54be87cfdb84b5bb0ac01d574320450fc1d0524d2d5c8093fab7ad71d16118a8

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1248395de986c547de7a3bdfd3936b22_JaffaCakes118.html
Size

761B
MD5

1248395de986c547de7a3bdfd3936b22
SHA1

db85d8f258a7fd1f5103f688ce439ab041bea189
SHA256

54be87cfdb84b5bb0ac01d574320450fc1d0524d2d5c8093fab7ad71d16118a8
SHA512

65440fde4f18960a7107139dee44220248464549d04854cbf86fd2af117b8d615208e842e58e079ac7657a5d897dafaf8e64c451251e55457e35b5090f534db9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002f37d8acfc5a850927052356c2eba76325446be6bc23d8468c1fe56bd570d1f5000000000e8000000002000020000000114c3c2ffd44a06aa74db43cccba22120fa5b3627d36a706956e668e1dd9e16c200000003c44b37d857ad5ea0233619fe0125f04a7cb03063744640f37740c9ad055f87540000000fce45154dd0dbf872c06008cd4abe3c3d2aa09bbaf8aefc37faf78c2208a3d10122f203c28e56d30f47de9d7f84f57032e5e64661e7a7249d62a13b5287f47e2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C37E9511-09FF-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906ff7860c9eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f71defe5b8452cb90e9e54c20f737de2d121a06642431f399c3bb0c487a300dd000000000e8000000002000020000000714311fbabc63079451f804942e3b28c818d2b104c3985b56f5a59ab3a08998590000000e08d26368c07f9dece76c9506ea797403500a6291b0f7476c83a7a01ea975bbd35e6aa78de90f850cfe2e38629dc3a5d0ddb2de87eae12c24dc459251fe7cf58d81512741f390ced9deb7b9472549e073f1c794fae452ca31b3b9be8c8f96a2f169219ddf110e424e515157f9efa683004004d0415c552aa93d8d579db694864e476ad79634a98f1ab6cd2e8c1d83fb240000000d85abd013970f2b5c1a710b933108abf335a571d84d7a731dc41e0abcad78c7661947df23a09ff8d89f378d0c787ebeec9ddd3f6b3b86e143b381c6edd4d4d38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420979824"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1248395de986c547de7a3bdfd3936b22_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6391bf68841f8d7262cec4624ef9eee6

SHA1
99430f4b160c9789d5cf55ebffa3cd6d0d9323fd

SHA256
1cfcf0ce9bc7fc6fb88eeadf92c75e82f67fdefdfb2f474744f96cb8e8a25104

SHA512
e0eea63bc4417154c4b0e4708054b57345c3f9a292d63cb0c0de90f2f5d512de587965cd85e9025a56853ec1e1621d245b250b22360011eddf3069742c22d3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bdcefdfff237f40fa987947637068d3

SHA1
d27e0f1db2e44b9454bffca84034f69c472bf27c

SHA256
99c12cbca638e68a7200100c360fb7caefecb6e7099dd40c43d07f518f599bf7

SHA512
4bcb3d00cc0d20a4e8854fd041ae2f1c47a9f681f82f8a02cd844ef123af49f8a14e2a2e9c6acf423dbc5b856f2c7536cd073cc801ce29f5593625987ff3c168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42a75519950eb5cf61a0d629c28472c7

SHA1
2a5a02dbf5a8a57de232c4a2f25f57a3362cb61f

SHA256
c92f5b93a04aea64c828314fb979b969d52425f44e23e340fc396a9c192d96a4

SHA512
8b38919bf1203b7bc280731ebff417b974015f3e4e78af1b96b47a198424f3f3597a4bbe9bf3be409b82fe60bc0a0c8b27d1496c73ced07109e752832b450662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c1b1eae08575fb95cafb875fcee7595

SHA1
4a8a0ecfbf52fe66c81c2569d1fe6ddc42e87cb7

SHA256
2d9a9712aa0a941b03c4ff469316198b96a9cb5d98e05a75a9c3be19116c2d3b

SHA512
200b13c90fc1dcdd8ab87fe4888e1156cb8df5bf5bed4cd51e9124e4d7672ab07eb38a9ee1704a7329b7863ef10fbd9a88b367d41e201f9ca2217b9189513a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
092d0540f2c68d39f8344592b5f99a50

SHA1
cf0ed536fd38bb4e85a70c5791d722132ab4bcd9

SHA256
b0d081525a6924a00cd021a1683ea57cf718bcb277fa85067fcaed9d3ded2859

SHA512
1b3cb9718b372335aaa1d82b5fd412a3de2e625df1706722debcedc392980bb65e3f729603421e803f81974872870c44177764738c091bfb52cb3890c2a59625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a56fe12030c6fcc6ccd599ff0542cb

SHA1
6f2bb1b56138452e69e2125a3eb8d2d889024aec

SHA256
ac31b9df02e41b22fc82bd0857c7077d12f72af5e3f46f9df88df33ed0986fb6

SHA512
7347feb22d4e2146864688164dc73d3142546cd30315563e58762cbad12140acadd9a514bb54fb887c7c63bf52aa76611d86eb5b9297b5db7c22aa524d990d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85a38392139c4b290740c1f847939941

SHA1
eba18b1e72395c2cd3dc745ba85b6120ac494e8a

SHA256
e7c253744fe553d35f9f24296afe92ad125a5e3badd2d25fd4c41e5e20a70ff4

SHA512
ac026f2b04df14c88742fa3c21a417f55c624f82966a19c5f0c6aa82e43dfd078581b6a3cd82b3057b505c397061f4f0252cd680af56df39953c6f1a042ada47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b257171b7110daa0891151432b7ded2e

SHA1
b83e1e7c489e6d3e4989b983776230ed5e7b4df6

SHA256
fca05946ff70f8af0f75f016076af378f6d8b84ec8ede476a3a4f433a61ab51b

SHA512
54aabcd34b96fcf553e0e4ea7c319bfa49abe11efe7a1d0d6202b9c6c4d34c3e5ac4a097627b638099b6171801ac6312bf61b12e0ddde1d4a4f7015c23d76bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3c30222aaca5b1f6843d8e027fd0d3

SHA1
b2f0ebbe1e8489e010c348685ea05832440e830c

SHA256
e165abcea9d7ac5bf4fae5791aed5caf5c392c06a2c36d87441db78934cb0856

SHA512
f40bc4d00de7939d0d5c927e10dcc093bbffe57be3c97fe85ddfca4233b04ac3fe6b5b90123ee74907829f73583f55ac6793d7830e094861066809cadbbc091f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac61a3d517fd39ffe532ec37b8c2c8b9

SHA1
d954c222fdfebb2bcefa2e7cd6929c15483f218b

SHA256
a36ba51189d6f46ed4c836885f4ea9fdde26805f8640f5f1f72e2bb5aad7adad

SHA512
14067c8b33503d0f6402152d44421ad7b3583ea922d2c391b3e9a3edc1fc12d3a4f978c853f23ddc37b8f7c20f2140bd02c897242ba69699993d902ed78b6f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ce4b5eb32cd9beddcdbc20f45bec74

SHA1
a05166dc620c36f73413099f6599f5834ff44cc9

SHA256
055dc7a2745321649f63769586a85cad49babdbe2677358306c1a0b62fdce359

SHA512
67cbfaaa8290371888cb6f0cedaa0d56734b07484236d432e89426d64095a0518dcd95b983961afc04705592f55c52ed76c96b69912141dfe131da7e4d1a2439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c9cf1fd4fd807e26aa39ca59cba6fc

SHA1
ebfb8472c38310121be7dee5ea2ab3461dd8982f

SHA256
aa3bbbd6331aa9b6dc6f3564e2c5a7dbde954ed1a42cfc8984352fa87349cd80

SHA512
3b9214a151842625c0b4ba1e1b512c2a078b2291b8d9863158587c3ad977558e51bb3168815c92fd8e8bacfe63be478f58bc9bde5f1bf13a5cd42ccae3308203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
684e930f6e1720e52ded16186e693620

SHA1
d57ec7d309155430460e3bd394b6f19008ae206b

SHA256
7cd6746c12fb6cecca2e1ec55c4c36c4b8223f2877a9f1295b77577ab1092f4f

SHA512
1bd8471c70a493f1d10fa2ee1516c13bdc03f211fe986a902bd7144e533f3478ceae5e13befebc77bfc65a96642bb26ce0c8c9e8aecf47d0bd1ece9bc6c47db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84f0c6173e97ebfa08df149fd6d41c22

SHA1
38aea6eed8f332c2c77848cd8b298cad89c7bc9d

SHA256
26446cb6516247b9dfb3ede988273c3e69ac7a9a262f11442bc1fecc36e28a24

SHA512
0d5e842a6a619499dddaae91553cb49486cbe672ae11eb49720f159bbd0b06faf8d2eb5f727fe1df3df0936c679ebd41013bbd44a05a560a652fa00c61a24d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d41796fac2ad64a83446f9a0946b9f5

SHA1
037019eb08d2b5869f02640cbdc9241d415a00b5

SHA256
ba58b04ee0fdd92d0e25fee3be79c303b319bbb43512d7c2bd74ddf267e22aba

SHA512
90980d0ec08400f006a6047cb4a812eed0ea7304bf9cfbdb880d470859f024a2d3623aea86091acb7d1ea69a082540f09d58eb098ac7f7882bf1da9a07aa4385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6abe0efd8eb6379e2d992e188d3e10a5

SHA1
7b1d1ba0ceb93156d594695bcdbd71721cf3efde

SHA256
f36220986fd5be0748071e09eb215f909799a87a132520da14d1d5f07e929478

SHA512
006ce6a0885813d518c774ae130201bb32fe2fea5d2ce0277751ee235bf99e4fdbb6456e7422ad13756480bfe1ca81a9668340c8cdb580a91cc5636f4908a8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0573fe535d41623752169869fd92774d

SHA1
4d7719aabc937f65ef215e0ab946b12cd508655e

SHA256
34c3c93b759bac1f4f65be2683a51ba42221362b5d6db3615e46eff07e59c0ff

SHA512
ace63fde9a02a899911dbd5a3621be2d04fc3fe7226214c26593bc911a07e6db9b2fc5d8c36f703175d847ebb9c03535f0b6f024b1d3015bd81a7120fbcec2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2747.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit