c393a7ba9ff2fa73f64c8422a42406a2eeb1aefca822b28d86470c4ebc6065d4

Analysis

max time kernel
139s
max time network
139s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8e492b5fe06a026c079b46205ac7c2_JaffaCakes118.html
Size

73KB
MD5

0a8e492b5fe06a026c079b46205ac7c2
SHA1

eff7e91bdc16c2483f8c9307f784b2112509fa42
SHA256

c393a7ba9ff2fa73f64c8422a42406a2eeb1aefca822b28d86470c4ebc6065d4
SHA512

a1d29825e4eb0b1d9fe0d96449098185022afec6ae38e0fa05d9c0ba787564edde91647a2f6e9735788ad0ba6f9a1e2d53fb8cf456c665f17bf23fd39cf377ab
SSDEEP

768:JiSgcMiR3sI2PDDnX0g6s+6Tkpe4GoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JcApXTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420677600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006744f9d6261a032928bb34a90be0afe78be202c6f2cf0188e5fd233b5cdb4197000000000e8000000002000020000000e57cb9ae2cdbf7efcf7d0d06aaa3d565e01292a31131a0fab6c92205105a0a21200000000256a188144b44c95bb2bb5c966e4ec129a0bcd68c23605b21c851e1ba8311c94000000036fa0232877227862e3d9a507df36b5d6643b8529b56c33fcd02d94905ec16b506fc69f9f209f869e9088b9b0705e80aa1ad417e36f7db595d08ebad598874db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0afa1ec4c9bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17ED6531-0740-11EF-A3F8-62949D229D16} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006aec643de10cfb4f515043a9403956979b658814ed694aaacd7c53b9605294da000000000e8000000002000020000000c25535507a6ac8d2099769d051a3d8c62bc6ae77882dfc6bcdd4ff8f8363925090000000d0e881edc7e3ca377450db57597e68819a73bb2d8416d9de9599fdc11622e26a18a24bad7a94bd3428c20118bff9b42824af8d44999fe6c6ae51ca232e684cb90ec8ffac5ad8e2ffc43a57a8cffd251049d1744aac13f93c0119614683040454cf6feb056d97ac4b4c1fafe558a5773554bdbda37a7225e4894adb9f4557c1cdd6dcc4dba067791fec4501276ca50a324000000055034f0ecebb77c3da22cef3cc4ec7ba30052809aca1fa2c1f90af8c6ead7359a3e8a0091336c743497921b8f9142285b2c606d445ee728b18da22ee2753119c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2888	2204	iexplore.exe	28
PID 2204 wrote to memory of 2888	2204	iexplore.exe	28
PID 2204 wrote to memory of 2888	2204	iexplore.exe	28
PID 2204 wrote to memory of 2888	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a8e492b5fe06a026c079b46205ac7c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8868e68f2bd093c999b2ac873d2e920e

SHA1
bc0e27f6daa038d4ae82abe2eef8ba14181452b5

SHA256
52a8e15a2b880577aa123112255f8a096ec94375af9ef019a52142c8fa1c51f7

SHA512
eeb2f20ce80e860c52ac90dc966b2fa1c9deb09a7a3afee13f1818155363aa83249587ae65e05d70cb2cdd19353d3c1e16330d8448fa6fbbcac73bc7ed5c3ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15dbe51ad58d39077aab9844781c2c0d

SHA1
1b3631fcc736aa9763c860ede665d90c7e7b028f

SHA256
846f72c757cab383c2c34cb2cef59939b09968073f33751e1944cf8288b9c830

SHA512
baf7a23c06559fa574e2d65bde0a0b9fbf85adebc6b935a199d323dab90a5430491e964c0c7a2055d6bbb43365925378f15735ef8d06331aad787e83e4ad2b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92a552546b4a6ed3d1b2a1846879104a

SHA1
5abfa7634ce269b4e58c0e03cdad23a40972b15a

SHA256
f3211df6525af6069364fb853dde21372d806dbfdf9524111b587ef5cbb55e57

SHA512
fda802bedd9c84b21102901619e8ec81457ee0e631a57e27fc9508e8e99b2da2c3c0f842c6a386d8920db74825bf68485122ba95ecef41eaaf1da0efd84a5b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef3a89cb942f98fb8a8966777e08759

SHA1
c742e69e415b89a929c6734edda79d7f9a8112d9

SHA256
e8c753afd8768e182bae8215fcbcb10163b17655feff690fe165a425110ae532

SHA512
8b627da8ba2de8fe0dfc2c71d84bf706277bfd75dd6ee8dbf220ffdfe7d1d49bd383f644cd9b98e9e6f3ae411f6e561da79a03d881be9c61f9cf902f98cc3643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b22605bad1e502da346771c55f6fea3a

SHA1
465e732611e718a6866ab4ae02391808e553f5fb

SHA256
4209c289d8a9f53f3eb208e1f5184a289ebff63a51bac87adef2deef7cf4df3c

SHA512
1debf3a5ee589583ee457f69006c8abf42aff690a8726305b2db1b60cf88186b69b233994da8649528e7cfeedc0ddea389d14f01280a9c0a4beb5bbb61d76dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c500fe9b2342b14767878fe3bc56e20

SHA1
7d572793522fc4d5d84bc322c04a630e2808b53f

SHA256
088f3cbb42dfb6da8d2c3aefae825e4097ebb1c6b04863a253d6add49af471dd

SHA512
a4d1d46f50e862787fd5ae31633250de176982c4c4364d9219143cae3135f8b6f917ac6e5f03a29d7c30cf29d46af63021e74a1e14f84adbd6764ca9d3f8928a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c266d05df47c01bcc8dc61e64ed7b65d

SHA1
a67bb2462f7f487aae69e2f39768e7e2819a43c4

SHA256
5ddb14abd46b0cfe9a17be0fcdd0f288a2ad1efe41f234c2c7e26899598af47b

SHA512
6cb508b8a2b9006bb0453422960cc18b42a08f50efaa3babf7c222fb09b39a50aaac481904a0ec3e0fff132c625a734f96c3f0347f4ec1ee342b76263e7d5acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40b7b064302c7a7157002a72def1fc83

SHA1
a0fa0fd71841ec6daaae99f0ede17b06182e1687

SHA256
458fa7382ee733ff431ef8428bec3e3f40ceb267502afb98a9496073679d5192

SHA512
42912b14a19344efe9086ba232ac9037640516992a797eda8bd9345692c8e631f5e79731d46ba9b9b556212b9862c6bfafab2e555e4f0c423c4edf6f5ae07bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40481c2ce6299a072dff2c48bbcaf0eb

SHA1
bc35f8a5f5b23915bc9d13877254353c9ff207a0

SHA256
fdf6bbda90ae790c45c59f6f68f9670da6e7adef6b7b79a5d96a47ca127dbc93

SHA512
899fc983a64b4859d96c97263b277b4d20deaabdf2ba23fd0d4bd75bf796599eb645cbb65b87af0afe347b1b966eb1a42e27a90875942903e7352fcac9bc0c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a29e5a4333c470bb16bd6685bb05ed

SHA1
936df3a1be1f9b244576fa91bda8641deb42df93

SHA256
bf3f85c9bd70893875c5c26725b73095540088149a16978b6ba5477e076cf23f

SHA512
4b1cb9ee9168adc031b98740a6285f0ba88346ca139a632d5e9726a709fcd895adda9118897a88ad50dda047ace561f951881bf24f2e1ec5e9754f4ea55fb340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844e67322502004b9072132041f6017f

SHA1
e91d8f0f396059b708322aa7668c5368fad2ea24

SHA256
ee3a13e92971ce0bef5ce2315a2f596f672f624b5e20da099a842f684b25bdc3

SHA512
da04d264b588e14b2b171084354b8e54f8b2e3b7797fea6090e4eec93a5647ed99d466171e54a9e98dc0cc37d8070818a172db0e787a4f427359c75bdad4cf2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
840aa5b652584673d9a2065c8bab82bb

SHA1
6f0ebc6dd797892a058efa5fa432842dba61d0c7

SHA256
4a9afee0457bcdc13b3633173b32c125c368d3d2a2be7210b51dbda91f9e3ecf

SHA512
d1e64d6070c8d8aa5d354069ebb202477f4dafaacfb6d90f4d339f12e405b5539aea737a9127c123595e3aa80780dcc1a82949a608eac1cb9542f0a9ff7545e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5395bb9c4a25e7d25b272d1b41514542

SHA1
45e916d9278504849f67b69c95c25573e3e8a946

SHA256
60a7ee354e38b694352e5cdf96bf23e6c779590d29024abe8521f3e0ee1003dc

SHA512
3b6f7d217695cc9d549f5c318e3668df10ae17bada6587caa7e33bf10607ba8819116aa31a773846e0ece140d9a648b7dbc35a836a9c46dfb62455d93f02e7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1864.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1993.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit