d5ed85ae3b3103ea7297cd009e9e067b462f2f5bba0fb42c48fa79ad437da4c0

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48f50981c473c0e6bfe9c9ad71eae028_JaffaCakes118.html
Size

6KB
MD5

48f50981c473c0e6bfe9c9ad71eae028
SHA1

a9e3d4cbdec27da8457fff74b0ed1e51fb780d05
SHA256

d5ed85ae3b3103ea7297cd009e9e067b462f2f5bba0fb42c48fa79ad437da4c0
SHA512

ddba4a97bdca7f8d37ab5ba3995883a5ac73e7d26fa32e97c484c7900f0f0780f37899451a0f9d19899d13a205e1b1c966a21b6711fc47288f636a0bca17629c
SSDEEP

96:uzVs+ux7awXLLY1k9o84d12ef7CSTUzv/6/NcEZ7ru7f:csz7aoAYS/84Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000742d37249637392748b56882e10c9d85c23aa1a2c44b0bc799157340648ef6b8000000000e80000000020000200000003192e7bad0a7894933fd440913c05910ebb05530ca179e70b7c79d5917e45779900000007e80d221a55fb930c6a6e29237e118d001303d551396f9545effd88a55d3838c0fa8d9a4de8cbc060b149935afea8c55c31bd9c63aa9b2d1353fda49c388bb7e5bfe840e1cdd319d2af83ef584222b6b12b951b47ee4642019b62fd32b6bcf4df919dac3e285e4a8f3057bdf627ee17a94b09cea90da9e5e65bd4c9bf34840baa4268016816739adaa0ac2dfb05cd32840000000b846007c0b04e6ea2942b13d39d4f4f794665d7f62f22b71fc29c45df4b07b6ed15432f38f78b9324cea0e30c7c44b15332ff0541f41c3a389c516899d8b9186	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000320b6223c5cedd2e2e02a515874b99669a9e453994d65256f7e7d9aa5e35994d000000000e8000000002000020000000647a77fb2bad02d16ba9a53e7c208449bdc9fa4e81d7647ed98437aaa15f3ce820000000f8f487c01bf720679a768381754305644eb58bdde164355d6b77e8f4cf26528840000000f8f19ec88b17e48fa1df785ba4060c64d7d8aa3ded053e82ac020e28b2eadc68a8f05f2e1a2bfaea183eed0cecb40c3121fd3713900e2a0fd95254ba6dba5373	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427193257"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A2FC981-4282-11EF-B93A-424588269AE0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9053e8788fd6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1892	iexplore.exe
1892	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2676	1892	iexplore.exe	30
PID 1892 wrote to memory of 2676	1892	iexplore.exe	30
PID 1892 wrote to memory of 2676	1892	iexplore.exe	30
PID 1892 wrote to memory of 2676	1892	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48f50981c473c0e6bfe9c9ad71eae028_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
520d6b4a929d421c69dcec25092b2a6f

SHA1
b169af159d1056a4f6ae08747a1d6dbb99509828

SHA256
6bf65900a799a19f323117bbc721a81aeb70838ea0b164f7cb5d545283613a1a

SHA512
3ccf3c51e57f4e271f1f3a0510fecf23815570467e9396a7ddb432607548bd1e0497eb3e39ead2acb46ba3db1ba75302831bed745dbec2fd327b0fc04ae2abcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd41d20ae91ba5bc3ac416bc9475ec71

SHA1
6b68575205411b530432349b0b7476084a5a2cdb

SHA256
6997c61bdd57aed0d1d6317d136d79b4bf972dc1b3ddb073a95e69418b135458

SHA512
d2905bf30faa68bf4de75bcb88fd6d01334766faf3498764dc5845ee89329f87667c41739d4b50d9e482878087831056157a6255573ae5d142ef0896fbb2c494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92ab301756ef9cc0bf4447e6dae82350

SHA1
f466e375a0e4dd293c32752372dacd1ef9f5c9e9

SHA256
c025159abcda4b68d8cb94c7f7c7c903c6a886ccf55d44bc12290f850e6e6245

SHA512
21fa392cdaafe7be95425f53125c88958726ca7fd97f7219842ae91b05933add1d2c7ee4740c0529782ef623195a6723c719cdeb90bac8ae1f10080c96646a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
146aed167af96addc818abed8654f7f6

SHA1
857b4c34c65d2a0df4befbda3201b20fa929702c

SHA256
492f1f054927772cb2436fb2752beaa6619e929f8a6dd453ec9af469c560c516

SHA512
4030e6cf7f024b2a11a48bd41597c8bf132a0b9ff87dd415969b0f7b37900afd9e7422070606556bfe2061c76de491ce69fd960f45165dccff7e4cff29a7137c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fcead2920a17cc02005042a178138b6

SHA1
110e924ea3068f7123d744d99e6aa0db96298a3c

SHA256
2b9d25d2fa6e9b240ed7257df6b0cecac3ac552c1353ceda60f8514a63adc89e

SHA512
ac43b4e3b5c36b8e0067a3163f17c097c2846c329d9616946f00de491e3f0d33bc851c9d2fb607e9b730fa9c8f8b7764958a29037091528974f7d855506afdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c111ca6cb8dec55cb05c15aed04ae4b

SHA1
6f67846ea2060b8af7d3d084a9156593dcc423ec

SHA256
197a65a09e8d0fb87148532799a2bada012b6215ef6d6495c28a4642aa60d3e1

SHA512
69be9e459dc21f25decacb96d13a28a4e4bc0f4500704d323287fd36a74529585b7f47430c82be82ac7b57a40f82972d298545e32ab84a68232f66ad0dd7efab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32706abf23fecdd3432fddf4b4cf1c49

SHA1
048f42c4b67d24103d2d82ff7967c054be625365

SHA256
4e7a41e88a71b9f3b354cff50e8019b2c3094dd364f4b709e4b7a613ee3134db

SHA512
196619ecf7ef974115ee709375ae2f4c986cbcbe29ae9cae73f9a13fb7df857f6cbb05f93c28ff6057aabf964cb6a282cbe2fc41b4ff91a23d83197ac57aa1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca86468561a064916d34131d70b3684e

SHA1
e3310c674dd1a98bbfd5ccb00b96b607efffbd01

SHA256
5e7286c3fb920a435fb6cb2e05e837c1f971d5fcbfd8ec655fc36c7526d80329

SHA512
06f2379cf84060df90f61d85c30a96e40ebb618646bc2c7e5ff98a5407baab1a5968d496d46afece16af58fc09d95e6cec156503666d87daf7c2ec495a2b740a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1ead64599a912cf9ee892d46ca786a3

SHA1
d3f7181b2453a4f30a51ca454f8c7c2cb3468bd1

SHA256
0c1f2e4cbba15ff0428dbebe8ce232eec6d4cbbc9d13b5d2157387c8a18f0878

SHA512
8f2baca1672944c6da90943e6c913c56319648351d9d792a579b2017583afc02b08d4abd86f66b001914d7744d6f74f24765f898b3f2beb894bba6a7864cc9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db1916c95e2ff8bd9efa6e6bc62d6a53

SHA1
e405e546bfb0e45aa090608b5294f78059e01757

SHA256
7f45c4c3290f71a7f316ed7814895b152a911c8dd6cebaf73b7a2c8afcb65131

SHA512
f05313a497b25aef70bfb0f7701091ac8c4a514fcc594675155ba06c76f2eca694f43877bde6ce12d8ed2c63328d7e616c39c9091e657148920512486f3f3b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4d017ef4e004a4a6494679888e03f2f

SHA1
761f83ebae9af8e7cbfee5f1a14748a09cc9b8d1

SHA256
5e76b3aa86acb4618a905fa6af667403bd709a974fc3d1e53c275d48dc6ce78d

SHA512
7e6d01794e295f3e7d2a1dbc26b75d9ebfd3e7285282e54ae61396bee579af03fe3b7244e898bd768bd86e38ed312d03ee989960ed077aecec85412b2df4c60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74c6d07130e3d6e5449cfb2fda530638

SHA1
7f0e6fb5aa0c5ea38d92e4314a4df3c94ff47ab1

SHA256
c230c3a73db446f031a4c7223df0a97b1b42638d7cfc3b81c97ee77be3e3cf21

SHA512
22ad46efabfc027f306ba9d29a2a716a1fe9e23de5fde25755532042270bf19f62c881b3d00d37e42ab3e85de92b820518c6d6f3e2897012e68697bfdde2bff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e208d3a6886e312681fae441e0324c

SHA1
ee96c428c211e5689cf0bfd8d3dda56009d2fe73

SHA256
e62e0adb2f65d895b49e2723980971facb42f2386fa19ab870633f5c0960a289

SHA512
2162f85d8308da20c7684fc0fa7116ae9fdc4f05e9007ef621399fe8f51547b029f17f61bee6f4119c2d1b1d40e87d9f7480a998ea5005d89d05626c387fb3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
155ea59998537933adcec403b7132e87

SHA1
83a5302976dd735dca48ba0c8eb726b8cce25cd5

SHA256
09ad9de7456618fce2eedeae5561db0b70acb4b742f4e3961c500794b18d73e2

SHA512
a9a56b6f46db4b4238618635a2c1bbac6c4bfef5eb3634577a47e1aa5c490719b394a1daf53703e1daae7fb51117558f06b9f1d6b5a26439add3942e9f02349c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f31f509e633107d81cd61e02729203

SHA1
6fae6630b819e7a946e8bc908fc2f2c3903ee965

SHA256
87f34b32cf1ebd130d90d128a08002163a438a0b69f15dd5305678cebc92afe4

SHA512
4abe098bbe2ce71e8fa6b02df3e1e20e37db81be56bbc9be2fd970accc8d3e2f8cab8cf30e09b4ac4c123eb39b73eb7e310b13c0c319e28973403ff5ca779e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42efa86c3c6a1d1340771d981b78ed0d

SHA1
bb2f6b6a569745352b3161941f2e8902cc844567

SHA256
663a58f027f15e967b1e129205c370da13566881e86542c897bbcf2b243cdeba

SHA512
353b5fb18ba45034f3fb6c20748095986440c4a37b4bc5193063ef8c5017a81e00558eea0bf5008739e2707188087054238c8ee7a4cf49cdd84326c96d378d6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB5D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit