5cb593196b7c2031a7d97290bb574ec96473b28ba80004c4722653c3b6036384

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89a105fcca348247c40cf41eb026c2ce_JaffaCakes118.html
Size

4KB
MD5

89a105fcca348247c40cf41eb026c2ce
SHA1

4438bbf84b181b52ec244c3dcdadc64bcb506918
SHA256

5cb593196b7c2031a7d97290bb574ec96473b28ba80004c4722653c3b6036384
SHA512

61f4cc366f08e5135de19aaca756b046eeb8bb9dab3e3cf078807e41955f119316e931bdf5ef2c8711c2f18647811275b9f412ab7be7f50715cc5257e91ba35a
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oL1P/y0F:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57D2C461-1FE1-11EF-86BF-CE57F181EBEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a48a36b29eb593ddb7171b103769cf0a128f9f2678248c060451ed6a9079e38b000000000e80000000020000200000006adfd4e5cb254089739f5c91c37f47f099b79a7bcdb5b8c0c2bfc690ec865c9a20000000aab59d60cd2d7fa03b7a180388db0656485ea2f81fe704451f91d9931d6d6a4f40000000e51160066a978fcedeb6b93969175d5e68805e9364dd965c03acf4ffd3ba3cb4dba868e6799d17af9c646d8365b32f81b16178fde1a4a323056a60b7134c0810	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423385687"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0205d2ceeb3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000019148176bd38d83ea4ed37aa1b4e3cb385e86898cd9bc698f85695047faa1dfb000000000e8000000002000020000000f92c71999240669367c76eb84e9f8ae6d2364693633de6eaa0d1381680d9995f90000000a602b3abf55c8b583d5776dc0d5ca0c6dc5a22ab5d11a283f66fbd10bde7e983bdbaf7355163645fcd8c9a44c97e5a4a00f0d84e83ec1508abd7ed64bfa8345abc9f1634286fd430d40ba17e37730bbe742ddb950f46a3dcfda850248d6b0a910223b901bc5c0dc0b30e18a4281b4b60018bb1f57caf8a202a0a7a8cbce77b0cca5a3bf1e6804c5dcaa72bb6a3f046804000000094034f54a4f9220c364689b48b397bf4d173facd7a40a1a5980349042a0b381eb132b1194694088a1c4dcc9705e12a92ad74170359f4b5ebbc93f64b9f7420f2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2704	2088	iexplore.exe	28
PID 2088 wrote to memory of 2704	2088	iexplore.exe	28
PID 2088 wrote to memory of 2704	2088	iexplore.exe	28
PID 2088 wrote to memory of 2704	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89a105fcca348247c40cf41eb026c2ce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19e43274407db11dcbe2516dc4bb56e6

SHA1
decd6bead34316b9d57bd1b0d5ee64e4e0df191f

SHA256
7270155fa40ed351fa335d703de86777178ed1cd4dc33082c846b53d12a6c047

SHA512
f07709691f73494e257ede26bfe2436d940744dacc16ca4ed03ff379223faa9941d9d14048c7251f875da3d46f0635054e96f6c62f0794ddd36999c3f1da1c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b91ad2234e4e2a7b7f45ac3d140388d

SHA1
e1ec805443bd53ab7ea271dc1fe1bbc0c529aff6

SHA256
d7b71febd8b78a98b73b52d1630ddda81a6e00c2e963503531a53105943639ee

SHA512
0fa92c16ae1501048de08207f1fbad3f81cfe7dffad061b863f29a4be5ac783ff9e1eb15a76f4dfa4de7dd691de598736b7efcd71d1aaff1d5ab5cde7b92a33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f1cd89258e747a9bca3dacff8a3253d

SHA1
0d8dd27f51d737ebb83e4caed3c169986ee8f390

SHA256
c58b401f1c6f52674328ec376f6a613039bc66e4f5f57fcb07dadb3a657968bb

SHA512
0bb848369cbb87ca34f378e2eb6f440588404427febe22aeabb1c908445240728d5c6bd911a4c8757ea1dfe8f20e9cf7df9decc1587f0de175de3a3c621fb0e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baf8f094e1f5352a4bab5feff8495a8e

SHA1
a199cdf7e6f2a310be8c5ab031b5124663de19ed

SHA256
0c57887713cdaea2370a3b4d834b014677a006120d4683010e94475653968c41

SHA512
65d36197a79fadd0c1128bf7b72fc9a3eff974c99c3b94508c2a8512354342c2866ae3e5dd7c8cd64102329064cdfc03bcfc38f6cf91ed014ad57079909f99c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6d40e9ebb22c9a26c88207905f05086

SHA1
bb5d116e76d6f5e0150e5edeb67b592cc6b9ed28

SHA256
0a31a8f866b590931b3575097fd43580005ea3d37381deb4d54160357c3eb329

SHA512
f1b4b0b22666ef6127dffad3a8fdefa2383737925557ece9bca6e3dcf78a9a12fb4f8e41e5360e7d8d54653d730c54806d44dd4a10d4cdc6f333c269414c91b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59335d5c73c296a3f77bf97461a8b78

SHA1
e265520fc9dacfae4f4fd9ec6880c43c08c3edd9

SHA256
8d7c6bda9b73b745517a94d6c8f9050445cf1a541108b6af79bb6ef96d5220e7

SHA512
c1b8f38f81588f6f85b0e66c3e2adb7777bc17b02910c70d53dd13d8183e784b6983028f5849c86c4f904672c9899ebfec0c61f07f81f8213546f7dbbad75ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0814bdef5d949e186211186ada4c4ede

SHA1
148b15b4a7bd566fe16eb0b72565269d5ef5466b

SHA256
0d9be57629cbb4c2b6586a4efc3e6dbf8a6dfe734668f3f56d75006fd16c5bb6

SHA512
ea0909f3e190ba5dd4c91cc4341d86b58e272875e0cbf0d6ea5c4fc6e80d5f18335e2c2f07e8b0bdbca4e485a04adfd8f7e31092e4e5200206068ba2a7008179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c766a462d788036a183349a35a3002e

SHA1
e81f4f99ba7734b981cc27f26ad6354d943f7569

SHA256
e48805ccffea471d6348f8b9ef7cfbd5ba7489835fa9898d626083da7c421939

SHA512
be445e2e94e3aac14dc0260bb6344fe2fc02fb57f643cf032a657c8ef42183b99f7730a37d6059da32bbdabc1e221677a579889a09fb0ab7675b460ed8ae7d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea9e61075089cbf9611026004dfb8f1e

SHA1
2f60edcc28b62a75eb1b439826bde045a19a6fcd

SHA256
9d25318f5f5ecb87c28c297b1055d92257ee45fbb099f6d3d34f54b2324c5cd8

SHA512
1ff87c396040c1a38f4ee67283b7f5f35424a11bbb60b23ea766a099761e3ce0bb1ad3ee7fe4a847e98e476bf67cc7b8bc7c8f72d275e29a9a249793a8492934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dfe922866b49ea8ac8c36cd2578dae4

SHA1
f7ab54d11243aa4ddbd52a8efb2b4edfacae6461

SHA256
e0165256926497e52cf31a4773e3b59f134a1e551a8101ee77c8ebb1d535bc8e

SHA512
7c248636d439ac1da1ea8d77a3dc1517327aa4b980bbec9db57f246a0eb2b4789fa573e92164ebbbb1a91a0f0b36e8168eee87a59685dd7c72917b4c9072d69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b23d40a7ce3ec0faccfdf78d6637f516

SHA1
b6ee26814f37a81dab5f7c3f7564e0c07cf48210

SHA256
11e1da9af3a1e71280d96e6cb722279ee1e233850e3638af6a969524c3326d60

SHA512
adf3e120783e580af8161b4682c50fc6b13db3b4dcced62e7f7f79d6a605f5e38d6e78b363120f25bc80f91a888e5787271c34af1b16d269430de3bd6e8f11a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a8b93b35c1c67985907bbb07e6d19d7

SHA1
f0380825f394be389796c0368df3e9a9fabf4082

SHA256
08d671474211b1f3d14d81ebc2fcae351db1de071f11adef687d58902f406546

SHA512
d589fd36cba0667e5cf4ca28c84c345cb066f3cd56bf24907a03cb50215a4b67383b27199e4a55c9195dbba00896ca4552e11c62e12d9ecff85d92cb677a0a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
366edc1f3821d065ca8e829a4a2a7745

SHA1
70d0b66aea2663e52ad7884313dafe3f49eaa369

SHA256
db399fa9e81ca778be1888933b2739cad657857f6a5b983ce75275e14e2c1cb7

SHA512
3ea25ec24a984e260868143090a3d9071022895b5b65484cb8f82d043927284737fbbb2e4045dafc943f71f8bf41b1f965bb1fe2d0b59eb3dd9b3ae088c56c20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6fdfcab565748c5c9bdc0540eb08da1

SHA1
7ce9ff1f5d1771a29e6a5ad5e6540b328ad60a5c

SHA256
681f511af96b4b6e042f964f45cd72efc6c46777a42967bad13cfcb75d009f0e

SHA512
bfbf3414eca7d2830fdc334277dc4cb64850c1d0b0eb067447c4c810059a65aaa3caa1af6de56a7f2bf90e0646659dc25709ca26062d98f3eff1cf19163f80ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b0b92f7b6819de98304d1c4f95962d3

SHA1
4d66484a9fc4ef8b971ef46a1cfa90ca0dda706b

SHA256
d43648eaf4e3dd897bd7d1a6d0da73c9cff45275636fa13e1c263bdbf7aaea9b

SHA512
1dd12a258e56ec59cff42a43d69cab70770703a59e56e469a5d63dbd22ee3b4401e446b47188ca86822f03d663bdb7bcc29032b02800d00136416e560f4df3e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11b49407a3b67d394ce1df9728db49f6

SHA1
d15f5e27993c1047555e3c14a3a31b36fa387b15

SHA256
2bb2a9c09584582b921493df92a722c621407287399ba949998e605f45d44c35

SHA512
b3a932db4202273cbba38c53da9d7f0c3d069a20f5d0c1b312c78c622acc64d8d7b266a162fbf833e5260192c682bd98b104018720709bd906b648cf755b9522

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C77.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D0A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit