8235b647daa54e44322aca9d20fd8400d95064776d66c908e62fe4eea977b05b

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

133066a8e654e421cc23ae68a1e805b4_JaffaCakes118.html
Size

26KB
MD5

133066a8e654e421cc23ae68a1e805b4
SHA1

9dc3baf93f60a5809452b211f31890cdcca525bc
SHA256

8235b647daa54e44322aca9d20fd8400d95064776d66c908e62fe4eea977b05b
SHA512

5b44dce2119a137c6cc8bfb4eb1319a5d92816f9a21112defb313419174b58183eb05ddc43525d7b2d772e042d4791b53413bc499d8889dfc1e672f2d459a29c
SSDEEP

192:uquH34b5nuGnQjxn5Q/9nQieYNnTnQOkEnt/nnQTbnpnQCCJVevo7NtnFo+NzQ4x:nQQ/KygccySrq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c2912a329eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420995951"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000028ba9ac7a9a135a9296d44d4fa551f92938a46ca0bc9732d86abb1abf34d009c000000000e8000000002000020000000b91dd5d47009f52baf6f9b51493e93c41b9d431bf693ed3bd8a7f1cb4d2b4a3e20000000c11b7989cbf95bb60369b9311364f8a8fed9fd6960d5529dbab878cb6f28020d4000000012b22eff69baeeb60f75361a5299e731d4f35abdf5e7cbea9230a637400aaa95155e6c99fd5ba874d2962cf7172c4e1a81555d608cdc3c83c259cf9f8d3361f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F670511-0A25-11EF-B1D1-D2EFD46A7D0E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e5036368f3e6de6c4fee14b04f6c49a3c47ec89bddbbca15b7e6aa794b27c511000000000e800000000200002000000053a495f83f2027f182fb16286fc5ff15c4216115dd3e7eb5eb8b1b773f4a0294900000009cb32335820bd6a12d69e8c2a5f959d1bd9b4df06d30b50baf6c65ba19638493032445ad7ef8ab5a65bfcf266ae66696f42e266371e7c69b78b6ddb73c0d04e1f416fe1d607372e8afc85527dc762c2306af31b7b061f2943ba92021e1718ae7b1085f95d30380368b00a6fe3d20d6f8307d6e9015d5db13666b1b31f2d7c6c8da44ae251a5ab736a0f1cb474be8871f40000000682ff4693da67be5366416db4deb8a555ce0608ccfc4c94dd755efa4e308b86b4057fdf5c43be8d5365897e38926605aa78082c61b96dbfff029bfd85239a223	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2264	2336	iexplore.exe	28
PID 2336 wrote to memory of 2264	2336	iexplore.exe	28
PID 2336 wrote to memory of 2264	2336	iexplore.exe	28
PID 2336 wrote to memory of 2264	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\133066a8e654e421cc23ae68a1e805b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b7805fe3899f5e0ca99b89c27502618

SHA1
ef95ff7b2f4522dc436aa56bb0fb7653111bcbed

SHA256
8eb606762d125532b1918e6bebf8d299a4767e0d269542a7d3124a78db176783

SHA512
6b63fae45b2586367a9830c9c009f8df3d7ed7e9e67c2bc186dfaf2922764b009c198266cb040edf224bbee5b95ab2ea3a1f4d7956d3c04abc3372d5ed6ef706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
677802ce334224c3742d3cc81c485cc4

SHA1
3e1e0900dc6d013ccab990f14bdabf6b44927897

SHA256
51ec86c03c9bf28d5da8f8d5bf37bc10993ef36c829edf753f27ec83f1c6b0ad

SHA512
d1054b139e2894e28f8f0040e455af596bea86c16a613d64cb2f74374a31eb45ad2fd392ad616018fd52128d8836f97cf99106bf3b9a54e940dab3f50eebf847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a96116891fe0bebf9df98b2ccc4955b8

SHA1
8aee23e5aff3ef396edb25014aa596eec71726ab

SHA256
d9f092883e28da3afcd63de7b34fbea799a0c5f72a46230dbbc807fc5ecb9cfa

SHA512
c72e9f00b92af9b38829a668fb3da3cf0435e0145cd561d8493f643b584be30bde16ac94a55371317003a3c639982f5d94156a7031e90313c8f933f9caa711e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
744bd4d63d2750e9ec29d05e204145d8

SHA1
bed399a1c894a993e4ff6d4e05887af233286d6f

SHA256
e4a8e4bede0dc373772632f79a116932da187311fdc509c9c0e2a08ac1d12306

SHA512
a4187d67f8bbba486f4a2c2115a72b1abd0f8ff4cc7a3c4ca1177dccc92b3c7b12d29bf9feac63051623e3db606b92146eca598a28ef4d39c1c0930cc5f39fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fe1a78f14a3929d712cb6db4ea84d15

SHA1
6c85263c5cad37b1b83c5509f928ad169d60f9a4

SHA256
0fb14f799d0852da52382b5e48aa7f4b25a72ce3e1f140c4a57651656803e894

SHA512
bf0cc504efb7c4a24866654faeced83b9ad8deb35b2a3c955f0b061b929f735ecaa4fefbd7f2a411443fac2fd41af29677fa6e77f6ad48a66e77d81db0c692c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09fadd602566f2284191881bceef9e03

SHA1
a837b58e64e7f3954fdc57d4d6ed5602bfb91980

SHA256
d82ee2bde95cea7a5055cd7d98fed0407314a3d4eeb40f4fb4018109e3dfdab4

SHA512
5f91ce331cca1292a6cf1d0c747448449e51d302bc7a253c00cffa9b4a01c0a301bb5680e32245f00892a3780d586b35b2083db1a3931984a962ab3c35a05963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e0819777613035ef5c0be60b1d72435

SHA1
a3880f59dd05dd69b1c06f9c2de248cd6b4ba97f

SHA256
d451920bff574fc82aad2db338116b00adf76de9bc37c2039f0beda4d7977e7c

SHA512
f7d8f2a1c92b6eeb74da3d44c8bdae193006e8b80b56a6f6a77edd2d601067cbad07da60963a76d2ad6821b7641f3a6f4ff788e46382e3b209ec967e4adcc149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c9fae74b98f005a8341bdb3fc6aa75c

SHA1
ea07020fab4781f2403dc4597ed332f2d5f36528

SHA256
2d7c4ee38c57d3daf5b57e5dc37de5c8bf6c05673054a4bdfb8d820006e1a626

SHA512
2d260dcfed27a7654b9343fc1f0c8c7730f8af4e0d5a98b43d31e35b458261f3e0ac911ee70f97277932f9fc33073f0112bec5871b930f365761e6fba6993972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6b254e9f79c8e0b3fa9ef9cb82596d4

SHA1
76d3c3478cc315c9abcd884fb3b50acb16fef5a3

SHA256
59a91de868d4eec250c3d9f0e3826048a0e958d4d5b8ffd7b87525d996bdcad4

SHA512
8cf32d3c9480e544102e81cb52a4b531c1a709832dd8d722caad906753ee79f47bfbf5ea7db005cf87c28d8068a89dddfe0c092e838b4b41892333cba7ad1179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7b5888c82f8887fc78681c700cd463d

SHA1
b2db5f19a1f183df52f849ca5c7aa9e1e0f93763

SHA256
cad2fed7eec7ff13ee392a752aaaa107f193a9bce17531683cb682890030556e

SHA512
323bd6f1f7f4a62e87b0165790e845393959f1421e2580699c75470130784bde20553a573f6590a8e84bea5a8f05a63cc7ce4439284abb199b72c9a51dfbf900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2399ae91c0d5a59cfe33af7e5c1866c2

SHA1
0d707996b950d1146a7a5dea51692d4f8031ad07

SHA256
fa8b7f61283340d58cbc79ad8745ea3f73841b95ac064ba6cfd149fafb9f5eb0

SHA512
d59ca2b62c8cf5d51d91d287bd52bb91eba0d48ffeab8f6976772e94713abe463c51d3be464e63feb23df567909988275bf9667b61d5676c373d5da488487345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d03975463ad1211826b0779cd0b468c0

SHA1
9192068ac314a0bf03a30585bed85ff6388165bc

SHA256
1336938c87c77cdb579c5a55877f822f8a4f1681bd9524cfae06952a5bb8f585

SHA512
dbc64024453b49a50b47f5b5c286f46efb737e6f533279124f1a117b45d9d5ad757f60b035238e7f8293dd7e73dd2df59461ac7fd62cf4565e0e79f025ea4ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b30ca6cf065e9bad8e2efc10757b84a

SHA1
ddeb57a52493f8d4c54d3bd7c37e4b0f8277d9cc

SHA256
542f9cb6e2924f13f1cc545884ce8f36247cd440b46994ba69f193a0180e3c38

SHA512
407994fa41edefc28504f22fede0aa9e62615e5327ec495be16cb3a3760d0827d951ddc99a0965715112dd3e5f7550a5dfe8cd615001075165a170e98e143559

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63EB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit