59b8940ca35f410c65b7a640bf21d95e54d77236a63b1f93a189bffb9c62e0d8

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77ea52c684c15b165a3cade662ccc637_JaffaCakes118.html
Size

332B
MD5

77ea52c684c15b165a3cade662ccc637
SHA1

be05a3dfff3d409385ffc839adbf61b47a91911d
SHA256

59b8940ca35f410c65b7a640bf21d95e54d77236a63b1f93a189bffb9c62e0d8
SHA512

957b2008b44a3e815d0f9dd28f395068a43aaa268529b50d205612d32aacc3ff582100217c5daf992bcd8198fb660e4cd5621f69cd40d9829b7ad67e85ca97ac

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b4672d41acf35af369b795b3b01fa3f4864a0f41d346d724995a21a89dadea9c000000000e80000000020000200000008c3d87fa0a6a920cac2857e7f73353a0c4f91f008f2492476b1937ce307768a120000000e5fd8ce9e198fa2d3952fbd8786e66dc5ea170c4d0e47bae30427646899df50440000000656a4f43153ced335516eda5efebdb41a44dbcc2f1b6a7042a2e5cc59825403fd98468f81ed9669dcbc1880b35b7f9a0b8fee1660c9c1f8f1949866dd37b9dbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90592255efafda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000005f7b858d8249c9a98e3946cdf2d95e2121156d1305265a2ae49aeb3f5581c326000000000e8000000002000020000000e443b91d7b26e57419921c80a8f73e7e33aa4193086046d59cae87544d14c77090000000b5d58ba66574c67e0de53dd6b4b236f93f818491d732cce1b52354d45910c1d13f8b2c44e48514820c4f0aac0f06b32f4a25498d51a8795fbe1d13cd86045a2961413f488d3690065a42eabd2807f6d73bf909beedbcc54329f1237af7f140915fc2a6740bc40336ada5910657de1cf4d43a9f9136202ed8dac81324a9757619f24ee6b80ca9b5329dbbf29434ec118340000000440d95609fef10ed4d356bc6382e281baa5b874152c61637dadce7474b13eaf6785646ea5f31b19b2f7f46a323bd64742e652a3d8fbc55eb6456a62d90fbd200	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80802F91-1BE2-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422946378"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28
PID 1700 wrote to memory of 2832	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77ea52c684c15b165a3cade662ccc637_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d979bcae76266db2a961c6324b79b7

SHA1
40099a04d849d40ac4c5017b3046aba46784446d

SHA256
d1390bb42a87555106c96942d17114e4672eccafd85b35ffac9a3fe14088d5c9

SHA512
38d4022f2e01138a2faba1797ebfb610b87517d6c027d288fe48ef45e144d3347e048c66130b233a4f812d08304d71650322a028e2eacd1b0b16b7f1d68e4e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac37d93bf12a566d1a2381b52f226452

SHA1
6cec39a48d073d65c23953d201b877d9984fa29f

SHA256
3bf12b35e5207b95598e2c2df7efbf1a4df9dc684af56b9aec1b5598098a0200

SHA512
098ed61bb6409d4b34206209a1136b00f62a275a0221f73ef5157f8545409946d3e8104f98db3fe71002b28d127f979ef57c7fdb86795dd86925a769c18a745b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb1868886950c2faab6c185fffb2b2f

SHA1
7face71edc4d5359b26211693c6fb401cfd492a3

SHA256
06a1ded0b9f14f17e361a9c1bddb490a91ab9977aec4a0f0c7c05e63905a1a6e

SHA512
9f610e1ca0047a610510a09390bcf63591822a70cd7cb85dfd8da10ede04b46ea221f171c976d664e92439194bbff9c4e50b3c50ca2ab5801fc1556e416e735c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e3278b548a4c2cf9686ef2d9068dacf

SHA1
731674fba26c0975fc5146b94c1b566fe5e0a58e

SHA256
e61ac063137be4764a22baeee16d683f950e95e13b8bcbb6996e7dd7df6bd7ed

SHA512
d87c814ad1223125ed56e0dd7eace47c581bd9acf877225a5e7ba870723f393feeeb725bf9482a24f88b1e9af5b39ade286be114b42988f461fcb2749af736fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d07e3c61350edf70736195f1ed443a34

SHA1
5ec7b8ca1db8036f017dd0fcd22487c5c15d97b9

SHA256
7bf5313931be54bfa51747aeb3f2960dad00ebbb44b84e897c1836ce684d8747

SHA512
348b626c9ed1bf9917c71f7d07a5e6b6c298470567d074beb88b51dd07b8bf17835490448fc819cec98d05186b251f01b2bb150fe4a3f6518155261038e9682a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c164c1f5e8ce5eb7f5cab1123c80fd58

SHA1
6aa05bbaed468b7ae502f3a4b220a38700331727

SHA256
4603f7a4db4ef1ba07a17e083f29f95547efeb756b2134268fccd365fd0a4e1e

SHA512
ad0f83e2138604e4d4d1c21c6701e76b31f240202b8d7454cfc0ab7588a2391d39f8c411994fbbe246213225858c4cc1a96657ddbe1a1d3190942b7d89a0c191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4f841e747ca7bf5ca1ac88773870340

SHA1
52564f33ae73da8ab70bdc13294c51dfaccc8c17

SHA256
c89002129d624a265ca7feb5c3e3bdcbb03a88873c9e873a1295ac00f12ef338

SHA512
e5396b65c8232cd0abf9faecfd079f3d709b7da380ce09fea4307e38beee881bfb7579749004cedcbfbb7f617dc3dc1ebaab82b767711bfd7fcfdba3417e70ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd98f7aef8e1dc3ac9d85333f1a33e2

SHA1
49965f7d040848d60d6e2e01c6256ffd8748989a

SHA256
7a9872e01f89864c9e9f8e470d60ba8271fdd4b089ece53a4ced45a41216e2dc

SHA512
47723394a26b944d40d197f4ab46509294f185394049b27f9d52cf956a876c0d94729c3a7dd03680957c28c39ccc6b736700f32c9b00c734e32aaf72f3b767e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f96e7a5523f087fe1b76d9508063a7ad

SHA1
acc60eea0a90fa4b96f80804270a9b103b1b8ab4

SHA256
a9acfd6191f480fedea861a53abd2ec441053da95590b008979803852ee276fe

SHA512
12fb54a612f6946f7d28b832e9e65c07d36cf34fb7cb5a78b20fbf5f1c0fc4de2977c60be05bb62a1dacd9022321f133ea5a8f6b478b8a3b556e0a75bccb9eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f95731a054be543751f2edc5ad7dc53f

SHA1
9e1c246680292ae7ee19671a7a97c5012b6c4b0b

SHA256
8c77bffad9f4496db4a4432cdd5b4cf1d8f53f53f6e8502c06b9e34372db7275

SHA512
72ec2166b029258396661760cfa21423481ab6f704958829b440dacf07f39732eaabf7cb0fde24641923f0480895353d27c3c127881fc9b9a2e71495b0dcf5eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0184b6317d93496bf14f17628ee40a

SHA1
ea085276dcb7b5b130ba430f2b040b192680fc17

SHA256
1e67c8c2f4100bf50b93bff53eb0f83176189b2ffcebae463b6bc873b65fa1c9

SHA512
5fb84fd572128263e0eab58f665554b8aa28ad53348647732357a4a3db1bc68436688e1d607dcec3e81d341e054df0f53299b0fefa9af6bf39d61056cb2e6466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c97c99ce7f164774b5a6f103edcce76

SHA1
b887a530dd83267d14cba2f70ce492f14a7f2b7c

SHA256
ffe5a5ad834979279c4b16040f74ce081709b0df4105c336f20124e3952d57e3

SHA512
aa32cf493db1912d574b526e911da56f679ad2dbe7c4cf38c292dc23b9b8901f8770be5d82d0e3d0c34380f5c02779e3378dcd588d3ee45e3d3a061862ef3f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
898b179bc287ba6c4f2d491652453236

SHA1
1b60e95d0a494970619275683fa43bf12f20a45b

SHA256
12159e9532b9f3a61c364e3b10161a556f2c74028e2bd5d81e7491c5a5f5661d

SHA512
1cecc036a299bdf4756f2944c7b0dfa8a40d2de9acbe6f5bbc450144abc424294c29a95282e8b6d4346f0461d1dace019718fd97fd87874f0dfe575a7dd9a5a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d5b3f7c0f8a174d74869205cb382008

SHA1
2bab772e88f671f4079cb4dc7dc588f8eb290b4e

SHA256
9ac575733e4528aa1af46e735d86e6286db535a4b5c2b5576064e3d466cc43d8

SHA512
0b322705e7336d91ada72a5c0e180348c2582a9c10466dd7fbf163ebc99582ebc5bb7e7816bfd846686935f56094e252e16e15fad1e12ec7df47eb052e5e6c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7665fc19db475cc8c3074e85ae8a734a

SHA1
806178ae2b4eca8447d4223ec195c2b1166e78ff

SHA256
96c2ecf1602fdd560d7ed66cb4b18f1d3007efddb05d6ce05ec7d51758653f41

SHA512
264251884e43c94f80319c90d47a7d084fde35529cb6857b153fddadc16512564afe2d4aad1cd9f3ea150f484ff78272f0ef5575035f1c695ac09a5c661dd5b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85179060139f0f9a54719bb7df06c728

SHA1
9bd87b94a04ce8982ea51b49aa98a22dfdd3ac14

SHA256
71e299d677dc9664b62f63e8da5f20ad5b7a723bd45f4e12e79e63eea95816aa

SHA512
73448754d5327a9f9ed892c05424bdbd30ce4069b2582889180b7a6846fb30d4d94a0557202ffd2b66762afc370c8e364cbe9d316014d0b587feb13bfb73f28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb8de83620eb981cc205f7f1d092794d

SHA1
8ec92c47b19d45b32f51c381eac517dbe825ad66

SHA256
2c897de0d245a467cae37bf7075d1d0e5ca4012257fb4b424bd23fc7e7bb21f2

SHA512
b3c2641f299a05d50c9bade835ce9a162da9002092c719ea1c30223277722cc8ba87a8b5000e6fd750f9a6030a688c11b55cbaa910a0c836a20f1be8a2e42658

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D33.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit