3328e22997cb3d2e4977a475bdc4074abc450c29d31a93b108919b166e453303

Analysis

max time kernel
141s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a57f590486bab207f3545f563379a045_JaffaCakes118.html
Size

4KB
MD5

a57f590486bab207f3545f563379a045
SHA1

f1f6ab1f16c9b5be8db03a33daf1e69f59fe7095
SHA256

3328e22997cb3d2e4977a475bdc4074abc450c29d31a93b108919b166e453303
SHA512

9f261a8eab83f8292c0db7cf44fdbc727d43957bd1ae247a2074a613b61ebeea374470fa26984c327295b3e35b07bc4829aabd28f0e2b781803e625d27d909ec
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oFHUxd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000a5c371073c3e75ec164d73fee4ae54ddf26afd1c53d26829a5ee7ec93ece93b1000000000e8000000002000020000000810f1c580e85dc3338eb8b376326f31248b016350df0c678383b003384824da19000000077d203aa14c8e03d699f423d34ea445014068e5229a13377f86eb4fcbe211f0711472d6aca01c28c0b1641ce8b917f13e19ca404e238e22134e8755046d61f9cbd178f7c233d2da77db78e7d2df1fd3ed781474a9e042b0a84f1d1a8dd66aea7c433f39f1e457a9e6e087b3b98cb695f96f273a27a95324c1c77653edf47ae0bfb51bb57b132a597414155291855744c40000000272962ab0083dbb8ab552bf1912812151c93992878ba8513cb13455583bf83b424e8d1939d278b89b762aff43840cd49ea7f2e4d43f2437f91bdead29c35c088	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22C92641-297F-11EF-AFF9-DA79F2D4D836} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c13f76488baf18e24b0e9560c9cbfcfbfe337c0a0879a8a886d7f074ce4810d7000000000e8000000002000020000000dee3601c33c97b7be2a6eada57f1b8755bf2d1bcd6aac2edc95956ada8324776200000003fa7adb9bdd9710be957a545f95fdea3e78e56f7b23ce24d6feebf5fa778a950400000002f5ddf3f69545c8612f7389a88969978dcaa824665186096dae57b25065c175c5be2da3edbd59bde2c1e1a9aeb3e383a5c87130486961af7c24f9916f33afb4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e65bf78bbdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424443024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2056	2300	iexplore.exe	28
PID 2300 wrote to memory of 2056	2300	iexplore.exe	28
PID 2300 wrote to memory of 2056	2300	iexplore.exe	28
PID 2300 wrote to memory of 2056	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a57f590486bab207f3545f563379a045_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99f3911810eba4bc0db2edc6495ec421

SHA1
11b5f7cea0ec01ad027c301c1384a99a54faa3da

SHA256
592744bb714f7a6a487d0805df06a61a7a33a81a65e362cad3aeaa0ad335c8c6

SHA512
ceb6c0f6362c10074df81b1ec4bdb92cbd2e9a3d6c2f8dc6c4d9d54685398cfd24203688cb3421099a2e0ee9dd13974af884453c600c566b34d097f354d17a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e3e5e86baef66cb78d6220c82663c2b

SHA1
6544b85ee261e97274a3c066a8b4ea25170eb475

SHA256
6bd8ae05486ffe67658df75f92932ea593772cb03d0b006072580f3c5e91d30d

SHA512
46d4a55b82211ddc02f2d02142af9cf73cbb10eddcf95768eae91c7b2b0f5cd7c304684eff7d7927fcc825e6fe7930e784a6c3b207e3baea8cc0652146c725f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d3c5e5aa5e150ab1455fc702f25e639

SHA1
d72a983a759f042f3d9cdc6d2f25e08b205d2bcb

SHA256
3da91e46a196d7cf7681ee7bb595992b6719de0f9199bc575f8cccd4085bd6af

SHA512
964df0596d93ae4caf8a27c95949c8c71b9890a9e6737512b1a3bdcb77addea1e6f7a68ad257e7e3f9ff501d63b82596117f012a79e4f6c9529f9c601e416542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25faf0f4aeb74c7beb3e1cc074e2f88d

SHA1
7a4213840a13ef7b68a49481f2a4b9285b6d861c

SHA256
374bd3672fa42438bfb86f80e2915dc75eece244ba8e1a3f7aac284e12d2a6b3

SHA512
c250fe437411a5919b286ecf82f28740a37db478ce4cb58027653d4b85d9a1a9bd8f0d65ca66a778e62e864958f1df0b12674052b87b81f32fe143ad6d84a45b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a66a6c32d930d6f5246b0cbe6ae51c8

SHA1
4956b3686ce3aadd861ba4b341a5afeab303c29f

SHA256
34e43296ed473d4e135a18e98917b5e06938e84c35c09cdfef31bb0075714244

SHA512
5d604c4789556a6565a95a4a3c709b2e3a6f64d05e5cb1538fdb1ae9454153e48dcdff73485eabd9632d5e6dd4b8d478351557d5cf9b8dc7388776e2cd6de516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a166082c03ca2d9bd5ef733132bde3

SHA1
b07104af3d111eb5dfa44a18702b037591476b06

SHA256
70ceb0d010d68c420416a979a9baec8dd3d51595c8e4439274ee0907d91ef502

SHA512
e3148bc1ee8b88d4e19a095747bdf60792daac60b8456d350d94b21eaf964dbe79fb9999c5455fa2190bc02f0154136ef64c149cbfbcd12db3f6b787c8c22822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13e71ac19a1ee572844056339a37ad6b

SHA1
5d1767aad1b9cb39689838f23666bbac8cf7e5d0

SHA256
984e6391b26b3ce0c27b650c5d6ff4af4e25f853feef791bcaa82d80df123eb9

SHA512
eef22161517f8eb07a95b6d15d46153e8eb8aa40818f8f7a4c69dd49aec1c8e0e030b2095a2243833d083beddfee4d57ec4b1f6a84f6872115cf28e95656b08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f647661f0043734611d77acbb4e9270

SHA1
c973d22fb445b1b372489446dd27d22bab08dca1

SHA256
fe15edfc60974cb7f44b65949ae400161936ac4f4ad4140e8daedb1b820485c3

SHA512
8485691629db34fee5536aa2e67c0d8a7166e86de19ba4fe91997197b0f747e6e51edf06c0be8e3800746548c6dead48b4c4c2030f3f70e2953ea0f999ef5d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b27bdc24a3b81ee9d882d842f2ceef1

SHA1
4fdde5f5935f1680f50ffc425730fc7586fa20f0

SHA256
4e5523d743e341184529d20332bf2c48c8b6bd7c55631a78ffc153b565a307aa

SHA512
f327b4f6031c0c406ae653dc3132e050888132a24e1e40d58f1d3c73659c00234511cfd10a877847f58b037aadebeeadc14cc0b4a90e5f5d1c5ecbaf3e18d6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb39930f5eb10e38f85673a12a829ebd

SHA1
a93c8b1f5962e5607d4b5ca93ed9e9eabb83f53f

SHA256
1dc5a7982bf2f8e43a5a4ec317d0f3cae1fd7099f28b552bc537ae9feb5aa5d8

SHA512
93a71775255c7f24a4435a1f89ce530d0b3aea565ffa613aea6650bd1088d523fa885af2cbf715f3e8494ee9a4fb29a3747fc30e1dcfd355230d485e38e40d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62a7598b03a2b9f43e19324f7994d4d5

SHA1
3648b585031dee38219d45808341b3d929a0d63f

SHA256
4f47c8d9732fa3335f2ffe3d90bca0f0c37eedbfe8c19f51d96533f39ac3b8e1

SHA512
8efccd3494a63a82a060ebdffcc756c6e5d18a9d5ae80f87caabe345db7f4dbe82833c784b57a659d06e806e3342495d7caff290332928437fea78fd220457c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
078d5f1835b296162e317299248284ea

SHA1
eeea39a51075df513072d8f36b9bf0481333c563

SHA256
e1d05861b1c5d90f6b5efc75b5d0193bcfcdf812df1b87c0989df7592309b76a

SHA512
4f37dfdb9ac15a70babd42a1c069662ccde810b7206e22a1335c9d840402656723236c07fe34f677b8ce6c28fe3a5d84fee651f52589e41319699fc1ee14efd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d49aa474bc6f0644a24d703e39fa17c

SHA1
74b4d110261e1b3eb921d84618b28e4c2add7088

SHA256
bd0de37113332a65ae0ea0da50cf71a39e9e318ee4d9db10778cd69d2ee12ca7

SHA512
58191cf38fe0e70bb713d3ccbe6ed59827f7d16eeec2bab1712f4b854334aced26a2cad628cbc14175e4e6b41a30a7f5db58503300a4dff92620691262df80e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e18b7aaf43d4986f6279705839296d2

SHA1
5e1cbb5bc25ecce767d74a024f3170b53ed60975

SHA256
3206191c129d65895c6b8b9573bdf941b3d7ad272c553b48211be50992b26687

SHA512
4fa33266156776e45f2af8eb26e8c4575271d74ff44b3a48c444b98f03625e74acb7f38bbc477ef7c5e059d5115196ab6038efe35d8c4fb2a90ebdfa6543d0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a63cfb8a556421a315d17c2b2fd09ac

SHA1
480dc682c0c0a78d16fded5c1c71b8d5ebc5cc50

SHA256
e96671c9be6e0bb0ea52c8a3e79431a65db3ee135dba3014ccd67f2f8926bd62

SHA512
70ebab3e55048cf60089bd744c89586768b63a7446b011dc5c214215f3d3fa908836ab390c4d7470a5c069035785483fe203d09523b07d33790b8964f4e1db79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc11e329d153eb9960570de9cb0d1e4d

SHA1
3d41abc3c08c88ffde8857b56aa31042bed97eca

SHA256
764a9795acf6ed049573eeb118a326f660d62797041f354a0c78e2276e7d2d17

SHA512
23604b33a850e60fdfd5a6427ecef9b99c18d830737694fa3dca364565cee70c7d627e4e84a070ca7f2cc8d1d4a9f4cccab4f7b5678e64685b5009e75e581494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ca175b96547db86ae896b78b898f177

SHA1
7621117c8f997537913a65f80db033c24205cc0e

SHA256
30c576e2424662dd0d1e83cda0ee0ab24c8ac02f205b82ade2cb784e1bdd7666

SHA512
03977d9097c27e8babb5b0d28105bb3e4944cf5b18bbc2f3796b7590f6bb82594671d6194cb8d6863bce5080eacb83a503242376df9c1699fa3e7f261cf93cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B28.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BB8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit