834c38fd9fc091356eeecf7eb7abc3b8f4b5ce6a39cc1c3000f546fe9e55694b

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37d4bc2cff31b43c0a5d51de1ca28ca7_JaffaCakes118.html
Size

210KB
MD5

37d4bc2cff31b43c0a5d51de1ca28ca7
SHA1

33ceacbb774cab228bbc26c532da23cceab2a8e8
SHA256

834c38fd9fc091356eeecf7eb7abc3b8f4b5ce6a39cc1c3000f546fe9e55694b
SHA512

ad84478a5f1c3a4e0f492f942fba50546bf6ff496e07cba970477b3c54cc27a769f555c45fc4986470aee3af90d0c4d40190fb7106c837205ffba7d6981810e4
SSDEEP

3072:1rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJR:pz9VxLY7iAVLTBQJlR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000602146ab32e72cf7ec0019e598c7a56bfff5c677cdadc3c2213ac0342c85edc8000000000e800000000200002000000078c51ea1614ea70b19490016ac150563d6e6518f2e0f57a952cae9547f535a4390000000dfc07b1fd8d29aae8d7a568a05935955f273fc7eae8d3f198ddbf9eeb73a096cf788d857c56517a2e32b7551f25e6700f8f78b812a00ffe74afec819336770839af2c03c6e66b91cd6401182a75a370e1c852a2105e668eb84cc09734e96dfe1bc0e8bae1707d4c826b706910e144767f48416359090587be1439ed2370344f44181f641e323803a513c3c9bdfb2cfad40000000742e421b02d7235561cbd66280ab35aa2566eb7434a6e34b0aa911c765abc6830c07b626933f4486f5d5b631a74f4bc307dabc4b28198b24fa51e7f16fed49b0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426836762"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d7405751d3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006f3585922d540ed9ee5b1db084af5c73c131adede970a8436ff7f7c05e2d136e000000000e800000000200002000000090d85affad9055e169c95b3abe8cfc13f9883447b063ecfd99d3cd09f2233dca20000000a0788f331a2cba632750e96197e02264ed19e1370c0855b8eae71e373d79217640000000e88a610206355a5c55a2c1af6bef1086ec2d8c6419f7921aabd31e949e63349ce70a79b1b46f0545313257f3b0d468f44147497b533c576e9c50712ec5a78c34	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81E85621-3F44-11EF-8D34-5A77BF4D32F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2712	iexplore.exe
2712	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2968	2712	iexplore.exe	30
PID 2712 wrote to memory of 2968	2712	iexplore.exe	30
PID 2712 wrote to memory of 2968	2712	iexplore.exe	30
PID 2712 wrote to memory of 2968	2712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37d4bc2cff31b43c0a5d51de1ca28ca7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f7964461db3555f9dc7e03db6d00df8

SHA1
9648f4cbc3aa4bcad2f87d0c05a0382f7ac6188e

SHA256
169431efebd724a4c0452ab7685e92ec6b10bfa32181446cb35fab45d5343ffa

SHA512
78c7a6705192512ffc499d7ae15b572f06825c38cd4a77c62e229da5349d5f84794f62baf505b66c41b7e2811c217bf9a6426de3e7a8b32a51224f7ded425cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28497b0da47e11c01f673b5e0973e9e8

SHA1
74ee79b03dace756a02da9faa4149c362c37d6e7

SHA256
e84cc3402b80197a46db6d758dd723d2e7129abe8ebe503a1f8a4f20876a94ab

SHA512
139b3c25b4d644e46c0d77e1797f37cfb177e8090a8bac8a4aa8bc964c6f4cbf00093fae26b818eda03a3aeaaa545fe538d25d0e5d6d73aaf26fa4c57fda8e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd733c92905eaf22f87a8f0bc6fecf1f

SHA1
0ce0227f6ccbdfe61006e29d6602c78e2a374f8b

SHA256
c8343db1eef2e287e9d72b26449bc610f117246b3568d744c93fe926349f7d0f

SHA512
de9aa00256c34cf3b3b030e5999ccd74c7df9763937d37af89e642dbe40eb32e007d3ed22f69ca11554a6cc29d782747342bc272aed94ac7d8409ba5f9998662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d04bf5aba5fbba73c4c5823dddeae95

SHA1
d6c4b6cbe1f3efc0bebc3049426a3f883e4c6085

SHA256
beca54416cfd06200fc54b208dbca4f11940db7cd0320ce6ddd0f05482280809

SHA512
b2ddee35d6d8de4d0788064d2d6705e16cd8a9e1c1dabe54a2f1d43ec9654a6c17cf5e18546211877d571c9969e00dbda64e91ef6637c5ae2df5b70676c0ad28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
564d3ec9a4a6ac6e1a6788ece764c51b

SHA1
c2ec15cf49c2a8cc8f21e376c0a055dd0ab32f2b

SHA256
f55f48a76e188069d67a4c2c366535794aaa05375f5c394d31335b518a50acf8

SHA512
53cd107aedffb58120ab90c579c2be7a89fc89530a28353738a0b871e5b177fce7c70029274f3b0bdbfdd6f33ab2739e7c37fc045337ec8de9aa7b66539999da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c125a23d6ffb83569bae95bfe5fe1ca

SHA1
9390674c56647d824cbe3808a4f3793df6a727c5

SHA256
5443889f5ca5609a6ab81de1939c42048cba327c8f3c36254f28cbc641a46615

SHA512
a286a33291f03b036037551f35d1c726db2d1ae1c656a9335b874bda686d1830e6e03a152ff66666226bc7a20801c39b43d1fd2bb55ff34ea28a9137f412f0bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f8359c71fc64fcc92865663d1a66926

SHA1
24c70ebe25222890696cc87e2ce5403640a84f8c

SHA256
afd4a9ff11cfe9d13d1627ea9e8e6e683dc3e8b510973aff6fa7cd9a1d62f914

SHA512
979d69cee6f4d81250b6ce48996d309420be60506d1e720d385c57be8df14cc07c7c9856dc137bc8ad72bee4d8d3603a4bc00a3461dceb673c33b638e050e65f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28ec1c61949d1c4c06c7ee6b8adbb76f

SHA1
4cadf5e9f55ec5b06f7de980fda776b4a9ca7d8f

SHA256
fd3316c57fbc8d84ecaacb1c81bca6b7d70d6c7d304aed7f8805d55eb9d9ef70

SHA512
081af32fc8ab32eb7e7718edfd51de4d974056e7d98f7a42a93e4307c5a1d19992729713def67f056305a0331e128ee95514299bcae58dccad2d739abdbe54e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b955a551047b0616b5293590b9bc704b

SHA1
1145e878ced82cb06daca33859285689c0bd916b

SHA256
d80593d3927c3df2f184de05fa4936696dcbd6fe67373949c99722ba4c7c8164

SHA512
6c18ef4a18204f86bb079f27ea295cf44d0ca6906f677703f5737cee360bb5d75192dd98ca84a0a9e690239d96f448c41352347c85915f09bf9f40c1c206ac26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce8077b17689f9400d82e4a6d621f8e8

SHA1
f2e5f87589b4e579b9e222dd3d37581390093738

SHA256
8675f83abcb4acff182cb14cc97f490c1d349663d05b109852a5d82681a76b83

SHA512
6dd66fc16897608677425670317bdf4fb7a222cab57116aafe5c3fe51a03ad3652dedabd529e131ca82e13cbcd2885233e49fc5379d9ff728356124ce90ef8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
270cd634d73c4c80e2d432ec2e9bceba

SHA1
0d9131e27ca255fb6a80aefd91a2b84f0da7f5c6

SHA256
54c4926dce69375cf5a51e7cdc362c2f6a1eb907da7d01f3c8a09279495b1df6

SHA512
de2c393781326b2c569c70532f4acebb28670cc01239aa7c235485e460752b6a875ecb537492d4d9e6d03417ec8c04aa242397d1acd77752d4ec93f8e6afbd8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
079c15959d47de4dfade65fcbd23c9ac

SHA1
efa8cfe970ea08ee9a450e4a438c38550852a6ff

SHA256
46bfc62583c8181deb7a071dea1459b128a804c24c18865ba498f5d9339df6de

SHA512
8eee00c46f54e72d6f34157b568f04677f5603c6123495f00d3e40198a536068d7dcae1422b59a84ce5926772bfe7f57b69b2e98134b525d97894456e73de853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
731326a04ea3eca2ef6e66294dc939df

SHA1
9d3f4aff26d167539251650b253d6a261290d3bb

SHA256
0277126e42d015f624d8ba39ff1d14cadd2018c641ed12d4873d671b1e64e183

SHA512
f1c38e2792ae254488c856c80fb65dcd9cb4511f3c213bee926f86894f4c38a42670f5013451c7b7fc4ef3e7938c7b5e7da152ea1b73f132bf6b710bbaca2899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a42adc172c311fbc1f036615af39bba

SHA1
67bbd2b4e692027fd9532914e8a7d75d69cd2483

SHA256
34fc1095d68b174b40763174b76e58b17521c808774aaacf478483a2ad9575dc

SHA512
6d2002594248b4fee727e1f331b88941e31c7877d0f61ccd95720a31af5a863dcec97224a1c86e5d078a1f72a2d5ad12629b15e8e989290433aeb65ea14efa07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d143f24c84b8f8edfb44cd0ea9ce15f8

SHA1
9d05022313808aae9ae1d6281af48887c3b2c527

SHA256
0e49c098af222a7a7962fbbf62e125568ab0581a79bf1fea8e17d534ab47b246

SHA512
bb235d9913802a4c9e85faed22c914a1d7fd857131e247829f483c5a6504cb5329919b70961600c0d7c21b93e9fb2046fadfc291ef8dd91024d9d41ce489b336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c0e008dea60f4ee75b569bc52ecb8fc

SHA1
faf88195f9b5295d6b292e845f94fbdcb294d037

SHA256
fe2cdaf02779cda9a0289e84a357a6f85104d485565e9fe2247d19c1233f715e

SHA512
5563786df2fb0963be89f5dfd7a83e00bb2a04f473ad2d5ff2ca785e0ed6565633109471c7ff1885a8335613ec5837be157f74387ef5b8b6973e692fcd7318f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280aab4847c8043c6939f120fc500275

SHA1
05090422cb8a5d4530d66c75eb2c0dde3246985b

SHA256
b7515fc500e6136674bb96a416bc4074191ddfff41bffe8db5f74184b27b4bd8

SHA512
3e9ce3822b405e5e00b3a689111c70a910c274abe520f5f716caf6b20d94bd61a0c579eb102afb5a89bb120d384ec8c6809dc0ef0ac4749da80c9904f1984806

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7532.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75E1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit