3e63e20f40489a009ef9a73a28e290907e65a27fd8afa759e46a34acf3a90d7a

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bdf2f220619e2aef7ee3f5066990355_JaffaCakes118.html
Size

133KB
MD5

7bdf2f220619e2aef7ee3f5066990355
SHA1

a5193c1e41d2d49c97689a0eeea088fb401c5504
SHA256

3e63e20f40489a009ef9a73a28e290907e65a27fd8afa759e46a34acf3a90d7a
SHA512

41a68515db7d5fbb11ffe9213bf11c72f40dba2eede998bace0d7e3d0a63acd0114eab521d448af01095b74c6527adf8d9586dd1e878f9b27bbcdaa58b9ad52c
SSDEEP

1536:Sv/kyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SUyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA76B0B1-1CB3-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d74fb30b5961214ca43017706119330b00000000020000000000106600000001000020000000284bd3d97502deb9424bcb595e0d7c4481cd1301d292e6769c63f5607f964d7e000000000e8000000002000020000000e71ec89da8cf42abd38ba866aa7c8c18051e73cf69c890e759cfcfeab8a03dfd20000000cd6b388c05f0874f6b101bde49c7be4ccdeb793143fab9bcd87074465e459582400000002f7c98e90131c684897e01bad216f87bbf1029fe89796bd90784d570d067d4f88f622e2e18f6601315d57886b59c1bf6defec73114f1295bf86b24959fc17f63	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d74fb30b5961214ca43017706119330b00000000020000000000106600000001000020000000b00a21d69ed5e53c850728b4d8edf899cc4ad5b6f9ee544ae36aacd9fff1d540000000000e800000000200002000000099968ae4da88ee303983df7c64bbbca874439dc9b17a9e5504d4b88de1067a22900000006e0c1f1ec0d753efa209602ddd4129fa636c2067d396db0622a3ed5bd25259edbd5c8f2a2d8c89118d8531455b6bc000497a1bdaaa4b246180e4a9558b8657980e2b44455a07acc7f03066ea5ca6593f26835639607a8e3293ff8c5c04c62657f564a74ce462da82823f8b3a73b9d278de295191bc7688b382e7b270e4780bce44fe3e9e99ad1aa8061247047d3581bd400000009d1b25c2d1036aa44482f4a13e841bd1ba802697c27b04889ca51710ade5f5b92b9cba59f496c055c609badd43ab1c42fd6c6d7d705ef548d8b5d6be953b4e0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423036295"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60871db2c0b0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2064	2068	iexplore.exe	28
PID 2068 wrote to memory of 2064	2068	iexplore.exe	28
PID 2068 wrote to memory of 2064	2068	iexplore.exe	28
PID 2068 wrote to memory of 2064	2068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bdf2f220619e2aef7ee3f5066990355_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb60224ac4a9457e4a2c4a57b861b03f

SHA1
7cbcacc72f0f1f4c159b6de9eaa1174a981fddf3

SHA256
e0d8e5c8eb3547a57ee9a1ebfdaf0d2d61ab873a1dbba0622633dcf48c74a136

SHA512
c909c83962a0e780f7247fd61195c76d00f1cc8d4b5af727d518ce04ec98b2d3254117f8ee71bb3ee62005377567fd523270277514e88ae6ca5899c98bf27efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae262a8897177132f0dbb739dda12883

SHA1
53a4286f6d68e5e9efa44d88a1ca0d6b6c3d48d9

SHA256
204cd30e2c7a7257a977c441399acd818314c85b0a806361f118c3da956ba771

SHA512
840e8bbbb15ccfb67dc73f260a8deceb284115d75485ed6ce1833b7c1a48fc6c5a6cb8294e65f6117e261d9e0fd0de276e7e70613c03f656c95e55649cb71604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c51184e3eeb83212ca822875158871

SHA1
21de622fe70326c86fe512459c7e7f55e0df88cc

SHA256
b9cf8f5c66279be2ce66a9140be86b75fc1a92e52faf26ea9d30ef8154a31a73

SHA512
0c5e155761a7019bd6516fad82bdacba6b02b4807ae5ded7e82e354d56102d757c8f894101e4d249a8af50f8b4aea8ea5080fca65677c1c8afd6f20f20c5c4c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
458c120d03583d19faa52b7b43983841

SHA1
2290301b36f8b47c114b56240ae3a1e07a3f8392

SHA256
a266764239a61688b7d80f821a76c2a8eae593365bf9f459f0f212f09aa4b4f1

SHA512
5417c4e28dd9df2287c3ba6df1c2e1fe066c5a837d381437b453e162e6b4601b5937c66ac2e34d552dd22a6586ee72b79a4e9f07c733ceea9f7e99ac8f9c16c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4c760992539a40a37a438be357da4d5

SHA1
1bae41140dc60c65be3939ccffce69aef93410e7

SHA256
9ad685f26d576959fa09bc2abf98158edfc17c78398cf89501ad8b900290f2f9

SHA512
e248247ee629236614c1c99f26eb91b33a6551645badbc638278bd889a9cfc605167f1161b3105977977cf0dbb19ef6db1636ce25f6634ef4a5d444b71b59f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec0ae05e35cf4aa915db941590604fcd

SHA1
d7b03fd20d7dd5b96370d9a573bc6aeb3fc1292f

SHA256
3e63b27e915561e20b834e27e57dc0902e5b7858229ae0ec79a4478a4f0c75ec

SHA512
5d629281740914987c5a7ddfc8358912c15f2badf0c71d2bb20796e2bfdc09b2c0466b0d70d2bfb631f677af3e429ad432551be4a19e9ab55eba4fdc7ab4c072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd411845369da2fb0747c7cd52eadedc

SHA1
9ac08c5d68d9ca3f93835cba8ecde29d3236d0c2

SHA256
d91c1e7a7ed53de971d31256f4b02f9cb99eb3bc3b64f5ebd99cd8d91e6d3fb7

SHA512
57c65c04f89dec5955ab1fab8df6a9a28d2986788fc90cafa73a573374190629a44aeab211f6cc6b61fe94a13d8f251fd0767ca74b770e509288830d809ea0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829dd0be4d3de8f7b606466d23b96d56

SHA1
4da75deed3b433aaa3bee6ebdb7bc428c5842cb4

SHA256
28e6635b45027e1ed8c2793823eadf5e30b7823a251eeea87f6a2aef6ba7547c

SHA512
51111981ebf18a0254a3030507c7a5dcd8bfd5a01ca766bbce470c4d62678e5449c0a03530fc1e3eb4fc3775438133581a101ab337ba17208c74183d248d9d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d700c7df13d1a7fee65325c41fb63b5b

SHA1
c287e4f5d59df51a2ef3a4923f83ba21d6de7d49

SHA256
5cb2d0716e43479c15cb3838e0b7bfa43ed5c435a297e6b6711f3e957a1e711b

SHA512
bc5385a73972438325c8fbe210e068d65a9b9fb4ce8f54d55eeaf6e7e11f8cf830cf5845a45731ce00b4becab9d9ce2f40ecade4052f5d559695c6c2d292be3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb9a387c3b76d26bd40b4abc60c2be9a

SHA1
2bee26d737225c2193e6e687b64f6f0a9a184ff9

SHA256
4d62b03984b200c96e1f1484d15fc2c4fed013071e967da88910d83c0be33b38

SHA512
296d3463b066bd17c1b07db0bf187065af6abde15398f83a5b6418b468d99f252ae4d83902c40a1960484619253f7ecd1360373415925bd74434174ce0c6499c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f18ed06e1b6aa53d0ca9b5456eb6002f

SHA1
4318658be0d8ef0bf67ebb2751498948d5a7b666

SHA256
413f2f06b1ab39f2c235d7746fda68bb0320b780fdf100fe201e0452da15cff2

SHA512
1cbed5d6e6e8f636d73276b650cd4e26461f5cb5106502216e15376ddfd970c33900f11d91711eb249051f0e82e0a696adffa60a6a7acced531467302f535129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1245ed2a8ed575eb73fcafb1c786bb65

SHA1
3607e5e6bc22e5cdd853318e7bf5d15fe6c87c6d

SHA256
a4d8d9f8c9fa481e1053398de03a5bd1ac03b6e9f6e5615719ebe7d9b6f1f617

SHA512
d3e1beb364242b1db01e768623f995b9e786beb9816d91ddaeb21b7c62def58b14312bb8ea0f2336052a5865c859375c256225425d468d1a7cab0b2f8d9727d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d6a8930863a6c37790239faaa82c90

SHA1
0a2464d3637ed71144bcba8e19fae392f5f8d403

SHA256
38b9e6c497bfc539afa6709f32cc626cc43e3725b2471dc41d3f5927a57b73fd

SHA512
7e9d4dfe5846e7d8012f1a35ad363cf2eafc0a10b09d0599ea47a2b802c007bb250759c5aa82cc3e9bc3639878db9679603f5b7115ed53452d23e244aba2e02a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
329007c6bf842d4351c1ce4a338a14f7

SHA1
466500c05f942fe7e898b036ee4661eaed4196ec

SHA256
eca59482eeacdf0ceb422875bde7090f631c3c4f4ae92d11278bfbfd9517ca7f

SHA512
cab34a6ab4eabd8c5b79ad34277f5ba1946c631288643ba0242651a730797a0d265264c5fb8d49669addd1623e1f0c5c9da1352bb89f27ab8b633830b3ef7d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7c2226c3d1584b6782aa4aa5b795063

SHA1
55574187c41cb5e17f0b387d2efa0c13b9cbc34a

SHA256
8e9702a829275591d906dfacd10e1619709fa53bc4dd36edfa2a4869c3e25224

SHA512
7145b1393a51237048058e16336dc7d00d1ed51d284ff72b83d6bfb7acc8194ef65de49a79a702c61039b383449646e88f06629841d3f5e203117a3bda38ad8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA287.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA3F7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit