57774d47907c154875fb9bb23177411f5612c2150be13f611dc3a495ebcb747a

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f44d5cff5086e2c9ee695f84572e802_JaffaCakes118.html
Size

4KB
MD5

7f44d5cff5086e2c9ee695f84572e802
SHA1

3669b83e42ff43c4b2c96bde8af9f26e68f565b9
SHA256

57774d47907c154875fb9bb23177411f5612c2150be13f611dc3a495ebcb747a
SHA512

0f55032129160e7530702b12c25a84a1b5e1da677e6c5fc0a79c58ec4916d45a7fe5b4bc323c60c6d0cd807723826e718c6e748ea01a3075eae13e883bbdd37a
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8of4Xchxs:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a58ace66fb2ae94baa2183525e2f0ec50000000002000000000010660000000100002000000097fb99605000bce2222dc6eed74a1fcddfdb9654c50b145a8b399fb054481563000000000e800000000200002000000029ceed5243627b38db162d9c84d204320bafa62496017e148d17856704f3fbe62000000010d4ad91aed429bae7ba85b05fbb1a8f91c7aef7900bc99fc536f91c164aba3140000000f2c9b5db5ea44e7c5d3d5379cf96358cd32660acbaa18878c336138cf2a265ce71ca0ee60da462a1a6c53021f91e2c2ace05c240a049d870aef3de60d42a245c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423113085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a58ace66fb2ae94baa2183525e2f0ec500000000020000000000106600000001000020000000734b0af7b9b169f4670fb40937b1cdb1ef166db06ae5da93e7a3c3111cce071b000000000e80000000020000200000002b8ed3d586651fa84d11d04be23acbf97c83d2febb4214ae0c4351980ecd023390000000cc1052758b78b8bfb12f44530efc4b1fbe786e9ff92322d9e8075fb1d6ececb5573afb4d3619b37598086aaf21644521e4ccea921f9bb5cda77b6466013de62c145a92560e0f5be529ed7a0e8c60108d25c6c2fd8eacc8337c440ac1c63fcf55773dd73bde34c2c03616066e6edf2877758b0f3284ff9918749cfd01085803926cabba5366341da595b86b36ba50885340000000ed274e1fdfcdf917a061c61c9cff3812a5f99fd3444a1950d011d2a0f4267ca3aeb012034e4749e38b87c002f09772d80164cab0f20739d249c63b70a3b27145	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9017fe7673b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A29218C1-1D66-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2640	2028	iexplore.exe	28
PID 2028 wrote to memory of 2640	2028	iexplore.exe	28
PID 2028 wrote to memory of 2640	2028	iexplore.exe	28
PID 2028 wrote to memory of 2640	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f44d5cff5086e2c9ee695f84572e802_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64da67fb26cfa492ac0c1103290c9624

SHA1
7dbd2c69f1685ca4b679b07051f9e5de58967243

SHA256
39ddc5c9affe8b88df72f27d44ee97fec53ad9198a6de16f1035e0db70e4dcd2

SHA512
8020724f8a4ea8ded31d208f9470f1cea5fdd6e9fe75ea4fb95cda9e124244ac771ed13afd6698377a78d9260802a7c79e51c3cd21739a2e812b3a91271b03d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51b58c3229dd738c12469670eab9656a

SHA1
8dbb1ff74b08e8f3d6f757a4336fa8d2f036a0cb

SHA256
bce8573b637683032eea5160612e54371da6274560df1644e7a47e6c62cbe0f0

SHA512
f5612f9d7b7b803e56421c3c300b90440342b455da6ff81e884a447ecd3ef3b30e4f1b4892ca1a2841eb830f678acca55d7f22d777c3e5546d2b185173290e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0080eaabab0844f54c7258d74fe9026e

SHA1
b5a23ab59859eb93c31048fa662b723f3f9f4abf

SHA256
72df28a9a924b8c08433dfdb31a811f24f71ae4556694c63579bb6f39d5b99b2

SHA512
bc5370222e1bc024668e5047a57b43eff3d8413770cc967b853f9352d5b5132ed636d0399c0a0311e514420c98a7846daf121c1e88584d3eb543e731195cc88a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71d1da5c8bac88263eaf23ae47ca2c1b

SHA1
5c3a26b9f16a48e4aac4884037f8b2b40029e12a

SHA256
1debe7236acd4889d1feeb4f045e549aa39616e99d9524aa743137aa02c88097

SHA512
13da0845168b9b82fdfaad2c4cbc889ec1a8bc2fe514662d70357972b99822cf1dc1ed4cae4d95e6de00095eff3d2c3d1ddca0e1a79fd4dc65920747a28835e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0d78eaac59877dfad88069331c325a2

SHA1
7ffe2d52089e52e1f6e2ba2ccbdd092d1dae4e32

SHA256
4f76a13a37473fe7aee25887a1299fafce216172206386052e02f1f0119cb54b

SHA512
82773100406e26a59158060aa9bf8411ba8741476c83b51bf04ba61ca094c2b010c4c2260f74a18acb264c96c50ae58c24090fd9a894a9d3f5f499d7f90ee55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8eddb125c34770ea8334f2b50f53021

SHA1
dfe6ae3ab95b86ba358670c627541d28ed14d14f

SHA256
5e7c304e1522ecca51b96b5bc1335539a8380f2568cb3e219d104aa4f1d87b59

SHA512
d73366d1cdcccaecf727c119b3641a060cf50bfd7a19af63f5faecfdc49ac9a564a4759491a09187da29cf9b0d42805b1ed4f43d67abcf3dfa6516fa3b75c462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0d3cad048f2c9135389087711891fe7

SHA1
5d4ee13855489c4369e72e79ef45d2a751f625e5

SHA256
59fc0ca8eca3e647f80131145465cda61ad7af648436116bba51dd074f4ef9db

SHA512
70e5cec78f362dc5d0e418ca5f31f16f735f66c324e1ccd85ab4ed5e5a59a381d31be72e0c6909fa6bd8a92a6c695529b6b4252a0aad636d0daaf95c7e8e38f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08f7be0efec0fd92504b61ef2aa1c883

SHA1
b7005ce6467f234ae70c658c32cd55d0b583a280

SHA256
63738c679056a7e1c752d6b096b579b09878a1f2e7c979f7d3cf1845892d48a9

SHA512
bb61580c7d470f842c4a2306841c939834f5e3e436803bd156772f071f2ece4a8672d41be961c30b30a06cb9c85d29512dc4d24c3ba689557253b5d649a553be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0505bb214687a714913f58dd384c3cc3

SHA1
a92f2c236f9eb4c7b6b3f613a136ae039d0be338

SHA256
aab856a2bafc0d23190bb1358c4e7555e4a8c355b7e80a4d77ec748d7d6af35a

SHA512
387bada90a13bae38cec06afbbc49a4760bcd752df569591fa28f7f5bbd5c3573287d414cea6bbc7857e4c38054468a7b4b423d2b8f3d7aa4bd2511cc2cb1e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247147fb3444702cbbacfef33c3f6862

SHA1
2b06cb96163dd4ade71ef073da607057a12c82ac

SHA256
72f3802eaed17680db1b095a52f30468dd7664b9c81299f00a8a10097aafb122

SHA512
f0787dd9d81d9167ba15f12d7b449320a176da87663f42ac1ad6510beb7ff7334ca6b5fd4d1a473c4b3834b9d9e353dbd249d022901625ad1eee95323a1786f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5954e55a3eca06e542b42a58e0383057

SHA1
9d76e159dee784276ea616337455e60eaf4193e8

SHA256
c8495cabde82826a620ca0ac668124a6f2937f31cc664886263d2b4c0c1c6013

SHA512
307c4fa393b444aabd142ff46bb34078ac8d602a9e267369805353fe1362039f5cd34d1c3382b8298d431544d1dd5d02a7efe97589ef501b560b58735176fa6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dc07b8c1b71631d32f186722b88fadb

SHA1
e83b542e085a28328e3a3ec93fe04738cea45d3b

SHA256
0ca7c72eaa8fd98a1c2004d5f4aa85246604afa0cc519c0e5be0bdc1b9bbc6b8

SHA512
dbc3146bac4b51c7bdc27fa1d37b0f73708e34d5389c333c70efd5a22b651de913b2f46b23facd157d8ac94f8613567c4e0e642b61a0ef4965813287737b2e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ac326b8daa20ae49e8a4dc704a4271

SHA1
e1e7fc2020389918f4d90e7ca08d0531dd4ca47c

SHA256
0f2fdf00ac76936f950a530729da3fe9115a53bd905e5d4e9fa92bb39c5fa0ac

SHA512
95d9348bb2922d939bf4b04f6218401e7440fc1b4f6e05d7a1f3836faa0d376b31db9999c950c32b0a9a8b6e145ccaa838e41987fefbb388db22a91151cc2f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a707551901360fe3fc72ba7a1017bed2

SHA1
63f2f8db3c79ccff0e0f1f1a844cf78c7a457a63

SHA256
4db3490656512b9c2ed058401baece8a91e44e88e51e176552e6eb46ef64c3b7

SHA512
ca5aec7bf1b4ec10386de8bf206323f4814dc5f37936d5f0e1d7665e828ff8d4a822ab3eadfcd9d0561380338266c4a0ab9edb0d4935c86f46799d79922b5c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df21b99b3d10cc8dfff79852def1e11

SHA1
f1824664b6fddc19ec16c03fdb6f98909ca36388

SHA256
880e6adf9c3becdab053362a9bcef6c1672d2e0e5cd5a2ab5ad1f28394623e7c

SHA512
f37bae6dbde93bec44f4e6d31f2861f071891bf302376b07f3bdaec8dd4e87251f137d67742083c6b50964ccd10bbd9cdc10e5721409f0ccdb6b5aeb6f031799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03713338c9e9e9f9748e058236bd79d1

SHA1
50bcf205a362fb24aa8329635c8bfc87f41e07b0

SHA256
4dae2c237e297de50b843892fae1a94399a7728aabc9cb459f78bac1f212ad50

SHA512
dde3283d3d06b49c282d9328014b904e54804347af092b9777cba995ac99deb10736602f0a028db206bee60b0d5b143ce536eb085e6be2e14af52d0b2204f062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B0F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BCD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit