4ddae0bb76583229be371e9b6416ba9831d958dc95c94253194afb46170f3607

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e94a927275147ca639859a630e4dc69_JaffaCakes118.html
Size

142KB
MD5

0e94a927275147ca639859a630e4dc69
SHA1

a13918832e1c6938ab24375a2f2376a785b671d4
SHA256

4ddae0bb76583229be371e9b6416ba9831d958dc95c94253194afb46170f3607
SHA512

4928c7663d1d997047cbaa41503b928037953b984d0c0bc6e72d48f24d4391afa3f144cac2607e10536fef182cfd2f87ca94b64ff1213d731868ea356d2a79b0
SSDEEP

1536:SePXxgtUFSXx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:S5tlx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{834B0DB1-0884-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420816939"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e94a927275147ca639859a630e4dc69_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39ccf94efe9ecd6c47255b187fafa176

SHA1
7a5407505dd32190059f5222c3e282230a47fd4b

SHA256
a4342fd0e393370a5cb6808a4aaa5aa2631a58358c96f8b234117164e3d24232

SHA512
49c5a29e58d6c79e5d0b34be07203bce47cb253d39464a39ad494e703789373af3f785cd239fa77eba9511c37396347e190ec2d78d428858f29566c6f4298b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd0d68975fd5abd3400f6d7efd1fa4b

SHA1
4e41312fb341954a7c07244d26924bebbecbd5da

SHA256
06c887847a7d03c8e6e6118a9e0908516c1ec05f4a031bd450670896035ebee8

SHA512
db4c9e1208ab218bf2f02f69b5055e2018bf506e8d218f27a45c36dddd8eedbbb9699e8ecc3b682f391914ab74a268b50d2de2250d3ee746bfb93310fd180b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee04cb865d3ab12ae4af89df4acb386

SHA1
c00ea3929d65ab119df9b336a393eb2afb51c72a

SHA256
b807e6bf2b898f5df4135c34e36c8979469e4e5d8574d081a198fd7daff64177

SHA512
56b4decccb49e28278c6458e5c018a7c8c850c6cc309d2ebf3342fe6a6804112f75b66fccdc0870c6490bc69522649119c0bdbd24192b54ca24d09b69aebfc69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38dc8244bd8dac18b1345156007f525

SHA1
c27bdac6b3bf8445be3b318deef9de0a970ca82e

SHA256
7e6edb7d3bf45d29569ad69e485ff75e2689091fc7520c9a700c7e2f9d1e1354

SHA512
4e099174c7c6297744499989aaec5364758f190bdde6be765660346a1172419c27445d425c7483d7b2a6741e86ffdf45b9dc4c86690b2c1a0d049f05d22e284f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da6745c3854d7dfe18b2f809803827eb

SHA1
48ae3be3f372e302fe311ed75b3c4c8116cb3040

SHA256
25586ecd60c0ce9866501626588c14a28f925fba5220cd7da635fb4d0100d8d9

SHA512
c55401d0be20a3cd658448a18ef99ec3b6354a6eee2b07e1fad61ae6e9466aa18688cd8e2963cf5503a4d0ed0be5ccd42e04b575b28439bc93ab631278316834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe600bc84033d4243044f7dcfc5b7eba

SHA1
c8acb03fdcde3b4f4ccd20ed91dc51f6fb177d67

SHA256
7dc52b3d3e5e4fb30f45bd9ba7f289298a1ae9f250475c9d3e183b0050fb2ca3

SHA512
032d0b949b7f87a4fc98b12ac6fc38cb245515be08f8769c9878e7f74dc62d88c85e4f7aab06d8ffbb16f3df34134fdeedc3041c1248ed8ef35ad12b30f8dac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046a292466b07ca7c02d0709a75f9f68

SHA1
2dac157866fa458f81c620991451512546fe434a

SHA256
afb159d48a717af770fa94712635c73d0d129417a63e7cca7847db9bd4dc0200

SHA512
590da39375a4233e8bdeb4e65855ed9f2cd58dd2fad553b6b47e691bf818458d5a3809952b729051618303031df9a737ee7e45286225d358bec676c33f7b720a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddd1162a7eab37d8309e340d6b9228c5

SHA1
39083fad0010c7f838460fe58b6452d51565df7a

SHA256
5ed717afa5119d3a952bf6010673a5e516c8b666344c54a7003c55073731f3d2

SHA512
f88cc404456211cd63e7ddeb3034495ac4665bce8390b34e46257175df666f05341cddfb0b11944055c97b3bcc571152449193f5f9984f4b6adc0e4f3b382161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b955abcb94dcd7b59a5d01b1d3adc3ed

SHA1
48cff72a51736a1d54acce7eb225cc1c25002124

SHA256
84eed5c4ba7a56e6cb7112a8668bcf32d1e70e70a7078817f43db2e710db11b1

SHA512
99085bfda71d009a7452bcd680e444ad1fe678e7aa2bf5375e4c553212ed8fc7d1cea35deb2dfb4d8b117ebf964f9dde4e211f9f88901b50163ac0c47965cb78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0791a3eb3aa64ba0778880b76478ce7

SHA1
d8f0eb72dbd1bd4792c9fa395308cce53d8439a4

SHA256
645c9f5f01cc157293bb959db3728f38a6e284846ee1b2bcaabcf1ab70ea62c4

SHA512
853fd901c73a19155c7aae7405e002677a83945d0af2857069a3bdd9600159516a5b2e17cdfb2d6bfc98d01a594512bb205492bde281b65bddb61f0975f9b7d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5359b7e9afc75b947845ed5dda342f9c

SHA1
45706cdf9bb3efeac4aeec2d417327b4b1773568

SHA256
81ce04ae991aa7c69003695bf9f47074a91132755392119b599af10e33a1b835

SHA512
66eebb981502bb2fb67fd7a25765b4ba58f510c9effb49882baff52ab601070ff5fb7b42136d295de6d5957118abe961b705afcea26ca8806fcae10316e003d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23cc7051f910a8da25132f347ce3f8cc

SHA1
dd96aaa929165a00cc621354b5a3e184eeafd8a9

SHA256
b5662f8636e3803916f1388d9c47ea2d618ec7c77663e86724500fa0b039ff72

SHA512
92d8ab63e1ae808acfc6839d6d35cefd176409aea2f148ffadf01ca06fadfc84181471941e73d47835e08bcfab248e9998e106266c6c21b517f4a307009b622e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25168dffc950874e08abbc35cb5c608f

SHA1
d698f0febb34467d6225014f6fe0ff17ec1415b4

SHA256
0c468508b9c067cd1414dfe86a955fb2aa0bd635f00c33263e582bc1ad0b5050

SHA512
acc981621f16458a77bb2c6a54a4ec0b3ba4a0886ff07f07cdbddac0b3c86b8a5edf6d753ca959d1726e8c257e9858ea678b448663021fc53fd9a4173c962923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcead5b9fee886faf5c897e25746b3b9

SHA1
27a8260e7eca5749302f533acea3beeec1bee998

SHA256
2bc1396dc081e5550663ba6f245a9c3e474c4ee8b640975b63d3e8d65ec40f68

SHA512
0cac496c8b90a2000dc9c8dbe5ff2e2d35d922fc15d1f6ad01e39c87673a9d7e1f66164aa1edc8915adb7e9bd4c62fe75f9d5222d0b26952eb460c72f7f72720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8da1c3909347339c07ab849e41b81e7c

SHA1
af7247c2f5be80466a35dc4b0fe9ca86c84f810a

SHA256
908689eb86bde49894c1612f77cb1841f117098014a6910dc81be0b4c3bbf574

SHA512
b92e23c4822e051211bbd5265f0264281fa5c0be4e0905f1abe2de081bb43510237156bea9cb73507d914fc09c491bfb37cbdc3ee3fd7f90829ae99aaa2116ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c64a5f0c4aeef9f38d9996d423fb9dd

SHA1
7c6b6e70a3e109cc1ab8343a2368c4846878b463

SHA256
9412545d4a91d4a0c9c33027903f0cdaea8ead1abc777630fde47f923a6c5ef1

SHA512
86e6a68430d7603bc7751fe09e7ca26f450b4eeb6788616cb89d7f7b43416d3980435a81315ccf80bedffda6d6ea82ae1d4bcc2b34f939a7057b544aac330035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f5ce2c18b650f1611acc54bfa4cade

SHA1
f8df3adcb3c6f015d560d779b8c0ef856866908b

SHA256
57fe27f1e44b316d2af60a8c575931740aa31b5f0b95cf5448103e56ee75cbff

SHA512
16922c8d96847e277418bef98135888df44599badfc98dc04844808514512c72900a5a4fa012f5f4aa52c0eac21b775c840aee96fd20020f34340242b2769b7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a87580d1b3223120b342ce727c9c6f0

SHA1
00c40f970b81e96b4beb434bd5353c909974470c

SHA256
5ad5023e0d01967cccb18305b28c522bbbb730f45fc559622ca6e0abcfd86e92

SHA512
3068e36674a12e5a4910b75899d9418260119dc7e144520e3ac8c26a774956d55211e9ddb4c4c58bf40a86513a8e17630a056f81ccebd6c925083115cfd4373c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1903c8691d73647620c010c152fa60e4

SHA1
f492104f7f496d119fd624f03ac29e8877292b0a

SHA256
0019bfbf0d25c7ae93f1354bef1ec4274c8ed301a3a3ff7573bfc776874777e5

SHA512
8265f93dfdc4bce7aa2b79f77f3506237de50196024eb9b99120c821cf12fc487e3be8c69675c4e8afb9dca196bccffa515e48f7ea72439849b83f6280e21c01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DCF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F7B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit