9f2fc74b6328ff979dbbd9d924c356d70f65d6c693fe48e724fa262f4ff41052

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1499c4010bde86f9105ff93465a9dbce_JaffaCakes118.html
Size

24KB
MD5

1499c4010bde86f9105ff93465a9dbce
SHA1

366dbd928ce3d6617ec7f7a43a6a7312620a7cc2
SHA256

9f2fc74b6328ff979dbbd9d924c356d70f65d6c693fe48e724fa262f4ff41052
SHA512

717567c3c47ecb1bfcc0f60301790f13681cde3a390131b38012c16f3225c01780aaa657b931f12613dc69448628d885486d85999e57b4960133804bc2495b2c
SSDEEP

384:0XKT1MYXvEGxa2mXuFSQd4aX+B/sx2M1Pn2v3iSN7jxhrPOpCnp1CV+tH8l1SwAX:0Xe6YXXqXmvXqE8quT/vaccf/w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421020831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A9C9D41-0A5F-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d3000f6c9eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000be5d92b967f3513c6f2c21a9640043cb8ca7d17d17701c88893f9ad46b06a0b000000000e8000000002000020000000ee37d1f13923ee1b309213d702f9db85f25fe7d871ef6904b633450c5902b2f09000000022206c10c9600a3dd6a8ee9a4ce68dba1ea671de1ca0c44fc50ae882c7887bf11cffc4778229eefe89c977f54cdbd7359ee65b08fe6a1f79df9032ced725eb4d4bb5cd0325f42e49a5b191e6845e8820b32cfe79f3e40334707d5daa1609c354d1456088ccce30656cd24c3b7f7af661d26a8abee83d8f00b32522fb9ee6ef2ebb5a6b6cb77562584da27d7126c2788b40000000036547a0d8448f2acfeb284c58c8af1c9130e64a57d44153bdb2009efe6fefd5dbebe42019df90d330a68dd47642ee2cd139ae6b6d4cf83359a1fcaa78c2b1d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000060a7c32ae52caee0c40d0385cb41e9ecba05c20bc263bd4a348fd79ec3c0bbe2000000000e8000000002000020000000ab2cc99af06316c84efb0c0a8b9ce6fcb0734ec3648e4b30eb07553121a087c220000000d0ce8d60bf68e1fe074c1427147b4e7938c374ffca13c772f929046a8381f0b140000000ada26d01d984da70e72035908dc370393c1fbb8bef4957bf98441d468686cff3e9bd405dfd59006dd11739f6cff087df6122f4233b44ad77173375151db979dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28
PID 2240 wrote to memory of 2036	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1499c4010bde86f9105ff93465a9dbce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a44069e63c4f456014dbcf7f835f9bb

SHA1
a5b5b7b0412283c076a59f4793c62737de1888a8

SHA256
c7ec25b9c6dac8c79170a462adb0900e70f2bfedf5abeb1d563cc70bad0562cb

SHA512
8d600d2ad7f0c27e09d15f42c92774ed1581a4d3fa576cda90eef405ff8fb51facc23549f27028ddba02e65fcd4769f6e18b8a6078ac8142fb20f0789288e80c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab0b109c702a72cec6935fe5bfda12dd

SHA1
5134b767153b6923026247ecdb6f3d47f3f30fce

SHA256
17660cd0cc44e2dd0b96c43ed3a38058d04da3336194e64a8f94861a9fa14cf9

SHA512
7e1f388d859d2bc32d857ed58ed0e867560696d29d6a2cf6c509f566c83177698ab952b2226360b653449a99d30d9b728c6d7da085a31c05bd9240491152823a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ae686430de94dc041dbd75fd7b6a75

SHA1
427262bc5a1ea440a946df4f03bfe9e0170da97e

SHA256
f4df56580a04868bc518f7a5af8b14352d21ff05cf280070eb4fb75a4ede9829

SHA512
9edaf70c46809679263fffca67f9199ce8424c8eea663edec4321bcff90a7d3972233d6ce985e2198b0c367842c6e430c1a276fd10b471421b2c405c73340f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
599f88fe7aba7f20cc017e285ca5e625

SHA1
46f27befc8e4acf5ffcfc045e88436138ce2c4f7

SHA256
e2554fe046e6fd2ee490e4201edb443bcee04756f97729ab4030337a392b3f2c

SHA512
8fd782406f5d352b8c4977646bdb9a7709e9b7a20e551010fa9359e9c91e8348d984eddd2828be05ccd879336093ddba621a24a70cabac2c45363329629d9116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d428fcf7b2480b62522870b7b2cfcc6f

SHA1
1ffb872ce463835554a11b7b1dc8340992a021ab

SHA256
416645400520b99676e68dd5fcedcf495a762a70f00a80dcc74dadc66a4181df

SHA512
34c93386dd9a1b5c616217020b3847f16e04af6e87014e0d1be0ccb5cc0438e2a2c88ac2523761518a11c01879fab0fa5c12b167f48b023a17ae29ef842c9353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a8d3d792330cbbd8aa9708e16c4a7ac

SHA1
eb9b2fb4f4ed06bb08415a1a9dca0d0a865f985b

SHA256
edd89187df00344a502886ed797d014a9ce9dff5e2f7f6a2e44022547d8b1cd0

SHA512
9b24ea04a709f7b9adb14ff004386b78341411937bbd9b87d112580a8db4144b667c49528f7e4d8b7d45235aa1d95f097b4257593834aa34f9df83f78601e11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5f30b5755a0cf423fb7b05b32d42bf

SHA1
1410c6ebb67d8b663f8ffbbf6c9bae653878f3e2

SHA256
d410d56eb963ff51d4b63def9047acd9a18c5e028f32dcaf739e3890fd6a64c8

SHA512
1d90d36fd325c7aca736d68fc16c16948a8271d60e2924c1661b00bce11008cbae0639b046ac1415c78a395426181ce3b5612e6962512f6bb1bdebac8a30dfc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca9493719ade8d529c85d2c61f5d0659

SHA1
37bdac6d44069ae6bac2cb3ce4ce1a9acc2406dc

SHA256
9b818bedf9daaf1fe6a7aed312d1941afc9403a3d9d79fcd3bad4e0544e0991e

SHA512
b3886b356c3045d17b22666c7d364c9c0f93c3636dea5959e78fc1107be27cad121fa0e6c646495e8893d75920ba017bafff75d891e97aa138f55879ab3058db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd785cd559e8dd1fb6e4f68d8bd3dd2

SHA1
5dbf8ace4a24bd2c8c74d2567f33fbebb2b70380

SHA256
8f4c0cc1dc6499d1fae01eaeb9c4fdd4821ac2edcb3c09604bcd77b0f1b7b28f

SHA512
22746fc3a1d440546ef3b78e3d8e22dbd8b311f4a257784984109b2b14e4733e8d5427b74e86b818c2cbff3b145a2cee0cff32d47859e403bda29b477255ad67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb747944f2b7fe4261383ece1572c76

SHA1
4dc70e92e72162e315de6027ec17727e4711991a

SHA256
30f1cd26163600a40dbf6078438f4d630f1a1a0037c6bb1513ad80fdf37d52ef

SHA512
cfd2abfffec4ebaee8ca1a71b2fc05b210ac28b9bd656058e0c4a3c48db6563ab41f1b50e0d6d2da50fd659c9bfb6c0636e0bb60f487015b27252ed381e7eec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c7f4bc05137ff2e328402cdcbfaa667

SHA1
270de1bc68f744a159efaa7ad92cbe825e0219e9

SHA256
4bca2c41375efe1886b0e992f5a021f86991c15b7db44c5ef867241a435b5f84

SHA512
8c75b170644e0fa9c008e5c1902fb4b6fa3b58fade623b34bd08763b3197b50bebef133371eb5e21e9422d7f79dfc32c46f81aa152444777259050a94dd0ba76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e313b04a914ac8533d58c6ffc0dd3a4

SHA1
fa83a31f34b00ebe29e6e637a4bf7a3505fa7a6c

SHA256
8c03418ed6c855fb7a204c7ef2b3009c003df89341588cab325d8d4892433764

SHA512
9dc090f5e4a36d6a07d061d49617a5bca83c66eec94304917407e3683ec6d660cde409bf42de8cdf3e4313b2e395fb259b38c73152f5dde5905d20f8f608eb0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
902f8d0a27f3738f1f2360b2d3f3e1cf

SHA1
7e1436d959feda8d33c4fbb9ccf39ddab16f4598

SHA256
ece9510861e195887e80f03ae357a86597b5441e9a94fa9996520b7b7f1b327b

SHA512
8d6bc9cb0ebb2e82a647e57d5dff302d6937989c15f4991c3b7c2aa66e29693f1efe65b98cf403c4fac0933339718379288d50737de9384992aa9bdb5da0aa9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d75c30232177221156512a0938032c24

SHA1
c6e1a5a884706041688b2e38efd477dba137b4e4

SHA256
a4c1ede164cb7bca053fdb4f9e0c61cba330cb16abfef5cde46294b1dfd68e42

SHA512
12df2d14b5367ce1c650eb5de5895da429d67f9e0357de53acf1bc1b051777440515c42db071ff3972aa3954826c061f0a3cd3f9733ecce650430e47a13524cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9514b0e861e8ae4688f2e4abf770f1d

SHA1
28d0e34bb744819386fa7dfd2b9f36b02d0668c1

SHA256
9917a1045ba99e4a23242f9edf5cbeeef8543208542d9da2b5a71b057883b152

SHA512
a1e6ae4746cab1cb8784bb8579592d93cb807b750bbf05c7f93728e751069c18c7fc152aaccdb70650ac6fc14d318736372946010f1c7485b9de20e3fd3b2b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FBA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34D0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit