60fec199c4fc5fd9343ef13f40860f55b20bf9a3f27393811e1063e305eb207b

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2f649c412fcb8e81031ef44f940b334_JaffaCakes118.html
Size

4KB
MD5

a2f649c412fcb8e81031ef44f940b334
SHA1

a514765cc54c850f0191605205cd6db27b4a43d9
SHA256

60fec199c4fc5fd9343ef13f40860f55b20bf9a3f27393811e1063e305eb207b
SHA512

615d55d4ea983602c223301c6278976bea9104aeedc8747343f50a750c22cdb79614081c838aa6071746259fa3ce1e2036b17f9a024c9d5cda8d9486397e7342
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o9lVd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C500A021-2914-11EF-873B-52ADCDCA366E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcbcd6bd1966a041979f1bfb75e186d90000000002000000000010660000000100002000000055c0a1970c87daa5e6b261255b909037d88422666b37f9c0797e1504c2463e22000000000e800000000200002000000012bb812b7bd74865597fb7ed452adf48623cd3562fdf7c392031f010010c78ba20000000e81124aacd2fb368382dee8fc2c47341e63bde163712252a1d317751c4e3ee48400000004cf718dd4ee847063e90e805cddf302aa738a0dd9c2107b4b6b933a2f0490db62f33eae3ca544ff59b0278722499e73886d678f274b59ad22cdea43348ed6750	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424397333"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c8769921bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dcbcd6bd1966a041979f1bfb75e186d9000000000200000000001066000000010000200000001a637b7339662d2af1ae663a2ac59675e755841760356023fc20d93fd0d9228f000000000e80000000020000200000001062ea80cbb531d4c40235647ffa467955e36db14467417429d43f6fd07f522c90000000e18d38927c91e3f31d94565436c45f7ce01a397af9648f7a3516b85388f647ad7d2d4ef4e64230fdf571e2249597d6d2c1c0ea48543c6fe798e0d87bb42108f7889c95b10c191b92b4ecf573bd37ff3a1135ea589eecb1c4a15b5411c7e0c03230914f14545f12c8af8ec1c5ebb1843100358fb83cdc83b7bf2eaf552daac5ac108c9b46397910e677d7e357cb880ba040000000cb5a85394d07409c25f509f99e5f43ddebfc711f6f35ece5af1eed54ccbf3e895eab3dc0a02421fd01eebb8bd686565f5ced4f7a05efe15390d0bad63148a6c9	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1984	3048	iexplore.exe	28
PID 3048 wrote to memory of 1984	3048	iexplore.exe	28
PID 3048 wrote to memory of 1984	3048	iexplore.exe	28
PID 3048 wrote to memory of 1984	3048	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2f649c412fcb8e81031ef44f940b334_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be7fa27ff95043e43ec1b81cd271b203

SHA1
29f39ed0f8d9d0b315d5690d481d1c6c8fcb6b91

SHA256
fc7a73268d51a9f3a0988830a57b478b6b68fc4acdbb5056c1364349d54446e7

SHA512
b24b27af8d4f82c42477bc19c408cf6bb0a6811f8f1eb058185057144e9ee8abebd010b894c3483f53aa29d3b70e3429ed14bf6213af66004e2a3d4833d96d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f77f73ec60affcaea7191d895b3f0d7

SHA1
73ebf82373b295c1f242fe3eeaa2e962f59216e2

SHA256
50242df51d789791b51632cd854471474c1c4821e94b00a9079e849b44ff9784

SHA512
1fabfdebf92aaaab72e916e149754014b166358b0fff7cffbe1b456049c988906bafa58ebd0cb8e18ccaf53b1c75c49dc44843c9ad5eca95c8acd459cbcf131a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44da4c2da28be22d734dcce353b0b145

SHA1
fe130aea500f6e6430cc6663f0e77f62e0bda27b

SHA256
5666aa2d67ea57ca595a3e2ada821d02eb5071c929238375caec8cb3bd90e704

SHA512
3ab30f50152d64f1dec65b6d2e842009863496c6953bef5a6e08646af6d1204d6913c4414a0188d37e8d3c95a5bebd32e737df2faf0402c91f6ec95bfdc5f26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e5558fe066a7417d82971601b051399

SHA1
ceb0b8a4b627703ee68b22d68139b6b0a4184b1a

SHA256
10e6d5a32ff6fe037b0cc45ff74ae17fa96b1a603e57a8d44568448730314a0e

SHA512
3f2dfc5d5769420a83ac36abc659594300384446814033486fd1418fbc6b6643a2386b7621cde2ee3154c4d0ca929c248a7887ab9156d72766243fcd30745727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4ca6ff77f8fdfd7025203896c4bc5b2

SHA1
59fbb221e1f235ff78a5219f987fab7aba7ede25

SHA256
57ee82601f06a4ff0ef30e5d14b8340ef8ab2825e1a42231c2ffba2b41cd3b4f

SHA512
eccc2af439d0884f5b34fb6cca8401dcce5a606c50790c1c0508a9b8a54c10339ce44e3b742f8f36b99cc8bb34ebf4f45d030b058d9c6e0262f0d376295599c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e752c6cd3dbe623b9a5ebe115cef2438

SHA1
5d1df8c9463f25b293a4b4301ed24b40b4cc8036

SHA256
2c9256cf1a75469cbd23742b86bde070b5e1763feed901a69a43b210be1e6a65

SHA512
c50e8941ab22324515513622f143a739a638c7982e59d6f9f07e99d2503a9c463d2be7fe5e2936ba27cc91d173d38d562d3ef403f00271cf3d9a8980e01607a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89206382b4ed940052415ecb7401d1a6

SHA1
084416ba72aade9c006fe62f53982b27a6484add

SHA256
ae8918cab1697c82157c9d36135f16f2fc5f052d5a2a01e00d92967a1a83a082

SHA512
9aa1b74a599adc354a8217a010da2b3c8379d5e722339621534bf16cbf7c1f52f4adb4d80f00fcd2052384214b9a0c74729b22bd578877d9a19f9394f4df5926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df6c6d5f17bb8a7e683a53f1ad7ec48b

SHA1
7944c4405ca7f79e81043c53fd9c3ed6c34932d7

SHA256
bffb7de928e32cc6f3c21508423e62d3c9a071cadb92e4e0ec4244e251ea8524

SHA512
fdaa4e59706145e8c9da3193a6ba71f548ad28640273ad37a7c6448ffdecb3734f6e65ed7468e71abf4c2f8f8dd939a6ddaa622a0f6f20ff8cdba7d0a395b6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eda20b8431bc1d96b4367b3cfa124a87

SHA1
5899b7fcd630dc909da5f1bd12cdc0e63d1ca79d

SHA256
c3c4e7dfd222bc32fff60bc8879fb99aa8631092dae47fa7a171127220ff38ae

SHA512
650208bb65fbf9472f8cfcd93cff0cb996b34e6c3b7621e50da381877dc481b3c70d2c87ce622326c76ab722ef4ae47a0bd267819edee3aba8477855e731518f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10b49e9c4549b2c81e57b9092a64444e

SHA1
b1a359ef0f4fd2382ddc116e0ab01ec04c3a7cf6

SHA256
e80ad9101acea533b9d55ab0cdc7788d007ca590dbb7566194dccef6d3e31d8c

SHA512
612c16b8528a6cd3dc6531c65e9d2c93f12753949bdcb0cc762638b33d546c72bf485cb12d6072076955d24f37a42f7f5dcb568697c760a713e43186487013e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
893c39f3b06ce45da707aba97fee69c5

SHA1
1deb401b3d5724f0284dd4e2e671b782a452a397

SHA256
5dd58f95a12397d4408b6575f6891ea143f88a63ad30699c88052fe3d2c4ba01

SHA512
229e3d81185676d2399b18cf49d8ed4e082910d5256fae7defa43c073c6b2d0fe3a75b9a17270c3933f2f36936a444e27d7292e31afaf1182f1a62c1afe407ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95bc41b1f4db704f3b7d4344e6d1d905

SHA1
0e3beeb07e66ccea5f969fd3cb67385fbb9bde23

SHA256
1261040fecfa23d2fbb334c56dae6abd29f6175cbbca1f35b928525da6901694

SHA512
dd874efd54de1b5d1f07f6a481cb090dc0896b87c188affd0a5559829047855f693c65920185f1b94fe39e96b7127a26134c6e2938ba42e0cb1732184cff35b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97a4337afbc96788dfddad876b558ed

SHA1
8f4665e7e828fe8adad43f246d71c5086e393024

SHA256
87822fe7d2355bbbadb025d88b5066bb819e27a84fab7e5a0007bffefc959a83

SHA512
532e301ef3bc737580c3daff7d37aceff485272748ade4ece494ef33e6713d1860baa5ca6a74cbe4d1d6658c0dd23c79564c42b47cba96153cc82a797a64eb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d17cb5b250e9e7970248f6d9c84781aa

SHA1
f4841078c5523ff53e74a3702c7695a35ac5d991

SHA256
399c0dda68f47f5c7c3acfe4bb2ef224360c972f83986d3dfe22c08d7de46b0a

SHA512
d1e600dde204d01a2cb63807d22a94e2d836cbc84af192f805e6a121954e024d2bb1334ec94d04638c148e8130888deaa4acf94ed9f6e4a00c1a66a8d0b59c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
771cdcc1ecc03eada9f04eb9aa013c45

SHA1
e9eea22d67dd191673cfe6d1f32ca48d01ccf027

SHA256
e0b2844e792005b41db980fd3a9fa72e26a70f6e340f1f64fdb620235c903eac

SHA512
a8cb717b282a5a6db46095c2c56a7b79a25cee12edba749e06866b073f91349d01ec641c283791259143a318b0b2e67cc00157edce5faa4edb5223eb03bab606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37808e13873f4a038615ba4c64372040

SHA1
b696f45974815aed70565961ee3bf655b9f711a7

SHA256
e2304297f5e39a93a6be9c4a218700c65ed09547c275dd7f04bd564c277d7f36

SHA512
074de902760db19f39fe9974f78fb167ab6d572e7213ef8fd4baa59fad011a2d31b12e6ab95ced1d2b1e9078db9aa79a6695931848954c7538deb60c0a423c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34FF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit