2acf0e678c4afeabbacc93aed2d08e5c09e24885173dd1726abf77abc5945a60

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835138bde788b3cf588cd65c30306ca6_JaffaCakes118.html
Size

12KB
MD5

835138bde788b3cf588cd65c30306ca6
SHA1

850db4108f73a828730458dfb2ee6f32a32a3a47
SHA256

2acf0e678c4afeabbacc93aed2d08e5c09e24885173dd1726abf77abc5945a60
SHA512

b598fdd5c5ce1e28c6add0d2ae9eacbef019c0ca29351fcecd6be1cd2fc3f590ba117f3769b63c404bb152a74c3ab05e1861b25199b5a5b9d9e8cd1b5fa0a6d2
SSDEEP

192:C7hMgBEOks1QTxE6av//X7/pDyD1sXKrpkrYqs9gl:C7uOkjHav/T/ZyD1w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423213255"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000007bd90b4f009a2235dbf57030c4c2e86210995b44ae942ebb98945c8054cb1496000000000e8000000002000020000000387ea3e9618399e724d8c9238785c96b869b82b9e3efccc6a5fe50a23d08f00f200000000f464bb91270d8efd5d759ffe5c68912e490a7c4807ac9bc64c0340d787f002040000000b9a0917f4df4032cd38a62a06c5a955a2e846cbc522f1bf2a54223fc3805eb6593b96f0bd2e45a60b870c5385b2db3597e94ec1fa8ae4e6a40555ce0ba767953	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05518b45cb2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF8A8E81-1E4F-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000680ec9e3c52852180aa8941aa7bc620c9ecf6ae3fe883cb86e68d62f4d7d25a2000000000e80000000020000200000004e14ba5e33b64ab99c562cea4bc9e240973ef3a19cf02ccff6f70ddef693b17090000000ef557c60252a4a8f230536b7a1d1be886a7b93088e6ce73dcecc3d841138cad53c7f316393cf16ddc58b636202b1694cc320b415b7ba0e58ac20475a0bd929d9e508285611f7de27fdfb83a9d409c2580f01a3416fd8f7db8a5b2d2c780c6eee2ae2c337b759eba6635206baaab0bd3633ab0dae1fab566d0228af76f1710e87f1c2f7b261fc184fddf15538281f72a9400000002240509384def1562cfede09646bd1f31fb1d68ee288bac857ec11c4215d27ed583d7383c01241c4f27e89aae5f619332f1e92490742f87436373e68fe5b3a4b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28
PID 1732 wrote to memory of 2264	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\835138bde788b3cf588cd65c30306ca6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78e8582f6679cffd91affb77a122a7c5

SHA1
515a9efd17e7164135ce2f8ce9728206603ed868

SHA256
02ceb477c652a6484c3674b47d18906d228cda7a75a8cc9e95f77e1dc3b4b124

SHA512
f4ada1dd1a9b0eceaee1cdebb03a5c723284ae2aca5c90d51c3254a9805512f186d117a88650120780bc9faaa2076cf1e5a5dd071521ef0ceceb97d76a32d7f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ee10928a4cd7fcfbef5195e1a534761

SHA1
9020c71e211e571fa4167ad722a9368f3abffc82

SHA256
4e9743f1795897fe75136a8bf851cf3420e60b1de8c7992ae3a361b94f5886bf

SHA512
2a61ca22036d922faf0a91ee02bd5b77fb9960dec474746e116a93732172de463c0841b5a9454979ec7a6c415e3d5447235360cf47eaa1522a85917781d6b55a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6228f9defa7a0596fc4f8c738949563

SHA1
770aee54a4f0122e7904951a730a9c706af81211

SHA256
3a65ce82d2d1346d93091ac84318f338e892131a9311e809f6ef08e486122463

SHA512
33cc1c36035c9c30c4ab10f42f9a5b4723624dc66ceed48278bfe20a9c1df61b4f4891c12be46f51c77bb331fff216ea88f9283ce12be198d65e437cf13510c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0ace5f74a40897c0c98d8b9bf7bc170

SHA1
b0dd50e449271707d79e7de1aedb6438209a52bb

SHA256
b6c6adfd764d5d9f1bb38ca7e7e7c52fdcbc4cc3018a0e1b791bce3ac2a85107

SHA512
1390d36f24393a6e059fd4352fcccfe0bc88b1031714eca808eb811c1e60244f578d4ce8fe2c63ad970469f7b8612ab7cd5153eb423f5e47e70d893a7b0d30bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2a51e89be389494441cb09a04da7518

SHA1
dc4e931b4fb6b395edcaa9d799a54cbf2842a7a6

SHA256
c9be062cb873439d6a22e98051c5f7f3510baf8211e2ecc684a730b8dcd90318

SHA512
a0de39834eda72034170ea9cea778c53d91bedbb293b623638b8f1a1ae122af5690dd904d4ee0eb5ae7125b09a6dcb5f5cf42b54af18c128bb115b400a8fbe23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c512d383f0f760dffd9ee3a9f4da6c94

SHA1
9e87de7e14482384ab5b73ea2cec0e0bedd669cb

SHA256
fa0d7175d92775fc004227e050110808436241c01acdd9002656c7773c97f2f0

SHA512
2220ac7311d1e2784a934d5d890d356504c8e27af57c92bb577e3ccf478ff1650b27f45fa4db35db06592433ac4191dfbd6c79926f17415c76df8dff150f841a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47892781e43b068557a3d88518e68159

SHA1
953a033b587f371b8d903d49aea883ea44b1f973

SHA256
927f60acdb25e6dbb53b8a27e0e1fa941cadeb23faac6557bfb44daa130e0497

SHA512
b16808151b1988eff2754463ff84576ad3b0ae119451facc2a45dddd355370dd126ef85e73433ade55e9bcc7bbb5a78ccc70fb1fb53006a5577880a5272e6067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a43cf30cba37c0f700c02a17c7d5cd0

SHA1
a5e45e46d5c68e4ec171ff10728104bc8b25a2d9

SHA256
4cae63d8770b06082f8d7ef020eea924341b4cd49d27fc81f6bc833bc02e9bef

SHA512
20105801635e3a9ddc50b8bb8a4a80540af86b488cd950685ce645a4d3b4c083b1960759539d440e1445abc327671e597f95df94169dddb06a18ad67bb5e9ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be0561d952a4c014493278563c8289d2

SHA1
5372bae8b555792729a9504c89e9780785466224

SHA256
969d9db76a637145b7d68803055db26a9c59754ba00a186757fbb6674dd2ba73

SHA512
490d756c1cc1bed3978b9aff461514bd210bbf3226e0db55d4e87aa5238ca8c682db1f4d30a099684aecab36a663b7d79373166b23e944484d7f967b40b266f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e140ade680bfdac235320b08dacd7999

SHA1
d20bfb53e7d546eea4a04543caa261a656e156dd

SHA256
2f59def8640dd53a79d2a5375886186e2f9b4dba6818ab0a0e37d7138f9049f8

SHA512
8aebeb0d9c0999692c9c26fa4dccf1825b3e242e20ee82d368bdcda7800ecf226ba82355c312b505f08ffbb840cbb5348620e1a86c1461cde672a2bd62e9daa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71d685a908ea0aed36f2da12002e3ddf

SHA1
07a496dfa5cd1111c822e909aaf8e313d8ee4f0c

SHA256
1508a50ade92a860cf1d440d41ca9adabe124f88390be5241b607495aaec72f4

SHA512
bc8521d42e6dba46456fe7b185b2224821e098f53dbd45c82dbe482e64f6ca1659f4f1a54c96e123348fe7359cfdaf99a6ead5ff2408d6f3eae1c131a3d64490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff47ca7c0c540827f6cd50f3cd33b96b

SHA1
6dc45cb86161cde9e7f622173b05e5ea47138b02

SHA256
39c1b325435e58273b91f145306d2517faa406b072bdf69a269a51ddf1c919c8

SHA512
2b28a22d19c778330c6ebe22a878f88e488c2c8518193ed99d110b7291e0f05cf55b50a90bec735335de93705e77ac403c61fd8147878f2259c9fc4bbfcb66b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
182f719eadfe132fb8f2d4c3ef9e62d1

SHA1
55d47a35a5ce8406cb610ad63df17de9f17f2e34

SHA256
53ac157e782f1f9cbfe4c5e51cf770880ec309cbd713911658ad5e18305dd129

SHA512
1f51a8eb0b1ca8cd6d126c2cf3950ec485cc78dddc7cff727c12cd77b15f2ab433a60c74d47423a852208fcde48ee0543e2b2f079abb90a303244261f0ede4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff2c0430d98afeaaaeed5e8e785581ea

SHA1
72ce9eb26085850f774ea5208ce0d4b9b96b1d35

SHA256
c58dc2c0207ab45576c105f4f3cf66863272df14c30d9a83620aa87144944097

SHA512
5423e64cb9047fcc4cd4d7d6bac2f0de83ebfa7ee0349d85e9c90f4fac5216d7f333f6b3115227526a46f59a00d8ac41e4bca4ac8ca0e6820594b433a51b11f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2fe1e990b03377e3bffc4e7557cef44

SHA1
f57432adbb3416b964e9a443073050790a5b2d58

SHA256
367ac6d1b84db1a4a5aea8c2c3530e16485c2fc5843c709abd8ee686e9e31fc6

SHA512
e03a3ba3948b6d789acd43980f8ce6834239362a92dbda855235edceec9575cbd5c51309d141958a5cf1306ed02d7caa830871ed96e3d46064c12bac5ddce405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
261393fea895987b7d96bc8f14630f42

SHA1
29f25a88cb8a6d63a43866486ae5045a54dd5590

SHA256
8e95d70aa46244a188dbb8081665f1f0212e556193063401ab43b65e9783a60f

SHA512
7735f9ac169eee3ddbb9e5e48d4503c9ab4e8ae6933a1d217d3f9e9b13f62d7b69f6efb556482bc19e6bce72f2b77d84482714af9a2c9c09734e4e41551021df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D13.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit