bcd6f1b836c03eab5ca1054997a352b716994724a04fdb340412d670d5fc95b3

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7a8eacece18d956e8d1337bd2b07fa1_JaffaCakes118.html
Size

9KB
MD5

e7a8eacece18d956e8d1337bd2b07fa1
SHA1

24071e713a000ba9c40ab09190e5b515392aef85
SHA256

bcd6f1b836c03eab5ca1054997a352b716994724a04fdb340412d670d5fc95b3
SHA512

a44aa5545cd791063faee5a8190a64636bfb80b427559c1ebc54cc5ed6cffbbc5833f6472f1d78a4cc63ca98d2a03e36d078323fe2432a7b1724e8e7228fe88e
SSDEEP

192:Q4BgZfGIw4yGxfF4bWJf0skcTNjHiYttYaYHz:eIVbW7Xt+T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F228EC1-F5B3-11EE-BD6C-424E8F757171} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000d512d8843ac98f538528b831ff4c613744409dc393f0f3dbbf1e413cad1b9acb000000000e80000000020000200000006189b397642d021a2c33861a763e98d8d49ffec0deeb2ec05107366776613e1f9000000004ef151b8b75a0f77468682129665c304c16e33cb32e49efc42bd5480ee2a872392487b978d91f13e4f3a0fa6845f015dcaa653268e378e6eee66deed0194105ad74500843781f21fb62063c000a06246bdf1adc9510eb5d92bf01055073c08f4fffe8be47c5ec9be0ffccb3d48980250550a2c019135e1eb01644ed1bb7ee590b8d6ff6509439ee3368b6e9cf7defef40000000530cca8c725f638884c972477dac83133a9251836429aff56646ca175d9d0fe22c8a4d56b1339bdc74a7f8afb2995d1c22714d23929bca73cdfe4aea8d6e80ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000e30540ee454dff55f3bcf6d9922d696d218167fe9247ae0d0a89687616c2abf4000000000e8000000002000020000000025fc3a58e10cf50d3ea1003d307f0c327274fff5a77da5dc567273cf92445ce2000000039d462bb4019bc465be79bc2eb9c72449d0dd22b8e493201fa241b3cb8a8051f4000000031047994a7f880b0b3bd521143cc82f9b344c67d06236a7c46ef540ab992c88ebb0773ace0d16e111e7d12f7c5bc1bd9b184b4d18f3bd614a147d25affd3df1f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ab6524c089da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418747966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1148	iexplore.exe
1148	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2252	1148	iexplore.exe	28
PID 1148 wrote to memory of 2252	1148	iexplore.exe	28
PID 1148 wrote to memory of 2252	1148	iexplore.exe	28
PID 1148 wrote to memory of 2252	1148	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e7a8eacece18d956e8d1337bd2b07fa1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ab00547268894288bde75b3494a9b11

SHA1
e21b8e8dcc191bee12185f406ed8059c8f054e32

SHA256
ffa85e0999afde5d478be68c12fe77b1865b1c7baef4baf964f61fda936f6c87

SHA512
a6f1aa881e7208cff0e6cdba0712e589cfd738a76b0f07446860d5d16bad4e70ebc04923ada68446579165b9593c6d8c0a12507126530ca432cbae84ccccf6ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff31a07b42515f2f728e5c293c34933d

SHA1
579f274a78dc0ebfcb652db49f68a05a17a659b0

SHA256
56cda4e1e73d29fe9347a107188eb3d38ace405d18451771919cfabf847ebe40

SHA512
7529bc149d4a47599ee550178f199b54560134a2e2e192a1bd2347ea6ae1666c0c1961759ee4812a20b85faa1a8d19552d7cb77e13f2aad46d5e377f845c55fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b0464f329ad9ddd1037d1d0180eff0d

SHA1
83e9e53a8e91d971a585bb81cfc18a8e8cce966f

SHA256
a646c332f113421cf2835e75aa9f4623f6239169b579fde191fcccb10ba6b398

SHA512
c67d23b60dd1079a51e6b386c41b2e777e55926b3df7c8cd2c538123e834f35e6069d6bef22d64d6a66fce2c731a20ac62f073407db6a89aadc5645bd79f4187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
732253ebc76c5c475385bdd8e0fc6741

SHA1
c0b6038ecbcfc6d90cf5b39ca030fe5b94a6618f

SHA256
eab45b5382dc21ebd785bf829efb28937796fc9f986ff07eaeadc7b2acd65be6

SHA512
6c22c3c36f91a112c3efb933a3aedf217f088bdcdf43c45a97389bb6db953d8b8c5dbecc5e0af8ffe017b02d332ec79ad132c4ba32d43f1fdb2666c5b6291bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f791a28d35ec73e4d0b2805dcc6ab2ea

SHA1
3c84c94e3c0f4a9350b6855d6acde0ae03873264

SHA256
ba5aa39f64567c4e36bfff3a3f88db1e49a864009be25fb7eb9918f5f4902d65

SHA512
fae9f82823e5cdfffc78e7229196285016ddd4cbf2d58637ea28eafbfd9e7b8ce258d452b07be9e3bb2648be38808669164a446f5fc8beecec33f1cd4932ade3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5acc622bc08716bdc5a62be5bac5e8c

SHA1
3c51fe7be7d8e48eb3b822e1fd19c62fb48b6019

SHA256
840d98e2a38b2b24696f1ce1707e9e9fd86176adc16a588c115828ea027466d2

SHA512
045f7d6245e99da36750af4724e7d0afb730c1817b95e813ca7330b4b1ad25b4eea5c4962f96c081add3a9d9db5bfcbb0aabe71f42a9d53a5f6d258818baf3f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f37084fa0e5d9a8372db28dd2d240e7

SHA1
2bf3b808488a8b1c47d405fdfac63ad08eed4e85

SHA256
6d5f88e68eaaf3d3f2ba88e01087c55f55ae67be44b551784d9645b92ac8cea5

SHA512
45a3ccc058a0c72212265eac653433288b14ecb8d11c41d2714da7e1f86c2822996241f6892f44486a8dc2567a6da06312f61524133df8b3720c3cef9ce477ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3037b82be4ffdc89a58349508cb43379

SHA1
93e0cd337aa8ee601e0ed80ab44801d1f784ccbb

SHA256
08f9d945b8f890f459679eed0609012fd1ada2db8875dde0cb082b5ac38f133a

SHA512
2953673341436097b5bcca7062db8c76c14ed3a3433c5fec2d14038883828e913b16d6af07b76c1eabe7922eb4363c01b08b756c6c47748bb6c0075faaa4b116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebe717e051d6c7e522d6a063dbf77d54

SHA1
2555c87752680c1b220ae2839a74c97f51b5ad05

SHA256
7e1c6a8252e5d5bb953a6e69c5df7429cebcc70252263b46ebfb2534048cc494

SHA512
46fcdfeeec498f0557647fec09473557315c11685298f0e8c56faed62a719da519243904aa8e6c921d349b4f337795f686264c13d5ec33f665d67ca760162cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20e811ca2b3ef6e4940496e2cca565c3

SHA1
f28bf568a82718a57feb0835ed585403ecab1628

SHA256
71e9188b824af8d8c3c0d036fbe8d012872e1cbbff1eab238ec6cbea2d56da52

SHA512
43d23a4132bc583b6dad3101a2c84eaf39e3a35013271073bf0aaa6c510f2ceee6d21045cb909e74e759017eba9b70589ac39b40adca1f4aeda31208cb8c7bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b3311cb04eb28ac4e7cad5ebd637840

SHA1
63f11d17603efd15611bd1997498da6f81ab44eb

SHA256
4967fa8b214b55e2c991273095d829f15c175ae100b830a333ae2abe02cf08ae

SHA512
0d0b3fa000529f18d88f58966bafd08b93800c0abe37c52785a690afb745769c6d9b29e166f5c85e9b259235a92ba4a822a1f221c485d976f9f538f2ac3e7825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa370239b3f647ace33729948193dbea

SHA1
7cfa65a54641cb0afd559768a3aa2d3eeeb41eb0

SHA256
16ac9896e6974d749812175edc0a5c9ffc925592aedcd27c74b33816463dc2b9

SHA512
d3d48e070276a2101378cf10353769e25c8dce3ce9f503327678db2a08a834f100f21e3ff726752a36000c255fae96c78f9ec3b317dbc479eb4ea77c932cfff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcb6becfdfdc36599e17f02e359cf88c

SHA1
c8a345969e8eb050f9c3fc717bd6a1d0844539f8

SHA256
cdaee15faed21dd3067f4a69a243905058a014074242bf8c489ec3ceb883f459

SHA512
195c254fbbffedb8a7929b4b072fe887aaf213f0ee458d5ab59207f896098d2642ad55819059eba530162376dbd8275c2ba96b5ad77fac382da69c0325ae0eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c4ea8aa75a8d7d6a6804b3a0be7e99

SHA1
b49a38e3744cbc97a4a2cb95f91124b3ff1d4437

SHA256
7e3e07413d721cd036df7d718459fa3759b5cf11258a11673fe50131b76ca924

SHA512
3002fd0848a121a9338b3d0644bc457f6ec89e3e5f73af768b67a8c5c1814497f434523bfcfa25f0d6443f98c019a40ae6b258954128d260b07dc2d698a5b4a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
870b97fc652d8d2a299905046692738f

SHA1
f46e2945a22ce3f910a1b8307afb8aa13ccfc56a

SHA256
d488cca2f3ecf29264d9d6f894db2df65c88e5ae75906348e8f2dc98bbf7a00f

SHA512
4df9d4bafd2c454deb6eea8748b16c893ad1ec73e176546f866d3e718f469744afd5cee494897e5f58104f3c101ce8981925173a4b3a0f8d31000bff428bddbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52d6f41e55fbc2948115f9fae4cffdc

SHA1
bcc8e5737923fc95088610b59e1c2e856a2f5496

SHA256
08d4085cf5cbd353d48516b0876ab415c2432eb3eb43464d71f88d9c6e610555

SHA512
5bbf3ad4f89bcd018a842e394efdc893f83d4d977f9297d6797530606d45547d0efcfa0660fe216a37387c922020c24d244b816ee6dd3866fa19a7d24b9aa840

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CF9.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E25.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E49.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit