581f1fddb1799490018a6bb798994e000211e20e598986ec722fa37bb65ff1c9

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ff6c97f1cf4d2c52025581087f9872c_JaffaCakes118.html
Size

53KB
MD5

5ff6c97f1cf4d2c52025581087f9872c
SHA1

75cadc7a41b248a4bd33361ec556a78d979a4c8c
SHA256

581f1fddb1799490018a6bb798994e000211e20e598986ec722fa37bb65ff1c9
SHA512

426f2bfd00d9c39a22821f5d9eb5369d2c4fe89b87474c5a882b5565ce9674f82392683837f7b890f6c7a46100af7038e7ae5d74c21a19694ffbc23cf0c47082
SSDEEP

1536:CkgUiIakTqGivi+PyUkrunlYg63Nj+q5VyvR0w2AzTICbbVod/t9M/dNwIUTDmDN:CkgUiIakTqGivi+PyUkrunlYg63Nj+qm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000e988545f92412d30bb5d667d0e2b1d8abe48ff9f7ab15d45d832b83bf164932f000000000e80000000020000200000006fcfbfaa3e42056afa2af91773ffc93c62b4784f0698d2713304348dbcc0941690000000a95b62e7fc3022821863e281bcee7143617be5bad8814ade367d780eec7d1bb03a41b5233004451013ba0575ad6c7ed3bc8bde11f236d3051322ed08fc13c80731e2e9f337c6b6ee8f08920cfc9678883f6a765ce1df2f424c659699ec407c7effb040b296b5f90fd480085e2c630df45f8cdd55728d32be04e1c3ab06e50f5cdfb3059415277f9d7028be66502e800c40000000d5ab6112ae460e0bb03c1dba7f9cedc0ea420139dc6acf48e79eb218e0b72cf0294d0786ea2fb8250814f8e6e0fd44ce3c498ad38c460d834ec445d7ee72d576	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29D2DA21-467C-11EF-91EE-7699BFC84B14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000006b64999be71ad17789eef331240092df965098551525dea55977986d00c6190000000000e8000000002000020000000659afe1dbd54b3b0344d3523d6923eeb9ee2f2c4ea529c55c7d9d34f40a83e71200000000fd0b11ab439becc292b9e421f4764cd20ff08669dff55ac340aca669a49026a400000003f600dbc459328b7db0bd564ef891b54f9e38e812a25fa8872608a973a6aeedccf1540616f754623a4981d9357840df4ae82ef3ec951a81d80d796e2947866a2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bbbd0089dada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427630324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2552	iexplore.exe
2552	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2528	2552	iexplore.exe	30
PID 2552 wrote to memory of 2528	2552	iexplore.exe	30
PID 2552 wrote to memory of 2528	2552	iexplore.exe	30
PID 2552 wrote to memory of 2528	2552	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ff6c97f1cf4d2c52025581087f9872c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eacbf544b4ab6b55b805b37b542bf62b

SHA1
92bbf2d5a3ab2c0b7149074ecb33bd711f99b3a8

SHA256
bd405b0f4257ee328a3c26c6b6a432ed3662adcb9c9f8f04556c46152af2b391

SHA512
45ea7f15ff88bbf645a1484700d32e5047b66a776350d5c27f2a54e064321b4623d4daf012e45d5a77316686f1b8819797a0b298e67e5571d4f466f79fd691f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
365d5f6fc81d21f9466855ea1279fc14

SHA1
17a3efd54a04ba7de6e4aea2a8836c07b5e15321

SHA256
10cf05eb21d7dd70e7126f292af0338fe87d70a653d7a914e866638a95cd902b

SHA512
b6c731f14070a786892516e18462cff9ec34591cd3e71dc8c755cc62d13e2bc071d4b60e554f1a379f92307cea38ecf07f88fc999f7118a42d995fe0a1b0e38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb9429964d4286d89331f22e1f6ee075

SHA1
582f547330f38cb751dc2a15e17884cd79bf907e

SHA256
0447758854a0da7b6502ef2c3802fafb48d75b9527c8a7ee86b561347695b901

SHA512
072f1085f55d3a029b91083c269c95b3f5d1cca93e1082b3cd2df054a8198578f99ad831f637a469e279a6bb5d209137a192d91948e3c04c0f6859ab3b820319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01b17ad4fa4a5cf569a8b6bcb7f6446e

SHA1
b9bf03661e06d944e9489daa2f47ce0e733dd716

SHA256
9487c723238ae8de495ec1b5ec0b4bc3f1e56b361b5f366174a0c157c20206c8

SHA512
13b3988128490a3848fdf5a29e7d159abdd4452f5c3db4752cab633519940bf19bdc5d4c0d5b2d23a4e82aec58216a4ce5091ba281b7ce1c0500f8e13f0931a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d56645a24a28f4527d258c572f4211c4

SHA1
c5bfc8599b1032da6c1132f0c67269f2b2fe4281

SHA256
f3016f18f3170106ceffc47420508e5452836380060bc591e15a8c87a5babec8

SHA512
ad946a9f9963808403007cdac0783c9a25642ee886848aabcb070bad34c87b5f26439a3a3c37327ce984357d08830f4131748cbd47764a7672c3bb7159295cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a42718297d97cf077659499e39d8e230

SHA1
905ec3aaa015285341acba2aaff3118354442907

SHA256
3fbe1c56714474f0d8879344c1b93823a99a38f8cecc18f517335d96e39552b3

SHA512
571f106118f0e7a3213cde6fcb5805d70fbd20462eb111d19ad7975e64771b79b8d699fbb5bb8bf8a4ee1cce07968d793676b33279ec1523f409fd55bdedc047

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ead61457bd48b8ce40d354bbe665615

SHA1
2ce310f5e96af596ec26385891251cfb37ed87be

SHA256
7e00cb906456b8df12fef24f6f722565050f8dd7bddbd7055ec5133584238187

SHA512
84acb4f9dc7d7c6a3751663702fef5553b4a2b5b3036ff89e7b314165b409df7baa06f947621fd2d6bcdbc5edad10e7e422e6960da6419957c43af2dc4152e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0f6a288ddcd9eb10b8b2c608ca2a73b

SHA1
5c42f106fe9f6ca6406356d036671b8ac0c102ca

SHA256
110686a4c5d0687fe3839bdf029269eed3cff6c5a12fcb50542fe8d463a071dd

SHA512
d7d30ee0f63ab3cfb55b6525fd49bf3549feb5e91e507f158f5f4926dcdc8486010aa835f490561abdfa7c506f498c83b02fe7fad8b8a178c6426317e6eb7cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
960b6f5e5ea5b93497553224b11f5c6c

SHA1
ae76cfdb7418d402418dfd9c615de2fb20a3a33a

SHA256
443329acfb86dc1155b994ad8f3f526a87626f137930a42d03e6636d282d42b2

SHA512
c15f35ede8d0daa58f8d142ba52e51e541ccaf3798ebdaf89769fb7f3b395654f3667dff7176de09478213ae00b08be216b815c9a070cc92ea793a85584b6bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d487a7a25fd8c50b9fe5e28e2e639320

SHA1
4238b38b3a563cb8ccdeb33fd9e3e5ae53b8661c

SHA256
df45c4f4be5326667e4ef22fd61c0df97b7aaa6c3cb44dcf578054a49286f2d6

SHA512
7860d67e748b851c153c228cb565141622cc4ead60827a9c5144452297a404e11829716409564568898c8990d10de3d0bbae8c915014d654efd4bf4568f83682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0aa6e89bded44875f886e31e41992a

SHA1
19150071a9ebe39fd3c7872b0fdbb2a853ab6a0d

SHA256
b69f7a65fade632b8c05122d726c45a9a9656d80c4524a5d74f500c878633c00

SHA512
96020af7b3a8dbf6825854139923bf4a718bf421059b254e23db17e7d25e3220b7439212697231bd5acbbe4d2613effd790acf11749eca295614da62f8381a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df0b1275398b7733ebbeb8aea303871

SHA1
f712b9616231b0763194c63fc308caec50915185

SHA256
8c04f2038f6b99607374699f6ab1a7a117a861afc53557ee9418e18f12218530

SHA512
11edb0954c61cb30d9aac449bdfc38bca9a7e31fed4d306210dc20b4a9dc12a01eb111cdce71bc1dc7ae8640c3e7ef384480a239e6940c869eb95391c6a07eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b328b8b5b762f7f36922d7a79d71ab77

SHA1
7186f2c2c50c66daf8951134b5870fdc5cbb7894

SHA256
736a57c48e2eda21bc548c1a5792ba118bb87b68520b4b753212ffbe26715812

SHA512
46ba1cd32d429270133ff94237874859cf3568df51f93bb265c010e41a1cdf5e80caeac70891a6592ac6ed5b28acbb694869b8fe5bea346a15ea81ce3f3c9ace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69058cd6c30e2fae3a111479823c5557

SHA1
ea2bcb969ab53553f1c01feaa2a8eb915624b899

SHA256
37d3a3a1da8bc7ffe529188552cca1babc0580ccf98a217dad500c01c016620a

SHA512
1a7881aec514753f74cb5ab163c8a47912f58442a46dd0288e53a7d783c1f3bce0d98ccc3ae3463b4f4d9353c00ed95c72bfcf5bc4109b76523da6507eeb09d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2107880447cd0fcf667019baa79dd340

SHA1
a2de0905a8632ac00d5184110ad140bee6e9ac1e

SHA256
dc6087f83617576b4484a97fbf7270c8528b74feb193ebe21155cbc8cc490ba4

SHA512
5576135af6351c5dcfb38ee8d5e37dd6ffad642340db55ef618ffb3c04cb18bce3288498cc1044bc202dfa14a0c67c2cac01892e3ce94c7da28d41e349ac876d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9CC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA3F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit