854abdee7b1c2732659db359fc4ade7cb8e8512fbf173e1b2675adc06962336f

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c966a119e208b40875807a84697fb28_JaffaCakes118.html
Size

72KB
MD5

0c966a119e208b40875807a84697fb28
SHA1

08d162a2757f683d920a85b91930de12504a48e5
SHA256

854abdee7b1c2732659db359fc4ade7cb8e8512fbf173e1b2675adc06962336f
SHA512

11634e1acde192741776c37f44bb60e13623b94d4435f0d21b6a7c8e11eb28026959b9925165e2e34651a7a9e451edf1a35b15ef1d67fd97845dbf07c90004e7
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6se6tKlyHoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:J3stTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005738ef75a86ac4df0108515206bffb635f4570d793ac3c3e3e7081e067e9357b000000000e80000000020000200000008eedaa286790877274bf27fe80af1349350a5901eb91a47855069045ccc2444690000000dbcf34c9915e8e72265d16399b2e3f49959efbc2bb9786e86e2e8b891b07db10cf767d6f64274c24950c964dac2726f616e6f7a95e03766483c0751c4be869f43c52f37d99cbde07d4385b7a0b3d7233889982f1e11a1a974f250ae2f8be5c3f6534068495a74672965b5a790bf280f77325be8a5be6ffb9ecd4318f36bcb589420333f940d472e80c556f250c7a9bb340000000ff0135b346a4fda5336a570509ef3b918572603e3f3dd53d23875de75cff0dc6b567e6ec3a84b20642180c9db1b74709f8a1ad5b03ebe9a23256ca8dbfdaad7a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420751704"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0C4FF61-07EC-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b90876c77c5646057d2cf37b01641f02888d9b7313688ee82cfd03b1bb498c1b000000000e80000000020000200000007281ce6b233f547da1e71821aa766a2ffdfcd60b3ae1e010a35746d5010377ad20000000b6651cc03d183db9a681808faaea121d654848d4b1f1ff86f5461300091f61bb40000000c54c176e6da2a93d41ec08786267737379ada08232b15f46a65ea755ad94ba4e5a33f48d7911af67d80df2ec49d9cc04c062616dec16c878387cdf3a89d4de44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a69f75f99bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28
PID 1984 wrote to memory of 1884	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c966a119e208b40875807a84697fb28_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8262d77c0d61b142c00c0982831ea4

SHA1
bc4513161caf80e19363850fea38973648722fe1

SHA256
aaf6e72f8e026e487fff32be85c0894651751a271858c985d1dd5eb3bf8c8700

SHA512
4d07bbaff6cf1e633322fb366d1c47e0648afc41066a981c302b450133bc1ee2109a203ee0ee250127d50d70b20341fc8060a39afd2c8151d06fad9c71ecd1a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30aa7b6d21744762e4859bd2f4a6e4a1

SHA1
aaea2bfc660a06a87dce7b72e93a48cf1c7f46b8

SHA256
ce445b81c2b1ea4270dd7be281f0ea227731fc3beb883a1556a207c845d965aa

SHA512
be7890ea76439c5018b7b91cfa38d50bf5e6a9ea600cf8e1e780e79683d88b88f8f1bd21526b37e8e0756ee45b21e8d0c6188812ebea19646323d2df7c58f791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e85436c0122c6d657944e6c77fb71f76

SHA1
b979b478a29a9a0a02348838ba3baa85bbaab33e

SHA256
9e9087e0e20802cbab89f9742faac16ff91297b6b9b639960cde3ff80cdbc467

SHA512
2f1da5a118bd6fd863a356d122e9a2385a7e70b3bcc19597a377ee26ad0bd974f9db4e1507a14ee3117e6bc513da1186ec3f91453aa5669586a8f6258cb3fd4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c91271d67dc5eef5191e10887c5b0ab9

SHA1
45545645f4ef2014a19a3602add72ec7f723460a

SHA256
20787bdc7d2131c6d315e1a0a3c127e978b390ac1720f50e7a9654381d32f025

SHA512
d1057e54deb07220fd3f17b3a77a6302a96680c9f982c68069b36b0155dd539d6d0e14dbc92689ce339da42e9350035ae25f9180887715cf38db575903932fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a834ea994ce4bca07ed4a6b774f263f

SHA1
acdd99a1f5fba76cff5f480ddaec0eb3d8e931e6

SHA256
d168d48608505669d8ed7046da787f4566c1f3120a2c701fcf018d36e3b7c182

SHA512
27bccec23e96c612ce7c8b8421654bafa0d9adda50af746b95244fc0e20b261f977c6c426b6f31be30d556b501982c7c70f6bac9fd3884cf7cdaf08c2d9dc38e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2aff3dd05394f1071b02efb897851a6

SHA1
a9d51e481f187035447b91a0ae1e967fce8c4f5f

SHA256
540dea9b8cd7f6c5def70ecb3019cd48b31a1deb5a93fa700bc98c0234985f52

SHA512
fe6d857cf3dbc8a6189ecdfc2c92677f531fcffbc1baf011c568c491612ad7ba18c18e47f970d02062b9fcc7fcf91b3d227ac5fb36c97e556151c75e091c30d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e09eb733ea6091c4757a4d209b09ec35

SHA1
39c7e8675a25b050f256a8cc7f12090b1725ec22

SHA256
2af22ccb5b6d8da19e942cdda34f669e34c951c5317da0b869b4e98afb351d0b

SHA512
f72c118cfb7fe29859b6c125c6c64da270ca6f14c28867e488d3e47bec5050ac4358e968001964c493087a013edde9794f7f5c76f1dcc3cf6e7b46634bad9b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015ee333bd495ff62467d9dffd7e7385

SHA1
792ca95a06e6e014736378a8bbd23de5b3ef3eea

SHA256
a36ec47e2cded6200c5ebb75025f7b8f0a921ec79ae6c8f3645becb180c2c776

SHA512
d65e8396bf0d3099375dd80263620a06d7958ceb34170d6e09157311270e008fcaaf5e91dabf77af3e4a6918d28deef70734edff0de7761e20079b23869fd4ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3607a0577735a5a257b5434c4c3cc68e

SHA1
090ffb1a58346aa89a0fadb46c8b68c47bb2475f

SHA256
358f25b540e05b97cb4ac231faaed588567c07553390f0d383b9d700f0d818b7

SHA512
0d4dc26a1b208c57711573b93fa3d4ef795ba15db8e54ce366ddcd27f586f46423e0ed6b63b3f66059dd354d9e27d4fb36445235cb3f7ea88afa998660a344b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20b767291ee8e8edae9e421cc42abf82

SHA1
6cdcf6bf1131deae0f52d0ce8d66636257ae650b

SHA256
64f49b62d4111dc5775ef7eff4098077471fe05f53c3f88602d23c3c02294fe4

SHA512
bb0b37d62816848aab12d654d21b79a0f60ab9a2d0d9049b3a3ac6284d120c422c3305ae1bd29da2bf9127f1512c6606b83e63bdb6c68d9bd2b61c4e0cc33d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a8ceaecf95796e14d0008a7ab829b85

SHA1
7dc9304e64300e94045c7ddde9ac97f0cf1e5d80

SHA256
ada16a11aaa0addf5420bee96ea4145ae261859e0db1dd8cbaf6f9a73ceb82a8

SHA512
bfb69b81f919b2e118d34ef6f33250a0a504d0bd1f9e3d576dc08ce570cb737e98d6979140ab8b24f2cad15506176d2f12eafb9da3440156d1bd1a5299b12562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
045aabb0dc7409965513fcc012e2f89f

SHA1
547e009bd1317056b85600f751858c6afa689465

SHA256
c90a5e3bad60621ec3cf2e841f5fef917645025e4fe79bd9c959795256598946

SHA512
47dadebdf189b326a483d4791149b15e5783563e43b24b1912d7983420c54cda1d5493cea9be308daa04281720cc768628d0d94455223e9306473cb3818d601d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4964fe69d12285a5785385917021d6a

SHA1
f6c0a900c8d3fa73593122a024f1b2a801f36621

SHA256
920ca3b520feeb6d4688fafc895924d5c7e70bdc6236bd3e3b2197a881f79656

SHA512
7f88458b42cf0a5fc5096235e588351826be479ee3d1c643d87db5a2b54e0b5803dcf7e40b7db55748d642bda6dfe4c09c3a290449f0b086264791078a7b71b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8dc7dabd7bbb9ba9f6c1f0c1792cb1a

SHA1
7c6ad521ee2d67a8f97b75e4da8dafa426e60d8d

SHA256
36f414e1636b1acfbd2ff690a0ce52f756ee00f5a709ba84f5dd0b2bb99131ac

SHA512
461e50ab62f3f90a0f6d92832efdb8bcb802c3edd2b9556794d3c155df1b146d97b8ac230c0241ee6a0d1772ee9c8c48c17004bd07494c0052b6c4e759e9800e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da474055c7902387f42f4955fe973895

SHA1
bec7a1b67978b838e49238d44816c19a25cc5f39

SHA256
88a0f65b7c54490f569e5f94bf23a1275ab7cb046218112a4fe7500f314e10c8

SHA512
f97c072b7d9496b09856b43b1a5b01647358c8d7b31851d00265ad75f85636a4ce3e7e9507acb8ea0b87f2a55c4792418eb9b3bf58f46bf73f98cb379b0c9376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
514e6260ae9791daf9ead4d15172da0b

SHA1
ab726c46134d48edb9dd1cd8d9907ba191bff355

SHA256
2dd034db445c4999b6b2e7f62e2d1d4e47ab2fdaf38a850f7a8ce57240b53394

SHA512
e5c0c610971899c1b51000f096746b0b0a37b041cf04cac10b99bfe4327e657c074614e14a124d30a146636ca2fd308ade1796e0f8d03cb239e12ff807750b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D2B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E0D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit