92d8b76b62d6dfffa876ee33ed4e4b289dbeb422484b759367b8dbd8fca3955054f566f164e994b09448c27bc8580715ebda69a8338675830103700e09f405e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a53d84c512530f7e47d458fb1ffab0

SHA1
4e02ab64c1d2ceff3ac29e3483643430a1d3652b

SHA256
10f152d02c67983e9eeb0f17a20b89aa43d0ce1e01dc73d45eccfed87dc80388

SHA512
979ea9a4ecbc28f446f20ccb23efd3e3e20035decd6e5b6ce118e0618e2f48d372b6868fca73644fcf212a768a2116982315ca1ec5e84fb1f2727878b954a13e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d343090a26dd2dd5d049be27915e312d

SHA1
3ccfb7c5e284a6e604a03ab652ae012bb313bb79

SHA256
39fc9a6b13b08fe2414f8d1d60833739d2bb60529ec52c2b093b2d72b78093b7

SHA512
69004fcbfc3eea86cedb0ece5581a2516e602372e647bffe61b0db2649d94c2154dde5967a12111e8f38cdc913fcf29f0b22c3c2b3d797560a3fa29fb50ee5ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e73e238320e1325fc9243cbd91234a5e

SHA1
8a737876992ebde8a3294b6c32e715cbffde5d04

SHA256
998d5cfcccc55655d742d09f0be3d8e4465c6afb1680edb39eacf9a193896554

SHA512
ed2aad18e431e11d79f0fa249d85cd3709b995c350437e169751328177ede64698e9c41ab1874513f06a1ae042d1aeaf643c95c230abb6a6d6ba2de66fb32c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc3e97d983e6aa20e1de14a96deca096

SHA1
e8f8e85a921c3eaa00ad6197b1e156d85fb0d995

SHA256
4d79a0ed1f133d540ef8514aa3e92fe57b87c92ba10c1e00c63dbb9c49d22df6

SHA512
b167f3fedef750ccbb3fd4caa9c9ca3e65abd649c2732cbbfad2e30d9903ee5957e849ee8c35755921a5579818dd07c24712bc9a6a948f7260516cec8d23db7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96e6b15950802d93ad2855ce4d430786

SHA1
b0ae9f411630879e0fca59cebfa2c4b837921d34

SHA256
88570e4a18cd5dd21c62d7d0c34c6b60c8306f2ea167fa555a1c27bb33eeea07

SHA512
e0d2d5556eb9bf94bba66b4285142eba8ef1f8802c714b6184be94bc745942ee0f328a8b60aa7c766d295e570b5ef15c7b6a0a3404df41d82c4719d6db041b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dfc3ce09ccb4aa19417618d79100d5f

SHA1
42edfb6e3e935526a9f77b15f4fc9c1508615ac1

SHA256
179352292470a9dc96b1ea17feeb41e07dbfbff45080b74e1df478662183f5a6

SHA512
4da997faee6a74c9947668b7baf2353976cdd89f7912393c2c0aacdbfbba04c7c043a42a83ef9999e7a471cc94a7047bc90f0e7eb4ec7d989537a082808baee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba034c3d33c799f21e74572432cec324

SHA1
f591d8bc00b8f6c8b2b5bd71588b2e9593c5cf53

SHA256
e0f50cfa82d5bd8f1cf5a447b6515d53f7d8ed95f3570d96fac42dd82c2a7404

SHA512
072007da2a4bed6ec68f0c4b781b7eb94cb0076a98c3022ff419c3325de6a9a6c6fe47c592024629bfbd58c35709a32edff34b197db62e0518370d59519fb98a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b5ffd8d72dcc581c30d3eb7208946e2

SHA1
69fe58cfff77e1a78ba9197c79107c4c12f21f01

SHA256
a5a367b2baa2778c0cdcaf824da30cd6bac588554e8c182efae1df201e89614c

SHA512
4c68c1251918a6aeac6f0de3e881595fa9b5ad7a9c0d1d0f9e6b16b8363713440b17d11bbcbbdc1331fd5a06ae1ea63a5cbb9f4c866168e4b3be25833692fcbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4913ba4478a3f6872f7423039ae5f43

SHA1
508489646383dfc398481270675ab8ba41653c98

SHA256
3acf9e7fe3a1ef1a3b27c31973ad51f5d4987a0462104be6eecf78fb69534f7a

SHA512
8cad20d61e13463b37db22b3fc2edc2d4cb5903115012684ceabb53cf5483075badf033e5ecb3173d2beac7a6bc8bc8ccb3fc0ebbc5cea04b23aecf5f951331f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e51c21524524323cc6b28bbfefad1d

SHA1
9c06c4b180076595a2f8a9bc02f941c06eb85ca5

SHA256
3072f2973b55f0c4b133b82ea302ddbd8f488d5e32baf1fe9eda7cd9891f296d

SHA512
8bf610de277c19dcffdda03c57f8ab2486c3eca85f05e3b05f1ccf82fa5995dfbdd894ef5feb8f2bd88622aace0a7d82f2970560c0c3ae3326477dff84459400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad8cc0a1bb7f50d5ad86d9ebb1898c89

SHA1
c33f3c669a5a83df82075727a045724c0ce36f61

SHA256
0b019e54309e40f03aff85c28627ad6b68a4660bdc1c4d9f1e1a4171aabf7f90

SHA512
6af46b072ca2fb55245b98e38861450462e6e4132eca968100d1d274bfc9cde9106f5b835526adb48af9e0df9bb3e19bdaf40d66dd0f6d89a9500aeb00af57ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9bc5c7a06bc1e61733820728b03957

SHA1
8d82e1430d931bc09e4dc62548e2fece294d3f03

SHA256
bd3a42640a835994b12eb3502b307fe8479da6145624027f5e6fd4e5e33548de

SHA512
bdc88321e33ad89387738c56928b3ee08f08d7ba5304f17c255ed89b87c0194e560133ab9ae8f4acda75d58346a90e0e11f072047860be898406da3276e4a9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0db69b0678170010808cbedc1c757f4

SHA1
49bd2121e4181f488f4fa77a4e8c2e262e002d89

SHA256
8363ce89f8879aef811583802f2dbe29fd93c99ef9c3f6a9111d6a4826045180

SHA512
3d500fc657f989e08a3ee86e82c83735e9d4dc4daae2d0875a7e53dd2ba073d15f67bf7042772f1f73921d54178f2a69e01e4cc676a24c930d33fa5c66464097

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49EF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B8B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit