03bd6601a80aabd09d7434f649d439797b0120d17a3934954ea8e851b3125508

Analysis

max time kernel
140s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8264e108a5475ab611abd325508bcbcd_JaffaCakes118.html
Size

20KB
MD5

8264e108a5475ab611abd325508bcbcd
SHA1

57c45ec78abf2b79b35a8b4fc1593ef326989314
SHA256

03bd6601a80aabd09d7434f649d439797b0120d17a3934954ea8e851b3125508
SHA512

32a61d39741fa9ca9aded451a50f55a29d2e5d17ef63052471ad10fd0410699dcdf2d7d6aedf872baf383ae11f568215ba953400204b466102369802e2158f24
SSDEEP

384:CanlVBbjPqoV+zji0Ft0LOzTQTzT+TCTGmvTG8LYqnJTydoBIUjS:nlVBbjik+zxPKPg0GmrGEJTydoCUG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000042566d19d848f5006381d1a1f06109f2d11d1ff15e1cdad15b59ab32c45ef531000000000e80000000020000200000007466177b375c9d31382b501f2918d009816fe134fe5944e723fb2957e8dcde0890000000f3a571577ae4bf1d0120a116de16c74b64a6cc873bf727351763c4bd306a3d582211d83c08225f97c828ebf99d125f9482c5be7d5419fb4e6cb6f3eab21dbc9958a6a2cd68e4d719fb21e2cb49648ea6b6afdb6c83e968a6dbaa7acb1397e2ddf49bc2fb7e68b92fbe7e4147a992747278471cc1ed0a65767ee03067b35e3ec28d6dd88a87f89e9d98faff565163fc3f40000000c44580eda0b108079f13a7a7e2eef1fadc375ce79040d3127eaf8ea8ed406a7d6801ebcd88849d7df153c96cb16e94b473efd63cacd055574b4e48d947b33351	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D97E43E1-1E15-11EF-B393-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423188335"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000cd41d199d53f35587845bd105102abc25470586f72faf6ea396e986994e6b7dc000000000e800000000200002000000017b2f84a56a11eccb0ba48069ea9cea9dce7bf4c0066fd83e320ceff8f1c68e020000000fdd963997e6a8f2aaf5b5203c9b1fb11724718423994d321e0061d8046e676e840000000aeabd0f1a52f70f8f7aa479f921125896d6e958e48f529a5bb7411ce0fade85dad325e1b23e4fd5a4ddd6f4193c42edaa74d0af20053aa9f1fca0056119542cc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01407af22b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3000	2936	iexplore.exe	28
PID 2936 wrote to memory of 3000	2936	iexplore.exe	28
PID 2936 wrote to memory of 3000	2936	iexplore.exe	28
PID 2936 wrote to memory of 3000	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8264e108a5475ab611abd325508bcbcd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46a03caf87ca9991846700c24118abcd

SHA1
bc48dddcb7a792840da7861f22cd27798aa989be

SHA256
15731c125a344aa18538a4acd41e37c5f2e38a6185aa85af062a4f06c7c87eaa

SHA512
410ab961f01cae5c3473d2236eec279451b66e1d31a9ea888baa40fecec4442046ada65958d828bce0fcd4c513342175997ba7a82dc8a4c26ba84c395043aa47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4911c1a7f56b1e58f7283825110fce6e

SHA1
8cdf78590b20e6d9abed3b0df0fc1666bb4c80f9

SHA256
49f99d691e1da40044a0d946d4825104d5221e3668285163148a5a549d246dc3

SHA512
45c0d0889a3ec1af8ad45d7adbe3bcc9e85418ceffa372cd838320991c176a4ff839bb3b67581b38fc71196e0029e0152b7fcada07d4536e30f97b80e08b9334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ae81c642a2b1d8b365585bda2c846aa

SHA1
c5ebf29c99b0fec758e1ee4ecb6aaa26d28340f6

SHA256
7052c1393bbb3eb6a045af8de3ad599101b4b8a5c1af2f2fe5ac446644005edd

SHA512
208259edc95a776e0e7d839cab46f1656f527223e46432730f79e77f34577513d8578e565349cd3fd1d14b1f78d001b6dc89fee690cc71a6bf4c9b4aeb35376f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
723b5c367d0bb71c272da90aadbf5df2

SHA1
95906b87e2b8457d42903148be0a1d1f44bf5ced

SHA256
e2b283efe878bfdbf4daebc296cb45ab48e52c2c4b09d5cc0906e657865a066f

SHA512
cdeecff3d9f245babd02b6829c099bc7a5100ab632b412d07c356a1216bf416438adf2645f8d414b426bdf093e856013da68234165898b41e089ff34379536d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
167c29a7e6f23f1d8d0d9a4f1f5a408a

SHA1
21d1c7bcb6b50bca2dfd5ea89faec8a6b9bbdcfa

SHA256
eedcfe5367e4dee12ee0c22c688e6e2ec6419bfe40bc2f51231814e2f8c835f9

SHA512
4e3fdf57fa36fa167fee451ae63f68cc760cf41a47270566b932c784b4a981d18bb1b3a61d250e9e0724a4e083297d1b1280ba8c33c9e0515e47da67d19d65ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c628c77e87b6b0bd8c7921b7f03ec31

SHA1
5055f9863f5138c6d6755320513acab51dfd01fa

SHA256
80bd641ab73a4caf284c7401b4d3deb69ee1234e5b8111ab37f7e45456371272

SHA512
eb20fbe1e7e33dac19ebb9438421b615703d8652f5ca4cf0752a3e0b8f843793be9a07b53d281cd6f030bbd2f6a2948f89c88738a24b453408c809684727520d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a10c5c81ca97ba86108ffca8482c4a9

SHA1
703f214da1f007cf60e6a8995f19ae78f10ffc25

SHA256
d50ebb9aa82a9144bf0512d6472eae64a4441ff5cd8b986e2fc9fffe64b422d8

SHA512
4ac0c68f9890fa9c32bc1c210a8209bcee4d6fd54c57ccf3e9a958b4e9c8df05a1d854b6fa94d9d7284977c9549a1899c8d2096873a31b3e77ec1dd4bbf5116b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7833386cd4a34db2bc5d8bd8320b9b34

SHA1
89d5fcbcd6b2617580cd0ad24760c338bc710c9a

SHA256
158badca8548b9c6bdf958f19b8ee7b280fac2b0edd4e9587723b399e54235bb

SHA512
7a6f502bbbf1185c53eac1cce86851642e97baab8170618d9aff1396ba5ccabd4830682588ee1966ca5238fe412a270e210ccdcc726bad5b1cb63f2a9b87127b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c860b85228fc68ce89a5384c6c2755f7

SHA1
13211b1c62ddf2b65ab5dad83c4492a080dc0afd

SHA256
e476f9a9520606f8454da26e072f9b6ad9ed33beea2e77aabe61eac723e90a4e

SHA512
e6ca0ed7fc9dad579646ed99e929c632cdec032e73c1c8b6244d1ede45f76924b6d46e8ec0fba5314aa59480b62f64bb246564771d0e87752ed7865622076f6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e356bbfa2ba7380f8a80f47193dbb00

SHA1
9dc0906b6fbc3ddea1e402629380e02a2df3ac61

SHA256
1982952dde967dcc731755f3a9f45d22070220cd496b4900c759e2e1e80de14b

SHA512
e78f42c7e9a328367511600a958b080eafdeccae69c27a60af9ab418eda6aca81b7cd74f3099cb36da5414ae79eb49fef82df5ffb9fa1b76bb993192837edaab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c73edccffaf6008c529aaa3e458b6fc

SHA1
348cecd2e01a12668d06d944e0ba93b470f5f3be

SHA256
bd4ce396f94bddf0d977b90f37bc90d5f7718f28843780ddb66f610e7fd94313

SHA512
ee144553cf2652af3349f9a85114a5484077ca821e6140640a8a81c0c7740db118cb82e1d841acae4c7c096c19324f47b882bb2e0bd1430da503513746f7b366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
036d48ba97a977ee88412c9f04e90eb4

SHA1
183f16fdd837045fa03598a066a49defac35a7f3

SHA256
40ec7b262c7335f50df07da23ad13340ce174b80a1f88cb74eac679c4b7e6ce6

SHA512
a8f5140c2e6dd6da993fc41fb0829af20363f78449dc8494049929f638dac8d912a307b33b57c196e30fb370e0a0e4bccb32071fb22af7592f94103fe5d61346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af36c505aaf60e690f60ef7b402b0c7c

SHA1
fd8d0f68d40999c4d5c83796ff3b43887a59827a

SHA256
a99b2d0d8cba8a8c448ae255308aeddb9be17691fff4746f9748e09ea93337f0

SHA512
4963489c1bd3b1c0b46efa836a74cd164de1517d97ba55fdc17bd9b9dd1a47d8555044ed6205cd5e1f6da1f6448060f7f1f170cf6096beeba8bed2c8ac95624f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6276c53fe964af7b9c0cefffacc083c3

SHA1
47041da2a87e34c8028e53e70527f3975d0b70ee

SHA256
d8bc33fcbb5430a4721bc693770f39d64253782310028fa1d1eeced84c54ea5c

SHA512
a31a2d8b26d4aa151a982e8f2ce84dfa25d181e6e2f911d8f7fc5b1900e23af4f57bc3973aa42ef24e232c62bdcad42e831b0a25c1f5a1f6e131446e80681f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3ce295d81d905fff96a53d333e2d678

SHA1
a8417568a640becdecc72d1284c4ecf10b20b9b3

SHA256
2c1b2908d5e0c1669a375e5ad4a5d72cfdf9b80c3a13f37f5e31bf4690f5decb

SHA512
4c3e95acc064b8b4d82c6aff16d5f3e96799baebd230c728c4a7bf0c6f1cd85d9a42ca602fce052ea9966f73f9fb23c4a020df8d34f84f7f8da76a9a0502d39f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d55f41d8f332a6135e4a86e7d432aa

SHA1
9badee2cac1327b09628333e752f63e86aa5a303

SHA256
aec6361153a2b9409f7e6fab7615f80492d457fa565d2d2780c8073759b0754e

SHA512
90f898542c90949fe66f3b32d2f2344b5c36e9b97f05c6f618082c891b5086d66ff410160b58f227b10c4bd320ec19ec6c2028c74584957bcdc812002f3236e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25D8.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit