6ef5d38b1c759faeefcaff9c41d09ad03f028f3e9d1df8ec495da88c717825cc

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e0314f2983519f27494d4f9d0dba135_JaffaCakes118.html
Size

70KB
MD5

0e0314f2983519f27494d4f9d0dba135
SHA1

7ac483c1ea9784752a16d6dd4a394af2fbe1dda4
SHA256

6ef5d38b1c759faeefcaff9c41d09ad03f028f3e9d1df8ec495da88c717825cc
SHA512

6d70100b86d6c0bf4e5f8ba717e851e68a44665b57b018b84d6a5049444b3162cfaf7fa10305da0e6a16ccd6ab12ca66417f34d073638f44bb9de8e8189c4056
SSDEEP

768:JiGgcMWR3sI2PDDnd0g6rlloBzBQoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFA:J4tTvNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420800863"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ed7549bc89dc3514240a738bfe40aa0d56d3b200977305eb4cac358aee9b74b5000000000e8000000002000020000000270719112927bdbf6a247fe2ab03921ff9b90daece45c09f975a2f19071c2ed020000000208c3a5949d808a0425952b0b064266cfd171097c038a317e473feda1e78308540000000ef4c05e3f4e550f95ef06c598cfed902d4cb770ccc63b2b45668a462e730976d28220407df9218ce6f0eea5e97c4ff9e7cafc820a5a30924b610f2f0df7442de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d391ea6b9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15042FF1-085F-11EF-A692-6A83D32C515E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d9b856ddd9103ce3234feff5b313a0315a00252b6ff98a670f5ccbe7c8ca56d0000000000e800000000200002000000093f8cf7d68d387de07b5775d9f71bb05fa46dc65fbe61e9fca832d1cad33bc3b90000000ea116b0620c226b9402cd5e9b172f3707e06d865b3a517b759bce7ce766a270a2bb1fbc5ba94ea4c7ae96c30403194a424313c113c48a56c310baec979091c44f9212be36e00b4d30620b0622c6c281c4bab2a488e0ef8a04ac2faa3024f9581a4d14bf15eacda9738d8d76b07f40d2f904c5092f55ed52dfd57effaf84cad4c689017c1d98a2b6421b489943ef1a1d4400000000b9e35e76c9191ac23f3714d60cf3fe689df43e0692036c788e7698d57c56c4c506aa56e5ee4916fbb5c53c064a1cabef240dbcda0c655dc41f548ec6bebada8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28
PID 3024 wrote to memory of 2560	3024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e0314f2983519f27494d4f9d0dba135_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9385d3febe3c08c74cf7b3e58fb76a3c

SHA1
0779c1d1682339c3dd3fc689eb2c5aea892480d0

SHA256
c642084d435f10d6a544912b81e7c4542e548744748788021290038bf24f0302

SHA512
36a1d4b55e75479df24375f7f863e4c9526414f6e92e657bba363dc637851fe4cfe5ff94cc5f85d6af80472f71a8413706f06e195f526f97649c5bb61502c04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb47282afe1f1fca2cb353ea56c7bf38

SHA1
7af26ce0959d8288755ffb7f75297866dfd61750

SHA256
eaf9b990c9009cc043ee101437e9b33ef48bf6c9eca6f2cd877292e15cc9f402

SHA512
76a1dfb4003104ef508c7396d9f2efeb202154083e1957a1d8750f3dfdce58e03b09a89f0a348b4839f65be853957deddeb42635c81c7bddcbfa5b3598fce01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cda1f953e05a86c6f4ad83ed242e57d

SHA1
c1e3c1db536882b1e0bc8ef1d16a4b8b5cbed239

SHA256
cc2b85e0eadca8d8249d9c901be3606f7c724ef8311d9fe3035bc333a65a7f46

SHA512
627594ec2f83a425a35bd0aeec17d5ee295f73645c0727c8b0f008d3563eaa1701a96592cd2e94b2d85e5ca67d9bcf42eb6dbb5f5195cb1cca8d1a575118b460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ac44350b098259da7f1b4a334a44a3

SHA1
8cfe892fc2dad3bce165e90780e80ab5d6b81326

SHA256
fa02dc13301b874c51204c3bd1245e3d07a5c1a60ab2dfb9492f8844a6522acd

SHA512
840c423d36b9850a4e256b7fde790243f8e3e2f0bdf975a23cfb1b95fd28585d6a3431ddd6ef19f5cf1f9ed323dd428487c64e637958afb3e768eac83f146e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f137974f568b6bed9de0c1712ca3283

SHA1
e8123abd9d24e0b1da8888898216a1bf1f342950

SHA256
a8dec9e50df534bb65496d5e55f60886921a66f889e0f8fe9cdb23781f80be7a

SHA512
724834fd7d80ad4e69e9b41e396d3ec86dc55130db3118cc8702d2d0d8d10f961c7b9e3298fa1b74f2d928ac2cb4b2f26f77a68f9ea6b5d6ba76e59ce2e61a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c71dd2e4928000d265bc61537cc8740

SHA1
97a9c62c7dbf43bb208bbd193d483863f533b8cb

SHA256
331beb7d29de23d4670c2a006e25374ff1ac04a0c659c52a8bdbc131212dd2ec

SHA512
4b7f806ceab357157466b629e8e08a7d75e9381bd88e684f441bd4a9e4c18085fde1a8d89e8ee9b0e65cc4191438274c715ea93def3c048579e671ab67addd0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
366a3b100430ecf1073ff20b52cbfeb6

SHA1
7c370195e89af19ad3d84bcc407ebbbb6aa1e252

SHA256
1c9a7a162833830177fff77e0d2452a9a3d055cc48e4a475ace4bf9642291237

SHA512
558841921666e7f9d26cf590bc35f6f6cc4a3222294b501f72ab68f068d7ed72c907f8f2205265a7266d96256318bec91f2984f4df04d88b176cf903156e036c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c7e0e1e00efec4c977479e004c410c1

SHA1
f74f890b97aed7b5b1d26dd6962eb71bbefc9f2b

SHA256
98751a8e993bc105ad7231dc31c5ec6b6b1462402fcda3bac0a9a1ab0032b03f

SHA512
44e0f4966e50eae87f7a9882d990f015476d24378c5b0ed40d848e4b4660881fa06633e15dc13b8e7a07c61c2593c78292c48c3000f5f5c4772c5f4d6de74cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc99a7b3c5d5bb9dd5d20e3427fde3c

SHA1
9b923f8d13cd3f90b5635a77e160d7ef61e36d59

SHA256
161272768a9cb5c7023d70dec912b1d8b8da4be927988b949fb06ad0b57c80c8

SHA512
3120c9418658e29ee4118e679d0b046b7c9a01eff91ac9a97255994520a85ade8d66230703f5096820747b6a21ed20cdaa3a43acbb2d1045c3ddbd1d3397043e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b96db2b5959140ab962504ffefc51ad

SHA1
8ceffbe5f136f1df21fc23f95fcc6bca9d0fea9e

SHA256
719d6e1e23b1eddaa9bfd795e22a11228aa5bf8746eabb2a6b396151729277a1

SHA512
75faf13905f3d46048a08be922fa7ff2a6da858b91000c47b28b0bdf046a5e1bf909cbe64f9b79ee8efd1fa47836ecbb6071e9313dc4ba6cab5a8e150fc5befd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bfeb8cc2d0fd601108c894bd769d202

SHA1
016bb77073956f575d3919867be930a6b67d3b93

SHA256
5929e5bbc2e2695d33aca91de3cce7192f7af4271b4c54c436d59ee7ce5ba046

SHA512
b9aafd16d1ccbd4756654a0b1be02bc7b955b46bd4982d40a4ce7095777e6e2d83041ba8597249894c3f5a8beddd4e4e8346342eaa195ee6df05e44dd1905d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e10e50cd59272b6b7e882e2362392640

SHA1
fec8a60787fb5c98d38d995591c6aa6e084798e1

SHA256
826fdfd6fa31d3c0db74afec500449ef534850b73ea465be1ba56ad4e08b26ae

SHA512
1a81ad36cc3346a8000b12169eab12d0f915104b2a92d345f10f4ef90860221455bd45b5f0a5588b35d2859f702eff36f30f9d1899ede448c75981fa7e81528e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
befb2d5e0d4b0bd107cbe696f0bb7577

SHA1
fd1660484eb9d330b2436b484f5e696701607b41

SHA256
ed5323435aa9b30e87849e222149e846544ecb5b8c8c7d30b25461a03a6a607a

SHA512
a0d79cf5db1923d7c1f882b98ecafc1c37268633933eda177e075abd1570f0fd90ccb356ab6d57710b87d7af1d9f3cf33d8545fcfbaf93ccd35de4c6bab0f805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4278575ca5b63cf8b7af5852beca23

SHA1
19e23c941c6a928e84124673c088bb04e24dd060

SHA256
f332d198b511d22bce1e0632ce36b2bf137f3236c0cb050a3b888da71e2ad752

SHA512
38fffb93e057a9f6d1b5721388240dca8766eb70677c48cb9e0722bbd2facf143fc32684afeb1c67e1e38b61b6825659bc3c450911fa58a074c69fa2d08cc591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08275638d0f0fdb6189bbd58fc0291e5

SHA1
f2ba5c0d69e2ab0648b2f2f5cbd833ee17574e40

SHA256
6f0cd6d1c5172b13df599274b819cf1bbf8c4186f993fb1ff09237fbd625fa27

SHA512
5661ab55aac3775495a702147fd4f67248427d7f58d901116dd3342888ac78f30a1639d791db98f9f2b740d2b15753f204c2f3a98b39c368cb8c88fc861ae66f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8440.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar858F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit