75c1622ae26fb854cdb38f2db4b31b1069dcee5f99a3e0aa42cb79cec381e6fb

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e5cf02bb5a9eec8ffeae18621645b97_JaffaCakes118.html
Size

36KB
MD5

7e5cf02bb5a9eec8ffeae18621645b97
SHA1

913d326b0837d576bc07db63921a8f41d8d4f10f
SHA256

75c1622ae26fb854cdb38f2db4b31b1069dcee5f99a3e0aa42cb79cec381e6fb
SHA512

b2952babc1cc61e75191414226b2b648f2de93a2ca0e2bd780510bfd1b02538499b34cf5544c2914e2a00e8711ec2b3aeda47d526cf1ed28a82669b6e8900746
SSDEEP

768:t5Vw2Tw/ggvTl5ue8qtqPoDsZnxVtwiyBiv2EO:t5O2Tw/ggvTl5ue8TAeVtwiyBiv2EO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b451d315e314a8208bdd062a1e12ff4c18d57b9c2b96987c8e8916c610d041c9000000000e800000000200002000000069a2b863c4c29d124cfbffbc22afb7d090126ea4a0f518b2856cba2dc01e78ed2000000098c689a61808b0ed815db50a611f4214e4d8f113cb6eaf4adad97c66dfd2dd0a400000004aa2d73cb2918b8621f5b9352f8af50aebd80edfd247e785441bd17b0d90a880cae17464d21b378ac7b1cd7c7cecc9e55a5dc8b85f83e5c0819ef87264eccd33	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f064fe1e41b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f8eb7f6c807f233f997aa4539509fdcee9dfc32007b0ad5f8282d130200d48c0000000000e80000000020000200000003a54883be71d51d2644f59e3ff5aab9e537b8915f947cfd8027a2cab42deed9d9000000022b92e2e757866ccc913e7b8fb00719363a6c8d40215d39bff9fdc3ee69c7469866c701fb31925ddf0b395691037c26d7051f062f3d05b8974ed28cc748f818d920ea242a26609ba7fdc0ce742d499697a21284a63ed5eb5921b1db9b6230c3d7c3eccb11b930879630fe8215fe77652372d93d8a7e3dc7ec910bedf72c6e5b977aea8c8766f99ce0a836e0b5fa0217940000000b77df35fc9858d227c72a3fbd685244b958bb697cd0bc89f3eb677f8d87fd8b60f8ab36da88cbfa1589cc49486a93ca4208d124b01cf2fd4a9052f58a172a47e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43BADF81-1D34-11EF-BD9C-4E559C6B32B6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423091450"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2444	2940	iexplore.exe	29
PID 2940 wrote to memory of 2444	2940	iexplore.exe	29
PID 2940 wrote to memory of 2444	2940	iexplore.exe	29
PID 2940 wrote to memory of 2444	2940	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e5cf02bb5a9eec8ffeae18621645b97_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f65c5250d025cf5801890e9117c53b5

SHA1
1ba3c37fcbd446a7dfbac8cd900dbed348f73475

SHA256
9aaabd7707505ff0514cc19444daea915a46c6d6f198cef65e84c64487802fe2

SHA512
cbb24d0a076b47c2b962221a535d1f5e57e943f56012d536c741bc7d9bdb102d49d77e8a549c7cbfd2dfbe269d459898dd5d9f5d8327a0ad97ba8934d43478cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00afe1dc603ef6d7d31ceac62fc53076

SHA1
f6eb90b3f1c26d03c6e9bbd3fccde39b0e44f109

SHA256
947031ecd00fdc3d1e43f73e375971fbbeeb4466d95f00192117c7761065f4de

SHA512
bd2757dc8400a13147a36652e1f8bbc09e52ae8f3ecbc9e7cc996e9bc4c101cb2e286357c400e4299a6fe95b5edfea9305d5bdfddff078d86d8ce4fd5beba524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
895e699f8eddc773b383521cc132e9bb

SHA1
a6cd5270eb1f8f5bf79d56ec64d65d4d1cd1811e

SHA256
fb33cfb937890f4045c1d33b208a7f5ba2b86f3e59b66a0759d9087d10fae68e

SHA512
b5e9d5f208031f70032f640f49d92fa597252d619132fe8b7625fb51cd28245530d4f39dd05bf04c22c9759e0301c9754a25521e46fdbe229e736d7fed011a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df1271397d05124b71cce3fb40398907

SHA1
45a15b9a78955c698d2f289e13318fafad3e7516

SHA256
5060aac4aa38312cd483bf910346a19abcfd2840b8d76d57547da8220b4d1d29

SHA512
57e87225a53b6adec474ffc5d68028a7e415a9f8d825669ef70027e664234f2db5391900f83adb11a13948fd8c9a81efa2e9756d55205381811cfce7e708f5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e234199929258606992371578a6f7667

SHA1
e7985a0ec7d23e9185f2ad9c6555bf3a240d56c4

SHA256
cec3be150418ca93b6188025d62cee12a68fdbc2002c583139420468e758777f

SHA512
0d660c0d421a3ad191cdab20e14ff7a179cc1c86e8d91cc51ecf5f8f976c4a0f3e978c662e2b9340cfd7055bd00f1a8c1c6d66f74850d743f54487b53056f416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8382ae82b3abe71c670446f7791b01b

SHA1
fe78068c86227ca0a43884c5cd2949e4a0b28723

SHA256
3d6c24faa6fb25ccf60fcabf178a8429a13d96086aa4804ebd4d56ac74ccf01c

SHA512
a9922df636f51d7eb97dfd2694e82b514b9a55bdf64789bcc948e2517162e94dff36c31be36cd7803fb0997b945445fa645755f9f86041c964c95574909547ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4231a0cc416ec5d22d968fcd474b6420

SHA1
42125087cd9e9b7f5ade8724b677dff5b741bea9

SHA256
20f907670b8e093ed50aee4690f3ffd129a106dc49c177a67ebb68d54c821d92

SHA512
372395b838c94d70aa63be6309caeb5eccb61b011ddc64b1d02064723cdca08766e53318d765c9a5783e20746403312d362a25cb7efd45d1675f24faa068834f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab006d7071fab62b5f0e3277818019e8

SHA1
f374cb2eb0b49affdd8c6057a499bfde8dfb8910

SHA256
c49e5afc3da21b22377ea1a48a5ffa932967bf28afdf9942b7bb3301f6676c06

SHA512
6a2f9d9732d4eeb1dea67cc656023e198a49c51cafffd69324085774c1186e17ad53a63da8beef916802999cd93d679392222a62d5e12b87c6a794f96e7490dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4fd0a17a13a42b1c82d5bc84f0e6351

SHA1
193a84237dd0a2a640635eac351c61245c287875

SHA256
18495197fb775fc9b3a3d5361406529624c4277184c740e2fb56e86837b6a55a

SHA512
4dfc00678128941edbb3b3a090ea7fb95aa443e3c5d3f02d9177c58fe8a995f9c2e62a0e659c05606155dab4a30e14ebbfb0f99d3cb0b3e685f64b9b6bffb4ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
010f7ee40a6f4cb8cb242445c8413cfe

SHA1
f47e1a67b412150f9c6e96b910dc8e69f3cc8733

SHA256
ed390ba9cd6887ed12b34e30258964b449264bcf3c0b3fc9fb92b21ff68f305d

SHA512
aa1d0c62b3a0e4443a1c046269313dd9b711f531e4b4da77a65ca9d83052e98299dd26e55265cf045ae7e2704ed8bfce3ccc2549e7b022e2166e421b279a5f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bde115a89cb4598379b56682d62c680

SHA1
3f1215c23508d4f59704b55b0436801afb282dfb

SHA256
059f17ba659b071f212d2e2b0b4bc46e1906d1276ef4d2af9dc1729688b6b24c

SHA512
bbe7fb6a2a4acc90f75124bb635247755c469bdde11cfa41b41a4c960e0591513ba7a20871a5f49f1ab7e685bf8d0d3975abf4fa6f84e4c94478ee2edf486a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4103d140dc24baebbb2e098dd3a7389a

SHA1
a8bbd8efd1e789000049f6f24535311b804876d9

SHA256
8062e78054099d92cbd0d0ebc84fba75649203216c1d128f96af788dac4debea

SHA512
2b43a7c7156589dcf195c8de3a072a37f67b4e157614e354bbc7e0d85ef6470362c7b3d79cf30ed7584dd80eaa95415f040be37059678338c6afd6dacea75035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79885e46e38d7f9d573ab649ce29d587

SHA1
5d1a8be373dbed497c995e7bcbd048eac7723e61

SHA256
375a54f35b91eb4937d43c56996690768339e8d65edd89e8626c738266a76acb

SHA512
e786e3cef982632b2963c57a440cc9be412ca4997cd7e04af893b895295ccf526e4c3676150877aab84605ea2c4d92c094bec75e9a04634b066d28fa4da1f88f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fea755eabfccd1ac03e71a2ac93cec8

SHA1
155390feb2a1790438d5814ea549ff3040d35024

SHA256
5d37affc8de8e9ccc4a0ddd35e7606ae408a6bc5cd2c8252d890a9e9ada220a2

SHA512
e0fa528351241581cc753dc4a746f4453e574e4fc21009924d15bb64c27f1a717ebced3c68c783e418ed03222461d52fd7f36f1ec897ca00f77dd1c7301a3455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b31a5c2d09b7a21776ccd2af4df2ee5

SHA1
31b9d4aa1fafe3334a2a24dd41a73d874053a23a

SHA256
f4222a3be3a84a4aae73697dca8e699c7ca90579242164d0363e8ceb070ed6e2

SHA512
92731ca134a2c7eb5dc916930e8970bc7e615a94c515f1bacc09898a0317cda6ec9c4be3d099e07aa0ec525314d6a95309376f36d4dc88929170e9d31af925e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DB1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit