87cd1521ec478f9617c2bca2e9c0736f318cc8fefad75983a8473bdffc1d3824

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14fd25854590583ed52c432d1bd0aad3_JaffaCakes118.html
Size

72KB
MD5

14fd25854590583ed52c432d1bd0aad3
SHA1

33d81e18defb3d84111a4baa347482960acc1650
SHA256

87cd1521ec478f9617c2bca2e9c0736f318cc8fefad75983a8473bdffc1d3824
SHA512

124754a42da8cf1e3c0c56efb095cdf780b84ce4506074032ae4c7403504032bf525f054cfd6a4d79fa1e2ef58deca887b0678a72173fda352ad50d383b377a7
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6s56a21boTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:J3vTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000027f64f467569a8ab0e8cc906d4dcdf5f5177a11ca75621fa9b3e1208a38e6020000000000e80000000020000200000009b40cc358795e79006f0bffe4a6f7d27284322dd237f8c7bfd6ba64ae0535e8f20000000d43ca46e1e07cb35fbc4bf4dbe86eb00926189739bd3ba1c992809d70acca9bc400000007f3919c1da493ee03ca916a09477e26177e5ec3359c6fb195407138ff2107827d2580ac693eb73445262a0590cd1d2899690380744bd6e9eff445c9ad82507ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D190661-0A6F-11EF-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007ca06b7dc8139efde4fb838be437624d14f717b2d4abd5d7079ab55695b36d51000000000e800000000200002000000087598f474fa3b6d1955f666295efe3153c650c9f52afaf1aad8ec06d10a9443f90000000fda7db93ccb0a9f6bc83db0708e466450fff74e2ca248d4229ecee730787256231101909b10257353780bcb6189753b567ea93237c6b39609b791053ae4999747be28d7542a04b855a96c4805e2c35dcea7809c2e538630fdf96eeb1811d79f7d4b9b90e01f6388b4276f1f0dbde33b0716c4079f3d5749eb5156704b2db7ac0a84efdd4a0ddc5a064b5a7a4bc35920840000000358d78e67eededc1d0f3c2881d399f6e49e5d5fd798efc314bccabe8e1f175a4ae1cc049c514da916bd74d97b2e7547624e649da756cee6807150a1b8dbf7651	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421027730"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c5d1217c9eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28
PID 2208 wrote to memory of 2528	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14fd25854590583ed52c432d1bd0aad3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32601ccc076d292a92073ae8422e5c51

SHA1
1218d80d54e12a286383c6cd038f50468a75ad6a

SHA256
47291694d956203d9e8b97699bc78d324b6c08c6a8154a73633479ac411a176f

SHA512
790347e70c8dacdc5aca782b91edce0af17f6763311a49b665ba385d9d36e3b44e38c97ed57de11e022b61d237b9d85a866401d46ee58e5f0440ab9bbe37140f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e84d01c83682d0746518076bc656bb

SHA1
5c5c3777576a26c28df5be72f68432473df809b6

SHA256
63e4f6fbce74c0647e8a185b70843f94d98dfd2b1ae5ad935bdf9d116cd32570

SHA512
61948115ca4703a4ec8d7859e1b8935a2ea8267f505dd56a152d6cf14ba842bc6df04907e7fc301c17de068b6e8b0a832414b1afe149b9efbac570b0004fca47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82604287fda3fce7dda27578b260ac13

SHA1
a4d76776ce2cefa91397aed7d96859afa752a0c3

SHA256
413b5ab027b35220a56b52b6943188ef6aeb67d02a5e6b6f8d388c4a5262edc8

SHA512
158d14a2c2c852f446aa5dd662f884475d6944718038c9ebe4c4ea45280f9c88c86f1597e83cb371e4c478b4852ae626923832586f1def570455059fdca33f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc79a1b92a24decb8e280e547f3bf29

SHA1
f4204ea09a0a9c7624e3599da2a9c38b53023bae

SHA256
7ad4ecc23fb5dd2d5d7c53a514e50513d9569b9d736c7dfab49bb22fca91a878

SHA512
19e616447a650aaeb7a6747dbc9cee6394f76a91f763ad4d13c308f2264c306f644e9d127719051917e4bebb3a7ef28ee2e72c94dd1d00c4053c1711c3643927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828f39ca07e0821d9f132b88431ba85a

SHA1
dcd0d9881f14eec1a03673e2d4426ceb919d95c2

SHA256
a4e695b90bf7bc130edb30150d64875853565a2f92fe16e40879be87b7d389e7

SHA512
3274109939e0ffc6dcb09fb09729359b499a052ec0d8253160142780ac9c372ad318ffc0749d5fa08d86177ef29ca4b665b7dfd6871ef023aabb32d11f22fed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85299d326ef18beea92c83da27c71560

SHA1
6b0cd8abbe6a2fe47aa6111614a5508fd83b4974

SHA256
3cca5913821b4726d34e924d4c31b2ef544eeb29cc1a767b26cb40359a39a545

SHA512
3a5052adbf29617e7f65c2db4c7e0ca6e6bef50e70e4463e3a75b9982df631d564dc6b4bd6ab9dbd9950e1f01e4da82c2ebabdd3e38cc8a80a063abd314d3126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e00089c45b440499c38fe95afac942fc

SHA1
5a4fa5f633fa631f05f8dc95b39afeb883c04fef

SHA256
ab9eb5d871633a0174b5921e3c07b75ef77a4b93069fba6801e24efa7b5755c0

SHA512
4070cf660a9cc22c7fdbb2f231afbc750cf643328b3a43b9c4e7afb096a1e930dce258874eddae69609cc9a9ae530d66ec87b049e87cc9ad5037f1bdb4ead157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cf987f778512940a1fb5371f0b85d85

SHA1
474de537060171dd2ca85edb86723ab57849d6a8

SHA256
4b4c51a38390bf5e0dc429117bcd5e65c33744d381567a33e0797d68a6b2a4b9

SHA512
48a7cf3a97c87650afb328f37fe9950ada35a3a26433182fa5d714c8228311267992a93bf99081e7f1efcd6f55f62fb997d542621bd01ccd336591337beff633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0371842a4ddbc60647cd8110ad524940

SHA1
dda5b5a092b3e065b3093d1e035e768fae7021b2

SHA256
6e50a6162947885e237f52b36247403401dc0491c51ce3c9c2e202b27f7f9491

SHA512
a442d0bb45c60a295f9a3252b0fd4483f797157fcbd87daf3de63de1115ce5bbd1fbb3628615019e2bbee19a0c8e1d21dab2375f967364669077684c8626c3de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b6a8e328cfdb207d281d7fb1439e24

SHA1
12d6660d027fb1e45c47b95529472bde69e90dc6

SHA256
123c93df0ed794394d259c2c0c49edcf4e0bd5f990e32b32e516c442d86cb8d0

SHA512
72ceea1ef509d30f7e4037d9fdc401cedf8ecb194e6f5c4b3abf72d1c291b123eebcb38f66015c8b1054ce744ed7cb9faa021c18b0f66536361428715e8a14f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a902ff2c514cf222cb8aed24f9116ae9

SHA1
aface1cb4c5da2294fa60103b870cf7be85e0044

SHA256
449a492b69135566649eeb6eef8096668251a523cde7a5a6fc7c55c9598f05b1

SHA512
a58675a1618d03285b0201993ddbd198e966e287117b069389a2d5e53564ec5bbeb803e2c64616671fd75622dc77ec9a2435947d9df79ad75c36caf1a41c7ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e73548b23b4f6de94adee10c4b082eea

SHA1
93404e014f7abd4149cce4e2b414fe7f2df4a83a

SHA256
1d5fed33c51d6b410b1bbb15be4ba3d5036d8d300a523d108ba5818db3df5953

SHA512
138b5b040efc0c37f86ef7ce7160bf2f075f29119e7b4282e8ea333e21376b3fe4117d645a0cbfbabe8d4b351522f75e5b0677579108a69c068db1cb55238556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf8060108ee230726c892a6f863c767b

SHA1
8255d6db56a628320cf42b9e8d027addf10914ba

SHA256
f22ec4681ee5de1c9215f511ce9b3eba75344f21a17794b0570f39c45e9d449e

SHA512
8e212c763e41bf3fd41ec63821ff3e0affaabd1840a5018cd7768749b6ef06bfd24763636d10f26b4d466cd1eea05aaca199ac31f1f3cd4f4162cab89aae7eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d5b58a4ec6ea890665b641072dc38e

SHA1
bfbb77ff28f0ff17c19375deb0090a22048ee6d6

SHA256
26ddbe6366e2fea5fca6e88f10167ce13532abe66de0eb04c33da4ff37b8dd04

SHA512
198211b9373b24a786a9756054e7cbae01fc4f2bb9d3d34843591fc51087255961306b284fea92ab9502c73d21d0307177b62741efb09ace43c7d3dcd8b5e6fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d3217f1beea91f0b1df42ae067479ac

SHA1
0f6a11a83c0bfd9028d46abc7bbd634ead679bfe

SHA256
54bcc93c472154b05b1fc373323d3fa50371188d9a4bfc2fc2135f3f78ba9ee1

SHA512
40ca3e693b0c0a022bd9013206163cab6775ba53b7806ed967e70b62331c39da4870edd8b65036220e0803e18caa007cc58035937e6c37f786c045725efb474b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c3ed4847abdf2155f35eed570072b5

SHA1
aef7756d961410066a74aebf1ef0a6b58101b5d8

SHA256
db553b715e8543cdb0c1b91ad46f445f339de0b5f1414c07c8cc8bdb41df01ac

SHA512
2ca41dfe1dffe8ec77a59388da60acadfa5877d67284ac7797cc5bd6672a26bf339834c39ea9710a643ad8d927831a04d32f58cca93898889098b347d3c6ea33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FF2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20AF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20C4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit