5e9cb5fe652587cf81c196e2871196792a448db58f9d4459486dce1e05fe57fb

Analysis

max time kernel
137s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1353aa1e312ee1effb206614a0c09f63_JaffaCakes118.html
Size

142KB
MD5

1353aa1e312ee1effb206614a0c09f63
SHA1

f08d4d5c99ec7022ef311b656b954a279fa492fc
SHA256

5e9cb5fe652587cf81c196e2871196792a448db58f9d4459486dce1e05fe57fb
SHA512

12a35732277f04d42d1021cfce99276b2d0a6a62137ad095f90d50b7b1d9bcf63e0342f4f79a602e57e4fa07b63c6464d2db0d0f9ff15604e02c4b21edf25217
SSDEEP

3072:SSVELex7dyfkMY+BES09JXAnyrZalI+YQ:SSVELex7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B81D0AF1-0A2A-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420998276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1353aa1e312ee1effb206614a0c09f63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be60398f58bc79ce1ac2e1f0ec9fd527

SHA1
ba1e1c50e11e77b236f7b4f8128f6f714478d155

SHA256
8f87434fe49884db13bc29ee99425c4a44190b665c739c08cf1920a37c1564b3

SHA512
96e889653d4a9c368ceb4ae5e15262b9fca2c803f484c5f512a2e42a67a11447f20bcae847d76050125d3d9b8d2bb23530c6bd2c3e998f4e5b99949e7cea2da8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e069fe32ab87201cae4fa9c3508b359

SHA1
c3ffb4994dcca2e36b6d471a14e488235446c15b

SHA256
c4fc82ef9e8f5e9a0dde71d1fdb38a9231eda6edb6fce5ff253780d9214cd15e

SHA512
42dbe87c8e93284ddfeceeade8b830433ef5dd47b97f2c11c7c9d83d1fd1ac9ebabd81a14777a6cddf9a5d86967a539263ea91bcc502344076899a60561857d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28a03a2528936f395c782d9f1322738

SHA1
bc18eae2f97b90da047843a5ac3346fee29a84e1

SHA256
91c80f5b1d1ceadcbedeee7120af6b591317729ed5972f5d22ae0843845584f4

SHA512
fe569b8a028deaa356ddb91e5ef747908a336c303e8d5b2b1c188911b0c2a3ef8e547362cedde15266a5a59b467aa09f2d204bd48a6154e7f6e605c43d1093ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e61e1d0b632407c6fd055506647dba

SHA1
657fd1fecd02194a4c2e7ecdc87450b4c5dde242

SHA256
3ddadeddc7d909512def161b06e15df647e9642caa3b18da1abd42a1eddf5c84

SHA512
83c4eb5f9c39e70dd32e235f5c24f72760fa596e7337446d66ebd6a351a96a6e4fb42cdffe6db8e3fd19b9f9bd28d094e9eaf9056f52bb50fffea169f759b09e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29e56485cbadaf23d3d1700b98ed89d

SHA1
403721df6adac075d0d75cfbce5bd09c58865df4

SHA256
55202805c275f98592ff5b5f978e7ac2fd2bbc830c815945ab6606673105dfdc

SHA512
22fc96d9044a1374a58d1d97d1f5e9afcf44972a6fee10958797a41308075beaab8c7e69514ad10809b71bcf313ff359616e5ec6e23d9094d00d82d50e1027ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abb89f9cfa8ccaa88984c99c887423cd

SHA1
8cf719f3adcd1200db203cc599567cda60ebb786

SHA256
94b31efc69a97c331377dc36b65141a2ebaaa59af4a36b59fbdac68734f52696

SHA512
47f69f7e295c5e9ec874161cb31b9b9f311494309ab32d6ce65f104acf0df06ea83e1e56eaea8cf859cbbca5656cd79e471241102ae3a3719383ae6ed9f327b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d21bdcdcf9712316a224b446c714cc4

SHA1
1d07222cf538c3515b6dc4bf8791d173d3218c62

SHA256
df77e401293cdcb2a3c78aa14cb78f9db3f0a327b583f70a1fe52a69ce85b020

SHA512
56dfca5b6d938541efae80be0331f3186eb905096a4a585a4be8e265207d28bd23a15164ded34dd394e5021075f4ca8b7654decf3da39540ed8b30a1ca2978c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
434a47c66ef944b311ef355e6e2ae635

SHA1
30ae53e224b318da40da9ab510cb8ec5983f76b2

SHA256
616bfc0451d5c33c7ff6cdf9af87f8d11ee046f2f8a1596398f3577ddc3820df

SHA512
1061478ab60407314efdd11d030c4a74e292fa2872c0f4f33fddb1900eb9206085ba85a04bd5b5ddf56eeabae050ee34ad12c8f2bc5fb38b78ef237da6c7ae60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68bb10987774f5aac66fe047ee357249

SHA1
43278a2b0722455e5751d10dd2c8d4bef882c445

SHA256
eeea620f6b4d526e2e7a2374b14c03fc094d0d2bce19a7a1abbee4e8510f9a4d

SHA512
958925f7255f944055d71e0d089539f234c12f6174cb99e29438fd3cc48aa21a46c3277d575e6c1e71e9e8c54ef8f66cfefa35f820125116f56187eb9114303a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a775ac0b3ca7e5cf93fe1de8936b7f6d

SHA1
ffbc62bfca77ac5f8e6e50432fa9e046a544d213

SHA256
0e75d99ae8572f983efb569a3d88eb04037e8ca4dd21a2fbda60a115597af33a

SHA512
4e8d6dce955bb37efa8a05b3f958747c7567466ce84289bf63e0ca90163ee4961c8047e756a53a9534c5d94ff26bebd61fbd214a729dbcb93f0b21ab42165b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60f1e32bacc1ca087f09619e5a194609

SHA1
feb15582e1e4c54655176cc84515ed458394b7a7

SHA256
0226ef167547da2ac8a065d8acdbae05d5cb78dd6d49dd5d0959ee77848ced6a

SHA512
cf47d3fcc60e99cfb7a70a2a7c8bfa46f0253a24aebd3a12c453e2a1b7b780c2e513b36cff5e9c55e87facf108250777b997e3778a1f4409118be4f295d4ce0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc6b295b1e48874cf354956a336d68e

SHA1
f1e4eddf1cd6218e7073c5b1a2cb6fd528dcaf63

SHA256
3340ebdefbfdb6ec9c6086da9b2d8e00b20780a0f994398c39ded7717c692a18

SHA512
de143c169398350cb3ff218e0fc756c7ac9c02cad8be91cd83d7f1ba32bfdf92bc660a35f4a23fb30fb2b5522bef24b3c95fc64b1e479ecd531919d5eff784d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9626a8922265c58b372e81521ed091be

SHA1
46282115a8be6c4b47c1f23c9e8d84ceb797983e

SHA256
96a8693d86586f43d3ef3c7b2066e0e08c9a7e49c8a84e17c5a3d75d7b13268a

SHA512
7aafb63fbeaea75f74825b406ca98ec3335deeb5e8e171fba07e8452aba9fc0295d547639168dd134e32a7c8150455564ba045cefa5aa5352b629ff36abfc0c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
468ba36213012d810bc592a8743c30d9

SHA1
686cfb6b2abbc7feb3d81aac8c53296831bbc9da

SHA256
7e40d74e161b1e3ec39342eaefa370a3993e61a1b0637f643e1dbcbbfaa40965

SHA512
54645dc58bf156533f4b4304fb638e4bfe5a34caa04a979914240f82ce8d0b681c309db98e2d051d178d0207adc957c444cc7ff4752ca2ff20a18b18e9d5d869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
739b4e79eaf8bbf7b9c6ede12bae1fc6

SHA1
35067506cea837eb52cd58c7f3f66a03a8f17426

SHA256
8b675d60538c3503fb99265b6d005804d221a91f3d54f83fd0c394aaaf3440b0

SHA512
cc657b8a18c1cc0a268441be318037e214c09fd562176f0576e14ef6e5dbb3dabdccc3b79470b3f52efdd351aec0f99997e61599c433cb2fa7774b58b742c999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b9982f8ccddc0e6e7039d9f677b7c36

SHA1
c456fc8dddd0458242dc07039b9ad0656529691c

SHA256
18d5c53eb9597456c0eabe34194290b245259e739f35255a6089915757bd0fc7

SHA512
1266fd1ce91f66b2316e135a9ef7267e75b47b9b0ea5814fb753f0c99356d27797d514a868e35b7f59c32c3f9523cd2eb49ef4757724af7b5c7545fed697aab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e5db256878387f21aea17e8b766caf4

SHA1
43f3b4242765fd495901fb36ab8b11fc0dc50411

SHA256
8052e3c42a7807afcdc6437fba24d04b78b8015f5bff010e77c2c043f2931ab4

SHA512
49cba5b6efcf966b2230cc47e1a1f4c03eeb1eaa69d8a5ee8e7ffe0e7fbb5ad3bb51d5f38b5086936a9e778130b3c76996191dabe4dc74c0672dafe1b35a4c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab67579ce0e083272864e863ec18e3b

SHA1
bda0500a1b7ad1c5d85dcc2fa596372ff1d0e0da

SHA256
2edfad3b1fcb6ee2f17ab082f9335a72997b6075bf6fd7127050a198e8c6c361

SHA512
a3362d2d115ee47378b210b2ae6cf52e0c09a920ae253d186e435ceee6fe4a44af6374ad9216d37bf19ae9ccc3685484c3ee4ee1d4c83d081b45ff40a14ad3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bf56c57cdef8d4a5521bc7742d3135c

SHA1
a2d0ee06194559c64c62cd7a6fdf2c391194b336

SHA256
5a746c51e8c1b493695682847c31e53893ca8503faf584f8dcb75f081e9a1303

SHA512
1d22f8647705099a93ba621dbf3c6a2680e303e2466dad0e90025d8913e6423a215250b827973729738f8d9c04fb51e3abc7043691ea5d4a8c45036f55e1d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9530.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95ED.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9611.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit