630343cc1d069aa4bacb770e0ff28800f7e8642eefdf9de1384f5d19a756078c

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4504ba9d3f5f506855665bb650bc0664_JaffaCakes118.html
Size

76KB
MD5

4504ba9d3f5f506855665bb650bc0664
SHA1

46b94646c78127701cba029c68093a0d3e952487
SHA256

630343cc1d069aa4bacb770e0ff28800f7e8642eefdf9de1384f5d19a756078c
SHA512

771441d73a0b47b8cadaea7939d13db9830bee01b27a841a27af0c20a61746b1aaf02625c376410251619e6a45f650a1f43ae26950662c5a9194a63777de7a5c
SSDEEP

768:JlkSgOriWNcaSoYBgGbgu6WPyqYrDopIVPfJcxT0i4+1Bh5rGNSBl42Ag:MBBJguTPyqYrl+rKSBlx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B69A6671-41B9-11EF-AEC5-4605CC5911A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006173e3f35808e4dfc452553e3e9420e70ea93099c4468bc31e4ea60009379b12000000000e8000000002000020000000e5a2a190212d9bfffb710eee957338e9aa0836170bc2bcfa8b39a2227d702be3200000008e9cb1a06251e9f7fc9f59013e2cf7f24107de4412d41c8164e0b985cefb6f9c40000000f3ebb6ff0fa11194e8b9ef8de3c5030d80b97ecb8ca4d4e780e52bfc4875f1757be8023b1c68cba12a12adc2640ccf6c6c8c922e0d6906ccb20f0115d5066ed8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e79bb7784e8cc51f44cbaa61b29555d0fc536c25661b700469a2c4d99cf62d21000000000e800000000200002000000020c3ed428660f4396841001736beb508588190f5f0c0448ea8a06341e8d014f090000000e7321fa524a031925f7aac7aa07bc0bd47f2a7dadbe3b0a9e9c7e197ae1e142d84d82de3a28479d1f07c014443f7f0202711649642318d84a2a65c6e9a01e1a557bb4b4c70bf704ab37fd8eb56da5bdb32bbe70cb566817338165c914cbe60f344b27e7278ce984970b21516daff868064707d3ad18054587e593f97e7e24bf4007c81eb6d54471a5a85cf34b57ce94b4000000015199af2a3b3898c34fc4668890c3b6a7035c1726a0a32d6fe8e757f50d8f22d29d050253c4962a3bcf7dbc46f694337700c733a1be632bc9efe80812c21333a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e090d199c6d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427107018"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2608	2020	iexplore.exe	31
PID 2020 wrote to memory of 2608	2020	iexplore.exe	31
PID 2020 wrote to memory of 2608	2020	iexplore.exe	31
PID 2020 wrote to memory of 2608	2020	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4504ba9d3f5f506855665bb650bc0664_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
153d13f4e776037202c83892447f4f7b

SHA1
0bbf4080e5b28309d7727f697c04b7c3d5c5f206

SHA256
dd53e3f7dda5d04a7348ae6cc246b9f245caa327ed7d9e598d75ef9d4c15fc68

SHA512
5e7684711ae5235a6c221c41ae54a700e3c3c97c8780214fb8bb3d17f7accc85c4025a84abe9c7bd3016a182458febd91b72123c6545a66064ad5355d3562bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d9e60b52bdc80f576996aa41b8ca7ee

SHA1
a918c1f841185236cd785606f2cac7192c48f4b9

SHA256
5fec781e8688f5328150b9b8b260e3f62a9be2df7d1128a6fcded2f238df13fd

SHA512
1571d87690655e0b5c494a6fcbbce21a8c6bdf18c7ccdd4b0bb454487a52b407a4132814d08bd71857bd80c326991fca638389e75ac299b890992eafec4eba8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2086f0d8b4b7f05dea73287d4cc1a83

SHA1
d4bc378aab83b32394ec0028097bd0a321a15d77

SHA256
f734b2b01d7bdbd5509d5dcc23d500ed7ee9f5fb0a18461a8b4deb26d811a2cd

SHA512
f010d40e3e24dd3abb6f36b0499c9e3edfbe81a3b3a5c70ba861baf80f98e4b8ac1c1bdaf1f4b001842105ceb5d0a8d98db60118e5014f983458bdc88cc9d2ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8d8af2274845024c2667a4a79a51a2

SHA1
54feae156263f45f4b1acbbcf97ad6abd6b526b6

SHA256
365d2e33890c2a6f790900540218f1dc92f74d8e5b4a555721ef43249c04e4d5

SHA512
e69c4069b3071b8fdded6b2289bd970c6d66806eeac9ac2ac158bc7b7ebcf1dff392bd10875362cdaf9d91e8ba72fdf2ae008ea5d909c3cb10afb9f7713b1a96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ee8777d0b292ba7f67e022f72932088

SHA1
0f30c6f5dc741185ac4ad4a9a5008ef2e804fbfa

SHA256
2a1be69bfbcede61a54a6e11fbe8edf90c6fbb504d90e0bf0867448de116719c

SHA512
e5fd68b92785f22f0377b3e812c2f0a948d542a422a3e11fcc27889a67ea6a7768c57d4eb548a389a31659e165c9618bb4e6202da8bf12d1f62940de661ceec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9e43a19bd14ac6c0b441829461e7655

SHA1
e9c54308097f290ef2047a9d77228928da6af65d

SHA256
8065032f86a0f1b56445684525fdf793742daf451f087d38f659a9c83bb8117b

SHA512
49aa2cc5eddb0ab52dbb96311adefd52b07034bb6cfe6e4d403dd32ae57463d19ada9338073b3f4759adc412bebb03f3597bec699360017b97570a3cada62cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ca6e33e369b70d04659a1c65b806e0

SHA1
5ad0fa713ec1b4d660ecdbe5a66eab7dc92118f1

SHA256
d5ca5c79d950a57f6c22822eab47f1a0bb03c169896cbaeb16c8aca304f86676

SHA512
0e0bed70c642973fea29dd698855a7bafb341bd7f08e3e1e0a783a625d26059252ef793b5a98f6fd4170c1b42af129162a7d428e6eeda0e484a8026c1b011f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c3a39c47233dc720e56f87b95ea2bf6

SHA1
8dd80304539dabd123cb0a969063b8631c4930b3

SHA256
549260b214c49e2f8be8966082f18217ac7ddb2b9d0326fcf50a7f00cd66d06f

SHA512
2b0bd0e5d92d63db6b7f47dc3fa3c6c5ce177e7fa7aca0ad835f1685dc5e8e17d08dcd8bc73bfa827d75d390ef1226a3071fcc3c349a73e747381e87e64a4db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb56730021663c22bf0fa430535af2db

SHA1
3cc9a9f46d1e595e4336ab9d6648bf212b0a06af

SHA256
c04f7c4e3e4897616ec3d1ea885b2d3959d1f38272c678289e7f305492ccfead

SHA512
ead039889cbd5d2fbc483a6fc6760242e20f14c638967fd3c4969260399df049a4f025f3d92d8844f199c98b6aaaa155fbad9a9b8f5bed0da1ef1466a3ba0669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd109386008949c2ce379298c3b49bda

SHA1
5870053e2b266fdd0531847e78e643ad060bd32e

SHA256
61f2c0a53abc960baa890ce5b7d41d7953f29ceb2b342907bdae88ce5a481fb3

SHA512
e319741f009e71ce4d6350923f9efccf197f101d2d83f256e096d7c25e653dbe7a03fe62ace8f8147d24ef28112978ad001a31ce96392d7b2af5f8530f20253e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e0ce9178a65e74fa9aac712a88dec05

SHA1
1693920bac665a40dd73336bc2d13870114b807c

SHA256
412c0c45e3be3fa4935def1917d4ad7e7d801dfcbc582fdd77f51660b01ef858

SHA512
e6c2c84e454537742f1790181fcd6306a8c83c2eb538e304a1bda1753ebc64d6028f19190678c51586faace5f77eba71b32d724598af7cef0eb55bde43b324fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fbdce3d965b3b025f3a2de978684589

SHA1
ebfdc1dd3f2a0e4b269ffd1fb38ca8ebd31e2fff

SHA256
34af8d5b9eb5a92984597837fa55c49dde91b2fff1f89bb94b89b51163278896

SHA512
45c5a50dea1664c882289e9de769f7daab20429e7665b1dad64c0802e7c03dfd9d7a9d5266d2befcc408a783c01bfadd7dd5b7bf8d5390366c904d447404af90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d0a8b88dae16f6c203c2ee5c13b897d

SHA1
d322284a55ee2b3f662b6b2d891573a7c79d6323

SHA256
7ddd67d4c06b96a77bfbbaf540f67a280e83052be98ede87919a31643b3717ab

SHA512
5cc1cfb8d4aa3cc860fb8b090a8de09bb1cb402c1d3213c21f3db7fdbf911fa8247f12ffbe19647da0ab4fdf4d4066400b7eda45adf2cb4792b5e1826ec7017c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba037b4b16a8a92bd89f743605be0b4

SHA1
c4e20d8f0a1cba21973b3cf021272d3f7a808809

SHA256
986d759ce4d42d947b32fdc98b9bfd6c0167d895ac74cfe9be9fff1c8cdbe54c

SHA512
bf9d7f3324bb55bc1aed2c37bb6f330f7090a4449689279df5a67335f8e9f2522a669e8d1d4f661ecf2abacc3ecbf1bb7325d6df69dc9659693745807215e2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b847fa524ee5c1965a6ee93d463e12

SHA1
22e6a8e48102754a139eda3ce97bc90be53293f8

SHA256
1c080a8e0cb2793610c0d6cc25ea8a109150465b01ad5dc126ad9842fa1ec936

SHA512
4d3ea693c02a1ae73321843bdf85a770397e79144591f6e9bb4dd4e3be0b2425eedca7e2a57cc9d849abb38680a04c8b026d31cce502428483c87b9a2f5b5c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64aad77e36c44b174927691b57a51b5c

SHA1
0517e60ff415475d5b5356092377e3bcf9aaffb5

SHA256
cb5ea11a11c0c34c1bfd5ecb78129fc4e550ae000d6eaf425cb0c11959787018

SHA512
c36b126f925d780c67dc0b36844bff447e1daa3cfb29520db9e5dde64ad797933028ea61e7d031b56a05bcff6d4ac70cba4897b9504d0a252c59f4535d5e6545

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C52.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7E77.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit