55dbe2615d351a0ae8ed108245041f9fc921808856d858491c94b5bd2e382202

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82c0a6d828e0aeab365d8d52d26ab725_JaffaCakes118.html
Size

461KB
MD5

82c0a6d828e0aeab365d8d52d26ab725
SHA1

293f07fc97ed880fe74938f2005feb4236e01b7b
SHA256

55dbe2615d351a0ae8ed108245041f9fc921808856d858491c94b5bd2e382202
SHA512

c52464d3e9f32f12abe4103ffc81d0268ac72687658b2f2ab3ef33d79f9656eeea236f63108250d1478bb7dd75127c75500999fc4ceeab5039b3f71760c6ff3a
SSDEEP

6144:SpsMYod+X3oI+YsQ0sMYod+X3oI+YUsMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X385d+X3o5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c082e83a38b2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008d823c2ad014d4aa5f4e9a4732f803600000000020000000000106600000001000020000000651a11979e354b46786b2edf77405f6f454c519d3d126d62eeb2dc81d699a156000000000e8000000002000020000000d42f5bca1b7d07b58377446122850ba2fd4c804b0c803ed2272b97dfc646528690000000044df481be813b802c44075244a5138c9736c6292f63cba1a773e1cc40ca5750f6554a5739eb46177ed3a1dddce02ca5ab247f8b707cd5a1d151a9c2f35ec316c6b260ef8b493bb18ec55d6d64ea80b791a39547f80e2013ee0d0713d7a13988888f46464065c822a215d9fae5704789d7711e8a9075e0b66b6b165572223718200320cd9ffdf62da0a35794ef9e7e3d4000000025f7537e664321a8f6f1909c5a61dcc54284eb468c115fc7d2a7b3e28118b38d8f31b24121320a0fffaa537640f288ef87e21f26f5339b372fa5fdb1a104a161	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008d823c2ad014d4aa5f4e9a4732f803600000000020000000000106600000001000020000000f06c636374f8bab19a5789b04d01cdc9f6aaa8c1f29b826012b6c6db833b1928000000000e8000000002000020000000e402a95e4e3d54b0a05657b99a5afaebc6284541de1a938464be3ebb7514586820000000333232365675b812a84fd48d965a2a81907c1c7c44f642a9bf8acc67c52397ec400000009e11bcc389f9bde0ba4de212600bbd6c44b5918dcad15fc015280f654c4197dc661878465d900a348713367e9da52acd5f2592892c15b57fe6e4ea18aa919231	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61B4A371-1E2B-11EF-A8CB-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423197582"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE
1156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1156	2220	iexplore.exe	28
PID 2220 wrote to memory of 1156	2220	iexplore.exe	28
PID 2220 wrote to memory of 1156	2220	iexplore.exe	28
PID 2220 wrote to memory of 1156	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82c0a6d828e0aeab365d8d52d26ab725_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2805907f7f505e215584cbffebe166df

SHA1
6ca678630d9452bad0f136ab44439186b6b99fe1

SHA256
da40dc1a8a36a1f9428683e0acfa9340cbdf47d596d7383c2c874ae3187f260b

SHA512
806742bb6a83c671ba3cbbb74431fd7d5909d811b3b5a764c3a44a52ca3e836761f52c02bf858a8f3b392b2460f4066a8bb15f5680d9ce5d6c484168955659f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d963e701e39d3536188dc48211c7b65

SHA1
feee4eccffde99be4d6c57de0c4f62cc09c3a04e

SHA256
ee92011a69f625567e1bda6b2f2c92e4690e9964f93427ea0302547b0d5f7c77

SHA512
e2946479ecec9da3fb8b0a3e8e2cd8c8c04ec3fa0d520c8fefd7f4caba63b5700fb037f85355075e1baf918f67fa6f090ebb2fe2d2e5038a0fef8b3e5f6d33ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d90881cf73a7e4d4a2ef7f46b3dca22

SHA1
821168a0e62af21f26f539ac5f19f6f77fa38162

SHA256
29c82ca0699f2f3ae0ff1440c4ff07743f2619fe84b9363ab514ab0e9bb4f3fa

SHA512
6bf7afccafb89a9c8ecb5ea24d655cee08316eb2fcbb5c3b7b20962808f1fa01fb0d123c0ff406ef3fd326e0e762352cd403bd1e6a13dc6f0105f1be2217d625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4720e8396fbef42fdd034009e5f51a71

SHA1
b6790e52ff693dd3bf3092467bfa3389f4d07deb

SHA256
758479ae022490322b168f3b2b2081d94d1dbc8f5a22bbe4165791d2ceb258fe

SHA512
3da49f188802220a1b714fbd5684d1cc1b05a9a3b24cfc49f8a21cf115fc3b456ede92baea4512da6303c51fd6f71a64b9c5d44b1ae9321c7c2689634badf3cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a555091a922559177b402fcfa1bf6de

SHA1
32dd5381b97130bbe16bd5a2bfcf6a006e63ece2

SHA256
0b04b177c031af805b3370ed3b2842ee261c429d76d3975f4d8741e0fc682cb1

SHA512
40b99181b40dfbc68d839e88c45c9580e31c43a219df605100a7f27ce2b67b37a02c8b4d06d186c23588224702fc0c4de6bed6d2d12bd674afdf6469e21875d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3a3d91f6f3b69e91a68cdf55baf5b43

SHA1
cc4b57a50d2cde029d731d83fbb9741028fa0b5b

SHA256
ab8f868d00fa60e7b1cdbb30026327503a24df7e30553439dac20ba4904fc11a

SHA512
d612082e2e7d015d0214280c224440d73e393fd9abd8917b92724c15a775b81dca72af4c9719da0da7e318333a7ef6ea3ef645c6bff0f6cd5f717007c5417f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae0b449a442287bf194b22ffd4701ec4

SHA1
8aa225da3f6520609fed63187abb42ac2227f2b6

SHA256
249dd60e1071ca097962fb61fc32e7f859ac8f25492caacbf62bd71e9f2caf9f

SHA512
194b558e29ec32a412b5fb924acfa95205b9454a322df0abb2dc836a65eff87532636a0ce8f36fea6f1f252f4fcc3ab0b08a5c62e22f68b992cfc7a64a60ecc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffda7e52a0ce93473a34982ac457ac9f

SHA1
4476283d69bd9ebd599ee5359dfd9b4d990370bc

SHA256
223622e743293ea7b8b2adc2948744257624a0b3d904100c79b3b690b7bbcce3

SHA512
4f4e6f15ffe9e24aba51d9beaf13671a34405ef493d4b95803bab529b6440c142bf3bfe314a30dc10daa18c051ae6d40e6ac1206a874976d6b04aa9e1c7049cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f08efa2379d3b17c7a0a52f4d4ae4251

SHA1
20b1fd71ad24bfd3f555cbe819f96eb1e394ba41

SHA256
ffac430adf9f07f10d6eaf0af011cc9652f62041da56fa61a8a905161ae1a54f

SHA512
e6551d6af584e131e9827b65a89cfb77606142609ffd0dbe9a29053b1398227a94fcab689d94d646eff04f4f96b22794cc5e8fa7b13bada84727743370abf6f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2194e16fe0d10fec67b78e940740efe3

SHA1
0fb31c65de1b2274aad2fe26da34549a703cbe8a

SHA256
647a079fb2b620d8f46602f8d07d838b55c2a2f34fd7d81908c4d2e9a6a02d5c

SHA512
85d70ef2782b35b8a8e0e51ebd492189a8496892905a60ac005ddd10a4231c2e2c7f3e6e1ba418673a5ed8fa3cac373dde010ca9ef90ba54635db6d64898fe70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c44ab1352029814241408be4976dc934

SHA1
bb952a9925d8d61c132554a449b2be02f0e09ce9

SHA256
d99257e80a8882ccd1f7cb263498e280111050867fc0a3a7a5c0f60746108dcf

SHA512
f7f0bfacd9e9e33d75afbf5a60d75d144b7fa30eae31003507aa841db08bd936697e37c2eb3780cce89c98a69c790f070dd7daccb38a5f395c761977b1e451cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8000fa436f275af259f03cf4801a66e7

SHA1
85e982b3f160a0a4299319113a78cfae16007389

SHA256
5aea5e149fb78fefbfa8777283960d163928683d3b09c97871ef7b9325b9ac07

SHA512
4097c1342c2ae9235d680948521fb712a846f57030eef933f89a95c9aeb34a6c99d5ec2cdb20b9c693f901fce14587cc3e393a93de7e001f6eb6bd1f40b89fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fed5e3a922d6aea34697587376271ca4

SHA1
41c6ebc01819dfa449a1a333dd78b5e402c96458

SHA256
4f1aa612a766d9f363669ba31ba9a6e7cf205e8006abb2d274e7b74aea725985

SHA512
7d0eef6f6b2779d529f3dcd0b4145538384c78fead9fc5c90c4817a93eacaaeaae4aaf85f2455c926125042d5840aee2e9c9a4a016f34b1c05fcd8add1f42d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a87643a0a1d3b19e134df87f6a3fdb3

SHA1
844b9d8567c80c9bd3f22d964358ae1deb7ff668

SHA256
cc3fd638e6802af442c9a70ac6caecd9aaa5ef5218d59bc9edc9a1c0f0a7c05e

SHA512
6d9d5a8e3365fe50842122eadedd1088c2a18f992475186c3a584c7e1b7d65bdbdeebb0aa91791e1192166cad7069acc7a4f5c92b934d235d1b0d153d98b7d25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8550912e2c37673734fad92af5c06909

SHA1
afcc99c15a4c6fbcfe518427203f6dc6727a4773

SHA256
31fdcdeef3edcf212fc89d21dce5f25116908aaf42f8a057c280d744a708f2d6

SHA512
33c5fa9ead388392e022918b53959261a4036f9bbe0a93fcac655494ac63495d9a1d84bd9ea33226173e2514f33d4c528bd3c7cf578330ef38b1eb65632e4ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
821651f352c8a5dbf910b3e1ce773ab7

SHA1
28d2bec4c963da7a6e663037446c5309b793f974

SHA256
2ffcb5ee7c74d9b18e7ef8e2d2820816d1ad2f7c76faf92dc94ebb438012a685

SHA512
5d7eb233568bd0c2915e2bc57b59d27a20dcb07a73b655170527ed0701fabea4d390eb22b0ce1789947da12ff72159f0e5bb105d69ddd7a451b4d29d29a0bee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F6F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar816A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit