631720f14d0419233a9b917306e81dc7e5b1a9eaed12f41c25b08fc65ec63a7f

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4795a8102e981a16280343cd99013ee6_JaffaCakes118.html
Size

10KB
MD5

4795a8102e981a16280343cd99013ee6
SHA1

e12215a0901d47f00e1b2571ceb4eb5044e27531
SHA256

631720f14d0419233a9b917306e81dc7e5b1a9eaed12f41c25b08fc65ec63a7f
SHA512

acfb04caefc80971badba0a3cb6ba241c64d8fc4d3432c79c1ab007fca3e061235646e58023df4998e96926601d5f002dc6fe5506b6bbd6d8d710f18ca7df470
SSDEEP

192:5h34lIoaNNHof18DH8emmm7mmmUxBy0zYST1YIuf8+O94iummmP:r4lI5NHS0mmm7mmmsn1YIuf8+O94iumB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000010a931faf58016bdce66ef75f7f8a103eedf6d1be4e3c5e02788542dfe2c88e9000000000e80000000020000200000004f73eed44c3ae384eb802d484548c29a833598c2bc51ac1695e1e557d4da7895200000008c84967a29aaf03d4375d5be6053a17f73c41c82bd40baa960966455c87f3f36400000007825de3f6962075284d21baf5b623cc30f454f3fc151ccbdb1253677358980e408da47edb736193be4a8fc5b887df0d070d3f671c65a041041150cc76fe9799a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702a7bca53d6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000009baccefc6b7faba9edac39bd7d67a439179d3b1b06d46f0f4a8cf901ce52059e000000000e8000000002000020000000d8235fd5343cb08c9763b7332f29da276d9c17301eff960ac8112643dac2237e90000000af4ecbb220e2ec2f84768bd6f45aa17cd77ff045d8219460f4b6262763aed04dfaa9357834ef96cbd37d50f4472742b57b13dd213a24df3785624a1afad3994d54da243cea2e9c2e093c7486bb19a5f3171a3261174172ed428f461f735ed8fdabae9240c0707fe8421a7114f1f7574251e1ad68fb6b11554840d4d809137866a35802c105aa6bfd4e8084b83651713e400000003001b7230029054d0d4cf131958e90c9d95aac0f1030b7baf12d99c20f9a238d42f0b0ad7ee17f8ec1bd725907fa095e966de9173d463d189f35ef1a8fe16f8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427167669"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5EC22E1-4246-11EF-98E6-E649859EC46C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2364	1748	iexplore.exe	30
PID 1748 wrote to memory of 2364	1748	iexplore.exe	30
PID 1748 wrote to memory of 2364	1748	iexplore.exe	30
PID 1748 wrote to memory of 2364	1748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4795a8102e981a16280343cd99013ee6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124379d788391264d46ee86a989514ad

SHA1
dd80149bc8200a0a62ce61c11a10774cf594c5c3

SHA256
fed02c51b0f3c288b11e5974a770296db8d1e7667220cc00bfb0ecb633630829

SHA512
184dd4ccdb4f08e353e4c086bdf3caf4098b6ac66ff3696db8aa766fb4592c11f07ff56e4229f30633bc53faddf575e544839a0a1fafc66e3a00948712e2c96e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3ee3a89da5a5a4fcb0c888430bc28a9

SHA1
61ba0ad6c9fb6ec780adc8d7802a402ca4244f92

SHA256
dfb86b66c6ce96c69a8d45c19e5fd93296fe1addbf5a6da501b9ac99d99c31cd

SHA512
35abd7daf03213a5c84f2b340bbd490a60ff2c877e7dfe07cccc79d9e52e664b046cddb232c219326eef80fc2da79104be141bbd2bbc3e2472c3fddc032b39cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd4891003a0611405f3daf9d9c021e29

SHA1
a2df3df35375b879d0e74b647c914ba360bfed16

SHA256
0161a6f58d29cb551b262da301afd4b62e3bec0810fd1d1307271d3442f50ee6

SHA512
7372248223718bfdae053213222c94a5dfbde2a32655ef0496f26aab2a02342b8d1a4aab0f67383cde4a5bcabb7c308e5216fbc3eaa384d26833f5a3dc543a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
683c16b73deda40c0627315fbd0cf7ff

SHA1
eb896fb2247289917a6fd19a4be93d0e08f9041c

SHA256
b8ff819bf22989c3099b925c4a4f6d9bc844dc9c63bd21ec7fed5983e0d733ff

SHA512
a79f906adfbc179f8fb98dd8ab01d96738717a8c0c5054f4b2d127463e9042f0f0d3fb8840c390980d955c777051a7178dc6674387ab599ee6a4010c0919b39b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07a056d6ed8e2e820086339baac67c64

SHA1
8312c3e2cc4bb9161badef3c01710a632009daae

SHA256
3df606907eb29c216dd9d586317014b5fb812050a695bebbd51a1de17a32dbf3

SHA512
894828b38d9fc985df7649036a280c5e1deb2bbd05c5db5dcafa7e4dc4b30f8c6578bfa4fc5aef9fe06f166a945d0e953904e6b0f3ed1156fa13acb83a6d1d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd93fc316214da9c3fb3e4afe7f7e67f

SHA1
76920f048720699c0e6bfd483cc59549a92127c3

SHA256
9eb1cca09c6d7c0f1bbbc8ac818222e09991808170cdc8c8a0fb5bb3af4e03b7

SHA512
a1d90016d71ce3bac94baa16ba9ea5e75f88c3cb2557afc0f470f0f9c88f51db10d8747d736d38830821bbe40a2d686bf7e63d9303f10093ac70acab49d26303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a616ce884711cd5c54055b256ba93f84

SHA1
e41a0eac1fa3f53cb456092a3ba2d7c007372fb0

SHA256
40a0ac920552103e22881a6322f1398c19759055efc5466f550a04d4b42560f7

SHA512
105f67da36dd64ca7cc7c1d5abd8ef68a6fd41f1bc1b51922134a7bded93e8bf5e4d9b3db9dc07cee42112a72b9ad5a7c8c39b3e5d9f512f8a4eeaba753aef9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dda1513a240cc4ffd3a93d25ba787ea9

SHA1
3679207f9f30c6291abe3a1930e90af31e5cb1ef

SHA256
862d48983d548085ba1c0a16f913fc110b1fcdad6238704a4b88f5abb319d51a

SHA512
858749413663512d563bfc002433d36f8727ebaedf51d9f5109b9b64b53cc766b06259eec9b1850e4088bfa9d1ba8edccf6594743c587129e84a67b50bd7e09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5a61a398d14cf5450cc350b4d46b9e6

SHA1
183b634b286905a12edbc8e86ca046df39b59f03

SHA256
6063574bee2ba3ac29007258e17b8746f80456f2817798870f9fef9e18c86674

SHA512
88f9452552778aa5be4bfed334758f5e3f31e6bb2e7e53cde2347bec5ba4cee1d705a580f2857d90759c06870abd7110d037605c6d4e3357de184f2a8f3a6fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be5d964d5bcd736c0dfae0020b9ff0a6

SHA1
1cc6566c50a63e957dd08da13689734e7de63ad8

SHA256
4597810d902c44706bb10e2aac141ca82d684e4ac7d97c12dc62b77639c65a63

SHA512
60456985d3556b39b5f765afb9c274b9709fe18fb9eb2604e36c4733665e4400f8b59aa857c0ce9bf6265ccd1fba5f9327b3b4b1bde34e805d7c6dd0e77f2667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95aea7489ea5ce3c39acd90ca2aa0445

SHA1
2325353adaf0cb5f3d2496ffc23194bdcab61dbc

SHA256
f76a9d59d26767ce96f64e02caf8a0a5ca271069412ccd1c288d98d8ac38750e

SHA512
beca49990d5494d1115b6bf55572d6ed24bf1a0c19b89042de842572a181e32547dd210e6fb99c96a3c92a7c03b01bc3f706e708ca39b2aca2d3b22eecacac1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34810610b82a3d59c943d883d0375d66

SHA1
c9d45b2eaba69721cd96b4494b04bdf6d4a08fe6

SHA256
7ab5d1a47747483c114ae16740a010529e2a87b5a440eaf59d961fd2977ffb09

SHA512
c4747323db78c314bcb16226bcddfc41e5d84a6723c3b93c3216c9260652e7472e54a88c1444892611b68e6747f45c2e7b478d14554d3e79c6ac9af83f64a043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d239ddda207825b15c7704da59ea596f

SHA1
0775133b62916d302c0febef8f509453f30044ca

SHA256
3237f999c068504c4620f138693f4ca8155e74f9a60ca9368616a75d98026b61

SHA512
896fccf8586f75ae54d1f3630d6af0b20137fefcfe143384d0702e9daec5f56d7c5d5c1fcd29a498fdf33e938207c3a5128c8a271dca7cae11db204eb84bf505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e0d033fa0eb3a221db01c4e33e56c3d

SHA1
25be86ed15c6d56e4091a85eb4d0da5ad678bc5e

SHA256
e8cb8e2eb3e739d749cbb7f3c97bb72d0328ff7dcf7139f7a4112be564da5b9a

SHA512
eefbf20c40d103af50fc6d399aa26823759492dda40fdb44de6cb569297f0b071ec8c1b21cb12a0d1803da15b260159fdaba180edd4ef5ea36fca9cf7cad72b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0060a596b5e89ec257bdc203bcd64db

SHA1
ebfefd5eaeab01e0af49bc09a69f6f249ac5ec28

SHA256
61611d2661bd6ef875cdc7253936f3684da25467fe6041cded6ba00b6ddfa3ad

SHA512
7c261b8e01157a133def7323767983a166765f4d4514e365c98c669d4c60c25412962b31111b798f9d81e6d1dcb5c853279586778ac8884bd52ce6e4f6e1e2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEB7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF1A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit