87e1bedf9a140402a802ee7ae1bf6bd8c30b73f50f57ca74e167d5eca1943431

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
Size

213KB
MD5

1184460dab9c98390d2206fe8a075861
SHA1

8a29e36b8bac3c9a0ad44af8fde9ec304d0b26b0
SHA256

87e1bedf9a140402a802ee7ae1bf6bd8c30b73f50f57ca74e167d5eca1943431
SHA512

3499d7a30d65142ea6b237d2892125dbb42a47b09d8914aac05920f154a58060e14297806fd5a7c1c753821371ad0780519373ed093341abbb8104dccc4aae97
SSDEEP

3072:SHqBZkfe7IF0VutyfkMY+BES09JXAnyrZalI+YQ:SHoE4sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59075111-09D0-11EF-A0EE-F2EF6E19F123} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420959460"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1568	iexplore.exe
1568	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2976	1568	iexplore.exe	28
PID 1568 wrote to memory of 2976	1568	iexplore.exe	28
PID 1568 wrote to memory of 2976	1568	iexplore.exe	28
PID 1568 wrote to memory of 2976	1568	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b152a4a98ee4c5edca9187a6ce58532

SHA1
cd976ed39c1ec5de8a0dcc71f3d067a1b78a9990

SHA256
25fa8bb36499b7ee6538faafdb1ac6bb0f4719cc26698e3369f36a5724c6d740

SHA512
f2cafb7f4128597fe8ddf9afe9c4937569140a4de430c80c7658e41f58e6944287e69c3e1fc4ce50d7be20033100806400095f57eef8b474b6aacfc8c8963be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10356941911602e6411ee2ec8c828f77

SHA1
17da582f9514ca4b795f6c76626db4c71059f428

SHA256
f6d172ae0c44e18ef1c5496c02152c167450afa9e6a2c5e9c3fe521da6ace854

SHA512
5feaac67fa5868c8bc7c5480c1d5a8464e96291caa660d656b25e33d597c128f6a49f89a8ec7f2bd54d5acb66957451d7000c05e2bb69851a692fcb35d130cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dd79da90b957210c1a5a73228004072

SHA1
22f69ecc7c36dfe6398ee020660cb2427c3f8167

SHA256
f4a33155e27add2d56d5a89d3377eeb403afe98dec6ebf7f99bbd4b8fa7b68ee

SHA512
0cc362f49cc765cdf054985f135731702e7b47a24ed161f8737a8abf1b4ba69bb8b640bf93d1be967a1b661799d7474f9a1e653f3588194a350e6294f20a21a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b762d7b1c8954b71da4e7bfc3e8b273

SHA1
36152d65d237dc9637707b530a00f5473d839eb2

SHA256
551280d5d0099c6be2cddf3ea4ff774558ce7974aef22dda82acb61976e498d3

SHA512
44131d4c7f1fe49ab7ee02a98c94cb3f086d8c5b63a1b46406225184fda17587656be95444723b2a1eac6f4a23637fef3863d2ff88c53b98b66a514519ac147a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a61c30fadcbb3394fbe25608e126367b

SHA1
f52a9dd5be371b01c0a21d822288253adadc93a8

SHA256
769a2de8c8a37e1ec16deef5bb5fb8547a7baa88bcf7dc3f15c1d17b07fba226

SHA512
40215512de79891091d0cb2db51c301f58aae6056b81794ffc9bfd2a75bbc8f3fb43213abba2b14f8ede69058f4be1776654eb387faf1f1aa7bc5d8837a51844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d672cb0a0492b6c22d5ac5a69f162d4

SHA1
70413104249e8a576924c2117627724750c51b91

SHA256
dddb68a1ad36ac0e3bff39d812dbb1755e3599ae1938c569de964dbbb8a7ca9d

SHA512
8893fefe22d317a19c6f4d5ab7a3072e38720f5ccf3f6b5a8222512ad1cec41470c5aeeea1b4ea02f0d847bd73174ebead8a3f2a4b987332496021501606c42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d31c2705cb6e8153f9bb12a0a4a2ebb

SHA1
d6ee39288263bc40416063d7ab818ceef5cf97f7

SHA256
9a12c61b4de99886af8bd351adef84bfe462a54ad6a0b17c642540af5396d39b

SHA512
75d53c05c9cd86ff80823e373290bd359468093db17e3e97295dd73960c8a0603812b3256251e51d29a0e63a0adc7d311d0fd0de90ae65eb83c05e19945b430b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba79ef2d0df7923c07c5da216d3491d2

SHA1
49cafc9d2c8c570c22382984641f195e2ecb477c

SHA256
58928f4d20dc2fb5a4ea14c15b3296260647cff06b9d7186a178fc76ffe2cc60

SHA512
0d2e5484d7fe60604f117a413bcdae272ea05a1b619e52d451ffeb404eb870d4a7a84bb918599cc712832b3cb78875bc870790b9dfd03483b0e50de83ac47f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1f975468c7ac72358da07bf7c89abc5

SHA1
f02724ab8dc00458481007a575aaf9c1ba20b1b1

SHA256
51c3accbccbb12f340bbbfb01d5aebc0b99576790c6f1d0fc3dd9424b645ab2f

SHA512
8bf28ee7bcb52d229efdf0b255dd8a71a28f8d813fa559d7ef5025f5d400f22bffd72e71d01fbfa13e362016b726b9cb493721fa51d35e2f05c73d6d35467a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad46835e7bfa5f492e0aa60ba49cf4d

SHA1
4b22090b50c0b37bc553f2389708f7e42195ef41

SHA256
657f4b9c0afc57b8f5a809035f0b9d37c9cab18fcd67d63509ad1d5e575356fa

SHA512
6cd7d37752b1955ac36fa204d071bfb9e7f89d9479743a492175917e88c4a67ce27135fa3055d5f9102be42f8a2d723d3313055e6786761d216fb387bf83cd46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db5e09390d440c1c9adaa037f8c36b2

SHA1
bcd20e16d74926ee5b7b466ed6dd98a552be0e52

SHA256
b28c5308eb8c545e5e11e090cecdfa0c529390cf10dff60b1e4a88b07aa9f6a5

SHA512
86fb68f90547b7d5948e3acfa0ab4584aa96d7f9a985b75a1d7a54f5e5e675109ec9bdf1ba81e03f81e8446ab5d295ff6dc63bb2afcf404c97e7266511f38562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76905467692bd691e3c1d56538f9d362

SHA1
d7780d7d8972533edd845218fccb26e7c4533f8f

SHA256
b84a04a55e2f6ff9ad3072eb9218934b4f9396f34cbb6ff70aeef93ef5e5269b

SHA512
0e2d84e6fb961c63f9c5f7915040461b81fd1eb189c36c03b945f11d3215f5e758cec0d12bd86d15ccdd7cbe6b2aeb9ab63c16c0c3ca35978cc4dce90a17ab0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1857f139d1acba435154de1e9f60c874

SHA1
e604e841a0c6e8862bc2bfb2f8eb16931d6d95dd

SHA256
5f8d3093d555635ef2564b6c72fdeb24bb7dfbfed3b9d35a5b207fe92924feda

SHA512
a6081b886c10b3f0eb93f3f75dbd61d72df74f97725a07a702efa7050d34969890a81c6294389838f0d790bdb05efa494e6904f79340391449558695413cd8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2403b281d0e56b0ac56d5127a403bc6a

SHA1
d48a0f66e5b152c72592711f7f6a97be583803da

SHA256
15a753912ef17e00ebca7a8a8bdbdc2cbf3d4bec6350ff6705e955ebf5b04255

SHA512
3afa70bf893c025206d3eb6096b2466ce70e6ac44d7de637c2e407f1a2e67e6619eeddbb1ca9c9b2cbd75d0d583f804d35fe6617e16f82d74ac829f248810bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ba557912ea003312ce787bf613fd145

SHA1
b0fd2a381719bd834fe5dd729646cf0bf3b82fdb

SHA256
c1105c83a66227766a4521fc766fa14c328100fc57f805ebb69aa39508573a1a

SHA512
c9c16aa5800985b6884e7569c238edb47e81271edc0ad28a2f016a43b15c85939ac2d65d54c77cdd29cdebd3eea31b9a1775f1b1c54cb212961aea6bac8412e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77b74b95f648cb3ba2dd4d4aba23c432

SHA1
8781efa796700043a30a28e6d9d120c37196b887

SHA256
af6b6925ef5ecd690eb8a8c481bb876ca65b4306c14c60e09bd5920fab4c056e

SHA512
a4c59400d2f978534eda98002e588e71301f86e670353b7406aa438002eaf9bb49be37e2fd594f32a75e726bf95849a231932c1f88380431b3f1abfacb32d47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb1f0c3c5f124c423656a16bd03c7fbf

SHA1
5b134c587d0a49597706d5e42cc736c4fd9a6383

SHA256
8cb79c5060ac1880e1feed17eb26b02211aa5349b1bf85b1da52c21cd92ab5e9

SHA512
2b89a3f1cb99e2d54dc04395aad77033b0ea3466b33fa2930ea25c355bc553f9b061b56d9c7e74609d4d9339ec7342341cdc9499637306054aea684382e5b578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4fcf0cb2251f02c06d183850fc9c794

SHA1
3728502b138b4b3d7f5fb73664865fb2db411478

SHA256
de30ab6caee8a2bb568c124f830706be9386f338a966eadb0a1034ee5e35fdcd

SHA512
660e36dc4b249924ecd0e259e82be426cbea55e7158aa9d350a000903c1a6451e1c2feefbb25653edeb77948dd51acdd2fb5f9f2db81f6393984aa0aaa8cf0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45970a89a15614e0e0350d134f12a7ca

SHA1
388d4cb37088f5cdb91e742eb64e880fe8a4f461

SHA256
a89bf418a05317d7eb54c542e3f02c01048e4cca707cf4607a6f557f88948453

SHA512
6c30ca8055aaa23d45cbe74c6ee226aa3509befef611c215e48ae3a794b7602a45c9bb6101c5dcfd0adbe7e2e0e0f19df5b448f0854896ba56b646e2021b853f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE45.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit