eec0942e14455db41de5ced12cdb0fe0e487db383577f52b1a1d4798091e10e2

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14434dcbc2c36dc2d6707027a4486cc1_JaffaCakes118.html
Size

65KB
MD5

14434dcbc2c36dc2d6707027a4486cc1
SHA1

8fad4b643264d77ddd63b5351565d751dd75aa79
SHA256

eec0942e14455db41de5ced12cdb0fe0e487db383577f52b1a1d4798091e10e2
SHA512

7d5c117265b61b9cc8b075230cd94e11255202158bee8b30951cf27ce0bce4ca4e25ba065702c27c9c8a40f1582cb6c4dc7e18773f1997770752e87db7721018
SSDEEP

768:JiAgcM0St8tN99OIsA/XEuXaXHiXHXyoTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVf:J8+iy7TIgec0tbrgaCcFNnzAC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000027b5812881c6a596cf7d6a146ceb127ca793e4eae8a06a821fa4ca1f7999ec06000000000e80000000020000200000000a1b6281251cdaeac8d9c28bbc0ec45b447d2ed5ed60877a71b9b57674f087db900000003ff53c61590c293030163a2d14141820168a6bbc15a7dee856ee55673cdbfa5181e081ba9b1d2db32e1db820566750684eb96446248850b5627c8f3b58c6af49564f540464ca2796fa80c7e3b35f686c92a08c6fc8885058e788dc1f9aa52da2b80b7dc871e040f50e9a9f5650a01922244f283eb0b0cd1b23d2cf2f21beffaf3dbd266ac8c366bfcf20b1196ed9afd5400000009ef96e96b066a32edc096ce3837199871c38351e3bfab7da103cf83f9fac016b0f850ff2a46ce1b39d50aeabbe7c807765c62fe5a8f77f0fc612a4128b5154e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000b1a37e8bbf3b8d16e21d05d038950a435b380960cbf7a9fb6d059635d31e3ca000000000e80000000020000200000001d91ce6f273ca168ea835e7f65233bca94e5989b83e278e97aaa374d4493bab520000000080aacbe83e948e791583b6b14375b6f7bcf5f92bf4433df850ab8b6499cbd8340000000b72773011d91867245558dbaf010fcbef3b1efcad7624b81d2549c87a32c8526de9f8abc4b2949d3ec4cba20213495d0cae156c912d09a15f996e6168826b02c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421014739"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dc17e35d9eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DD9B941-0A51-11EF-8547-E6D98B7EB028} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2544	1640	iexplore.exe	28
PID 1640 wrote to memory of 2544	1640	iexplore.exe	28
PID 1640 wrote to memory of 2544	1640	iexplore.exe	28
PID 1640 wrote to memory of 2544	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14434dcbc2c36dc2d6707027a4486cc1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cee4b83ae8a791716afa1d271124261

SHA1
8094bfcf5dace3910c147bc2ef6cbe2649e04d81

SHA256
5f71a06f63fa4ee76c09595729c61cc96e17f883534d3d4a20710b2b8bcdaf52

SHA512
c035407276fd7024100b891859218ec7788de30c2660c06265bc283f38cf661a12bb6e546c13a7b9b0b8de8211e80fe70dd62a08af15a5e683832402fed27a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bcc03d6200a8f4550bc315f6046d662

SHA1
9c0c424ee8fe3de4704395080340b8f779af8919

SHA256
b74ac80c0e7fd28621af22bb4658b56baef6ee458e25f689728f7618bb1d98ba

SHA512
f6d6040b8e0319f6b851694af3a5606194c030e2474f7a2b5bd354b9c9894488d12948fc5fb4294277204c0ee0a64566d1d4c2dea980279273ce67c49a160c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b5cf2abe2ac5378d226c65dac781d5f

SHA1
bdf70d9aeeebd98080dd2304f28bb9695662fcfb

SHA256
19062fd0a3c2e4c4f07656b06a7734f8181134dcc3265d5fabee087170a80407

SHA512
501039e51d55d6e47ed8a82a0bbdf33289af829c517a17f235c33fa7f30122a630ae9e278b03dd3089bad760f77f98914b379e8fcb98b5698bef884d41083951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fae4a5f390e81e117a310bd4ac181d57

SHA1
84c027b62137a2a0ec6428caf94252199c29fe97

SHA256
dabbdac64a2d4db81b2e07cd1639cd725dd3a74c3c25970c01aa1b052d0dd848

SHA512
61c5d26169fa64b373f0791f5f431edd5df1b6e9ac9cae597e04a232c0f3b9a84ad00de5b9966db161c9c93cbf8eaa55e95045304174b2b3b3e870a2042b380d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
340adf98a2d14f01712731739b4726cf

SHA1
8157ba2a1cd4f2819776278204bf564695cc633f

SHA256
1b53874a403764866c866bad729bbc2e9d0b783c814c6d04860edd864b5b24fa

SHA512
25a3aaae6e32c16f89424b7f15b18d0f78e02414fdf52ddb1d94779841793f60e44c91184c1b84ca7465161d22b6d439920e4f843cd873ac3ad5ce6362964ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b0cb7d17a5696abb5fe1b4a8ab7b0d7

SHA1
b6d52ce63496ff77b84d7c115f081df8621ba14a

SHA256
88812e7e9742a1562a50d49ba65c90960e9fc04d8db1a538ef0667de4cbab99c

SHA512
5df0520d1ec0eab3c04a65368702e29d253edee4661e462611fc1865d5d984df520cfa9d4577e12305e1a04c934e75d25c1436d51fdd7cf6880d33816e0efa4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03079601a6a76825ad5d5f7a78943b4e

SHA1
b21cb64899d88c757b6dd620a99a8e4d8b35d215

SHA256
6277644f7f4e5f1c22bf588ee5d30754eda57ef9af3da0f3ed623680eac724bf

SHA512
b5ce6c220aa8f86f3d209e39e910496145e9b05bfafff3f24532ec25f2187e07875ca5f2d308e7a5f86560c21c21baa3adce90de5124f1ffe51508b49dd24735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
645c36ae850bf65df468c2c8a99fbe4b

SHA1
d0fa8451378bf4bcca757bf9df5c835eaaebfc52

SHA256
74a6fceb5c52e67640f07796ce8d12c2161c5051901c7e4f296457bd6724e3bb

SHA512
02e217c0d1eecf30be6dd3a6a6fe245d6d2e95ff6596804321009374e5b3ddbc2ce8cb737cddb14fa85ae6c1d064b3d9ec13a4fef726055f880d8197c25c026e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb38c639afe33d4f6bd8ee2c3aafd76

SHA1
3646e082b531916cd58e46154d64f8070afacaa7

SHA256
ef4198c3bd292689707870ff13e48e3813bd5c69bd9c9d2e7bb1afdabe2b34f1

SHA512
46ec4c9db8e26e50a59fbf39feed1f95973aea2e4c0f88ff7769e55f123abd4e1101bb4c3334bea082dc3f8e55a154198ffd11be54d6ebbc507ea48e8336c1d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b4cd1f0b95a34a2e51f80994852950

SHA1
f563ccd19acceb00a8859650ca1835f20ba3eb75

SHA256
ddfc6d7569a7da4763f7422e58ad5f83e3e235d2bfbb43a434c663038270f7ef

SHA512
a07c4b8fc3cb20750732912c5540d76e695311ae1207e87ff083e408653e1cf167e3ba012c450e30f97a5c24c7822439239a72beb9ddb8f4f3afa7f5bcfc44ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d030043c43248566a7b0acb0ebf56d

SHA1
9caf3fc1801caab648b5e3e55186c29a083837da

SHA256
6ce844e08c1996d7395a6bf7dba2d13bf50f9cc7f73b78f628475c63280bfa24

SHA512
3ca47b9f9420a7ab6ed0a9d5e900ce3a51682503aa8e41a43583b3d721442b45b0c8e58de92645f66f64cc60c9652e340569b41ff10c852b950e454cf8c2dcba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e080293ff6137ba43c3c37c1e723dbc0

SHA1
e9537571cfff504c6b6a98f7fd8c812a297a4da1

SHA256
35e8d29117f1e781bb46d00ad5c71c1c6331b9dd7a474fe8f693df67b4605cb5

SHA512
d38d8fe318772836d62d894ab53a280b38f16b82b17b1d86400b3bb9e91cea6dbe6a3caf12cf518459ab7b5520d4aeb92e3cc9d5a7e37303d086cf222fe217fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab24d7bb7b5fdc1272ec49d33f0e7e73

SHA1
830897ab89bb57b42971e5d89a8b42dffd21c7eb

SHA256
77095f483b4acb4e03ffa7c59d82719e6f342975de2cbc368968d0bf30e084be

SHA512
2d627c73a3696e4ac1daf49767fb44f125c0672850c65f96850d474977d0316e2c1fbf73de285b9dae095ac73ec49da865f2c372ef869af12c269f7b390bc457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6557075bde31927af96a2fc01aae3949

SHA1
1df4db44256db4a5b149ea85aab3eb2e4387c658

SHA256
3a4ab2695d53cf6aeaf6f54d06df5a9297ada3aec8136665d81c698c2b9ae33d

SHA512
594fdb462dd8ca1ce225e4e967de5c9395a46ff11b98d7da1b81ade04da19d33d498fc87f653e4fc8704f1d9dac8eadd174444f4de7369c33b58b1d232383fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ca30e24ab7718c2bc57811c0e503fb

SHA1
fb34289837843ae54451cc49d93dfb1b382695cc

SHA256
94c2f7e7fcc06050227fd1b8d4f5575b0b347ba853e58866f61fd96730b19824

SHA512
f8dc4ec8aef8a0b35479fa31cb53157c7fbb7a0effb193d51eb371aa13c5ff25892b791b315e399337634eb9a50358b5983f5c823d2d23e7769453988ee5c169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac7173757a6c7cea5e819dd22b3111c

SHA1
1db295898bfca34f9441ef9316d0f50b2379c4fe

SHA256
f9b26ed3243b3fb26e4e8c7959922ac90ab8acc7ecd4618aec841f68d7bbeb92

SHA512
9b3051e9e75799df22139489c49e0b3683e6a24737610c82d8c59aa3bfb678890d5221f92183b760b20859e9955d733796e737e5f2ae6134068e319a3d865d6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3585.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3695.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit