60c8a59e047cd18d996219075b27680fea8a9837e334d00657139fd1635ce877

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

152023ac9bb3b60dec0c248befceb635_JaffaCakes118.html
Size

70KB
MD5

152023ac9bb3b60dec0c248befceb635
SHA1

dbbf687b0d01427f0298c73e39bb88bb6f52e498
SHA256

60c8a59e047cd18d996219075b27680fea8a9837e334d00657139fd1635ce877
SHA512

f500ef444db806b2c6ac31d0fcc1447ccac8842d7ca652c4d37436b779aa208bfea4c8f7759860b0162fb29abaf722e198c33950efd344ecc21254d6b74e78bf
SSDEEP

768:JiBgcMWR3sI2PDDnd0g6+0myxF0stBNoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRe:JRmLJqTTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000bfb23d007b8d1fcbabd8fbe65ead45e44837ac9c7d10384a1db70335ff0f91b5000000000e8000000002000020000000a6f0a5bab91f447ad4628d3b00c0666080c1a5a30a28336c48572cc0593a9bd0900000006baf82379cbc7c30210c8ea85c8546ff99949f6bac5616da5a41f823012eb371021bd0434fda5305571043e8a9b76f8868329f91dd8ca25115003d2838c0ba18ed797d307119fd82eecbab8817500fe94ba7e4c2b756e15a9f930ece43549e654142aadd9f9d2c41d443a787a15da90b6892b6a034d2177755d9689ecf4e5990f9308a70b40a0c8362a0b9b6eb9284f040000000df34789a6eefdc05bf2dcede3182c9680f473dd11b6eed1f3ff50654851efd10471c8ad5ecef0bf49edeb8463c2fc153561b2aea5bd2177ec6d03bf3cac5ff95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421030174"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806a73d2819eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008e47f122476b87843f32f0a56fd49d42b184ffaf12cf63f6bfc66b8a67ba6b47000000000e80000000020000200000008ff5379f138a9186e1cec08a2e1f8c8b171abac1b3153fa62011b24fc1a0a8d720000000c72626dc0f002220e6a817778f8dca5c17a617f4615275fa887448672d4ba92540000000d1b6c8ca4395e8f0e9182bfcca2487ea8fdf1bacbc54f3db199d5bd37655c3b0eae415bc738a3a748bc2b2c7d2b32983caaad73cf72e5d3bad944cec1d6abaf8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDD75B01-0A74-11EF-9988-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2532	2172	iexplore.exe	28
PID 2172 wrote to memory of 2532	2172	iexplore.exe	28
PID 2172 wrote to memory of 2532	2172	iexplore.exe	28
PID 2172 wrote to memory of 2532	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\152023ac9bb3b60dec0c248befceb635_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4908ce6b0f1856cd4ae09390a573e950

SHA1
4672d9ff29730f8fc19b6561fa62ea6c4d377582

SHA256
03db3f5f15e8615cc04b96daf16999a344b587ac95621d33371b043f588c841c

SHA512
12fd795b215dafe801544264e723fc93636d58f697c25174b6cb36cc7e2ce6d1a51a8fcea76b0b6439cc2b845c8bff051cf6504a4ec0b688af475c349fea3469

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af589fc7cb47bcdc4e7bd5860fc9eab

SHA1
fb75ecc30ba7a91cf059f893fd82983353b5a443

SHA256
e9e29c39afad92cc0513a2e364a4efcdd29cb30a27784fe140bf7f6a7ff9033f

SHA512
4db8cb8dd0a0a253bb42952ba952c91dcde32baea87224767bd2c2198f03e3dc1455042f12cdf7ad7774fe401d57fdd7ae081cadb871c695169d67fcc10b4133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e02df79f540a7257bd34e43cafdd6278

SHA1
e4eb1d67dc3043643db30a2e17974bf19060205b

SHA256
f1368cb97d1e4ca12e01dbfd391e8daa33b552804f06f1677bf02427809ef86a

SHA512
7e2680c4284860848e44d1bb3d7457e30f140b7089df0fc3179cecebb298cce391552d526a48bdfb1d687816da346c08b5a0ce0a7e9613cf5e972a410f6a0287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83da43fd06699de59d619dd2dd476c51

SHA1
bf436174649d476e1de0fedc67d3e938693876e0

SHA256
b4496cf04c531a7978c9fbc26da9b7fcef1cee884da9e68faec77ea580938299

SHA512
ed1a57373eb0261d9e52991393ba5a0dd3edfc483244d6d2bb422e5089b89cb914f0d619652199e480cce2c6656281d2b3dc898fe6bcdcdf7b3c648788a9840e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abe12d3cb6db2b8bbf8666ec6c9da50

SHA1
5dd00ce7f61db7a6e2cea54ddc267e1974f23bf5

SHA256
7660118adeda5cd24bd9435c9484b1cadbb297a287c0f00762d2d48a37fa7409

SHA512
5daae90edee4b5a4817c1f77e7d2202369c56910940cc16323e68db71fd5ca44d012c4dda0f395a4eb8dcc50583b77eb1044f7af5d67cbb9572e5c84673fed90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da1a3e5daecd72f5547efcd4c84cb82

SHA1
be5bdb7d91800ee25ea3f32a1da60dbd2dcea0fd

SHA256
2b11b944b97052aecd4b2e45f34ef13bfce9f8111d88bb55c0571a0628481196

SHA512
00309dc2610727dce641e08953a6f95df9f7745b24aea4fd43415f18f22998122dcbcaca4939985c6f74bf730dccf139573756fabef8d64309b87506559b36fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04cecd81bba456b4a038c69df8912801

SHA1
a4a5d097f771868c42e3f70f906ba2867a6d1b83

SHA256
0b6a3d5fa6c2314c5e95d6268c59a89a1870350a848c52a80cc64fe8d5541c2e

SHA512
df97497a89c53333092ceca87ee6a14dbbc1f229ffdf22b955d9780aa22dc89d3ae9e9b593010a90b6b0d1d650f5ec0b361674efdcb36157dd383c803f204138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b73557b8e1bdc2d57a494a2a14c69eee

SHA1
ff304a59b5a801efc75c421843f453447dbf4542

SHA256
32477f6c726763f12a4f6b9cbf4e0c4cf7f9d50e86415450de4b17e2873bc076

SHA512
08c451440afce69b39378f396854f3dd3d461b457ae23ea42cea38b194320eb5f1a66fd091a2568f968c7b6178bc39887a0037cd275ca0c3bee5e2cbb1ecb56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af9a48d20f481eccbcccf395c24015d

SHA1
eb6a7a22d263379104bd6630869d9af70c7383dc

SHA256
2af43e80d33ba98374dbfb09a84f5ef5cdffda58f4d01d46fb5d60c89f0b6a25

SHA512
dd5b70d818be314d64f6a750cfb85eb8a3e5b3882e473bace18e913c19de864dcf7b60d41b4e7c7dd774f0ecf2e45dc18fc3e7f547f70c0ab8c4cd38368674b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbaa0913faf7841872c7175f35349fe7

SHA1
d8b1e1f2c5b370439fb463a096a039df71b5e66a

SHA256
7044f0c35cdab63237336fb2a52c21928d09ece86b9a3a19430f4fc817f449f1

SHA512
072c7de6a646c30b5919ff13393f762d09219bca8402df96e862a5246e0e994f37cc2075aba2a5376f0f1788352158a5f5da61c942c7d50dc174eab9e5c94571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ddc4883daa0fe97c70678dd96036fe

SHA1
51c5d2ad5a84c281415bb6347f91a3ad6b932363

SHA256
d288792de81662beb3af4431415c4239a1b9b95a89e3bd52cb5ad39ac32b24a0

SHA512
8b7134d42ab110fbe57b643fd9d55e2a8ba4d417e939e7e3c49ddd3dca9927afb4a2cc59640b4346e70412e383a32e5f7dd713a504507c3b36f6af0fe8140ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d94837c6fcdf67110117171252c096d

SHA1
5907c630a085900f5e55d7c1acbb5e00af76528d

SHA256
739c16b68cfa19c261f6367e2e3516865e7c56c668dedd67a7a162b1413ae2d1

SHA512
841c7186ff484e441de96da26c3feb263a89d82d5d476b1f5c782d89674f3a1d11eeba1f87c5982036d6591059303a1171ffc7d14e367eaa4d4ccb9b4c9232c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e453a4f38f807258fe9fd1ba628b3f06

SHA1
ed7d8117f97a46412aa022ff02056bcaf4adefc7

SHA256
74272b5d0d793b169c667f3b9a99d3a5e883d4d0af465ed1bea0becc07810cd5

SHA512
0931b9db8e92334edaa5e9f650686b46595423e235b4ac3631ff191a9e80c8b934c106265aecacdf0e046e22f94a8b5b031377d8ee66796fcd2a91dc49aa8cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5e424075194ec517a170cef7f9f9229

SHA1
056cf29ebf13af56eba4a03d78f8c2f33acdf3d9

SHA256
a7ad47b2c0ca9e6e6dd8602953f935f43dcebd4f1616a624ef1c47df79fa46c8

SHA512
fe513b401fb529d91e46d1dd9a092cda2967cd9af464b2749ff956a197322cf23981a6ae0b1e4a87904b46da4405170ccd9901c5f29a554e7cf7c298c8cb8e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
774f98988e5d0c34a2907147cfdeccf9

SHA1
ed89ccdffe06ecea888af8e75dcd7097256f66b2

SHA256
3a23de1474b29d952ac99f4a08148b5b7090deed3c6b74349b71d17b21d761d3

SHA512
1995c84d9cdce86de8a0aacaf8c55cdf7295d244842fc3846f6c2f564a8d54c0b0736e9f4f84b2675be4fbd3ba5369e62fd442f58665b7aee772a1c211c9913b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FD1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab408E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40A3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit