d3a7b39e707df40adce8fdfa56fbe522cbd47a4f63674b9f110def16558c21ee

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

836fb7113bc8d722928323224a95fcce_JaffaCakes118.html
Size

461KB
MD5

836fb7113bc8d722928323224a95fcce
SHA1

8c43cea98df4c9aa93a9f6430b3b72adffa5edb6
SHA256

d3a7b39e707df40adce8fdfa56fbe522cbd47a4f63674b9f110def16558c21ee
SHA512

99b647a702485de273cd26ca198fca5249b28c7a35e9b996e66b28ec08a42259e24e60d49281f46aae7ae6e73ead7d9884acebc25b0fb1f844bd0cdcd73a59c0
SSDEEP

6144:S+/sMYod+X3oI+YmtrsMYod+X3oI+YosMYod+X3oI+YLsMYod+X3oI+YQ:55d+X34/5d+X345d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F336571-1E56-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ada0e662b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f5cfde27e40b448a6b480cf757ee310000000000200000000001066000000010000200000000e9e3c4ebe78da345313d7fde98a36aabb95c8d14ec89a15918148f36d25de19000000000e8000000002000020000000995b7681691df9c60a03e8daf1875755187c952069dea8dcf3b087b86409bb4b9000000072b1cb9754c84ce4279c9addc0fb57f3397e82b1a9d39c3c333ec2311f1090991baba8235a2c15a25876334ac6833b248a50c6fbb32c1b79990af23e3f74c7c657a04c928c102352eb4d1bb960db3b38ea1cecc54cb73f5bd70c1e3b5b7acc43ebf861c15687d97a74ee3ccd528d1385ab60c78ca4854893724b2bb14641da5e9860a0a1b1fefc716be386bd0802a35c40000000c466630a2853428e4456705de8bf21348a71728c228e5e82502a93ee0fe657605a3eaf26b0f01a88840879d39abd1371234bb3306659dd2bfc8ea0814cebc0cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f5cfde27e40b448a6b480cf757ee3100000000002000000000010660000000100002000000055bed6ff5bcdea4ad8eed0a0ee228a3cbc3cdc0a9e9ae9a601aa20e960de3d0f000000000e800000000200002000000090cee9de55ed87aa709f17d9fe79a15208065d9691ac99d97107044a5bd1c43920000000a21a7150ab608b479a3a31729efd5833d9e65491c7b09281837729bb1fe9747040000000ca5a901c5be2e55394a5b956b32c56a9d190fdcea623341dce8117750fb040e08cb3afa02b9d2f893ccac72a31ad521708495a20ef20215f6443b070858ecbf9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423215913"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1548	iexplore.exe
1548	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28
PID 1548 wrote to memory of 2560	1548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\836fb7113bc8d722928323224a95fcce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97f157c0aec19cb4a0d74d9d80b7bb9

SHA1
9423c4cd1c39c21fe087d1e528cdf8ecd8575819

SHA256
7f766b5d2bd2ca1018d8989a41388bb11bc3f4f28c7e6861f02e856cc8ed5146

SHA512
a5ad924cea514b04230a16b74920b6f1c8517fa3518731f9835fd11671abb22ae3fee9e94ed77c98bd6cf8b9aa933a5eadb4b52460efbfa9b9c9cc05052a6de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc3112ca74e7728607da4320601c5951

SHA1
6f59058f61937651f0f28b3772b1831f1de7de40

SHA256
b655bda705e32f5e68cbb409f2d2563026c50e5a54e67d2a1486d58cfd4cb47a

SHA512
c369e82c2d7b12817cd4a210ef7ae23d4026e39e22ada0de882da5ccf94e9d26a43631fbb3fdfc367309f0459aa728704f316770e5fc7742475f4b8ef7703ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f39b5c71227e953d9c85f885d613c578

SHA1
bdf2948c6f1270122b7313cc6fac11a78533587f

SHA256
f9607ff8d76e4d7689c1ffe09adfb1e6db5441e81e50c929346eebdfdf84a0f2

SHA512
2a703dca50b8983c7e2a85536ce3dc34b9fddc3c7082572efaa4a5b29a9457b264c05c5d73a1b344c249889727bb1c58987c29ceed0e42581dae12032b133d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
821807c2b952181279f55a099f2b1a13

SHA1
df77bfee8c5cedfe2ae77ab913fb276f4020fa06

SHA256
6378034e3bc7ff546c9166a5e35c74f0dcbef6312bb06badfe529ececa381827

SHA512
0219ca9f71dfd8b2480e11f4ed0d36ff29bfb2d13c242495ebc349444266d240878d6b93d3fa2ece5e14ed502205c66127b6eb457be687260583427fdabf2286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4f0a8bd28661ff87abe8cbe57aeac89

SHA1
7ffca925de0a45f1604dc130928b04cf3b37d5cc

SHA256
ad8d3980e55bdfb50f85088ab651f3235a665b77e2905bd19fa2d6178abb580e

SHA512
e89c7ea08fdae41041730fe53481171a18eca1216af6047b4a77c36f88f7675fcb5e781d18e4f33c9ee7ca14efdad216a95516bf2fa710da23a1de9a5ff2c780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee0519439ca99218a7c675f056c4b6b0

SHA1
d0c0a448e9cb4efa649079decc35572fad806e39

SHA256
f2011ee776eaccf40ae83607cb7a5af98233dff757722960c70e5d0197bdd837

SHA512
87c219db84f19856f0c2dc9ad5c8300c231691ae0fa66df0c513516688f009beb20ce8cbe295a30e49b3f38c47c4d505cd42d4d8f1871402324f8d5eb0bfc5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff38a4d4673f591db67a02d7b7711a39

SHA1
03d0981bfd687751febfb524f2feb99233b186d8

SHA256
aeddc6d3ac54ac2f880aeed8f8b7105b95e024c4a310e8ccc4f4c3ec657d226f

SHA512
78c3e1fcf8f60b81d46ae7859a5d97e782bce2433671dc58b2e3c78e4f9053b345837fb295a30d09fcda4ed2ccc30db2e645bfb2c3211bf11bc726aef0dc3502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f11ba2a571aa90342bdc533dd019d642

SHA1
8b6c23a8df24b68d336128f37edd9a13955b6194

SHA256
d5ab074e8b0b7ae38334fef0e317755b6223a3ca8579b7082c3d57d1f343c9db

SHA512
68f6c53774f62b123562896189665e40c933b22129e5f41581502a7e9aed7039070d386ca69b6f91459cfaf0139bc887a421e7764ce0018c74383af8b298b472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5e019af4533e90a64c4e32afdaf03e7

SHA1
0b71a0eb535efecb5d4d78264947ab1aac08d77a

SHA256
7d2849ac354774563525f62e9fff2abe4e7a2eec656c0cc14d746f527ffaf6d3

SHA512
5756f554eaa4f1fc66058f1f504da3183400153991ec898cf1ce0194c189e7f538c5b0f766330d26dbe23574f1069835b1e4c5c458ccad8d8ebcfde7a738289c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa4441de326832d4ce8985e91d765dfc

SHA1
8dd5a618a50aabdc0d42b0ec6c829604be697309

SHA256
d453305a920a513c9cead5da04936cd5f84fa368cae96dbf28a9a1c192387a16

SHA512
c87ff8f400c24f1aa6c01b4ae69dbb9ea223363d44213a9450864210bae09f06fd3af3440f8c28c559c067cdd469fc1bcfb0d3d885f2f5c5f48dba69d58e054d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e63b54a20aa8aedc3f529e05b5135a4e

SHA1
be214cbf812d1edd53604df538bca79b3b65ec18

SHA256
e33fc0ff3f790f2777ab8ee80b845ad801ff5cf557f777acf6e8577ad829b0a0

SHA512
9a94ef41336fa99f55ca37534d0b81a50f500b5c463f2423ce18c0658a88c3530caf49ba6cbb8af1749e7de268cdab002b4ea8f682c8710ef737b59d7644bff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
271e10735e42bb81da26e10fb37cc5dc

SHA1
f534c3a580f3d4a432e9c7d437fcf6ddc37ac0bb

SHA256
99f008a033724803516c6f4ceba7515255ac67b655b5b45afcd4f10e4b7a756f

SHA512
2fdf06567e3ff46c8c215f6a0ce98e5d528059aa4e20d95f714511b8a03adea930ac1ac46439a8d5caa1f0c41e77ef8c3f8a017f3c0bae868dd3c81a4b3990e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99dad118f904138e1e08b81607efc95e

SHA1
ad361fdb3ae81d556bd3b99027259f1fcb72c665

SHA256
c4b6323b09b14277a345e4f4ea736d06ea2935d9646fa66d00184b420fab0b62

SHA512
ba4aae20f627eb1bb25b87855bb5b24d59c487dffe5db00b2f422d46139aa2599eb36f758bfc6ca8debc0bb2f6753fa7a3a311c0b53d338a363717ef920c132c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26eff5584b72050b3826be46dccb50ef

SHA1
8df0e1721e158a8c055998b97ccc52cbc58d61fc

SHA256
a794395c038b7d3551e531bdb03900bfdc5af1bc2bc92e4de6953ef200fbb5c4

SHA512
08ba032f4a5d4acd3cabf6dbb8d4242ca4eeab4179b4361fb4518084f4877887ad6174e5c376aeef8c13c9393eb673c26674b67995832985f2f05ef1c75e8b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6adc1016fa06370ca430bb0fcd419ddd

SHA1
e081a01806e81c51bafd398d5484d00b8036bae7

SHA256
6b437ee1524635575889aaca60d8c435f8bc2a12868d09a8c8256d6504aa5bb3

SHA512
a3f34648bf6f56e32fdd1ce1f17bb50c22abac4967ef90d99dd8fc996d637e07323d380f25288275bbcca237e2058706faf5ba180bb9c34100851255e7588d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a35dd9266f6d23cfc40321076bb7659a

SHA1
0ca81974b34f27ffb737e4ae03bb3b208746374c

SHA256
f3587c1dfba212d0ee27d62808f4d6efe230511c2c7140962b02959ac9ff8d4b

SHA512
3c27c678563bd7d74a27ad6f3e6c8f5388f8a6cbf1797c20bcd2a742af4956db6f667cbe8ca47c0ae8258ec753e54a6adfbd183d3a39017ab2c42089b3b1747a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA5B4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA732.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit