d87350a61bc53698c6e8625acb7b39998f1edbd65b5981f08fe3f9855af109ae

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80e451cc16c3695be3c20fb70af9af1e_JaffaCakes118.html
Size

790B
MD5

80e451cc16c3695be3c20fb70af9af1e
SHA1

378f19057e746d16b10b551972ee85d8f9800715
SHA256

d87350a61bc53698c6e8625acb7b39998f1edbd65b5981f08fe3f9855af109ae
SHA512

5c357fdafce6ddc427b140f25d14bfdfb84d97a835834fdb29be96aec55bbd77d37d6a527107885acbcbfd0f75a008c3f7e88c6cdcd40c21a0e31df92504418c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062b37670a8347e4590a7b577a636839000000000020000000000106600000001000020000000312e6020b392bc53fd446ab37bb7fce443cd5bfa688b3997eaf54bc40d6a8f32000000000e8000000002000020000000d531fc9680aae81544ad6e89e9781db256df94c37f00cecd7c6b9e2acd10b73620000000c1ea159ca5de39bde7258f074ae98ffa8907109f4672328d8bbb5c2f9835cf984000000024f0ded7bced5fdcf49e7c00108aa3d0ed16e6643aab71d7e2393bf8d263273eede9991722d8703ae278700db0b8fe742938a7f050004358fb220013d567ae5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD4EDB11-1DBE-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207acdc0cbb1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062b37670a8347e4590a7b577a6368390000000000200000000001066000000010000200000002b6d20d79c273dbe93ce6fdef4384b2cb1e6eda2d77013220f348b560753676d000000000e80000000020000200000005377433e8032378bb82144cff58a466b4ba2d8316988e4808f21621bb215f69890000000a4b33f4888ff34bf251b4bcbe09cf32e21e7a0d8e0d4c015b7f70b92fc61d3ca78979bf34ef16a074c9c0c07f80afa266a92581a476e223c97505168273b6534fa9fbc52c1e6e0bf161889738e77129aff4f87d0c1387cb9d40a52a2563f0c37e4a9aeda12e261e8211669941015cabc73bc16b45cfe3cbd559e6f7f81a95ec6831013ded4ac69cb2e3c27d43dd0002f400000002cef49812460b5a523da94a4fde5630f0cce452b7f680b65996ad61d93453ca01fdf94b8e08d4bdc5556ce0bcd3d820a85530686476881e9c4c82598ad233b49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423151028"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2892	2160	iexplore.exe	28
PID 2160 wrote to memory of 2892	2160	iexplore.exe	28
PID 2160 wrote to memory of 2892	2160	iexplore.exe	28
PID 2160 wrote to memory of 2892	2160	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80e451cc16c3695be3c20fb70af9af1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a2dec5a1e726c2f86b13166f2bd7840

SHA1
483e6566fdff7b1296edfb8f15e774f2c68e5d70

SHA256
4f08f47aaeba688dd24560567be2b64178159b20575aa73ea27aef533da4c738

SHA512
de02f5eb6abb7b728e6de3750e127315e89704cfca2e16d8b2ac578a46cb805c95690c7775c213933060d76f0d5a1224976ea205d7f58eaf5c83b3407fa45f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfcf2057facdbcd0deef813ce1be1a59

SHA1
ca7d2a4c293e6b85fce44c3627898a2fa43b285f

SHA256
defd42e8d6bce38857bd850eff7eebea563958b0c0ab7ac90d1d124707ab1fdb

SHA512
fb6c2432023a5eb18679965a6e30c10de53f9fd2bf54bbbd5d43c0ec66cef9b49efb9c9977a6c3ff77105f07e058290a98967cdab6df4e54fb43c071ed2c06cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b650d9861d574d0c73067a2c23f15f3c

SHA1
343af0fa91830ef701c3e0b2b61e1f58242555ca

SHA256
0d74f2b0e1361d36f619c03406ca1d46caa8ebf18c03d04a914fa7f9c0c83182

SHA512
cc8f56dbc6a72bf683134f46fad15668bafc74a8c9217c9e5fa2ef94c20690c1fc8d59afcbb724cf56592c42a9153ab0531ade6d21b329c23c25084ef15e52b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
011614f509dcd9f5a0138ffc76185644

SHA1
1c130d3aa228ce68b8f21178ed89c2519931ac53

SHA256
371d748e34d268c9df564841ce37e084efe9677d99df50ead776393fd8563705

SHA512
dfec55f44ab90a3083eb2fa043701111b9d4d07111629c42488c2066c92e14c36f277b49861abb1d344f4f9ef262d1ad179e8778d56bc362553d307da6bf92c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f307e5ff9f58f5669ce69c4bc0c0c13e

SHA1
741ead9d25363c9337e5736fbd65a3042b5b7913

SHA256
1e80a8717616ec80b750cd764fc5b6afb604500abda83cb999390eb5a39cb5dd

SHA512
ba1a3cf7b961a4fe61ce19e915a9fdf8a4ee1efbc56736ce427750c18b2a85a42321e57db23f57d2df28e361ea4d7920c4ef22f78c681af756de8b6b828df485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b45b7417e9d473ce399c36c4265a084c

SHA1
2b060c55725085d92b8cf26c23c81941dda613b0

SHA256
4363eb6aa795541264e212aa1bfe121d34005d1346e3a80bc90b0ba9bf4fa459

SHA512
f8a579a9e4ac1cc435a922a6943ee9d5361026342465ce20805075ea3ffacf9888aa2799c69986b10cfc67693b2328ff623234f6419a738979960b2cb3104370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
962d8849e90aa8ef6e7282cbb2b3d219

SHA1
7b125fc16c65b8cb57c4e3d73a2dd4100eb97e6e

SHA256
1735462a1f02381ec557b954cc2479d94e0135f0b826787d70bd87d7a52ad86d

SHA512
3fb49c92db8157fff404471ae4f823f71b38c12040234b1d8c628c6abdbb0accf2aa24ac90d94317fe7d95c718955ecbade7fa066ee3a8e4d088fc80d4be7f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48c6de0e25c653800aad60d8555e229d

SHA1
2728f32e0cce2eac8e65aa22f26c7c804f805dc7

SHA256
cd577cfc3d42ed4036871202ca1d54e188f7a7ca46e79ad49bf3d4734518cc94

SHA512
1e91cbd0e97299a70ef7b632a28c9bc3ecb8b983bdecb472889643939a509937bb8a21ab17a95eebbb3e75d475bd079cab0a3af2b2d300a78ef3e321273f7b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635f391c41414a492e9d699ee10aa608

SHA1
1f246ef746533344ca2d7d848522047c7b6fedc0

SHA256
39301c32f5ced3c2c08906c6759eab8474a309cf3c7032133576966d07713f1c

SHA512
69dbae1b8dc001a4017e105094962baa804216a812a2ef24cd05be41973028e2ce59326b3186b0ef25323c808fe1282c6e53791d78aa3b776d8bdd9b2ea79ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9baaa303706337d88f4d73aded20f47

SHA1
f2a337c5f7994976891754632c6e4423d949024b

SHA256
affabfaecfb277b1d9e07ebcbcdae476cf758926bac9b207bac5228181dec980

SHA512
4f8d782c5a28e4334d26e4691637978c971dd680584caace0ae5e05f11f9775518b49042414edaf64a143db9035e2b8aa9b348807b9722be7f23d87b2bddc69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a84e46911a3d97fc38673744a421311

SHA1
ac3774eb0de98ecef05e0f42548c0a23e1bc2a20

SHA256
271a5cfb4878f497c53a7c84b2e5aa72d46bfefcecdee1a026491df00349dfc7

SHA512
c2e4736619653b60d2ce49118840c271dc415a92c5b8fc4138c35ce8e441d537ebf065ef878385a67a2fc895126d4fb173fe44946a3ebdae9738c26ebf2f0ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0faf7eb5e011326b1257c2069074a614

SHA1
e9402b22af14ea9ba21b738d42e858a0a2485f6a

SHA256
0945938b6f8f176695c8d95f198531d32d1ee2d7e94ed6ba3ec623337d8d4c51

SHA512
e1763c8730e24ecd14e4d4318575d14c0b480b84f08c2301fd6a201acb54d44fe93acf35bf7deceb22e019c3e7a7fd9f60a9d7cf06b983dc3a7e5ad949c08b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f16ae4916d199d96127ef9a9c1d5da82

SHA1
a57fefb0166b0926a6512848c715ff7e9ffa1d15

SHA256
21ffd2f14a1e0c9eca85b8c0e8979e557cc7b5315c14849210e4fdaab50c6950

SHA512
4f7c2cce0b4a042580dd24658c98ed69301dd2a0cde5e297249a2cf82ff199c821687aaa14c465abed80ff484f645f6108e136bed20ae030a119c4b5c3d532f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6721be496bf75e050969e6d3616ca30e

SHA1
4d002a97d51ae99ca84635062b8d9a59ca226ee7

SHA256
fe1a17bd3d8dbe184f656bdd288d357e84e0773a9338c52844bb6673b0c0ebf3

SHA512
a2538625c1546c1be00685b66234bd57490d197a5e501c7ae45b1639ec913421c19b7f1921c5ed3bcf05018b03b2548c9d2bb070ab336cfe1bbc21cbb10deb56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06a33b0da029496befa4b5c95a6c2aba

SHA1
bb016aae2b2cceeff5a83fb2b6aff7bea8940de0

SHA256
e7e6fb4dc5c73a8c8780eab66e180fe48a2512757c0383fc0a81f7069e8b0ec4

SHA512
46e2fe86164926606817faa483526421b865e4106dde59776546471b4dd00340f44161a9824b70137192b84e02566371f9ef9338d2ff770db047c4efc7c242bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c8e88526abf660fc4e4634012d7f641

SHA1
bb0116b7a03ee93207060954488664b0a9366b11

SHA256
03218a5ffa0ec63d38ea56793ec90bd20014b3b8d29e3c3e9359493fbd0f51b2

SHA512
42882a890c42b0f429a5b4189d524cb29d042642d747afed5203f89d2c69e0052abb26a1d7cbb7ed87f53171d551dc55b86380c5a3387a3696731548e854404c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2434.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2537.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit