1801a53a726729dbf4e60102de669605f90122f83653886a42634b4a5ff88c3b

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

284f78b9c03af688f60e48967cb1c8f5_JaffaCakes118.html
Size

53KB
MD5

284f78b9c03af688f60e48967cb1c8f5
SHA1

97349f217a4820134beb381caa3307c0e54149b3
SHA256

1801a53a726729dbf4e60102de669605f90122f83653886a42634b4a5ff88c3b
SHA512

918044de93c8fbe829c0359c9b96ff53cc1d0f3b307d77b21f5142788d9488754d6a5e9609ed02aac004bb0dd9410128c11122c29a97d7279ba159a81bedb23d
SSDEEP

1536:CkgUiIakTqGivi+PyURrunlY263Nj+q5VyvR0w2AzTICbbKo3/t9M/dNwIUTDmDB:CkgUiIakTqGivi+PyURrunlY263Nj+qx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E49DFE1-3B8E-11EF-9CD8-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000b610bde0ddfa868cec934072ea2d3f9f8eed90ce35c172b9aa03b38bad77a15c000000000e8000000002000020000000f2414a44ac0e83d792ecf653cbf15879a197f76b1b50ba9e272a6506d0bf4589900000009ddaba3e96f12ecd4fc2c70167873461191ba243865669dd843ec16c35a0f54076debbbaaee7fbc814dd396dea21227b854eac84c7dba65a984cacb89a646030ab08849412e7e6d69a1a3d06a65c7e34d9c1549ec9149455d82d7a255dcea3a1a6e25d0de23cf566ceb93fba7b0b39b749db7f034bd02177c61415764b504af40f436051a503a7ffc7085f33bdda940d400000005a92cc364c507d37ac718ba091448f99fed10d57e7588a402985cb3f2b541239ebd2779da9e9f60b8c521bec3450cf1193b719f291af4d021a47023899bbf21c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e043e8e89acfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426428547"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000c7fa50a015c46034c4e7b3270a25a85bc3f8f76f9460f89d1ec03229c138cbfc000000000e8000000002000020000000ed72158d5d2ebc316660e02fee7fc980aacb854d4c83723a71d6d5b6f008ce1220000000c92914a3cb0957b4633209394c7ba8e1bf7c678fbe36d4cedacad7bc5d508ecf40000000df8d901cab94ad44d15e1980fdce5b92bbe2e50fc0433eeb68a6a77986464667c8da40c96420defa6b145103009496043a0f53d5e1700bf88b7ae3134084fe20	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2472	2300	iexplore.exe	30
PID 2300 wrote to memory of 2472	2300	iexplore.exe	30
PID 2300 wrote to memory of 2472	2300	iexplore.exe	30
PID 2300 wrote to memory of 2472	2300	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\284f78b9c03af688f60e48967cb1c8f5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dc42bab4325d9b453e1cd3372a734cea

SHA1
ef14c908b9856ce9d59c5f6a878b632c3637993c

SHA256
3d0803ffbd7478ab730e120dcd4c159f9424ac29adeaa42c2fd1940b987bc6f6

SHA512
2a34815c02da48308f36c5efeb98260fdc81974d1df0a1841215e87d674f2cf26a2824994c835da8d614ddeedc24a1b1740beccb4aa74f9e4c5bf5a550b3aaeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
63ff96a5c237a5dafd2d6f84665b2ef5

SHA1
aa4678b3495e99961c2035a6878f05ec5013d528

SHA256
80daf44677f5223231b1bbc26b7d9964fd78df3651d8158a1e57b247b6259585

SHA512
0be74e94606f3f976a13936d7c71da6cfd6d9abe6efb4962718569ae5d8fc57241de30f2f47ef9c77cc24df74c4300253265ff1ffa5c2ef5631d583ecb54ac66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
25cb998c5091bed15f7dbc0c50d46e74

SHA1
e16a74f9dd3db294237a830fd1f53f17d2d65f78

SHA256
b6e5e2863770c4574b16f8135a928df658f5776f850b7e82630d3428b1632325

SHA512
41caca3c993f8c229f8bddf5e91a5532d298f00dc8abc8051930d150a7747d2fddfe4674c4818466befe9c199e5f8b599753ef09dc90e6df539831c66f430153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
978598a7d36c3b5e3de92de562de3b80

SHA1
4b6a7ef48e9613e32ec37b6384135e7397b69d67

SHA256
357b9044b528b653a7f51fa345aa767aab2c8f96ef2de5db3c12a857a27166e8

SHA512
bc947bff8eaa74a8b0efbb5ef424aa6e93ad7ee6c2edf1c0c89ce8cab9cd57ce2f3d3a5089889edf240c466cdaee200db0ee795e9a59da11045d36704bc4b8f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5d62e6245e896f4240799ae8a7bfbd0

SHA1
c4ea49d0528103f9726ba0d048c228abc8a36fe3

SHA256
47465f04e442480ced0b61d3acbf18a951dd87560e24e194d305fed0a5c3f532

SHA512
ac0a770ae2d11e4857b0231a9f462d4323739c9ca7ccda0e2fb83bafcd6f3331c89c68e84b295d4efc974c793f187e7c326bd6ea427118eb242f8056119f1ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
35eaf3ccd336a8e6e940908b69cffa0d

SHA1
b5a9a32ae31120c7445c62e9c6f4f121408f5325

SHA256
1c226db3565d097481dea7d3823d765a63f92ace8036600990d0f432aa29c448

SHA512
dbffde53af786567a86c5118683295bb618ae6fea95f81bfe3139f083007e4e9b0105bf68d67bcb0d9123bd93ae42000b6bb721c5714ee62f48e1ab198542499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a771d0d7b3847659b095e20caec2ff3d

SHA1
71373b98e52abb39a483b98c1af165224bc2c48e

SHA256
0384b56bd8209c1c4185f427e2e39625d345d57ab6535a55509ba0a19773e28d

SHA512
90fafcabd83e15df12745264c22b418e259848e43b203130c6f87f6a2a3df8d3d1800bb930b4a53c085b744b6a03f311e98cb924a8d027f52e627b40f6fdd09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5dab03fee28e36fd372d5427e721bba8

SHA1
d8b47c3f567dcae0f492f66abbe8dea53b15626c

SHA256
06bcb13cffce01f0fe9058e949c990e2a1884e2f98a59a963b249692ca9f2818

SHA512
3837c3578b579a60ec5efb060842a28cc6a18bece0eff4e3067ba3da974e6af6ab99517ef9881bd4fb66992423c5a1d95a5ba40a5257ba070ffb12f523c80c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
04851cf14e2599eb6f994853bdeca71d

SHA1
8c390fe2a5f4f4c864fe207cf39050b55b2e9087

SHA256
4201c8edad4df4432715bd70249b4ffc4229990a81c068726deaf17693d2c1db

SHA512
53a0149fbdef9aec5e1c35a41d41c7b676b5a79611f03116e28280bc3ac83b6ea50d3ff63b84888a552cd6199c1e6166281f1044b2c76bf353ce8c4da2314330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3e963c0781308d0c696bd11460e315b0

SHA1
fbec5116ef34464dc6ab70eb4f430c93d31d16a0

SHA256
cfa42d2f71509e926616701ae3aa56a8bba85aadcfe3842c1a556d2f2c11a0c0

SHA512
55c0c853f83a8a17b504a9647cc3e395d8790297c90c9ff9b3db68ded265853f28fe767e073e91f4f1ae0f0f940c5c8e5550c4a33e151ac271e00b127aab1c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1c33e984cbf3a86e7caba006e6afe85f

SHA1
a3fee0d96bf08e0e63f2f9c9bff4c4a5ede19ca5

SHA256
1134bfeeb099ed96d0fd44b277f3a2613c0c710fd81f3ffd767ef99878b29410

SHA512
5284d82cd577c3172431510858a7c3f4c102365ab5e1d8a97c15b0bf6ef109ea4aa118d4220db9520eba7044604e951c8e9a694fbe7eff00bf0369fad372f9fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7d0ccbf87ecdc3edaa2e5dc95fd0b7cf

SHA1
bcd3f4d2532ecaf3eb6a5ad5d1a888f69dc89ac1

SHA256
2ca6fd85a2bc04f3ec6847ee1e8f02984d9f87c6e3c9197f31c8038fbf6460c8

SHA512
23f6f855b8f5ca612d3ae50f14c60d41b520d0ac08440fc16f02813a981dc68b7a8ed48323e119a6a8f0b820673ba4ec0e6e3ff3c4554e3f558d891a511cb1b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8af9973c9dad4a0157251e23b58fe503

SHA1
3f682a7186b15bcd378cbece475c8396156b9fdf

SHA256
b620e47437b31a43cc481c453aff5d291790b8ecf5cc1e76721a3d3cf83d90c3

SHA512
a77b5980ecaac5f6053beea828e026dba546b88bbceaf7956f480dc8a673761098ecc6b19714a3bffc16d1f0db457a7267da0ab2bddbc8782862fad37b9b20ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
46b646d946978657c974f38d53897efc

SHA1
937e448ae693fe2947dfc12b6ed49cd90ecfff34

SHA256
f47328592ab94462596e7bd63d789dd884389be21a677df7f610def56827da4f

SHA512
8250bcfa2d71ddc28cd8678d6cdafaa180c4b1eb862082ff4952d8389fa925bd372c89d72f67384fbe5ae68369d210a10c4f1936bb2069ee5de560dc4049075b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
47e876eec2f565fbe20bc60463ce2c5e

SHA1
c7d0a9721ea713bf4eaf71845f32606188c556ce

SHA256
3b5263c3f2efee5df48924cfae736d1683e46c7a63d5cb318b3e3cca82aad136

SHA512
679058bf1a20e2a30b93d5b352581e503f2a7aab59b5dcd343a4a7c6a61d83e42ab2444f3f71ea8b24c00ae312a4c2f032aa989a2f028a2eddb7b01c1c477021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
18230b2f6fe5564e90e3ed58c47ccbe1

SHA1
5b0958c701ff3e9f7aa42c3b248af0921c5667ea

SHA256
5a7a1ef3d9add676fe2510a9ed4fbfc860ca05a6c6d630c33efbe995f29a48d4

SHA512
231baf135194de79cda998c96936eae0de391206a246fb73130523194b09e17f7e9d0da3e79eab7b0dcfb02aca04392703c5fe4cd86eb3c0dfcf50890d8210f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\filter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1529.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit