50f0daaa9bc1a3f0b86c38e3949d27461d37abc3520efa78691d48d896968d3f

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4465c084b7c26a7445029aa46534f990_JaffaCakes118.html
Size

6KB
MD5

4465c084b7c26a7445029aa46534f990
SHA1

8842dea6bbe0998c2562905a679cda39739d2444
SHA256

50f0daaa9bc1a3f0b86c38e3949d27461d37abc3520efa78691d48d896968d3f
SHA512

a54851dba0f528225ce8dc733424f63840ffe04f498c32c9333160d149b1e0bc1a5ce73674b7a5bc22f15e5b223d717f8e7d9707b124923d8b0aa09243ca55b8
SSDEEP

96:uzVs+ux7aFLLY1k9o84d12ef7CSTU3wn/6/NcEZ7ru7f:csz7aFAYS/uC4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50169985aad5da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000a263fe97a7b447450dd7a1df31a6a5bf0e7e53af1b3ab2415dcc75d6e168450000000000e800000000200002000000062f24873aac1861ad442255ecfdf57ae0ffd4b04fffabc36016319567ee6c9de20000000d47e1573d644f2d06fb43367beb456f93ed0a67c30798c9cb0517473d0a7568c400000000021858a2f736373624cbf0d32e8c840615cb7688e8c9a5239806ab103222917d13fccd7f37f77daf547b7435a607b6e2cd5d35026d05c73cfb34a2e76d300ab	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a99732bf76c713846cb8181e875c194f0bc93ce7e6dd8eafb563baca09398c20000000000e8000000002000020000000b200bcc8fc9b0ba5ac33c60e520a8edaf23d540d9d23c1d35cbd47f7e80de43390000000ea9414b75744b905fc761a5a200665c88ca0fa68d788abed1576b0f82add073e2114bfe0bbc8e21ad734e5ac2609ec1ba429528c3a38c32e01a4eeeabcea2f366a7e44f13a00e80cc39628cf3ac113d1df477003e66913466cbdf690cc8606658bc52cb32db3b0c514f560bcb83a24b2e5511a73ba5862a31d245aaa90cb6f10d43c9ffa563318d5039418a3a5e2d5ee400000001599199ee9892212534c0fd80c63983e3929265bbf97bebfad164a3d1a1e6c7ec917ce1455d0db9da2355c6419820a87593ac1c44f75bb82fe157246202d8006	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95250161-419D-11EF-80D8-CEBD2182E735} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427094924"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1624	iexplore.exe
1624	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2384	1624	iexplore.exe	30
PID 1624 wrote to memory of 2384	1624	iexplore.exe	30
PID 1624 wrote to memory of 2384	1624	iexplore.exe	30
PID 1624 wrote to memory of 2384	1624	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4465c084b7c26a7445029aa46534f990_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9a5be423087cc01602826e71fe1cd7b

SHA1
fa3c6cf9e5d2e96323ce1f4c77dfb5df950f3e86

SHA256
ff7f3b0d3cb7505d73bcba8fc0c325f7c297096eee9c03bad23e8939d1678155

SHA512
99ab778c16f8543fe54363c7665217cfb6348548e645e22ea13cc01944f4157ce9ee644c2162195b16cd8c29c98b1afa4e9281c1cc4355753cf62e3b13d17022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
908ea8f675ca341e402ee0994c8868e3

SHA1
6496ec97c7a57e7c61c5d7e0b06af7904e6021f1

SHA256
cf6e134f88a7f1f15d97c62471bb78e28ff31cf3255afd418c79f2e8f20a1775

SHA512
afb710dfc138f4e3db898188466fc102f93725ec0f213b8c2643547814339aeae524c29e98d4c82f794fe47e9f6cdbaadbc530b3c122e263b3c1a41ad1dad5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3417963be064f59f998c388ef23d64b

SHA1
351ce0623deb2d5a71cbc710696b17828d9eb525

SHA256
6b43dbd5440f4b8d0e5d41ae4e2d8d02a98dfc47a826bb4c058e83f806d065f8

SHA512
084ac49bbf6623c65e63fa156bc8e1f4657661f158887fbce5c6b9a94f4f47392ab1ea11357bd18cc6468decf73bb6ed9ab6c8e77967f14b449646765c6868f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26086f2dc3db5b2052c2f611277c36a4

SHA1
5f1f23c59d7fa9126b4b6b660b8850e622a3f06e

SHA256
7ca4e383b8ff1b5e816b7fb506e736d8a934937a1f21444e6364faeee1aae5e6

SHA512
52fef30a974c1203b71e777c02f5ca6bdfeb50f07999e206649e2c2bced525674328addc2d033a9e0737ac7a995701acc725e1f45fe15b8ca94931a0c16e1c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75c9994badf999090f8322f97d002a51

SHA1
21e992b1ad6e969ddadc0569ba6aad7ad8173b33

SHA256
fa78a9fee39572c65a277ffa66183845babc512e8fb48691b2a09d6e46c45a47

SHA512
ef833477e763d0d94f2ba3434f5e535b49a85201be884da5bd22241a509ed17e561a75b685b174fe0197521a49cbc09f76b1f9977a5dae447022a8ffc29f5326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b02eeb3ee5a7804f2cfda48205455321

SHA1
55dc6e9633da2b6ff8cf6f445dfc6bf2bb3015c6

SHA256
d4c1abf1732065276f35b5daf5c46871634b620d525a02bb5c6d04817b1f3b1d

SHA512
9fabc2cfde4a0356b6bfc8a942254cc0947c5496ac47ed4d841eb53768f6352207a6bc98ad317e61e22cb7795ce0c93cdd61ae738b92004df8460fe0b9eb25c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f029e4073ad53d1b06cd0f809735f38c

SHA1
ff30cc785b68fc597fce4d81afa4263fdb3ea31b

SHA256
7d6239b37eb0015417a405db3bea99f699e89cc2d60a0895662529dc63994b7a

SHA512
07e7c035c1f437b7bf6f931a60a9ba9d90c9bcbf51e4e582d077504a4047e8212edc633df3c7925144404f2384fcdf35d392ac713d35a5e4659b776dea166aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bce296f1cf2378ca9d40150c2fda0f86

SHA1
951bd3d49fde964b88f71e1dc1aadf19696456bf

SHA256
c0a0371ab6c68f5c8e1c1347f11dec666fba2fff513fa0164229d2687c16aee8

SHA512
24a76e64ab626b41e5bef88bffa1bc853402525ce2548fbd2a8f65fe941b318e46516babcdc46164a35f6a76164b7063887747377f04a01e16376ff58bd523ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19e3d08034338ce65583091ace6374a7

SHA1
8b0ebeb43c63e5ec9746f16afd6a1a7f65ffdf6b

SHA256
890d0040627432f251cb55d41a9e77d10d7fdc309cb8aea95da03fa3f678b32b

SHA512
62a4d204606d692ec95df16746f3306d21fa2543a920773da988a3adea6d7fe008f9fc4b91b4ff6e9a3c273bc984b5f1d9f8649d0a62142d7f1e6ae822b0f777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a6841797c751234891ad7d17cab2f18

SHA1
f6271aa6754e46fadf0cf69247ab8d24fa6803c4

SHA256
f9fba608371db25e3800fdd98e9a141f3641e8c3c29743f346072e1bb5384bc9

SHA512
02b605ce3974ba02c5151172eea7469c78e10bae09ccb586efc7153a27e7648beb26e7aa1732703aff914df41bedf8286ad957793f02aa43f5c83f4b70a1f423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8f742e91cdebc7d26ff0b596aceb343

SHA1
99661b5388dda677a1d57b66fad9b43be034bf33

SHA256
edd556d5182bba6913bef88d5ed3e179bed0a068b9139f792e66475eff527fde

SHA512
622598d4dedfb5fc60c7c846366cf2b58e89b45925f817fde2be42dcba9e446f392343424d05023c45f871fa44868e303f9c0ae3cd2ff297d99054e8e943c8e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f58f0e9af31ed8f97209f82970f737dd

SHA1
1181679f6e8f6427f652507bf9d62f12a1c11568

SHA256
6d93e0f288cc54a86baf8f3a969e1398c262ffd72de3c6ea5e4b315faf54bcd0

SHA512
152b65d813e3a4514b8091d1f4480880931e22e1ca39ef2375c79ffb6ef1b58a2e4981826b08a88ffca0a589f7f79c54626238e4e13a7d31138d0933ee795f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e09f817d4bae4a42315708c26ef93706

SHA1
b1bdecb21d15d7f75b80b19e35bec7ec080dd8ed

SHA256
7f8299dce0af3e00c38b687d5ac749a15dbb68d63524a1f5c52476332fecfe03

SHA512
649439e30c2b82903cc2501e246163060b7fed85b9faaa3815afeff3746c158b429a2ada574d5d57bb2853a34a1f1a4f0b843013b47a3fe93515d31c595e45bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd2110f4501a5977603510036e3e0017

SHA1
c624d28b943fee46e26df63c014dbaf2f9fbf297

SHA256
41c307df3e4f2cbcfcde6da90f6c65664aaa572e220e3291d2aae1c6295f6170

SHA512
89f66a59a32e85a397c5c17d256f84d2ed0e67bb486bc620e7a7550afb47c02ebe76b006218d029a8453940361bb273a03c607f2169b34fd6fef0b5b750b92fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fc512f8795216f16163a9b91feb7a0f

SHA1
d82873afbafa6e2d863159f2490822bb16bd4534

SHA256
28ec94be12430a303cdec72fedaa6a1080e4bf226ae06b18605da899cdbf5cb3

SHA512
372def468d73c332ebf324fa87924272bd71f763a252ac1b0b265e5f419d81501dd684430228d9b90b30211e19e461cbc666bde5bf4ee68aacc6d7ef137c3ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
953bd6cf199b6d1ab91645ace767cb62

SHA1
33c8d8332581a09e422c370d8effe09912c0fc14

SHA256
74884b49f840c57eb3780f9f40c50a0f9160321f8ad25feca6a93348189271c4

SHA512
f064f63490ab049e21987e223a66235b51f3dde3e2c6aa614ea6ad32a35ba9654fddff6c90f2e7be55c01f62ab833691eb81452e6100dc590bc16e510acd1422

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF72E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF7EC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit