17c3f6d644170b0b50f64bac31df7b4114656c9323869bf5c5569cc396474588

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

634652e4ea933b2ca1df9b517d852782_JaffaCakes118.html
Size

37KB
MD5

634652e4ea933b2ca1df9b517d852782
SHA1

6b46db328e5e1cd863f4763c4178c1e735ce98d7
SHA256

17c3f6d644170b0b50f64bac31df7b4114656c9323869bf5c5569cc396474588
SHA512

528bcc08b12396b5e1683991ad3aec5fdc04dc7ff5b479017533c03587334f608f90a868ae187498a6a45b4f45db373428d535b957bc2489c1637530f9811001
SSDEEP

384:/ZIfpgQAQFSJhf/vPkJnbq2BQ8WkYm4S8X6sVWvi0WMsjcQbEICW5BPxbmVkWE0K:/ZInQ7bNCW5BPJmVkh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88E3B751-482A-11EF-B692-6A8D92A4B8D0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427815167"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000fbc69920d013e019b5b68d8b5390c9f556e170afb680a29f1cc14c43920f9c96000000000e8000000002000020000000929cf79be942a2e96d9dd30d87306d4e9f83b5849537d77a4fc686a5d4051d0f200000008d3c6a1d8b3928646f53cfd5372fcd7216cebfa193437755a5495241d339ce73400000003a0c85b48a8f528c3ca0c55b002814907bf8e2d2e38b053115ff8faf8c73ca20663744573ba5e1a103d206d08a346d13ad928a3a07d0fb714ea715e7ccebb82b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6074ba7b37dcda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000014b3e41b7b1e6e9ea112941e0442b052e5dc2bdbd8a42ba0be3dcfbc3f425dde000000000e80000000020000200000000be6512b911ee1b07b6f2ea0a4285891be41dab5dc3a648d604d23990417210490000000ccf8559b6da043a6d2755c0faad23c274fe4e2196e7fbe4dc9dc1ecb3647dd7cf05d50a2b498f0af4831c893c43e02c69f2e0263562e781582789dd8af28d7b7ec74e0d4af23f9ce60cc9f2472834256bdbc97aabcafd5563b9369babeb1df3d932fc3267a69bf8520b9704ed495b461fe9336d1fe4909a0247b72dca23bbb474231d38e40e7e45ebfd50b36e0cfbccf4000000026fee714386c7b3406f64a257f2f7a1dd39f0c0051fae036b8d7676aff1ad03650d2aedf0c33e1c981f9a68b882c492d94d980ec862e92f65fbe5aadb6b12fce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1728	2476	iexplore.exe	30
PID 2476 wrote to memory of 1728	2476	iexplore.exe	30
PID 2476 wrote to memory of 1728	2476	iexplore.exe	30
PID 2476 wrote to memory of 1728	2476	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\634652e4ea933b2ca1df9b517d852782_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb7baed9f5923fa93dc2c1813386456f

SHA1
2c8f89a8deba520c67bd2460e0c3d328c6ab57a4

SHA256
a98b37b7edcded4d68ac500bed17c76d4b582bc3a4dd7f39057e4b5518b934a2

SHA512
59194e50617da70f042f69f9f3373e180669efec056580271adc8c97360e05d375bef3037e4b866eb9e2bcfadf49dbccd284b6422f7a12552702908643d57a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a8160b3c2093aa16fb08ce95846ffeb

SHA1
dd9d11f05175ee8d6f7731cea41489bad022894f

SHA256
ca4ca209b0cc2e4c2c514d577477c907135581981c7ff3912ba5d663dc848b28

SHA512
f41af15855c69eaf30a056e1ae5017a43a2f7799770efbc5f5ff4dee7600928eb7a31664285723170436c5881b97484c2ee5b5671602fc9435d2fb25c9a9d215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aba6a37242cad40e0dcf140f9a208b86

SHA1
19b270416c6a68fd40a834e2e06b9f82939618f0

SHA256
574a1bb39aacb9efced6d89afc8a086903fb0b795a5f4e8519135bf7d7dca05d

SHA512
856d1e3970dc305e8ac4d74009778cab57a69f19997ca1d7ae1b51b638050debb8dc930d0623e9a6fbb064dbcc8a1e57be7655fc2cb12dae7f1fa21c8cb42525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
781ecd45c18bacf20dc618ef68226532

SHA1
2d0cd212219b200ce8a56938b4018660a1c15068

SHA256
6370ef1482723d483bd61e6dbf58e0f77b15e0a20332c9fe19fa91dde81ddd72

SHA512
6c88247d84581f9c377367051768339c91e104c9407acc7996d9ab4de94d826f94cdcadfd2dc0456f3e7903faa061f05177fde809e0620a24c83afdbc0a1909e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95ac33f5d2f72580ad646b95693ff343

SHA1
826764d80cbf3b654dbc1d94a682240319483311

SHA256
2670ecf789a726bcfebc2736573b5f2132198a2c15df5ba355014f402302e514

SHA512
46055ede95b1b382a9cadafb07288b921241db4a99093b7c8f8fbb06ce5966852ccb296afb503c3113288fe99bbdd4409340e4ba7af4d4b833a818d000e1004d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82e8b5da6007ea87f97903da99b5a131

SHA1
6f79c6669061582e027ce8a22dcfaf9d83be11cb

SHA256
a6094e0391743e6a52f42ed52b2401d5c2c35288725ede1156fb26b3f816e020

SHA512
0b757efd32bd85cd439b24fa4d313a747b3af4dac010a7471861c106bb644613d634c07e4c810b9f90dda57cc3f9bc10016d47dd6cb764e3f785c144ac133a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c0e67158f3f019fc7cbcc6d40521333

SHA1
653ef6d35080b8580a776133e29f729fd150e396

SHA256
bc46ffae31bc2897baf920a0a2341c04b3e55f7f6e3ea7680557b8d69a860e5b

SHA512
445a5f382159dc47ccc32ee4a45c4d72b3ca50245272023028731e375df93e7e3addfa91a7bd33c4e8df0be52afda37627472e0783181c397f552b2b1c6a1925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e74b1898ad507c2d8f20955128b40d4

SHA1
2ad91a8fe9df1d18ce27e2f7205d6e798bba77ff

SHA256
df8e608c54c4631032e65a55b367aaba1bc5bd8ad54206642a6ccdb2a809be5d

SHA512
999a4b160e6c1479f1fd300115e160e5364d538519d4c87c99b0e59fed15524b15b06646202290a15d4da9fc353437377a6be70f1a11cef17b42b4b4cc544a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7869551eb4dde64fcf36ba1db3d2ae36

SHA1
070357b43bc25f767749fbe587d21b68414473eb

SHA256
4bfd1d9b0e3ae7f0fde0c6dc1a5914c5f548e6fce96c566ae3417166d78619cd

SHA512
6deb85827ee14220f0229ecf83c0d0525fc5673a55c6b1d1cd41120f2d27a47c7f90a0ca5197a65e86cf2b1848541f7773d8b2651b284c6a332baa6dd256856a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2e2c6e25094002efca66d54ea05ebd9

SHA1
ea6121e7438b32573b8dfc2d4cf2c3e6f3ce9b1e

SHA256
572afdbe7e6389ac3fa4c05a3c46fbb78323a9fad3dbbddbff198e6f830d0dd1

SHA512
a2ff992651b45ef7207fc4e4c5a2dcab74d568e6364928f5e6718cb366850a169dad979f357b8a02ad1f5fd391b8582a31ea30916084764a1cf34aa4afd62022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ad4a6868c424533b6478cd666c8184

SHA1
64c8d78be679d4597b4deebae003519120c73f59

SHA256
bb9b437c8025ae414a94f8b79c3ea6879404460784bdb25a606daf3b5e1175db

SHA512
ecbd539aa9cc97ede6ef4d144859694ad31f202cc9c98229388baec5773e26c43bbeac543180d971cf31b268709256d123e48dd304d6359ce5668e44e3fb5393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aeca24d2a7bd3695ce93ca127300e61

SHA1
1d934a7ea160f4ed91dd5c8d1de74319bdbc8c47

SHA256
673e4382fc3fa7f0c3a1fefe2f759e704be2021f9de9007d1516dce048552426

SHA512
b8ea278749263aee249b311568e8e7797ad580f1305e8196ed4be82cb8961251a8daa63249492608587659b7bf7733a00117f01e405420bae5ae1764eed5a197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c93198bca389cd6d2c011b9d290b0e00

SHA1
c8f516d415ff64b1bb26b8dbb45636702612fd9f

SHA256
1fdb011153ea095730dd79aa42bba3f0cb942a1764f03443180ccd07f72e37e2

SHA512
c3eb0ab7485298dd1d11ad1feb3689de28b2ec19ec7c83cb417bd161967044e1e2b8365f2e6079eb52afd9b6f21c8167818799a8860d5d48062267143e45e49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
333980212c005f23bbd8bfdee061a592

SHA1
d37b69127679b301a9caa102ed60048a40e31c4c

SHA256
13a62f61d5b530c23f19185356ba01e4f8f8bd031f6280955dfddf2b95321277

SHA512
cd61d4015720ae2f131396feb73aafe46ab24f6ca077d0aef73e15706415dc6a05451b5341a351328ac11f4980381ad0bf651b0bdd3d70c825cd4a151e32de01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93d76334308ad42a795c502dfc5e7e5

SHA1
31f0f45110e0641114af68ee74c1ab96ae2604b2

SHA256
6ab193466ed19cb8ac850bec239407fd796e0788dcc028cce9147d8013416d35

SHA512
5894addc80a228fee3fcbfba89a8592eb8034755024a97738b8fa1f09cf16a998060693f63cf673e6bedf43962f060b48170c8838fca0fa35e45dad2d3d3764a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9DA8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E67.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit