45c22531ae66bf8a6ed98297975c1c598430ad0cec6cd0f7bd939c0c30e2dafe

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47ae662311c0ff368980a0f6228929ba_JaffaCakes118.html
Size

7KB
MD5

47ae662311c0ff368980a0f6228929ba
SHA1

0910fb9604e8e80dd50585b12193ee8a96331ec3
SHA256

45c22531ae66bf8a6ed98297975c1c598430ad0cec6cd0f7bd939c0c30e2dafe
SHA512

1b6aec1956c10499f43b979df69cb02e56b34622f6272abb3491e4de462aaa9c7a7cf4400b114ebf414aa40f8209b16af2bae836b576319390f8bb0b295f3499
SSDEEP

96:uzVs+ux7k0LLY1k9o84d12ef7CSTUBzfNhFBqIYP+YcCcEZ7ru7f:csz7k0AYS/qwr9zb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000bdc2f75e97032993f316604e815c9c7c0972679e623277f519565f36818c4e1c000000000e8000000002000020000000d49d97b7645d85bb45817f3671347eef637c38982875721f2c12b944c01da7a72000000076c1c3c5acd0a7e82c01dbc9f4fc42b3c6bf63cd61444d3649000d769d979e3f400000002b5528ca97a1d6b0a393766be573845f1bfdaf1999d296b20083366d421cd320b941a36693c63194047807b8fd137f9a32d12894dc4fa384a5cf0a371b03bc61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005652c42afd1ca7f3df1aa28bd4caf826ee520f71bb92e6ac4654e69137c674ae000000000e80000000020000200000006e4073e46f9e2fcc10003d6be77d640cb7e21285c98824cfc22c70208276ce91900000007440113a1c0b1720881d65e0d39dd9dd8c0af05d6a1ec4b6d800fab936518c4da691bbb156b3ed50d3e9188b18ba0b0a856f4233178b84595df4eba3fb97b2cfec949c076c82b37a727be32f447775df3285053c46ba4ff04abd01c23234b636b6ec9a49410698a50b378b7d0c89a1da88b749bd7a78cf6926912965962332d6961f7c58c98c044ecd92f131db401851400000001dd0aaa2fd719cf95a8ee7c16266995fb8bd9deef027f4717fe26b7f3711f37b89e3cef2ad92ce0c947796b054cc12a6f3a919f5676926a4e05bcb3eba63810b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427169396"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f015b4d157d6da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA73E881-424A-11EF-AEC5-4605CC5911A3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3012	2288	iexplore.exe	31
PID 2288 wrote to memory of 3012	2288	iexplore.exe	31
PID 2288 wrote to memory of 3012	2288	iexplore.exe	31
PID 2288 wrote to memory of 3012	2288	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47ae662311c0ff368980a0f6228929ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38f6aa7542c07da2937e02bcf552665

SHA1
86f427833c2b56c4f4a19c71a278dca3dd5e63fe

SHA256
a8ae924debe88673c3565838ff0239a822f396420b2f56075c7a4a97257e8ef2

SHA512
fcc1ee665e64560a338b985101cc874c3eec9479f17661fc150f4a478bb22328afe9714feb3b351177e984f8ef6575a6eb3f6169c66d74528db3432d6f5a0fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
309f7e7bf1c819a5ceee271b1ba46732

SHA1
f6e2d6bd5b074c22bf4ddb8396ce59e06fa10293

SHA256
006a244749900ec1914ec11d2ffde4d92bcbc28636f18ee7b74fe3f6069af79e

SHA512
3de63f16ba4e0a665aa6913dd1b4c009db39b42185cf8b35f520456f3bb15ee6e87f29965b0e2afed1528feb31fdc4f9d7caac453c05fcce5299aa97eb9e40dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e08174510909ab347554ede27a31b4d6

SHA1
aa49d875f6597baee83cf955c1e5d468ce018918

SHA256
f48f1569a206e9cef0b6485ef8b0edd690a987ea69e1da78cd095d6d99627200

SHA512
7dae377d7c94a423f8ed4ac273c3668d5ad9eea9e67c4d6ce8af7a0aef204f13d40810c2385869ec5a76bd6b2a81a0f5491e4c1eaf80ccbf7c72652ed8f8da79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7bdf646800bb4051925e92d2a4af07b

SHA1
c22032ececedf7e83cf4b5e6146872756767fc5b

SHA256
3d5bea261d5048c7f4cf47e6dc1a6daff637a6e7ca2de7f3755366d58f811a94

SHA512
57ca7962a9024f985b096a8bbe5e8241c9e030b480b91bbd3221ffc0e7ddeae02105504ab64f423f8e1ef0e7dbfaf37f12fb50574d373f17a54f9c3e3222a0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
711ad8227106e60090c1f811b04ed0b5

SHA1
eb965a1ed8bc65b3784afa0eaac1a731bfec8bc8

SHA256
ec3cd20f59ced58f2e31c92d7fb1f2b565fec01aae3f48b992a9b91d0c086996

SHA512
2e4c269efba7ad95ed4afc26a339c2024938823a487fbe654eef0542e8953daee9c0e7d2438bd2371c81c0bc6b1b301161d82e5af23dec9d3ebdf191424e9318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8044de1bffc42afb722bf5fe58e7574a

SHA1
4948a545f8e7105f1d617ac01dd26ae40a336666

SHA256
a6cc77d8de4ea6c2c16d2b955cb3c9dba2b80309675b001ccd36a10fbea7b368

SHA512
52f6784a08dc68835330ae39ba15c1927ffaea014b98dcaee864f664fcf8df59d1dc665bae5b2464686aa185190902542aa35bbe6a37ecb672e268771350000f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1d79540d3c1c4f08903abc69d2ea937

SHA1
7b0771cc5c0518dc5a4a852f1d778000a27b359d

SHA256
03bf99a2c1b78db3ac8b316060cbee8c72b518e17d91d05bf8541e677a9145c9

SHA512
577b9417b7f1e2fcdaff82b5c15632c0f87c104e77b7b68e7469e3fd3f3d1680e1b443c0df682d4d64e6329edf1e821d212f8a8c397bfc3152ae730b286754d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38d343648363eac566933219b5393238

SHA1
ebb0ed38b50ecea3170dae1bd689a51dbd9b5078

SHA256
e07c0e968d531951df1864f40188da101c099329504e6cbb78f1e6b9264b2661

SHA512
236b3882e4a69bbb78cde07c7d52143121c45c3e99ec0eb4843c40889ff1923e992a0667bde69d634090b29faa9e6b73fc4abdc9034271a65f88226808e499d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7abd48629834724589a93ac8f0ceea1

SHA1
d1325d3e53208bca2086a23fb5288c2633798635

SHA256
2490fe3809c702b16d253c86260f8b1b0751578e3a8a3dff3c7eb891cca14753

SHA512
f0045d311a5ce427c199f1cbbe2ac54332449174c96b760e305acf3ff23e7360e8e5fdec116e819854f1bcb84450d897ef27330a72e45844bd29168b250d6f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df790709f7a19898f1f03722e5aafd2d

SHA1
ca80bbcdedb0cfb24e163903244643a10e639859

SHA256
24c5ffcebc0d15ecc37cf8a32f746d52dfde07e0a023aa87c97c7e828b413f42

SHA512
76b7ead0216745b831f1b47ce991ea329bce5987d7b9eaeac0034b4eb29e3339628c0f43bdb65837e7688401e64cf83d114426693944fcfcb6d2c9ae2ee6df86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d974bde4efac998b6b7b953b37e22c8e

SHA1
7d7d7552cf955332ae23075d98a73ca06faf6d6d

SHA256
6c6baba83594b270481096735b9bd60a1cad543a6618c396012a2b7b7e991d52

SHA512
b42782d4228d3ee0aabad8f60e1dd744070df70753d1c0033cdbeb835a36eeebcff05f08489d05fa891b614e959042b9e73bfd3aef8ed3e2a6083d86ac6b2e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a45cd96013d8045267abe41b50c9423d

SHA1
b9170cb267cf3e44b9d02823f943460c32e6a6b7

SHA256
bb0ced6f3a52256fb7d8cb8de61cadd28866fbbabb5f228092cc51fd21def995

SHA512
c9a0aa7a91f641de9f45afd4ee10e77aafce2be8fca1d5c84116c0be816d6573edcd553cba0c416736cda84ff091b449eb3f1ac8e065ddcaeed6fee6a29d3eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a52e634de1a2ceeb3bf9331f00bfffe3

SHA1
c550929ac0e237e0a82e7d641eb2e6eb1a8e16ce

SHA256
f23d9b787f113ec6ef0520ee04404297711cdf553f950f44007e85278513c7ff

SHA512
586aca6ed2098b59545a5f0fe21302ce713f9382015769ebedd9f929c8f42e61a71a4a9c6d2a2cc2305e1e08b3238770abe0b092687f9c054441d392a8eeb5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7853d9b75662c0ed8bcc470e9d7b6952

SHA1
23fd72f00114f0fa8aa29cdb228b570a410d5891

SHA256
86c74a1a8b12acf5d5e6827df9bd735a4bc300c6917b7fdf9e9117a487338b69

SHA512
55fffa6e492661ba21cd9aa3461f11b5d30a66678e243b4614e34877ccc3babe506b004f231b44ab4acf0cddf1e258c30f074955e97f31b5890baad239f47c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2ad876dc154248e72272388cd80e243

SHA1
f9220a8bbe7b058069e626626445c4585698264a

SHA256
35ad12897a183cf54fa4a1ce9381f8d580172140e5915cd3111d629fee5715e7

SHA512
8397bd31d78d7b6d9c09a0e2d55f6a407586824d7b06623ca40318fc158db15b0d6813af491e2ffaded03c33d54eb752392a6cb582fe06f85ed36ea0a9082527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43d8345d27393bae213486b0c1a2e1bf

SHA1
6afce97eff9e2cc96427d678821c9ac62d4af756

SHA256
f7b59ac0ca44db031ddc203350b470fadb9e2b6809099601febe4655bb7566e8

SHA512
9fff80be33c9dfe404b7df84cd028d2f9b34bf569d4411d4f4546922007d4ee5d393917d0caff0b0b178d834fdb335a1bec7485b0329c9b4dc1e293a6c576964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcba03835525b005aad39de30dfe01dc

SHA1
9a426841517229e27d61e149396aefc3cdaa1d51

SHA256
92da1813eadf134a3059888dc9311b947ce6846224c99a89c243a60ca52b0177

SHA512
10f5e532630f41db74a2fb95c818738f1959586752d5b57e30cfd031d917f88f158136e7837b7b9494ff67195b413c31718bf7152c33c45efcded8575976fb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2253.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22F2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit