38a76167d4c385380edcd059e5d3255b7f937a7f73e33e09c6851fd8a57427b9

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

846491f93966a1302995019f325223d9_JaffaCakes118.html
Size

220KB
MD5

846491f93966a1302995019f325223d9
SHA1

3f5c5db783854d742147d46191f49df3317cd837
SHA256

38a76167d4c385380edcd059e5d3255b7f937a7f73e33e09c6851fd8a57427b9
SHA512

7a3a09c4f5512e60df386d19412b0d5543a1d61637993c7173426b8487333c5b1be5d83abb0a2dd7bb1772725d908f0d42202a3a80592fed6a81ddc9ce997cda
SSDEEP

3072:S29XH1IMuBJ76yyfkMY+BES09JXAnyrZalI+YQ:S2n8UsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7309E21-1E8C-11EF-B7A6-525094B41941} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423239494"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1164	1512	iexplore.exe	28
PID 1512 wrote to memory of 1164	1512	iexplore.exe	28
PID 1512 wrote to memory of 1164	1512	iexplore.exe	28
PID 1512 wrote to memory of 1164	1512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\846491f93966a1302995019f325223d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
961a40c3ba9ef7b3b0bccc8486ab2347

SHA1
e0d9818811d74942514edc80d4001c6d98eedaf1

SHA256
ca75422120c821de8045172268c4ed5bf0381b4ae2faaf25e5e396d3d438e510

SHA512
eac87dbb8faf92854f8ab6165c3dacdc52df9b1fda3f943d8f28f861b5bd9765157003847562033422e7b87608b82eee8815d32aca2a1df6ba5fc47765fef9f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dbd934b6ccb4aa0fedde6e440cecb49

SHA1
61c345207601a57e5a98075610189d46f50442e9

SHA256
a5d1e0c581332237c4fcd315e539a4f1959dabbfab1abd3bf6d986e59a2dfc88

SHA512
69eb75b8c7ffb525da5896ce968fbef1d7c090d2ecf2b53aa52c0471e4e0bcebb3fa65b9521770843b8e2c7a0c0e91a97b72540779b6f4378264d2de642dea46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
368cbbac5e0f69d86d54264c43efdf20

SHA1
83665df743176dc1b7f60eb95495a99368d711e9

SHA256
18c6a5267d0c3337547bf41b75bfcb3d359e81e2d75916af6d450777197d656c

SHA512
72a5076573c535c77c3ef71d9616bc1724975ca46e9df7bc71e47c060274c7e51566a343e77a478fa515f408d4f816504361c64c16894eff29540cdf1fd17ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ece6bedb384b2db56d5d5a0491023a74

SHA1
9b38027b4796333d36795ee5c76d88cdbbb1badb

SHA256
b3e3fb94536355199ea91dc2255524fafc137d2ed56c158d1d3b0af377b17862

SHA512
bca57e51d96f7e5d1cfe9a8cf7779dd812ead2a15186e45f060e80ace2aa3b17364136bfd0e6472b497e8db8e0cd1cda0d93c387230b34d1817db7b14d29523c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62cd4504cb9c8b68fb797febfb2e6600

SHA1
5b19546ce89439f589f91cf116a75855b7c6181d

SHA256
4378ee62e513041b2027d2e182e4b5d049631b4c71263c21ce2cb10d930d550f

SHA512
5816abc89c4a0236e98ef84a7c4c7d3b82a4af1525acb929a7060886a8a7293f5c61a7f81b0ae7ff34bad3c0b5c22068585b898b4ca957778c0e6c507bcdb622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb9475ac8d6a1c4e677dcbca310035ca

SHA1
c8e8f419d0510432b5ff5eedb5c80009a40aee70

SHA256
dfc5d34de251f38e10a1f04d34789e668259472bccc43b29f151f9434f6c9789

SHA512
e871f8333e628998b1eb25ca2068ab4fb8a09ea8ad4c2521e7225518f3ced1c33dea3e35fd277faa3634955d0e870e727c9660f8718a2db46db42bb2ebae0954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b3495ac5cdf2e897b457c7991af275c

SHA1
49ad71ae813905370cb23772cc172de77f2cc0f5

SHA256
0ca59f6e65dade95b9197eb8e3f73c15619687ee5e91da218035973aa3c571b0

SHA512
6b8497b771b3ef499d578c52bbe8b9482f2aad99adb4531924ca5f735692d4892954895473596771ea4c564453a9ca3ed26a0ad79721762e88671c87136e608c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6772c5ac06639bd0adcf68d89a71a2a6

SHA1
440d1218658a6c9f26a8f44faf99d690e8d48ee6

SHA256
3a1b663c3ccbaa85015aadcc3739d14bf19c2c732800ff1d8d22adf6fab8e05d

SHA512
68823597b54dce58cf0d335727c5d727e567e1988f624d00cb752d5223dd9084f2eabf33e42ec312dfde99f2600a8e007998a6847c2ba998782f4071078e30e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9d96226dc36985a93debd95b6b9ccf0

SHA1
0b678b0fe0f8788041437da0c31516e7d96f8fc8

SHA256
7b5764b3ebaa98d48855341bd97c43ecd0c3b7366f00cf57ef4356d3c6ae293c

SHA512
d893c46708309eb4a4ef499eb8a0016d68d849304d8d2193a539cdb8a2199a2a30dfc1e01915cfa9627bb6dc4c1320554a2ffe410f576d9bdf3b443d8beb65ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ca6f91e4496f67bf67fb271c46cb5b

SHA1
c4e23be68b8afd1932e59b2ba257c0720ef48903

SHA256
568ac38727b5deda376c5db8f4d2674d97885a134eff6e63b8a570b42fb32abd

SHA512
0d7dc51cd1b175782f6e2e62868077d4bf8a90ac1cdef57ddc3c35ca67cccaf9bde8e76a02db64c9e9b773047ec1d3e221a357b90103eb8e34406259926e1a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b4e95bb44a6d66c2bc6cb108ce69ac6

SHA1
c25f0f3478b98e0644cd36f0aa13027d773b624d

SHA256
d141afd6501429f5750fd0ca37cbe141166fce3846f7c3f4bfb404a18c2cc90e

SHA512
a7e0ad429b771e3ff4640c1067108b5d770ac2a47e349f96139c6cc0bf7d190d4588e6a34ce51d198c01ffed0537b37db8ccbd6244620576a2163c20a8e23d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e43b1d05b4d0806a18195dd1c89d434

SHA1
df6fc24dbcb662d6171fefd11168430f31adab88

SHA256
4d30de52b9b7c6e398107779d03d552a1ba044f3bb105cb4234b75c980a30b93

SHA512
8db6e25f1953135c6ff20aa46921ba5c9b7e08fc7cea15d1e3f562a7c3b057bdf161975400486e74c622775b72c7c0d78b98198d9a1b19b556d84bb080d9e9a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b03a96d317fcd11770ad28e9ea411105

SHA1
f147f70813dc7f5666abb339f793e5d89867cf44

SHA256
79370754535e719956d3be4408d96946cb3557ea4617bdbf6c8bd18de4070698

SHA512
f84af86ff8ac187f327ab1c4b6cf307f32e942e48fe25db1ee256928630d20bd5155b85e75655588531fa9188bee1731d4b59d26e78ff6e15b30753daf545ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b56d424c5caf719e77c46f685f76ed4

SHA1
19f9d63ba68cdb71c698e2faa25ecbd15183f101

SHA256
22c00467080af648f8d2b4a3638ee89f3477ef4f9a8ff9bdfa37daa70198d206

SHA512
1f8c2240a773a6dd1813a9a55ffd9c16f2b9351c44ac08597a3b1a0b4f141a11951f6a476971bddfc43bf083615b3c56aba883791084ae75cda3fbdd82a1bb71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6e215b94cb03fe2939753b33d1c2a13

SHA1
136f1a2e64101d0204844fe5e5a39a578ffcc1b3

SHA256
241749a1e0c68a4fed81dd72aa0bacf8e01fb1013fc392c9496813b2dc3a9fdc

SHA512
ec369c95aab0ca0e88877ae89ef6fbd7ad70be7db72dc4a9c65a2c3ec566fcc573daef96b13d40cb7a450aa6a38087bb7125d29bb6e182cfe150ec4dd84cd150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d86e4de1a6c76e3a42114e5a10ef8d4

SHA1
36ac469aa7e307b16dbc867eed8c338467d4ba9b

SHA256
cd7cc105599c447ea0433b512347f83e9e8967ab91e1fbe4c5aafc105c7e17a0

SHA512
2bad00e1d67f1040022058d12c3bc490bb7b07396a99f49c01035eecba9d23e5f0a896848d7600de774672e570954172d067d7ae97b77c965503300145b1ede3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfb513d0a61c619d0077ea60569c971c

SHA1
0a89d0a5597548f90233b2969dc5e827a7bec13d

SHA256
47bdc0eb39d6d2260edbf6590f98fe49be4da9962d65eecffc0e2f0fb15a3c74

SHA512
4b022882a40c85e648f58163969378982ff43f95224821609856dbc3a8e1a58987fe7e5adea5adf9474c82329d77f5b00fcbbb961646fdbb4922fcd86c10790f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
313579eede842089697561f8a709c2f8

SHA1
fa2df40354061e4d64b1159c9d2ca6ab1ef7dd06

SHA256
f9cb45d966a64059df58c3f82c00049d588592fde2282f3195500fd38d5a2727

SHA512
ac0def721681f734ea7e2d8b3555419001d3e7bcd404b0193f78fc4632b76ef88e37bb0b01e3f4d03bfe2fac885ca0a16ebb68de49006fe71ab2eacea6982d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1132.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1242.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit