b2cffb91b63339bc6bd6603f6b42e392d239c382f43e20136541261cdd840f3b

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a44db51343d429be4cc15be3296597c_JaffaCakes118.html
Size

10KB
MD5

4a44db51343d429be4cc15be3296597c
SHA1

dc11314ebe15425a32ae704c2043160ae6d99c90
SHA256

b2cffb91b63339bc6bd6603f6b42e392d239c382f43e20136541261cdd840f3b
SHA512

401d13071a6bdb700259d7c1ff89e235ad1ab79f5c5801e366b61428b5020d642b07bf77d81a9601eda0056ce0f7e067651a2b4ec76157f35a459bf5b601a313
SSDEEP

96:uzVs+ux70iLLY1k9o84d12ef7CSTUBGT/klspO1usdBQSlVHcEZ7ru7f:csz70iAYS/IIyN9PHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c046c95ccfd6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86248661-42C2-11EF-8920-7AF2B84EB3D8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000099f651238a8812ab8eeadb2195ae5e9e7806caf1b61de20d04ba52804879a0f1000000000e800000000200002000000006ec44d810374cb48c86762079145d62e001338269d1a04189aba88218ff6010200000008d9ac98156704d36e41e5cadc644e4ea5c0fa8ae0d5d0da229ed7ddd382b975740000000fe4e3a6e38add4d737989ab06d69d89355fad7cfd0f77044b704724b3e92949630578753ca812fce99f7b71d918ee10b647dbc1d37ec5af8569df7b3ff765a8d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000730cef146c0e9b7b137461db262ad2009fdf668bcbc757b46990aa624863d2f7000000000e800000000200002000000058c3cb2c75142392d24b39016c27a4cf1233083ba9c7b956379803d2b6c2f45790000000e597399835be2ed1d66b45b1aa1f297857f937ff2a4e1a34ba936fb334bb53f6902b9ac144eba3740c247541d7c47352b0fb194ee550a4f60e544fd836c0a44f1dd2d66cb115b5e11aa06990e3e2698c04f7b1b891e44093d8aa24f42bda1f13b1af5dc23465fc6f19d2b91af6145647d61fe000200f56495944399edb590793e2face1260d7b6dbefeacd32a54246eb4000000014c1ae1c0a60ac9d63079fc41bf486e7e9f1d3e72ada0e34dfeca8da4b50b9061949a6358e99303a4883484c3bc7ec1924fe52634a8961d64ef158f255219d22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427220739"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2384	2172	iexplore.exe	30
PID 2172 wrote to memory of 2384	2172	iexplore.exe	30
PID 2172 wrote to memory of 2384	2172	iexplore.exe	30
PID 2172 wrote to memory of 2384	2172	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a44db51343d429be4cc15be3296597c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
447fa59b1564ec811c091e086803070c

SHA1
adc08a484e76711acd4be41dd58b98639d6810a2

SHA256
afaad48c92812a10ae19a880a69aefee989923031291b00d7ce0d9abdd8ece9c

SHA512
b717edee2ff0491883e6946f349da3b181038bd5281de6cf6cd1610d687bff0f34fcb3c7b7cb99c016b192a1db11c958c67ba5e7b34d0c3d4e67cea16b372a17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1935e74dd510d912c9be16c146ddc0db

SHA1
726961cef1301b2c020b320cb7a65583aa279147

SHA256
984d35b3991725319ea28795aed2c3a19020baa641c18029118386227118a4cc

SHA512
1eaf733d65480286fd06af0a1d1373082f9ff0ecdef9d036ec0e5cfc7c6d88a81455a423132a99feaa35417a2b98db806a94b8ef5af3f299ee93daa93aff4707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3df5dd0a15d290700d71efce3c96293

SHA1
8358aad0626f7e6efbf3e6f3692e1c88504cc91d

SHA256
f78290fe2f861ee7c8a84daa0f947d46f85f2f325ac0e3f8b176af0283c28836

SHA512
dedfcd8f99854e0a425b7c42db8369335f50ccec461bcd8954ec326942485ae28498ebad54b9584d718cef32637624434b8243f98aedc7b0a5251d69b3acf904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8c7847ca65e5b0e30187dc7c1a57b8

SHA1
3016fa609515706c67159b501c84504da88390fe

SHA256
8ce45b27b7f8975e63010d53535e3022b0918efca347ba37653706558f6c3d9d

SHA512
dc8c868aa59f721ac9412e8bc0a46c38024b74743b78094570f5fd577ff8db8c9db45bf777e25a743b841f2a8d4026c8d37ffb0fd414b68b1df1c2c11a9028da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86ce7b6e9ee27e82ddae6aa3acf441ef

SHA1
d61a55008e9eb043b3b4d97ddf694cb2b8c93229

SHA256
4078c3bce976e16941fd8044db8b23dae166c651e699b5d6e9785990d4fec217

SHA512
66960ad8e004e03ba66e49c28302b9fc5ab45963ebc30ad0eba61d91c2656464973e2434e934095c41421afb98dab10c4fe27b41c9d5dc8baf48016701a6f3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31a37f3a426d71df3b7d0829d15889a

SHA1
656d2bb3ce51f58bf455dfcf13444e90f2ca6b34

SHA256
369ce5f4717c068264c84d10d71d47fd5ab283d3224f21314930d7efcd80cfe5

SHA512
598836f2ee4329e27136826ca04baee906f9dfdba5a3611066ccc1426543d9c333880532e0340dc7462c605ca3240731171c370342d5cd69b20cae8cf949502d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfff093a8d86e448feb71a52cb43ff07

SHA1
a229838e02c675f1c149371fcabfd1e348fd9f8f

SHA256
16f433d94cf029eade236abb07c70c95177f31bda5fdcc288e24da521b9cf76e

SHA512
491adc891fbf68da632a5ccc2d110fa02fbcf502308f362faa83ab3344b066be9270011bc23f22f174fd891161e439693c581fa64ee693b5de94a052334db2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7bec9f62c87facc127eef07f95459f0

SHA1
b7cf88d2b98ed85ac5b22a964da13e7be72bea5e

SHA256
8b62b03b662a132a5dfb9c9759b75e1d7e26943e88da07a8d48afcdc40fd898b

SHA512
5e3f45dd3baa48fdd67948fc7d12666796f00ad0ba335e0cac708df623b8ad5ca4fc64f489a2afc6190d7f73926ed44a2f44b756eb234b5a94cc7f363bbbb8d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eb83f005fcd9ee1ff8da6e6c694d97d

SHA1
a13bfe0d2747c3a6670c552b29bf7c7da5416467

SHA256
6577593e03d534eba9199b4885b7e06606155535917fa914b770755fda1f1797

SHA512
49757d3b9042b0d4749f0a3f41cdc5e5c88ac2ff79a7cca73739bbf261fac3b65f9bf52b167514dd4f3016025134d2c3c75025ae6412f3c100aba3bfb49136fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50e254ab0fa7939f3a4f91f2f739d010

SHA1
f052d0a715c9ae2d3e549cd78366903ee815df10

SHA256
fb9a11ccb674f4bf013891bbf1e258e2e348bba9ba4f3e5fc0f8fe2951b640d6

SHA512
1426bca256dbebe4d84be22603823c6a5326602d2b237df70e8fd1ddc0fe42fa2ceb2f2068ab687a9b266b35d206526ac8939e0f594c8935bceb3ace71ae6782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09cc4188f1f7bf43bdd8ca09d91095fc

SHA1
21ee29619cb1cb06768a5e0fae9c2935c3787246

SHA256
a215b3da75dddb46a81fcc72b2797bcb8242b8adb3bc0e822e42f1f44ea4e3f8

SHA512
87ef44bbc66a142207688ab5084b6fb7e7d4233891cc1e6e65389fa406b5a5a78cc6b01ef67e0855f479706f5a323e033cceeb7d50e35b1c88b89bd2c19f783b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb2b497fe55ad4e0d10bff9d1f6feeb

SHA1
7ba369f75abdcf4739049e7b9f0245c6bd271e57

SHA256
cd93541b9d5af277876c70863e5fab4624878a9157f52164340dd56bd32bbc80

SHA512
e82e201c2d1001b9309334603a4d014ce5e086f250f42ae55dbb359a2293748306ba5659d1379227570d0120a75261aa3cd3725f841af2e0101f9c9171d19748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533ceb4acc1c99bd590b170dde6e0a4d

SHA1
7c5041864a0f18adbf9fdc0da57ef4dc4d83fc8b

SHA256
6aa6b4a4609a28075ee586462114a078b36a8274263e7d58aee5b51b9b356a3c

SHA512
a821f6bc8c5b62e92c9e8295b822111dd7bb1e9f7cac5a22d4838110ebe0bcc193be5a0e21adef73145f408b0c27907187a60c8321d29b9913bc8a4b8df63efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa2058503576a08c9a2a0c61f9dca230

SHA1
7420fb3db959e7c5c3db7c9cc8e2e9c414c6437e

SHA256
d5d2124606589f6170dbb6f81f3557dac6284fcab2596ab5c4b50fd1e1efa5bc

SHA512
d755854b4abdd31508bb1251eadeda8a5ea80c2ba9995d5b664be8abc18a3a95f167ea87f151f8827a39a64f7084f6064ee28cc5f30bb3628f52bd58ecee9d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50c2df9bf9aa2b875f84b17771eda551

SHA1
8937417a45a61c2b099043f79647e0b403f67080

SHA256
4e0b341e992e2f651ab82e1bbf510554b3c1273a0888c1b11f03ad4f6d738b55

SHA512
a142bc49e1f1d57aa6cd75dac848270a78a99717e2d6cf1e707d972d70e99b432449099ed5dcda1253af64f2f26405c041801cf6ce17482bf155c104b91aea9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
617953fbc4cb9699a5c859ac1f4dc945

SHA1
493abb2f438fa668c4a9aee66dde9e3154eeee47

SHA256
364b3bec0b1c222ff44ef35049b9842e29f1b0c4d2275ad597913e28543dd8c2

SHA512
cdc1d472aea53ab65a7a235a129b2bd449d6dca5a05e94f964db3feccb3f659e1a32e7f382cf63469bf6646a672bda9217a5de0d2ed1af57b1983974fc2abab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1242af0d86531886f8b2e3e83e70e7d

SHA1
01c068b916d0f727af0ec5833a82494c3a43aae4

SHA256
fc0ea749db23c415049c8d27f0f9815ff59882e0cd5cd13fc11d6cede892e5de

SHA512
c1d687d46753fe492b33d2db5633029ea110706238a1915a2c07b8a32be1f1983ee88a7757c98cefeb8fa23702f8b05f8272b01795ab125d5777ddddfe172d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDB5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE66.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit