995f369c4cf0bcf7566cfc2c5e0196467b5ce429781a1e20c72e8e967f3e6820

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ea712c16cbfda1372b9f26e365bdff9_JaffaCakes118.html
Size

213KB
MD5

0ea712c16cbfda1372b9f26e365bdff9
SHA1

add600285ea31e247d1fac2c0127f548105c69c7
SHA256

995f369c4cf0bcf7566cfc2c5e0196467b5ce429781a1e20c72e8e967f3e6820
SHA512

12c732e3934e82595f5cb74855b1f60bcdd8f46fde91ca8aacde17be1117b59e72b8ba97293960e9a7e1fb5be2a527f78a27395b9e71ee03eed5070e85b5a29b
SSDEEP

3072:SIVMLWJivMQ2yfkMY+BES09JXAnyrZalI+YQ:SILEhzsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420819011"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56DCF631-0889-11EF-888E-CA4C2FB69A12} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE
1968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28
PID 2004 wrote to memory of 1968	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ea712c16cbfda1372b9f26e365bdff9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
42cbbec35307160f037052f12aa10243

SHA1
5ab7a28eca13bc8740ab9de77160e0a6efbe284c

SHA256
a4a04bb64b06b38dc915d068f7d78fb945c3ffdfb78cdff18d75176da36cc80e

SHA512
9133dd3f5c8b55028efc1192e18e904b7dc2d3c762bf5a7bb90fb2a5ea6df8fbe8f21284fcb7e7c6c05c1d137f1f174f45a60aa52e84a5c2cf7e20b23ddee7c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
950fdc976b03f9fc566a72223ed2683a

SHA1
1386b49cca0813c533cc5fd98754078381b28620

SHA256
fb515f284169317a694af3b1306525a3d4f132ac242e1d6fdcb7db14c0b30b4e

SHA512
9b1f1f49cb1dc2fa215c3bba6ae091999d871fb2837ff7ce6f20c3fb40ad14f9b706716096f62ead88ba23e7391415052f9b393ab8b9144bf72c894911022da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
904c6edc886a78191f39efb187cec541

SHA1
90eae0c7e1415ed34dd8016d47ec721ab2d2c6d0

SHA256
c9c6a437943a9683810029528dcf99e1eb1e99ab5fda532fbb7768938ae72530

SHA512
06d16b5cb875495243654366c91a558fb17ac9d3f7f3ffae3bb9851a1781c588733400c64214ec9043d3b95a7bdf3e58e089d5466fc711bbb183938f89bb329e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6c24f976f7afdd8951d9244e59d1e8f0

SHA1
bf2fd56c7f619c1a53e99b5dea98c6b2a027b853

SHA256
e5b2c4e0df9028527106f12971e656074655d4d57f884d8968686aba76895904

SHA512
5189c6286590be212570a2d9338f8729f9220a83dba02f27c78cea45174c452dde3b0f6b87b78f6b809583644f47afc9cb371b3e30c4760b7a55d4dca7be329c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c9f8a08616fdd0ae447a88b92a61380

SHA1
a156352f8c216d20e54697b1a96dbf987950adcf

SHA256
e899bfa9523319518e24746fa0535e70c59c501ab600425e1d7d19cc8b5e91fd

SHA512
38c788531fd5c238897134c6ccb57e09f64529721ccb6e5f5f95e402851e75005e4e57b20f91b34c6210be6c87b274f96d86b3e4be17f5ae18d6c5611b3138c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4f8da9dd988169397fa06cc95c0eb993

SHA1
ea432790fe232d5f63933116f142536d0ca30a8f

SHA256
8c51da8bf887404991d2cf7ce459cce18573422a0cf1bc85b8abe0cccfd55ba8

SHA512
940affe7b29035c88f3ecce70398eac46adb9f30e89afd4fb9bc2e8da4bf0327c363dc91939656f74167bca95a504d753722d2f739699701ad7fda3ba5666ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1bd93f7fbc078ac9621bcc0a41a4afe1

SHA1
5e047eafc095b5733f4be9c667ffb780ce6acd8d

SHA256
4523f8f748b988daf2ba7f451d3d672a3499202ec1138d4f08562fd7e6ede76d

SHA512
486955fdf37b5d6e0b8cc6c0c3e2be5b5f407e6a402e5b360ea1607c617e64099f6067ef4cbef6f4d4f6e5eba9a8a51329550a4e38613eeba9c90e07c4d4a1d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a27e3d06291f75dc742cb0d2406624cb

SHA1
6ba10e2e2c0c97eb3a0c2316fd11320467a29b60

SHA256
e8f664cff4fd8f77639496eecf4ad0dd24c24d37a2e35ac2e3e57cf89b417352

SHA512
d2fd42277d9a42b0fd3bf97bfe069a682adf705be544458027317eed82b5d5b98da8fd269054209a487d6d8a9b944549a8637b3fc3a3d2003d7d62e5f923f59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1547d0ace2adb2add4c05eb11ef551af

SHA1
a28ff2edb64ced28cde2d36a406fda7d2aba896e

SHA256
0928303a118e6731fcd777ae802cfae66d26ff2555f82038c347781a37fc5dd0

SHA512
59828c3361a05156294fabd78e58aecc3d9569857400dfe165f969519a7f4ea0c906d5d00e6c3e4c6e89ddb09e0cb3f120483723a1f0045f9987084e367aeabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
abae850e37e131e9478c09fc91b99bc3

SHA1
ac3b146c7b4e2b50d822f14b603adb739ee04e68

SHA256
87c26ba8be2ef20abbb01a889f401da15a41c2883c3be3313a3b24a05b15890e

SHA512
058f262ba38128fe4e5e931fdce7fe2f9ea4c1101f0d4bac6540fc41bea06a17fff29851738884c370668dd210f1b19df33aac2d07597828b693617ee2f51ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
de2b02ab417f183962b30ba7dc02cb77

SHA1
866228c7f19847d0e6d92ea8e098fc5f69050e75

SHA256
16d6cbb29376533ee9297d33f891e9a385e49055569ddef2798d5d6f68b7cc89

SHA512
2e82c8e85334d9a9c5407f5c5f5a3ea8102ed6c28c5b04860913a93fd18ed9320351309d4459ef7f5bad66990bbe401e93b07344c3ae7b7c9c62f23dea87d928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
972acd45633552d9b76bd6893f3303a8

SHA1
fbb3a9851ef896222e30ffa9ff9a0cb0e0b1b777

SHA256
82cff6e33ea7c60ae80bf726ac20774910c8a60d5b949f3586b4c61acbecea06

SHA512
eb18b348a6083de96c1ead16be111bde76eac54ab846cbe4ea56a035e6d1c633323f376dffae4e1eaffde8b0be7383dd1b7db14a2d76c58325839eb8d5e051dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
15feaf415127b9fb7a4246943a8037e8

SHA1
2c3eb4c35c02aceeff04de203cee265123c0973c

SHA256
7017e316de7ee4b853b633bb80bb66d41c99207f6a3d18aacbb9f42a591ea9f8

SHA512
2a4cb75053becf0b4decd402affaab5ff67f8872590fe3de4d79dcbf1d243163edc0f9f7f0fb5dd752332fb9cf523ff00374fa1c51d077f487096053d168c245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16EF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit