19812a0e507a7e7e8059e0daa9ff924580cfebc9f72479a2d15c25b9233a8949

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

184d34784492ad30e8e3fbc2e51bd808_JaffaCakes118.html
Size

30KB
MD5

184d34784492ad30e8e3fbc2e51bd808
SHA1

6a855a9fe13f5090f44ea8edb45752f075bb18c6
SHA256

19812a0e507a7e7e8059e0daa9ff924580cfebc9f72479a2d15c25b9233a8949
SHA512

c1173ed3500636e7846271a3a8e3c4ef6c84fb74a0895c2628ca45dffe7d6122c4dbcd7371d2f598de1e3f5bf1fb47607bdb62e1eb5a141978a7b92248684d68
SSDEEP

768:swA2k0VjIQCeCzCKCKCQCQCgCgCq2j9wNLzKisqAQNl:s/2k0VjIQ3+jjNNnn6junKisqAQNl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44B3A2C1-0AF4-11EF-A68A-46FC6C3D459E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421084838"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000221a32d593c76e4f9964d4157ab50254000000000200000000001066000000010000200000009cbf38be1747d3fc2ba7940c4c0dc7993c9a5ae045c836ba95aada437e499ab0000000000e8000000002000020000000ff36e9ac39ab4c5a2b7426ff963b77e5c8e98c3a851977f7d5c1f663f55f301220000000b7e44190fb623f1245d4fe8f224d884ca518ddf57b0b26c0b9801a2b7bafd8794000000076d591f8f7aeeae7ebd5714ebb89c9bad9566597a5eaff36f911feb7cb652f1d3985a25370ac266f2495a667f418cfa8aa27732889d1694875bcae70c7580751	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e38532019fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000221a32d593c76e4f9964d4157ab5025400000000020000000000106600000001000020000000b11d5321e74a7fe6d3b7d996ab1c908e24fb0ae6096db023a5a0704c1f699bb2000000000e800000000200002000000062105ac2455322d60e9a92a1d5886d20d808fa65a28e071ead87020bdd3ab3a79000000003cbf10114b533796e394dbab9ca849224cbf55a1265ee47ec74dd19663e29a737b1e5e64a4ef25bf14fdf1a1cc522fb819bb602f8fa10ef9d949715ff33fc8532691c87c07323fe3f450e971221f87d09b212a4745d7c06561b3107512260cbb178660202462da4d6801571df7db76d84664b80f4410b2140cba6f37e334e45b97002fc7f53b12db5d121cb7f9e3b80400000006048fca7d4a2e91652210980ce933ef82ec651c2c021d6e7457ab9950e75f85bd842d40067e82d69fde313cc7c3d409675cde1ec721d8aa95dcc54c1ba9a1f2c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3060	2208	iexplore.exe	28
PID 2208 wrote to memory of 3060	2208	iexplore.exe	28
PID 2208 wrote to memory of 3060	2208	iexplore.exe	28
PID 2208 wrote to memory of 3060	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\184d34784492ad30e8e3fbc2e51bd808_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
504e633025fe99be9f569a0cf919f4c4

SHA1
972884c4717f2246e10f6004d848f2ad2c6a520d

SHA256
2c42bf5fd922a04d85082b79ee43c69a78e05f98a4dcf920496e6ba0cf1a56f1

SHA512
6ad9aaa586d6164cae85c892e5300912e93985ccc36a600ed33a93b3a0e8d5e494b7ff782fcfc37e952444f3523c8fb3331a45edfc2561de0a031a5698fff98b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed5b590dab47f57d4ecb57e69751f19a

SHA1
d0b3a1f9d15c57635507bb41b591d3a57440e281

SHA256
72bd8f1297c598d943a3d47b45fa92a2c3170894867c866ece22df0a8174eef0

SHA512
e11f4a96ea31ce4240c5dc50d10d339472091a10278e74e6b2bed781eeacf5b7c44f258b7b923b4079b54969e778bbe988fca4965cc2fa1ae33512affdb12839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8c3b0f0695a8a0c09cb6808de235b4

SHA1
e6cbc667d10f3e2088140ec7d725e5ad6a5f899a

SHA256
bd7b465605a2c4b1539649ff9729cc00c21c08596f6e619d0ba435767969ca3a

SHA512
44af921b5257787fca148ebd418606eb4a0f1afc2c836eeda7944b839438a83e7bc5a694ec87624304c9b4e25436444b280f185b04b4c0d0e84893c20b16d294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13775157dbbafbacd0e0001d54b051c9

SHA1
3f537ac1bfc9051f943b020d88a8b7294a079d3f

SHA256
04f550a256151d7960042b9d27348ef647d5509324ac81e27a54b6475084cea4

SHA512
d9ec6303e6c3afd5dd547bb301b84da9028eb0de83dbf2add68b76940b936889a6a6a418c0f09fa537a2ec53c189b7f6bdc86f71719b55423581648e20b9c2c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
695cdfdd38a6eae20fd14b5a784b3a65

SHA1
a3fa83a8790a41cd43ce5a7c62bdf56e090c22b6

SHA256
f62d4e1b2335422c7ffc3162db1b5007cd657a6ee43fa79ce5b332d4dfcb3c46

SHA512
964f90e88ce1091e175a2c3bdaaf52713e9a1fbd36f0d047ef519e2867094f1737389b97d71e3927ea7f8cdcee1225a506b9baa4443e4a69984ac401111fc127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e21ae94dab543e70d316ee60144ee09

SHA1
93de982c53f1e2ee452c00df3018471f9b15ec55

SHA256
0c98824a9357f361c8ebd5525235e4fcce1c64c39e5f77208fde8131ecb3d4a8

SHA512
afa7da142116bb5f054d4f6805a95b541894d93e49c1b567ad15bb868fa8e4e552428e6c4504c4288219f870898cf01406d6bd12d18eb74da693324faeccccee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ba386ce4133f5f0f30cedc132140ace

SHA1
088376bdb8aed1393c81071c937da80fde590dec

SHA256
2c6a04c8c7154c30f5e2f66f901d981f65e6a114e8db16a014cce86b8dc62edf

SHA512
47f2eb852d5e72458a11ba35bbc4dce022877292416952a1009343df41cbbde3a743d55c604fa2a1df1878a67dab605799250d275d3f2467c3b53507f267753a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7debe9261ae1284319e91092b3ede709

SHA1
23bab3638985540aa82e9bbf544bd42e4d1d5990

SHA256
13bdc5511544711ff229ddb9279c370752b253cc578e3d316fac2d1d2ee3d8f3

SHA512
9ed2f5a78587c4d4cbd23c34bf8ccb0c50c48d3fe963f2234e553482236360d378af9f4aa8a0fb94ec05323fe975ed6c45b957d7761dd8040430533fa4b84506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ece384a0a8fb70a8df1b48a8324056a

SHA1
04830d91ecf651ad4ac4c24484d1354dcdea0bb0

SHA256
8ccd0d150a28a1800c1c65f7e9baafccc07e75850a12cdafdc8c48315da32c81

SHA512
8358c7d82785fe97d8f879a61479c6871b2619fb11fcf9770009f506710bbe0a3dc0a766ea397703763aa78c41521a2fc51ee3d731fb6250ac708ed70adff34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aa7a00311f62436de5bb45dcabf12b0

SHA1
80bfd21f04b8da228a9b0c941102686bdb037b3e

SHA256
05cd0638d4274d425ab5d69c5bea2050f45182fe9574f81f5259f5dfadf16996

SHA512
7b9e2623c3c3551480960a9e7abaf1500b4982b9021adc7b9718e75dd3c16c3e0b478cdb65158f4e4251af63189b2104caa288de1740815f578af882f5c6a761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8c4ad8c53be88799026a03c1d4ed08b

SHA1
3e62ba623aeda8231223f0f597254f09149fc211

SHA256
e3cb7ecc9497b7c53b8647057ed2eacefce89c1a4ac8a3a20c9db9e974802d05

SHA512
0a60beababf99e08635138ada00efbf3cd361d61d4152ae42b51b119932bcf87d6902872e38bfeeccd6240190e065bbe3281b3e79c75a871b41d98225b95dc55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b21c51ca4c3967b9c7ea95f7873bb1f

SHA1
bf31cea23a35a5499ecd4263e02a8cf82bc56fc4

SHA256
c208502bbe487f42c118d5b9a370b8d0475435b93abb951dca963a59a9bccb92

SHA512
56469c16aa8837cb4470e721bc6ac26f3c4ad12e625305ec3b4f47ace5400b6338f0f66c65d543bc482990a04a8e6ec82fd704626381c8d67ef30df502001aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
792ca30ca096a2f98f996eb5c661ff8e

SHA1
225b051b5ece41db8a48b9e06f4ffa4e0c9e5a26

SHA256
9db45624e225448421270644c0b6f39425bd8fc1ff83e80d9ca7567b2e149262

SHA512
bee03a2e68b1780eb222115fb2772aee8710d9f07c52714483ee8544e8c5d90f19b8670c9e8e74376fdd2e75aae65bc43853cd55dafcf7f07a50e808ac60e921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1268.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14BE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit