a5a3153921424db8aca5406aa1fa4f289349f1ea7e0f06b0825d6604979e73d2

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc98045d94df2807694c600029fdcf7_JaffaCakes118.html
Size

460KB
MD5

abc98045d94df2807694c600029fdcf7
SHA1

4c335b13275c57ccefcaff45cc7eabfaac8916d7
SHA256

a5a3153921424db8aca5406aa1fa4f289349f1ea7e0f06b0825d6604979e73d2
SHA512

eee2ef29ea6f01902d6804841a71182e09f3cb6d4dce1e8f7a7e8278f0da78aa1dad287c91a48f0fb2114b25f696b2f711cb68b826cd7f00b214c362a7863b24
SSDEEP

6144:SRsMYod+X3oI+YusMYod+X3oI+YcPsMYod+X3oI+YLsMYod+X3oI+YQ:25d+X3+5d+X305d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40826221abbeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48661E11-2A9E-11EF-AB87-5E4DB530A215} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424566347"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000008e663ca7578068c473d81c09f75aa35cc9071477b02eb6f9addd064c1c05ef9f000000000e8000000002000020000000fa50ee1baf9e531b6355d25285e015d9ab4cc426a306c5a1fc3be9be05bf4bdf900000001cf1d8acc2203bd20260cfd1c766a80a8fa42b6c21b8e928e941875514b72f6d975b13cb60bcbb946d18ccfa0f9fdeb67db04b44a0cbf03939a35229dff6890a4962291adc269bfd1bc654b96aa0edfc60bcc42ec02601b0be7058bd2a93b5145ffe36ab7a0dc87f2b9207145b831bf58e4f45d0d4a00295fdcaffda244f9773021a7258da95bf4e6d5e813607f3f33e4000000092ac5e2675a8503e3fc34fcf765d0b841dd1d24df742876da1fb7d750f530be1bf47b2514bdf96377bd3a978505768ed638073084ee34c06cde3f90b3f121e6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003b1355659cc619c5ef6005e6edf09ff50fdbecd1916974ce8cd798f1425b7226000000000e800000000200002000000063ef8a12aaf1e1eaa9b8ea12a7dee899c57ca1ab9e76ced9fc815f2c7a45f3a8200000008df5b8d900b6819af303f613acd2831cfa6246a924e8d18d91b0fad464ff17344000000073a8d448f980eb85bbf7e9f27d0bf5707fc3cd7210b413ca9f59fa3de6367fd61cce52508562b0ddd502df580fc93ced73cf78750a42a9c626a1f6fa8961ac4f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2960	2980	iexplore.exe	28
PID 2980 wrote to memory of 2960	2980	iexplore.exe	28
PID 2980 wrote to memory of 2960	2980	iexplore.exe	28
PID 2980 wrote to memory of 2960	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abc98045d94df2807694c600029fdcf7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fca3f9d5f19d3f901bbc1ff16666002a

SHA1
a547353c23145ae4cdb019f448b4a1970587a31a

SHA256
f100394661c0bd6981dded4afe5387497adcc4b9f4838703d2550d12b98afb2a

SHA512
34c4d851a308ac08ba415476fa9f8961605f66944d051f59b77f7a04fe3b6c7ada9ceaae728064b39dcd71a6b43b11e37828b9289bc1d3ff471f098ed58adabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b774c5b0c4a821bf64fcdc4f72fa0f8

SHA1
62ee271f44c056574b840f43a459d96704d0002a

SHA256
2492c69fbfdfd31d886d8a569e04a3ed811b75bdd9031081dd3d7c5e23eeb754

SHA512
25445f87812be6382e73649394e1873fc606d27148dc0843353697907c22053ca2b5a15b4eb5848073a85beafb166a533f1bebfe0e520cb8bcfe172f604a3b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ae3979a5e0fc886b1d11cf1b9615ee2

SHA1
f752ee16c55ef600fa2191da42926e9486e64c31

SHA256
f81e4a68b3bc92a679d970bf4452a78932a697fd3d6d8be5aa6fac36bb974cb9

SHA512
b093424712e284b9376a5307f3893f5378378c75c7d3335e062449128124666492908d2e6bdd1d8950ebddf2501f2f2ba1c52e8d64f8960016ec50fae387b367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99f31c0538201bf125c321a82b61a6bb

SHA1
00a066e3be4596a81d844dc1a0110554463cfe50

SHA256
1c2b12dd6bed596b1587973adeeafc681e321151cb2a70f3d2d2bc5b8b06736c

SHA512
74f61d6d85b1a9bc158bed4cb97900584cf14499729cad7f4956c87a5c37061d4024032f95b130c88f417cea68d1288d1b850aa8631399a905ea90e62035a744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e5b2bb7a84a835e007b75bd9882903a

SHA1
403ab9f8b2ff6cdc0eab14f4cb56ecccd9ddf3cf

SHA256
55348bd2907b6c011a733ce9c647ce8f1f0b7e1ab142ada9aac664c3e9bda3a8

SHA512
3e8d142e83ea0df3ee8a15ce655784051c008d70bc67832f9b2d4c1bca0385583b215de7a78c0fbfa265683684079eaea7d600defd400a73b7506ca2dbd69adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68fc852699fdc7ed1b11ac987e1b7eeb

SHA1
b2adc62eddd50e2166b978bb3a92d3981329b0d9

SHA256
89b78fb02bf7dab33537231f85bc4228145b2e3ff783b086293fab8f7d47aea8

SHA512
b09fb57afe6c6e02c784b803312da322e319dad0d8eb9c5d128a9e52906c2f30dd3b2f4fa482d060009ba4f8b2c95f8686afd25ee57d43204eb195c405f8a4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6540eea2b0ed59d4cd1604b1e73070b3

SHA1
c70e8e673a0c0cac6615e62ffd98cd50df86e204

SHA256
a709210308e85d23ac0b533ece6823801b1a7e2e9c79f1421fecc2bd50c6e3f1

SHA512
fab44cc86153c3dcf6d821e8b66991dfcd893ebe270f8f572821b7520e08c9c08d71542b8ed0505f6429196b2fa6dfedbe5915dc4df9fabf561c35534755174a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cafa2a8c8d213472f3d9f971148a28ba

SHA1
7be4fd0006182309b8286f0f79a38686e63f986b

SHA256
525e7b7abfd7fbf9ce48b8aa259b0edc66c427ee3852c0977f02fabccfa6b4e9

SHA512
1fd71dd972ebf298b97dcfcf47f344661e0376365541ba637453b8da523a9a79749393281262e64fda745111fa6f5ef6ab9475a34608188de0e68464b58309ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
843376ebc5f3c2e51772a02c6d39c91a

SHA1
ea210204806060411700557c5ccfb20af95948cd

SHA256
c52c65fb96aab436e6a21dca5b2b6fc9eb7013d0314e9381b2a0736a5afdede7

SHA512
0cfc8f052c4a36c7dba761f363d583897bbdbca02703c6f48bf2303cdd2f6dad275f61879f2b440ddbe8ac379a832a3f29999b76d545dbcd10b2b1470e4c35a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e95ceccb7678b56e4304660de1b0888

SHA1
5bb908a272e6c12abb8e231a1785486f882512de

SHA256
f6fc92c6d4ef1f526b7720d8afcb8004583b41769459f3d60970dbac43cca63a

SHA512
3288e54f7e465b44c586f5786d79212487598b3151f00338a04044e5736ca5c7853e3204d8d115001c9914e88737d57225674be145f5ea8283791795957b5636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a15d70f2d021850eeca77d607e1e2c7

SHA1
c3623c57941bef5e56c453dab2b0b76d439d5688

SHA256
021ca4c793603cc732cd0623d7d1d6f92f6f718cd4fa01bd0705c21e60bc77b5

SHA512
3255c20e228a2af75aa022b50c37db55b606871d8b103083467f6a952af15198b94fed79e5a815eac588526c22ec3af378ccca09b435784756a084dbcc1d7763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8afb26fbb71c1d0aea37cbf48ac35e51

SHA1
c2ca613767722d3338ba1c8da151c312b83f8a61

SHA256
4aef20852ef9a5e7571eedafb833000b350fc69b641bcb43996737f403439abe

SHA512
087d3c0d97b453f905654851866a64ff0e0e1c89d98b93df6dc3401d4911a653dc17e2652b89c2f93af9398a2b7c71e8b1014ff836c76f71c9eedbadbb6c06e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc45cea68d4e16379aefae40824d3c0a

SHA1
4e0a7c712824862e8166d24f16a06e71d476e504

SHA256
b2939393a82de990972cfd5cae6a2ff90fa4d1f83a5a85458824f59e4d222243

SHA512
5817b5265bee63e6a92ced1b17ed14cf0a84ba497f41ac0ed9e8c508b2bf92ff058f60959a1110216241167c66878b688c299ecee84848114202aefd5ec45c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9130b91145f577490e5f82f591429535

SHA1
3107da78585853dd9acec3cc62f76af64396ebc5

SHA256
c77c1bc69f8a668c33111f668ea4118bd4a7840ea2254e4527ad51cd689df282

SHA512
d55ecb9d28aa2610ce291e306a2bc94bf7c69593f91d8bade3b04fad7e4c24805e75585a8f58e0004cff619b336ab393347739ec376f48ab6534ed1deffd80f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ad1e9e96d5eea9699a3d3ec02797a18

SHA1
bffb26199b5e2e9359f042c0204abb84b56b220b

SHA256
1f4504287570720da0104f1efe0482cb3008453400120e5cec512fd07094954e

SHA512
40f9c1bd6cc1831ed18eed2e64e85ad310b31846e24e93dca6e27e68203c01aaaa9ba77404e86c73b70146c7c676c0135514f4c6fc5ee1f8502aded22cbbe342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32cedaad0191e979f70f8cd8fa8275b3

SHA1
e4223fb9865912536fcb1f86f2f165b8d868d3d8

SHA256
3b38f81696a704636f1e1d4f803714e9fe2b2cdee3bdb3e85db07fecf162d070

SHA512
97d4b60bc850a6e975b1b7d7760eb6f5b37ed6b0a73d73090a27fc3a94196c1e677f1679ff4a8df26b978429e2aff00e33de46a4c8c753daac42cb37bf2f8a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8865.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8923.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit