61a3534cf7dd72428dd2c14e365dacdbc583db4199b0361c7d257c1875263c9b

Analysis

max time kernel
69s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29f9321440b4dad18062a76df7e11a55_JaffaCakes118.html
Size

22KB
MD5

29f9321440b4dad18062a76df7e11a55
SHA1

4575fba1909285d36d0bfc4dbeb38707e42cf803
SHA256

61a3534cf7dd72428dd2c14e365dacdbc583db4199b0361c7d257c1875263c9b
SHA512

9fa989745da70bd961ac8a15b4a1b4eae1cda50d284ad260a624b84f81f6e1d0e31090143ee3e256fba21dae1243b0e00682a5ecc06a3a6ef388cb6708938b64
SSDEEP

192:Nb53Hb78YvIYb53Hb78YvIYb53Hb78YvIZPN0Gfxh2UU1qtv3pSpaYp4pnbpkp2J:x53H8mf53H8mf53H8mKZfQErjTZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426542465"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A9454D1-3C97-11EF-B137-6E739D7B0BBB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000166a673a4a2f768d36b56b9180297ecfdac9d96d557d7c211eff2307d1dc5ffd000000000e8000000002000020000000a3f7015befca4941a3c656246cf42556e40b87fa0677e46e306295b562f861c4200000009c454fa41965affc21a36e894c35eceea56e5b24aa04eed83420eb69471c1f7240000000a901f3559b386fc8990a3242ea0e9990332f0ab76371ceaf5f59767b2bad35fc62e284e31c315f048050b1ea6915ad219db0ac164c93b5ed45e013f2dc48eaf5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00a2922a4d0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000251ee2eecc6818631f9ceb8b0af54784864991b39c4bcf83c0c8a74ae2f05de7000000000e8000000002000020000000e14ae84b03f3ef7cc6cb2664dda650d0af634c329a5c3ebee775b776d4c14bfd90000000c7144755b0a804327da069988e9d408337126f5ebcaa0fb72a5c3a2ce31e477793d09542c6f2c982ec684194b9f61cf23d2d7392f93add99a4e61c791cfe4f8166fe05dab92ab9bcfd7f7f11f4762c96d8091e75438e192bf88cfd568a0c3b54ba82d333227b45bb2eb28f2899d56252b567f579ac8de0b1c221256143a0ad8aa93283a9bcd8154f0d74d3a1268b7e1340000000c90b0a44479f058e0537c913d3b1c6150b8a8e07876c336f5c444b8a16da1aedce395607ad861972633bdc51e8496d7d3f7024fb418d48b1136f78b8c92be508	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2116	2240	iexplore.exe	28
PID 2240 wrote to memory of 2116	2240	iexplore.exe	28
PID 2240 wrote to memory of 2116	2240	iexplore.exe	28
PID 2240 wrote to memory of 2116	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29f9321440b4dad18062a76df7e11a55_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eafd25fe978286b4abe2c2a4941073e4

SHA1
5c0e3928a591e7f5442c0e931c7107e740c6933f

SHA256
1b5e72a9319d36d25cbdfc7b6bab449b26c8b80e183c87c1ac7095b284a80241

SHA512
9e09491981c1e8f5661b9ea2f7a80bd5c371e031dbbf01beb75cdb3d98de4d0f2fd3e74499512e4724ff8e01c16c49d69666eb1714d4b82e9965731151c78d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b05c78024e7e900b0993a9795e2dd122

SHA1
b297245f02e097afb11e0786bd9e5cb0913409b9

SHA256
65100fa79f93cf13a3d371a02a0f9a0cc801f4d86ee3e3cd5c15554ebaf58f4f

SHA512
f08f21d52958936aa1fcb0a8443ec4227f2ec09ead6f74054f08413647b0c360159dab31f31aef29a4b3110e5576d2ae302970f6178ae89e52934d17ce9dc0c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83fe9a7d301168175eeeef33b84ecad6

SHA1
a3a645a833c9c4b734c76afd1b8f614a88feeb49

SHA256
1f88efe97b956e6f60171e57e40707d07df9af2a809b9a5f9d6faa73a9a6192a

SHA512
3f827405da3a499a199cb5e73ab8b1c127fd309af31153a49592f5102a6bb88ea21216488196c769ce2937516d505920b27d349611829b5ef7adf9e1ad595a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca290a9a48bc600ca582a09ecd2db40

SHA1
f449ea4f8c35b56eded0b91fc7214f5bdcda3ef7

SHA256
fb7743cbc7c8ef8a08df9611cc0b4f75164ad17e089d6145a23ff5de22b1a33e

SHA512
2a3f7f095f16a0600feeb4613fa86a2fe9b215e1976f48f2c165ee1743087728623bedd37285813cfca8645afb4db23ac2a3e858f1d93a9679ac0b12e36c7369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dab60b385a700ab5a6eb0f15f2b78ff

SHA1
59ca9c50c8caeebc77a325b0495e90482978ad4d

SHA256
724687a515034cb9229b3b2a9718800e99d2dbca82b3c25aa943c7dd1b20cd2e

SHA512
a445026349ace7d828021f2d01796ce448686c5dfc0f79a1b2b7fd67f29d4c24f6466873f0bc65ac1c659683f8db6fb0ccfbdeb1cf59793b36ac15c18d4ab2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62b6e7fd7d029263332da569d6b8bbfb

SHA1
0188739d7c60c40eded783259f42cc618a413e64

SHA256
0c1a1c7622e4bff55cb1601af3331d5a6b35b82a7cb9d0fb8352b62e3c7db454

SHA512
41bf47ef20dc49f9358f4d10775e0ffa4971afbb304775cb26b2fce422e77717534454962ad0a710e6a3c78daf70e4c9bed59209791f87879853225259b61246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
104eea49d5056d09e232a520f43dba4a

SHA1
4a2a95f43d609d2996ae1bcfc1a420acc4dae05d

SHA256
67aeec184bf2f31179f2ef28368096a3715ebd07f8f15d0b7bb7804919b6e09d

SHA512
62421e9065e781ce1fd871392f0ae6ea9a1aacc30e41a8d0448707b1294327f06fc0c60964d7b76f92f479a4b44c9b0a96c34280d27df043dd6af2b4766ecb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a418f35b99e3dc7ed7d16efcc5479e7

SHA1
ab83f7ec2cec5377649476042843a2bf319d98d3

SHA256
1f6189618605ad29fd2623b40841ca6d551b2e128033cee76c52ef2d429967ee

SHA512
51c7ef877e2a14476a2ea48afb9a906737c05d5e714c9eda532f9a0833da0aca0fb53c4373f205f3de656c66993884212826aac7b886363bec943558dfec8c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a52e60f37b711e745e9a2a95d4528cbc

SHA1
ec4555eeba4a93f546936d352785c4903fab88f6

SHA256
1a9c7fcd6a222f9ae5cd5c1a05f787a4b6f5be7ce6bff50543331952d1357f99

SHA512
8f9e4204070322fe707714843e7dc193777a790759235cc7fca7def81372c668cccac89baf72ce71ea005e601d9214e2c210368da410add679771a6962e6486f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9518eb84759b0a399c71d86420b7dfb6

SHA1
605f89ac98b17e5444f12c52c588459300e81543

SHA256
3137b07116216022e342392c87cb09e65af5d263820f98fbfbc6d7fb9bb514e9

SHA512
71563ac1097689c15c4d2acfb66a1003ddf86864875f25194de6e978096c09fadb1d3e3e8a9213aa2e4ad17322b01acf097e595acac7cb4f02e4432a6c69a9d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ea0f0f8dbb2dfeec4618e5399bedbd4

SHA1
2f0ec555a067eac791ae41bfca5e132675112862

SHA256
01c25afeee1bf3919748e05f3907c8e4a997183beb92b415458ef98a4f883f65

SHA512
9b9745fa59f978d43b0dc090f06cf5ca2e49416e0ff1b8169d7db663ac5b12b670b7b27b207fb21c2ee82f379dea68a5a79074a03954e838e565e682be3d94e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b07262ca71d788e65f910f32414754

SHA1
a9d2b9ecebcfbb52f1f64895a375a51e070f82df

SHA256
dd86f4aabea68216e4b058a126e9795cf9f15831dcdc3b7b6b33f1093617a52d

SHA512
472b170e11b3f1bc161033de424c68dc17b8aa0081be75a20f86e66694e310a5b6d65b1b3ce14a4598aacee2a2c17987c60e2823803a559d5c61286a28f28b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d89478000f1338143d15cbc85ba2d232

SHA1
c261b366aa74f2440611b438807007ef7f1da3c2

SHA256
009451e910f7879a8f0458b1a1876555cc56780e5dc23983456c479f42ffbade

SHA512
9e492b4a22a702c3f1dde3842fe7487d72d8c9a5db41b857faaac9a6ad5dfb309de40bd397f1987a543f722d2ec28b51bde86beadba810b7d39343c9f76fac69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea6a494b66decd1e7986823718402ff

SHA1
c7c7ef080dde1f32fe0b2b0eb5a13ed84445f579

SHA256
de6295efe589c02b81a1d6cd40a513af8ebb9bfaf8ea0426d79a59e0f59f61dd

SHA512
461f916ae58f74effeff938a324db8b259034be83e31c28ec7c4732c07ca0d3bca5ed3c11bf5308f1435f3842a0714243f5aff4e233231d2f4ed46c7ad1dfd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f2381b8de8f14bc3f38c8fbf196342f

SHA1
01a081a2330c97ff4197f22089b994bb622e9db5

SHA256
404b779a4e34e04efbdd5750b14d626b652fa823edf224929f92aa3a272f72de

SHA512
cc716047de7867cda18634437fdbfd75aae0dc1258bb06ad1ad7e2bf100d2c79b041c20d6b57fcb174ff55f842a90eb9ba3408091ecc288773e84fdc49e8f274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
864089b315531d3778824a9ec9e83990

SHA1
b9097a6d708f2ab46cf206fea200d2f9542c23b8

SHA256
e23c47090ef499425149944c05a56ff6638059ef41aa9da802175aea21720ed5

SHA512
978bbd14e727f3b0d169de0cae54a99e5cb9d66898cf3d009cf752c25bf7a35624921247abf91ee355a61540c3390691f5ae1bcb1b95bc0f1e5f53d60519fa28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a9f3ff8f238c4108098be2a7a7fbb2

SHA1
33c524c07c2f8ed4936db2db4b246076ce53588a

SHA256
fbc98895c13b25656d9acbcb9d2d84dcd6c2733899f520f458df6f7c72e7d49d

SHA512
21f58782e7c6a34e8d215881170cd0a9ce5f417df345a0cafdd7dd0836c400c394aa44fa18e879819c69d8c8c17d040d6348ed86e8389eb5cf992415fd781784

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC249.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2F7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit