292522bc838aad15986ebe78e8b9336b32ed3d647ff3fc06310dab3f517f28a4

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f3397042a27185bb72d1aa4081422b4_JaffaCakes118.html
Size

40KB
MD5

1f3397042a27185bb72d1aa4081422b4
SHA1

cce5c2ec521f3899c8c6f6f4a9c9d0af68e5575d
SHA256

292522bc838aad15986ebe78e8b9336b32ed3d647ff3fc06310dab3f517f28a4
SHA512

eb9a61645cc75907ad0b8508fccafc67f9b86edae267f5b00fa7ca8c3ba8be95ecbd0849fb1bfda88db07999d7a6265e1fabe6b9d996e7bec3b0a1e5c9af109d
SSDEEP

384:7dG6vH4/jIB0FlOkEOi1SjXRS2tIhQzm6FLGhguwq517XTBkBY5AZidOu5TCBT9:7oGHIjIajyv7WB1ZidOu5TCBT9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9046b99229a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000b0682bf3f932fca6906333b7c7740f23a5ec35a97496f989d0f56c0e0315def000000000e8000000002000020000000842b0ef9c3914ace1cae0f7994608eb82380a7775783aad61f32b0b2cc343ea29000000057f33b604f869172ff9d03bbe28c6df9e11ff54026218271ce0d68c8d407556f4db0a2d94728780bafb180b9bc750d1cb429624591046327b1ddee5e39db69c188527c9b44557a395b39bca9e1a0f12c1365f872a2268eae6e82344fddfe5c15cb9089926ef8dd7759a3511e96beb55261c664f1fc0e4c690b65b72aabae6430047ad13c484db02c4db79d3d10d0573840000000112d54177f79885e5dbf2134e864b5a655d7b078d0d57cf3260c6c031a0d6c95b9c1b961f76967bff04e73644d16f102b9108506ba09d734cd312332154a5b0e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421212174"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BDAE0A21-0C1C-11EF-8ECF-42D431E39B11} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002224f5c7490a49484bbdaac15ce7cca5a9e2cf9880694943f277a0c5083018c1000000000e8000000002000020000000ddb117f8cf6026682718a61650c1ca4f0b502ae02c67aa0b9cc0832cdac961c320000000bd1287afe42dd03ea38d7aad9541694cfcb88f77189e50a9d6ddda37ead1028e40000000031d8dd34519584957c517ab80d702f7f1db9429e26859b0b52ca78307771d68122d27d72e090f630b1cf5edf27557e5323589fd67d246448b1b4cc015562ea1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2592	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2592	iexplore.exe
2592	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2936	2592	iexplore.exe	28
PID 2592 wrote to memory of 2936	2592	iexplore.exe	28
PID 2592 wrote to memory of 2936	2592	iexplore.exe	28
PID 2592 wrote to memory of 2936	2592	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f3397042a27185bb72d1aa4081422b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
86900272ea0daa7d26f685c034b9be3b

SHA1
0ab9ccdc394feadf0df477d2aff0c68a91cb89f2

SHA256
d933ad6d90165b530b362cc80c628c23685002b7dbd3c03a091bc53575c7bc85

SHA512
bfa6add3db6556aedb095963c6d99181084905d19dbb352a391a73b5305af8d7b87e9c9612576cfbc622504a5a8df2eebec38bd77efac1c3384aae0683cfee97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f24c15da042d0d377deaa755e28e0cc0

SHA1
63f29cd936aa3f90751ee7a1a8e30df26079da5e

SHA256
1f788ab16425c6f7caa9cbf936416e6e05dcc0b4638d6b3d0f23527282eb797d

SHA512
f4b253159d792919495a26e48176cc9d3caca4ea18f2fef63e86d5f00a781597981e4b8b97edc746f65f285575e1ed9e9ff0fc6418e51f5bfc68fda793d9cd4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43e28a929cb44a8e36b532814bf7c1e0

SHA1
a20cbd64cd88361c5f503b528cde64eea84718f2

SHA256
07e52f8b0431eac054ea10dfe51ec6ebc0aa56b41d52801e777a2a63a5b6ddc9

SHA512
683e350ff82a5a42d12c8c30d0cee067179393ffd8ed297ff728de0839d8f18b734ff8ab5a9ca216a58db650ee4643021753b51ff1c8f6cfe7418628a7e6d1e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
582863ec4783ce81835cd8057fc7c709

SHA1
b1975013f85c592424638d97274fd7456aaf6ed2

SHA256
41dd066df73c4a628e4c05dacea4d6806a9a9beb186591569c0e48f3613f7a9d

SHA512
f9ff6e6bd3b6c8325b6ed4d5e5d2dbda0fb6239f4caea2e4bb9326719b2977d750e43eeec49995650b783030548f6eeab83c107af34c4962baf7e22d453709ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5251ca5653e7216d4e077460fe95513c

SHA1
46b50d6a4c6a0effcf7d18b59aa216203b042064

SHA256
79690cae7e9071b5384ab0186d4a390c8d4fb3b42308db1611948f4d3f6d1d53

SHA512
56c9dc5ec79892ff0faefbbcde62720f3a4dbd11060beb4605e6caa0f76d92c077b881e5f2045542e224c05635898376bce29a7c3a08f6120fadc3dd06f3eb06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36fbdb378b2845d26c08bc0619c7d77d

SHA1
db46c4390421325f18efaf9847728ed50c7e6a46

SHA256
b34827b830e9aeffc5c423e99fbbbb30cb6684fb5bd6370492b44c69d559cc5c

SHA512
049f5a1750f3e8de0ee94f22c92cc6c15945f6ebe205b992a194f2fa7280b28563e391bf74c16ec86aefad0918a356f447a08d1a3c279554bc848e1066545913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
317f21382fa11e676edfa029ed07ee1a

SHA1
99d8a9814a23a243e6716ac031aee962721effca

SHA256
e263e36eb743cdf34139fde5c2646dff2ec5ebd19b42c0b7604f890dfc88afea

SHA512
822892a6890565e63c12a2b81b786d4c90580b93b214b048b662c85b35639143322343cf000538f35c2bab6b9ba84dd914a00eef5c9e404e5b6432d9d49aa904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12e19810659aa795af0f2b61b746b96

SHA1
25edb609d0f17e4e785e2ef02f649d6ca953a1b9

SHA256
42f9d3a3296aab44cd56339fe6359fe997c0ded24c26b5593bd19687f862d64c

SHA512
15aec61ecd65d193a15422cfcde6a34b3648ba7d4308bb5310e1bdd2748fe61cf0d684fc0bcf6509e1ffb219cd6148b13466f16cf44fd47f2e746a440dcf80cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef255c11731921c744e523a3d5a66921

SHA1
7eaba90079d68b0d16f870fde7d79b8708c0aa7c

SHA256
d848b6a8a04e9c6c343d8d37acf330cad6243b5d04c24e3073e3016ecf29c051

SHA512
3a2e2f48f30266ffd42e78da0fc117cef45d092af416df0dee6ba45a1f02d67d4e2a2176ff0e60b4d667b369d3debdc1a254b9024e9819df6e260413430f33d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80616dda56ed9e7716024ceca0b42045

SHA1
48349d591dd6b4cb8963815fa4774bab321ed7cb

SHA256
19fad31456185f994783c806fb4811c9df94a1427283bcc16b60065c6766be2a

SHA512
dc2349d991b1dc7c565c8469a639a79d38d2a98e277c8bdb4374e24559fedff8101aa85b06af015c69e75bb9df1dc2e5d77314f4faecdc6980a4604c8147bc3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
644a3df67b80eff5ba63a27d894afdb3

SHA1
62646c3a16c3cc75ee9e1d4f83b3908407e5cf33

SHA256
c902885f6a66124dc54912ac38cb96ec5a8fd6bc6df864fb6fe7927538f42b99

SHA512
c5317e2a7e993cc01b789dbd78bb3c475d3bcf63a237e2b852bf2cd4307bea887f11517ab1765dffa9d74eeab1ed745e8cf8f0737eb39b5a6751ce00f4874925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9008f802c56f4bcb96901ad542758b88

SHA1
41fcf01a83a0df8326bdce7ea26ab6914c338d84

SHA256
8e87944fd21380951f42a05623bcff08724b3c0058cbaa98422a253d3a72f59b

SHA512
96682e04dbdfcbc8ad9768b61be6a22a84a6c1138eae0a44f09c6871ddc5776103b09e3b29d032548dbc77838e7ff3c551e1f9f16836af7ae0134bfdf5df74dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b237300f35dc2df7712e28dd385fd518

SHA1
d8e4dd140a1b2160638a4cee06baad0ad01aa2ed

SHA256
0bccd1b9d6c717500f2a20455e9a5b635df4aa4519c1adb96ec2a1e88a04ed72

SHA512
db71333352b78c3f3c7ac97f6f6e8f0fac5b0265c37baa9aa2a042f893f8c0f86e6a3ab73e46116b9c56cf4c1945397e811793536e7dd1088bd677048bd1b06a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f25129f4568c28908d067a889f4dd954

SHA1
adec87af32ad2a30d6099cc111ca5d9f864f8d3d

SHA256
04e9a155b5e5e705023a306316deddf0d056b380803fcb293d6b3f9e608249e9

SHA512
3f6998b7c5ecb41a520a7eece484e966177029e5f9cd02073f223ee6c8a10b6e87d5afbba30f21c71deba2e0ea1250ab5d8c2a51f6cf02803632b2fa5f512a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDAE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit