1babd50ac4c6acd97ea573c503c0ecb947a23ab728e207a8beb1ef2bb83b8e88

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fe9511885e8295d166dbc2145b4763e_JaffaCakes118.html
Size

74KB
MD5

1fe9511885e8295d166dbc2145b4763e
SHA1

f80425d5e35ebed44cfe10f832d897d2edc89344
SHA256

1babd50ac4c6acd97ea573c503c0ecb947a23ab728e207a8beb1ef2bb83b8e88
SHA512

05325810cd2f7a0bd8b0cd62f28a242c1495aa2c7b4e6a092004f581ce48f185e3f147a34e90933b553674b2a7ee7ed6cb555ca3278cda334e94bd4c4817bd7d
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6sw6qBSndii/2y2moTyS1wCZkoTyMdtbBnfBgN8/lboii:J3Oeen3TzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421229446"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60267cca51a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5CC5061-0C44-11EF-9907-E698D2733004} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000050f8bf270fbd490bdb5b48ee9cf3c2893de4cf83294a01713ab9d791af52dedc000000000e800000000200002000000097ebe8696f0533376ab9d30a5e10883d04044c1c64fc0d35c3134bdecd0047f320000000fda9c8d54748ca5a65e3f2627afe17f02cea8ca3958936a655b874f5ef20bba7400000004e8e33cfad4bce3a65669f058e880f330d73799082601fd6764d6c88fe6b13888efd081810d84e2ad5fb7818d51b75566e0a7af0dbf3cb4820ae64c3b4b4caba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000013a8cebd9dba11820a3351a96414baf972e42665c80ce434a854dfcccc11b8c2000000000e80000000020000200000000e5c8e33de62f8382efeeef13ff92742dcf690d5f8e06694f67e71c7347b45e1900000006b72cacf8790316e6a24b2504ca4d86480357a462bc80e6770c8ab33d1d45c4d52210992f387d783fef1e1f72e6a30fbcf5310c37bcf1b6d5d0379040ef62fff15c25e90cd626652c7958ebb1d0e2281c38aecd94ed762c3c38e2f99286906a32485732d44ff708db555148746f5f5d6e3d33168106e6d718c1c2f9bcf14620cec654534eeda60ef80f4aeaca72373cf40000000a9e718e6cd40653ea311311b01bbd6d97829dcedd037da2056b3729d10f6ff9a5a5b8208ffe3a26df472f1590a9c214a51fed3c708feb363b98408ac180c066a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3012	1724	iexplore.exe	28
PID 1724 wrote to memory of 3012	1724	iexplore.exe	28
PID 1724 wrote to memory of 3012	1724	iexplore.exe	28
PID 1724 wrote to memory of 3012	1724	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fe9511885e8295d166dbc2145b4763e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f1f59193ccfed1932f4e0700d31812c

SHA1
a37e3296463ac7e3e2ae9fd60f50a53d58e84ce0

SHA256
e8bcaa594254281613170225879728efab2480d4e4ba3787ad2e9fa04f5baed1

SHA512
aee0571cfb016d0e402a7563c86a448d4fa05e93c17b77444d64780950346911237b4102ff6aa5ffb2a222c9e1239e08ecc5d0c776e6dfc863b224a9c29858c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3abdd82b48b23a687a21493de17cbf25

SHA1
634e437d8145dd01af8c7820b46315ca2896b7c6

SHA256
4a501872afcebaa8517b885c10e1dacee54f2ead17005bbb19a6518712f43d25

SHA512
100538074f16b0a8bbe5aaea5c070e346c31e549345d122625ee86a4372380a537fbbd9b7eb5052499a7afb1f7c60324dca8394c5745dbdce1f10212c8f3fe68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
99ad51218caaf527ee7c5a4a2629a5b6

SHA1
3ad03574c34a697dcb6505008c67dd90e97a5c16

SHA256
77b038c85708f793b31d885f277284f2cceff6217551fe1c763448345db678e0

SHA512
3c0b0696c69973ee35345246a551c44767963184ee8c70b7ac7a56278dd4e09d375b6fda2eccb7dcb64a0837f59c3af665e2398cc4094be959ad39097080db6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6435eead7cf235c38e1e8397f32a2eca

SHA1
f73e8e11ca8906c89e154ea4e2010093fa2e1540

SHA256
6be8c1adcd05cafc7554cfd46dcffe324d9bd867539c0a1d6e42460b84a5c70a

SHA512
50e947964d116dbce1909f753ef4d217e3de37be2da4cf7b870eac8732205a8e52e443062ff5a093c26ab292e4618db6f8886e5ccdf5865c15e0219a6a7df145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
445159ef5cf32e9ab38fd0d6a9ba8d3e

SHA1
cda2d579145bb2405ef05526b200fe803097807e

SHA256
3c506a8a89a75f3091d81cb0abdecf6f479886baf42f3ae9468cbc1cff31f23c

SHA512
48cf0cceb7a569a651be3a3b0c4dd5a5e8405501e4e24d87103ab4842cf7f0d2f2a4eef005d1b9e9394b0ca6a3f7f2698a2b3d9e44bd7b5a35ed48e7db7702b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
801c5995136f430f9ff001d785a9899a

SHA1
411f53543898eda17bfebe118dde0e554464a343

SHA256
576caef145bf9b40bf9579ac5500b8f30023a82fac9b0062b35f1c8e605cc7df

SHA512
3cec504669684fc74c388520ca2071a45b2f9bdc19e7693cf6aaf0389f111da6ba70b4ab1e46498ea7767c178b5c2fe93eb59e93c977ca7b211124f37daedc92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4999fec0f766719d4a90b5eea3a073f7

SHA1
dc3feea4b9dd61355974f10cb67d8ee1011aafbe

SHA256
ff83880b1f8f49d7626b1ce05908a6691221f5669b1e12c61b4ae15c6cf8e34f

SHA512
5b44618760352056bff77332da5e83fa45763427c21cb20a665204378bb6b2bfb5655a69fac79523f76078b4a5a08a2a013050c5fabe7d7af3547df11eb5de4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
93fcdd67181442220359a867d0a3770b

SHA1
ac8c4fbd42dd84a7a16bb1b5c0288f90444a69c7

SHA256
2df95675697f3008ec3d8582e3441def8bdfbe59c85dfb0c07210039e98c0e7a

SHA512
b5eb84f401affa4705637a1b9dffc5a1691e8b491756c2df75c88ca000335f4e32b8478a20ab8b5571bbc584125cc2a4d3fcc14ec5090e0afca020c0b7b8bbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
589c97c89c586867412b39368a13013c

SHA1
21886d1a801b54daeb77936b7c24d47cb95b78f0

SHA256
48a2479ded75556f59812412e70dd8ab5ab36e75b3c096c48f90d283de3136cf

SHA512
137c4d4119b3cbb550e2c58c743f47e18c0bf8f473a8dcd72ea91fda9a8f2b20ea9b1d49b2aa283b0dd7dd489dcbf0c256754ba0de6a1587661897538193d888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7f623017188e680f1f03c64c0c439555

SHA1
dd5a7bb1b4b050fff1e6a5cee01bee27821dd653

SHA256
424b50fe0e9388022abafdf082a74b0dc9b273fb49bf2fbfa453a83ce7b4b4ee

SHA512
15102126fb931537534372ecd2f340c3add1325cdfe52bb42e32899946cf7dd7e4f293d1b8afa65133f81bad0f3dfefbab0240775b393c4feae066d731a39b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cfc0e3227e5ab56703bcf86edd3f27ad

SHA1
2ed3da77bc8e699d575b67358f9b48a977e2cbf5

SHA256
c6a090a5db3f0524e0ecbced7526c2e61ceb98d2ce2f4d1ad0ee58068f2bf5cf

SHA512
e4b247d047d1ff62887c2b308fbdc4bbbe2952e1fd8c971739d6c44ab18993a500a3c6283bf4e5807d95771bff9410edee09572822f6d92cd85a50690dc77cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
001a55e6cd4aba75e1d05e7fbf7a4afb

SHA1
fae8d6b31a776c639e5ef18bb2fbf813efa65e01

SHA256
2c81dde6473678861a592555ced98dbd3026cc8e35a5c161e8b9b9dc2205150a

SHA512
18c4de1adf5c687a926b85950961b2048856ca4cef71543de518100053292793eb3cbc5e9783223fc69745f7c088d5d9758bc45f2241c931e532501bf2d17818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f704818a12fb9209e1e3a83ccb0908b4

SHA1
3e10708555e008aa0db4cd78487854e39e292248

SHA256
a71262cd51631423e87680bba92acb9e18190605d86ba400d91eda856a6f3441

SHA512
82c3475f299927821eb7f8ae8645eeed328888fd6b61370c9f4d21d05d7e87eddd42bf5f1f57197917c598c4ba1234c1207c2703109fff8782b173e60ae557bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f0a5af57a2ed603587b1d6e29266ba70

SHA1
a6ec08d07024b1fa9e9ca3ce3af6d77836740b25

SHA256
098348949077fb0094983cd5377bd63501144311498441c818d82d199a77f4d5

SHA512
98d437bf20d0425aee545a230ad53a845ac1aabc12048ef748d80c57ab118af1106d2d03642fd91ba169ae7a9521c6562413ff505986caa67779e781ee22fcc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
87d16b3d65aad471309866a1894d61e5

SHA1
690b409638e608d7756618c64abb528ddb699fc7

SHA256
fe1f32b8e953f5ad7ea0bb5a8d6753af656629a2c2d92ec939e2f4d00a8358e8

SHA512
aa3b456bee5ad1431c4cfa45491f75bd93bf1e934cf8d13a25244703a6fe57dd2eb60643821dd69e6ce42bea50d14abb2c92eefbfedbacd863ff915968e9a152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
78ec4bff32ce4adec7b95d6236663ac7

SHA1
9fd2589d1d5a32852215255ea7b4ea17cc4b16fd

SHA256
aa9d922086f416fc07dd2f5b63d28b1d040ab56a259e5a63793c5c42ffadd373

SHA512
b77a43648b5587b2a8c4b9660a782caecef28eb35f7746f1226bb79b82197b9e0585a5c1e2213aa3aa98b62b3f6c94bc3cadf42555aee3974de27e223712d97b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FE9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30BB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit