d2c43912a7ac4b5222cb1350825d856e850bf95d2e5ad8f46d1f5fa7fefe240a

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5df7947ce716cbd2aed40bbde58ac6c8_JaffaCakes118.html
Size

7KB
MD5

5df7947ce716cbd2aed40bbde58ac6c8
SHA1

d0bafbedf0f961a102c881a1c2157357e8b09219
SHA256

d2c43912a7ac4b5222cb1350825d856e850bf95d2e5ad8f46d1f5fa7fefe240a
SHA512

0e9026ee4a92c07890b48c8a852a90ee2e0bd067e60537725c19b7aa42350feea497029257c0dee92e2c4f88c7d7416d236029068dbb13a70344265d56dda8dd
SSDEEP

96:uzVs+ux7E4LLY1k9o84d12ef7CSTUTzf0b9qQ/s6fcEZ7ru7f:csz7E4AYS/ltb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8065EA61-461F-11EF-8A2B-F235D470040A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001d75fa2f8b763c2151de8a28e869eb38f8b545d2e88c8bd5fb154306e7e4033c000000000e800000000200002000000019011c3b03dd910d698f1b9234e16cf4d7adaaf8715789adf562985f9dfa6d522000000039a245cf886183ce74f15557108cc6cfbca6df3e4d080517fecd0724789373244000000087ecd1b1c4c2fe4bcf55da460ed3ddf5bfae843b4a8d1f81f344ba0fdb083adc2171c97388e3d9ada15446fc5d44143edcbe20dcc137c5d58e4463a7d4bc7163	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00025572cdada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a71d91d9d32723f39f7d4fdfc507c98e86e32a220e217ba4c2682b37ba270a6a000000000e8000000002000020000000a72b8acceb9cf6b270b3fc6ce7b106b3d1c460ad6572d2f477bcd9693da9022a9000000087a795abb5d52b2d8ddd01503542df1eba2632f86bcd86f6818fa09ddf99fb286e544f3703c302c48855a4fbe5b5e012c411d4a2bae54fd7c396fa28fffa9ac950a4bdec40943ee5a4013eea98d2ad2c226ba5acd498954cc75b30a4dba135b7b16025a4829934b85c585b23592ba81925ceb951ca8c09e2d56bd8a0e660d9cd1f6254dc85ead42da922a257170e96154000000057622a296264b74e2fd8e2294eeffd0ac01b3822dc72dfa69c26b3e8e346ae6d11a7ce107adb85647aa94b51a70ff504461b358e38700d3ae5a803ef48c959ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427590527"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2456	3032	iexplore.exe	30
PID 3032 wrote to memory of 2456	3032	iexplore.exe	30
PID 3032 wrote to memory of 2456	3032	iexplore.exe	30
PID 3032 wrote to memory of 2456	3032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5df7947ce716cbd2aed40bbde58ac6c8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6c55e3f42967a762dcff190807b891

SHA1
aa5021440b0763352bf01608714a3e2db9bab4c8

SHA256
ac705aad46eb2aaea7260db3811f505aa87a621894c6c0770d458334dbf70342

SHA512
c6195cd341cb7e26772a00c8eeef892acfda4da83a2290cc263038549e78cc4e3883300ca7873f27f4bd2ee0db81689acd7e70289764d87b7c18e01f67446e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ab899a6bcb2e3bd46b6b27de6d6505

SHA1
36a88f7418940eb50c7af08c7a78807f5fb18dfc

SHA256
3efd1f2345641c8e712c818faf7cc6eca258338c11daec5edf45f73b74fcebfd

SHA512
0638141b20ad7640a1885bd27e0647cf574ef38a524540b329a03cde66bc47b256d44463ce9df744f765fbdfd3bb727217fcaa9b8e9ec0bbc90d766d2eb378ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f4036d7bcdd7be34fafb55ea0f494cc

SHA1
43cea031790bb674816c5e871677305aeab06fbb

SHA256
71439a5bc6784804eb8da13b459f8e41b73323c4dcbfc1f1eb362b5f6616e482

SHA512
0a6fb3b00e66fd833bbfeeca078496bb6c6828dc84649874dcb21c11537005bec53d17de4d2a67d180f49cf081d3ec1cd41eaded7ced2804727d91df69f09b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6776dde29a3c2bed94df1c48c723abde

SHA1
a515de810cf0c9e6f742bcda375373a914746726

SHA256
25b7077361029d17c1025cc026e8f1cce45a291e10c6a7381b5688ed5d28f596

SHA512
c15bb2b6310eb358aaec59fb9f0386f8c389ffd0a37caa88d10fa57a999ed965f6e6173f70bc108701ae4f494636146c1be3e5493a323624ef976a01fcc840f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d11969c45367955c12749d31f8236db5

SHA1
3d82f7fe45563bd88cb23869a8d34ca4e5c51446

SHA256
edf8d6137b7970add90e5ed99c72239cc6320eec07759b51f5c748726f6d5e72

SHA512
16f02eb7b87a45d28991aef3c78cba264563b2b10ea2b84f80392347c5088d226e0d559f2ca69d7454871e1099adde3bae37b92b9b259fe60eeb33620c20ff3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be90bb52e61199b3c009b8c2d7bb62bb

SHA1
2b42d57aa9374c4fe21109fdda50de0f3b5e2c8d

SHA256
203c20204e50eb85f5ec26dc1e2f020542ce4ab7eaea9b55b9d5c8bcf214c0ff

SHA512
556737c4e96cd927213ee435d2351f2aee7fd8674db98f11a64cb6b159b80b73d804d5388572f6fb4b6e1eb9c71be329ef8fe0e794173dc135cac55939021a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daddc72466c2286ef91544231e15ffdb

SHA1
961bf3aaf3e2873a72afdd1f4b5eb3663afc58ff

SHA256
c4db7a71eb2331443713dff9d8bc8e022b5413cb885f5cde366f590de7b7d92a

SHA512
77bfffb603566ce4f3f0e1fcf126aa7aa2e418ac7bdfb37f99aab762b66e5989482770dfa21523d4f981f536dca58ef66ccecdba322943c02df73f83345acd43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd5f9ddbf308e07f0377eeaf8703cf1

SHA1
c6ad5ffe2d976214fc1f06dafb431cbc64610bb4

SHA256
9ab19e8c9f71d39e59c1667473bc84a692d0c91896348e39eae0924f1b5db01b

SHA512
a2bcee23483162f8834471f16e4887910804e016f7b87a7ff9a674e9017ca348e9a5ab0763c7c8ede7a74c9d8c26e9aeeff1576610814674cd6be64161dfe121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a46cd71d1f6ca59ab9a9460df6e3013

SHA1
8e5a5ff3133af595f55c8bc0ab0c43b038814958

SHA256
8599cc30e25de5eac69f1bec6fe24903863ea06d20df8f7db1629243f912fe12

SHA512
d52662b2eb3273d99dedb692a55662b53389632db6c4e522ac20f9a9484bf22683daf2a3ff4c6630f370431cef5cb4f4230cd4efc2e79eb7c6a0833c25eb3585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a87a6a02f74633a61abc56c7e7d95b

SHA1
a2175127e8c7b852992658691fb1f15509a5a495

SHA256
b740957895d53480377c9467b1cf04fa7a637e00b7c60f828962aaf03f6dd6da

SHA512
41338b9804298e49577b28576362c79d47af741d7df81d7befa9f54bdffc048a8a8db3dac76358d273ce3aa306042f017da8b91a2a7d32f0c6244f1fadf1ab76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f20bcf8ff9f528b9b387187a2d80dcd

SHA1
74ee102231abd330f896633e613b6dd66c565905

SHA256
c5700fa1fd83462fb6eb7aedebc24cadc6cc6da91c8ee2573204d66d2f12ebff

SHA512
38de15e9f97d09fd157332ce84a4cbc7a69ce2fad61904d49f1bd0a0d56b97c86b854c73ce10f77dd84338f2f478796318f2dc30872eabfacf887c0ea1f26645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a9362f3593bf9b0b73443eeb9272670

SHA1
e389e5d807d1a33672f794f5abd8d32461c3b243

SHA256
bab552ff268c05497d12bec3c6e8f2c3e2233169d2b23c204e54147e702fbaca

SHA512
75f8d3df94962899cfd3b9ef6c7a48138d7c8988da1a0ec003844ac957bd12705c80c8f3f363a6534da5eab7c9962a93dfc9d2c1fdaf08b2b6bc3d3bc9125fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2ddd956417b6a059677c3f3b309a3fd

SHA1
ba2476b301e3b0eb378ae05e61f930f718d7ce9a

SHA256
63bdc5582d1bfded1690343e41b6c55cafd87a74acdadaa354dba3a4dd19594c

SHA512
2363fffe243b7853b929a8af1b4c6017aea58874b5c54860ddb687d981161f7a3ce00486ef437b7540a6ae8c984c811cb35fd890be3ef093a58e0fdacd341a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3aa74a43b7338ff80bed45b71bd2c1e

SHA1
813c3da1df6382ffd8867406c37b3e7b8254dc23

SHA256
c00a938478d0e940a158d02198ac73ccf34389abc07eb6adbce1cf8c20d6e3fc

SHA512
37a49d9210ba11bff2bf3d9a348df7fb61604ae5f13a5172108de38c0030a1e8e2eea282598a9c2b1cf6167330c6b9872f61d1fc6073c91ffae046b0e2181a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
770939e272bdb855735d0f443d150f84

SHA1
90daab94d4b084faac5606b9e918c13884855768

SHA256
1987932897b084c0525b097987b937132adf726e13dd9f9f5ba1d6cbb570bcca

SHA512
0887f0fc35dc03ada2771c3df74d16a7a49760204685d4bf6d5f282022abae8bb322443c343bdbfc27b57cbee352624b0cc8e472ed2923046ac4b96b2d39d6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b06c863d926dee8328891d1facb587d

SHA1
719e890d418e66237fca0f56655293cd28996235

SHA256
6fb7eb0e6d84327a86e0d04bd4ab5aadc359bbaed16ee6c3b7bb533ae4a4911c

SHA512
9811ffbd02c4a7b36ebe2ed5a3bba52cb75d34a6541d782f82b7e9aeb9bfcf6e2867a5c706b8ee20f2fa489e61c5b64dca792f8a4945006785124ab6a306eb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d9072c003dd9714512be5508069302

SHA1
a44086cdb6cce3bf7464af8f0864b42f42e1f9e7

SHA256
c1c688e27e29e594a0bec02bef30874af43a31682541c9ed49fe63d431f5a7e0

SHA512
a8a7c7b97b04c04a48c79a1a6ba5c41edd5c6650b9f2aa57353f0f398a7d74494fb5525b6f72ee6303ac61050212c192913af4dfbec298b39c0f8aeab8c26514

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab286B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2919.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit