7a2007c79d4a6f9fb057ce01b65195259189a0c7371c667a4c598e7626920374

Analysis

max time kernel
131s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

498f49348eee174c08b7ba0ac7664f08_JaffaCakes118.html
Size

13KB
MD5

498f49348eee174c08b7ba0ac7664f08
SHA1

a6d692239a73c0699060c1bdaefadcf2346e6231
SHA256

7a2007c79d4a6f9fb057ce01b65195259189a0c7371c667a4c598e7626920374
SHA512

42d5ecdde2676ff85c889537ce12df877ffc89cfc766db59eebaa45f1ee500714ebe3a9d27b3c146171e2a5d044f22125c0460b771d26824bb5e7ef938f82d87
SSDEEP

384:3GFJA/XSHL55M/Xh2EAS7/DPm4U28QCIv6uh:2zssvKP1/n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000173ba57456c3a5b551bdecd08e0a33a5b59c2db54506575bc1e4a543a5e28ff8000000000e80000000020000200000001e7ff55a4c5f8e8e53220144d35460e7b54a6ff925e0585c5dffa463423e3ac22000000028275a24cdcb40da0421a2f5d6c34fd88be3fc6ebfecef449652ad7ecd9b4e9c40000000ba10ada5ddbfb2b599677ceadf4a767bbd207a3eca659750132adbf62b7cd38601bc594295395d281b141901e25272a0ad5ba55c15a5855ae24aa6aab7ad9726	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427204300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000002e4277ffb92d5d82f5604a17223144d9e8ecae4330dcb0a85064585359989015000000000e80000000020000200000004a3db1c416b59fc41ace5a91dfdadab39ebd17f85d307cb7c91dadd0a7ed62af9000000067bbfd25a177abc860abb99cac28ed47c0c981d64563118c5da543799715971d9662da5dccb89b725acfeeddfc851f8dfcefa33000016be930b1ae692965625841ab37fc0dd972ba4c01d778f2800f9baa332ef810d8627217fafb7169fd231c1d86393160bddfa586530a7c4e36ce6ca3b092f097ef3a30ea5c26347a90863cc31d2455c473030c2b01fbceb09ed4d6400000002195b25322071ce93d69aeb40dfd455dd6edff35c731abafb176bb26f52e72cc29d92c3615ccb600be4338941477a0338d90ef19932edd2287d68a0d0da17887	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1012b918a9d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FB40AF1-429C-11EF-BEBA-E29800E22076} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1484	iexplore.exe
1484	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2344	1484	iexplore.exe	30
PID 1484 wrote to memory of 2344	1484	iexplore.exe	30
PID 1484 wrote to memory of 2344	1484	iexplore.exe	30
PID 1484 wrote to memory of 2344	1484	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\498f49348eee174c08b7ba0ac7664f08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
818ad0945d6b481e3f5120f9ecd42dd1

SHA1
6ff5aa1d88e267c357aae50c150c1e7a87ba2b25

SHA256
6ce1b530cc1f0c7c6c4ec097e40d3e848988a99a269d2d1cccf17a6ba5d42d7e

SHA512
8ef4259b3ff272bfb49728764e47bee63ff98cedd0c06f705833cd5bd116f56954264ea692d6a9faf30d11b51c1b7462cfa1697f4f2dcfd847be0c4756f6ec1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba9b825baa57da0efc8d5fc37470e0d1

SHA1
16be222ed30e758e166ef6cfde0c936ab9659b9f

SHA256
fb41da0dbc1008b79530b5a8933d9cc14c292eeffec1677c30baed4e32592b06

SHA512
cd28d3ee44c4c01d15aea5f537013219c294409cedcb361c4effdc1836c08676b583465ad3d6667746f3ec4a35e28c94353c9f24c3de650e8e2af027ecdcca02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a8f090a9db60656066665abccbcba43

SHA1
bf44d96358cd4b323e7b49fdca2e5739ffa91656

SHA256
4c4a4d8f4d4832715629a05ea51d6434815afec32f03fc937e2b2697cbc54035

SHA512
48b422b486d26a0b84db5bd457582841a8a5169c96e897ddb749cc238565a7d319f427e02a58726da8c61f9f1f4c65459911be5eddf2e432579a50b4e01be5ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00dd65427cf6f56577eecce0385049ff

SHA1
7187846877682f972169d30a9747c8d674de018e

SHA256
c7b851f2e32a491039b2a626e87893d02b525516b41112e2a176040be422b0bc

SHA512
234d5858907a9880533b0e8ddc352e43d3047e33089891003afcc68bbd9958a19cb03f3b247e9dcd45ce0736cbe3149b2e2221114f7410cea99e55fea45eac08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c465a8d87d6915937f6249e79fc065e

SHA1
81e128bde17fae948ed23c3c2781aeb39a39ebbb

SHA256
2e2b72e5cf2978db72f959ff10e1a47ae0a29abb9fcd51648d1a191f41e57d41

SHA512
7ab2a79fecd2adc4766fe3b9ece9df93d2b13c4580454396696a19c852fd944340dfb6b6e2bde47e818ddb3c78bf6f484a277e16782cb963b8a1f58a7bf4a899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
870da2b130f35f2aecf4382545f3625c

SHA1
a34b27152f3047da10a8d030d530948aa766c85d

SHA256
808517ac5e2a481a922bde64e1df08b967ae43622a4943ffe246c7c2afb189bd

SHA512
e8b45b759a504ffa8fee0d144752c9482a6dc16d20a82716c2219ee9127893ca996603025f82a899c93e64a344de0bd55dc496312873a8f422b8ca4fb00d473a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c865475baccd52060bbb8ac0441a6b08

SHA1
48f028f08fed4f00b11e89d95c903029a6837fb7

SHA256
8cc98805bd7c6e363939c98b637a8ea6fc86bb5e00f7d3c2e5bc57243f66f1e5

SHA512
e7cf980c338ab9db1df2f31161a29a5498b738139a307f9f293ef09ab3225e3fa869bfd97077dc0e5749dc69f33eb7378e146bdcbc709186f1d83915a1b68637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
636b1911649b0666fe4925fc95d2e66b

SHA1
be1b322a0d850dc4bb60d096ca14897afea0b86b

SHA256
6ca5f25e40de1a814c596565798f389cac953e6bf52bb6b6e3e6c85541f6a6e4

SHA512
571fe1f48329025fbab48df849cad485c3a9a4f1527ef2ec6b9d194ffbea9a0a94e1d8cccd6c72ee0b6606b7a5a64ca5962ce5e7babd5463aee457a65f51ee1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f235eaf020e09b3321fbd95a81a7717d

SHA1
7009d9a1caf5cc18caa7be7c98a4f73527214194

SHA256
4c56c55cc7a702bf37971e970da1a7380ac0d89d559236dda926736d91cb9f6c

SHA512
b8e16371a2dbd790684c4c9c72c3c3c065b5e1442808bdb9d93f044ad392019329dcde4b221147f778afb6457459f91b91fd4b32a4927b89179aabb4768b3767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d7f6f6f5f26f64af254b61e6dadb26f

SHA1
c96d940e1505a4c44171d3d5419e16086bfa1876

SHA256
840155d444eb44cc5378eca418964ce53b42b67be08f5ade14207eb8be74d8b5

SHA512
6d47967a633d996b5b9509adefdc7fad8f74134a0b2e67465f7fb3a7233587894c2504500b69fde1313608ba62ceee627484141cb03b9757f373eaa0fbdfac00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0af721bc73f5b815d6ba16478fa9f06d

SHA1
142f6e20fac06e2ee2d085a47f39fea847f970a9

SHA256
bcbfb7e7546ad2914a69932a543a9c94f4f53b19e8944df1ee9ea9da348c8725

SHA512
7de02b1c20f113d0eb0d9d4326641f46a7a34937c6eeaeffa3d47312e46f87f7812df1cb65b366f92ebb77491eebbf9172441733d9a5ee5f2564bf825a94e042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b68632e26283ecaf4a6297bb271944ba

SHA1
1192825f4c4c017aed6ec66c028e479b1b4104bf

SHA256
238e99db94ecc455673eb64b037016978810b451c7aad073c3ac516af8c81eba

SHA512
da655681803bd87c1a1356a7abf28f0edab0f0f0603220d8b52b5403033c3b345b9dd699a89e843cd658f4cae9a08090c9e55e0f54ed7bf69ece5793efe66125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99a0b55045828af9501cbd29be89b925

SHA1
87bac8c388106f1ca04bdcbe518bd5d1548a0d16

SHA256
e171c20e50b2f4cab765d4be4f2a43c2762a84d7435b41d3727abf991781f252

SHA512
fd4fb4fee349f14fc54a3a323b47d6b539da5e661199aba18d72509dbdb5aea05111907ce2a98c61b2a9eabb4730b2089610b8fc467e013cf18c8a34cbc36449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b015328432bc595815308edd8268218c

SHA1
fd719e9226e86b6cd9ae0f7e08f7e8bd6722f42a

SHA256
3f924a1af2e5a947bb5a5bac3cd3d4357a657ff2bde73606d6969ccb3691e520

SHA512
df1ab4fbe104aab106e568ab6277e9858a4e128075871e9d0cc38daadb419092718fd9bd45ff6042d5b5919ec768c8a60cbfecdb464ee1d31465798f29079fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1fae70c13bc13bf20eec74925aa314e

SHA1
2e77ecb09c975ae0f35cfa9f55f6d1d13c93dadf

SHA256
3f8cc1d1849cab5d987ccf871dea0acf85ec22ce7e6c1176dc415d2e6755be7e

SHA512
433edc815386e364ea0961571895efe5b50bda1079a4c6bcd0ff6c78d56a834f22abbae9f8aef00cbec954fde600c23c9f01cc5c8ee47b01f0c1ea11cae62f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b183771a9f9a4c1dfcc951e408b481e4

SHA1
4626f33b6db64c24ae4b35a4c4fbfd2a75ef615c

SHA256
2ea52bad4e80bdac847ced54ab6989771cff3c9f9a252e4bedb8478849da0afe

SHA512
60a684534a4928c845ce678f81a64ac0a47d24e8f9babc1337a7999e12459a372d79877cada6d2160fd0034344e72917252d644bcc1184caec09d912826128c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a4b34ecee0e7e7d818c8b86aa1bdb07

SHA1
b24ccc2f93fbf42ffc8e6ede754d75833ff54d77

SHA256
95ce6a14e9644124a3dd1037896c0cceb0f9abb0d1abcbd3ff11643ca33b86e7

SHA512
b4081d26e41aa8a6f16a79ad761d26c01b91596f30c23f36eae17ad26a5fffd25c28765fbf3a159ffc62c3bc9bdb59538523f67d3357b8dffab1d025bc87547d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB75F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB791.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit