79fb266e724a0c1702b295cee5de0807b00c25081b2ebef99dfa4ac301819d8e

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12da712e42b5ac467a1b9111c65fe649_JaffaCakes118.html
Size

188KB
MD5

12da712e42b5ac467a1b9111c65fe649
SHA1

d684c151d57412f83fe71c7e652529c2147856a7
SHA256

79fb266e724a0c1702b295cee5de0807b00c25081b2ebef99dfa4ac301819d8e
SHA512

c5d82a4518014d1ad029569acaa724420568e5f2b80c69f812fd873b6f32273352a2a5250d88216d577c893b6f6c23ba85f6fc7abc58c15e18d622ee725ba6af
SSDEEP

3072:HZyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiS:csMYod+X3oI+Yn86/U9jFiS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000020456ca05a642c4d6da5e7d3c526ea68592990649314199a0de218904c6586db000000000e8000000002000020000000b858550b48f65ce9039743a5df7c1dc491b42a941179c026f743ad9b74efce02200000006d7c84c1ba24add29b6bd9f0dd37c3f474ec42fefed6a792e8cffbbc2d8d303f400000000f1934c79ea0d0c93ab7ec3fb21f12c3d34ce0a47e85a74b2c979c06fdbc22a742fa70d599a0aca4fcae6ede8e67596a16a349e85111b09651361b334a03929c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420989622"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c092d9a3239eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000319d9dbfebc4532f1294986051a74403edf6a3913bcad66d1db88d141b3cab58000000000e800000000200002000000032b842d2a4ea65e5d19b2af6c786d1b33bb00d7feb55893d2bf95613e4602491900000002522d9b53c1bee80d10cb67432caf0f67ce56a0469b1907c6f82cb7d6b89c79866bcf4532113d09e91254341584c773ab71a0a1899b9d448d7beb41249d60b151bd908362e5c48c7f0af09f1f1f7994ca53202bc26c3d9af22ccebaa9f7e6b86b67518bb65fb9efdbcd167b6dd28b60f9d9d6d2e9380b9b1787e84b8016e01fb2801bffb76142c0fb46a4f650bee774f400000000259f6b6ab110d3c24e5011ff441fb62e2c269c0985b352b262b222617c7db64a610ab34a8b4d39408d7c20dfb1edbff7d34f372b1f0c7fbf112d7d9e8c36e73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FC7B191-0A16-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2700	1612	iexplore.exe	28
PID 1612 wrote to memory of 2700	1612	iexplore.exe	28
PID 1612 wrote to memory of 2700	1612	iexplore.exe	28
PID 1612 wrote to memory of 2700	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12da712e42b5ac467a1b9111c65fe649_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2fa2165986212971b8579f0c843feee

SHA1
1f5e403f010eb706f3b9ef52246ca195c68ef2a9

SHA256
3f973e4f23bb39339ad66769ab01395603849630f5ecd950c186e9d042bff68e

SHA512
124c37250251173fb0ba4780b8fd6f3f25f2a11ca66d81b1df576b050d668af0513654dc5f9469294b8d91750bc14a9070017b62437376bec726d89646949ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7bfe920c39ec9469cf9bca74bf2c0b3

SHA1
472ff52c5d6705c1bddb8a35d56985a48af5ca2a

SHA256
ef512841694ef9f1e345d94307e0268a0223857dea47b12fbea2b80a5918025c

SHA512
1799a012a289c0323bf08b9eeaf20b1ce0b2aa9ac71271ab17f8fd6def104e2a76f6652f693517bf47572ab0b598245d87c52feff1bfafe0fae86c761e42c221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d253768c575a930c19206a8daafb56c2

SHA1
583d1b09a2a4fd5c4613b27a7c6d1d0fdae45f8a

SHA256
c8649b2e145212cf4b2a153a9c8b3665df82f980cba51de5cd965d903e01702d

SHA512
6b5950d49eaa4d7673a67c67742141c00b945b7533f9e3bafdf17ed6fe5daf6a41c5600de95fbdc63ed79525136773bc3175cddc29d4e2d73da09bd53ebf6720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12022442782d5ea829df52f544879244

SHA1
e7ff3a5cda9d6aefa47ad57df1fe0250ff087e84

SHA256
27b9c7e24b23deb6f50c177cd37f0245b0e4863d5b2b59e955d45b9404124ac4

SHA512
6154c6e2563b37050cff1fadb934794db721d6f9e3eded0d644d4f943453d719e7b5e15e40136c9ace3b70e74ebb3f6277d0c629def4e7c2fc74c96b8454218e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1731af7cc905d88f371a12c4c69ad51e

SHA1
e1f5a18a20ec4a92b6b03d5a36af4ae7b8a440e0

SHA256
d20fedcb156375065a7d5ad03f77009ded1d6a5380704b42c1d2c6c7369124a2

SHA512
981f90cf083deb52004e6b1f571281cbe7eb01ea4f69ee90b84f59ba7c73357dd71789e35fda877882080f861d3a2c8a1fb687287fb2e7086b165df9629da147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e62ddf3b699af343f24b1db4e8b7ea86

SHA1
f618ab3c5b6658ac81937b3949b3929a6e691ac7

SHA256
932b1a036d885ae82b3ffd1a82d68fc55605496921efa452c2adadf8dbd14aa2

SHA512
9b18eedb6155a71b8b55493d4d2cd6fe36a48740baae828ed9dc407a0f400815017516f7a5c1c5cbb2b0ee5ee96d35ddd36d56015f02b8ab9ce12913236ef2ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c11e413c01da90ef78ec10627a8f47

SHA1
95fe5e10ccafc40b957a8eb58b75911283329106

SHA256
76775dae787fc4f2308c731fa1cbbeb6ffbeec3babeefced6bb80a51e1020e38

SHA512
ff4fa39074a468e240f44e70a2f6c135c2596ae79ca9e6bb17cb4ee0cb7f2c19ec88adf12d543550940088fe864bee4f9c0a07ae38a205e81ee4a7365c703f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9539aaedb6b4653384b587aef85f0d53

SHA1
7adb3919c6de5f70b1694d35ba3559e203ad9446

SHA256
7dc0dd240dc3a447a2cabaf46cc55ebdf17ce18bc331d812fbe8997f32d1842a

SHA512
8197becd3825b2302b5eedee6a47bf30794812454301fcffd76683dc936ee85f95a2011019692428530db81a9fe2ed2b4538947aad378d4e47349fbf5d414126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55cb64b69ea6f25f7d6fee8a639963c2

SHA1
d119e449c26ad1c718d2471c89e9b0fbcd4eba71

SHA256
81b59c1d47dd4d1815af367a8e1788a408beca518196467a8ee2805432d01601

SHA512
9139b5e06ffd69b60c6678903c2641861534043167b434985e9b8f7c57afe03a84a3012dcf50692577cdbe88620cec95f9e5af7221955ebd32ea5c22a1c5163d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcdad8b6ede5a5c86f7f23b262e94f90

SHA1
e2835b7149d7631dbe2bf3c70b5c336403f43dd8

SHA256
589777ea37e091ec5288d26ccfdf33ed39480c0334970f2729ebe3c3c79c8e7e

SHA512
1d126a96ff8fec270d88b20ba5919b3ca843857666e54128217b42aeac209e88f9ce7dff41281899fc1fa154c49c7bff3aaf3eb86617e7a59e9d42dc4ace17fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0863a1394da8cb830cdabe31beef3784

SHA1
401251dd56f9a9bb3c68ca2463f18c313c293062

SHA256
6fb16f7f9f10a9e856309d7918a80889e44724d82dbd69de3c7346ceab41cd20

SHA512
745c30d90874480fe68aeb185c3253ba3ad7871b8b325484d54c2e0e335f7907a68692bdd996c4779119cfb7dd0c1e5e8e8ff095c66f98a3b3f9ebaa6d6a589c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4043d0c658fa4eaa97c0408b6c60c1

SHA1
fb1df7d29ca28c1a99a2fc680943fbb76f1eed7f

SHA256
81cc94e539d7983ad79d4f7dd78392a81f682b63122337ef4f388f5fff356785

SHA512
b5b3cda5848a54a4c5563162b15df16c139a8cede4db750274a40231ac9bd7a77e7a000426eadd27aefa549b8e5ff82fb9284b6bc2e7124a8bf174830baa25b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9091034e50f50b1bb825e41547954f8e

SHA1
eb2006c2631e47959bfe081eb70716188dbe3793

SHA256
16bd0e4f097998ad2e87167bd603db8503e6015bb86c347864f7c178c5f6d8a0

SHA512
c3bb96ebae1e163f50e5b39f3520c8d649ccafcc736f49e9c057d73f10d80c11b40b2935f84d05a2badbfe22d34558f3fbf8be1b53403149d4e70f4238b9f162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae9041ee1c5fad579d567fda5a7c2ba

SHA1
653b2a8eefcebe9ecae1911d3db472285f0f71a5

SHA256
467475d2dd488a7695ab41f868d462ae78c0dbcc67ef7a850cc53159525f9eb9

SHA512
a69145036b2a6e77e6df6d1636e951b02b87da8b9f814292e3e4b7472b29d27070184431ef2297e505187aed5901dbfda0ee9c06cc6ea5108c74c9db6ad84325

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa6f97b835b92c9c914b4f9aab2141aa

SHA1
0d0c3ccf12b319db7b42b842e467cbdf957d428a

SHA256
1942c7621bda0063037ca98b078576afe52b555930a71400f50f9c13a6146588

SHA512
0337a31d9b8e68f7ee9f42ad2a4b957c18084c9bc505e25f0b2816365666e1098c3cc40ead447b037528b47639ac4b032536b98175b46c918348537545bfbf32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab905E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9353.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit