a8a09e2e4e7a1a92f161d8a7ff6d0e69eacb2649a6019fdae35ebcb2cdaff753

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202f762d33473f41c60675219e1dbd4f_JaffaCakes118.html
Size

461KB
MD5

202f762d33473f41c60675219e1dbd4f
SHA1

273be29baf8fefb709bbeaaf5c4e7c189b825620
SHA256

a8a09e2e4e7a1a92f161d8a7ff6d0e69eacb2649a6019fdae35ebcb2cdaff753
SHA512

c51745ef6a20e4539e1af441bcb0bffc458a2d1610729e337b8b387aba5daee479781c6dbbaa8c2ea793466ecdc48c59dc7ce5207a095d32ff1158c69edb232a
SSDEEP

6144:SfsMYod+X3oI+YasMYod+X3oI+YRsMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X3m5d+X3P5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421236059"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000be847b0a047a374a38515c4e91a6218d5de40a6f0daa36e91253982229660c3d000000000e80000000020000200000004cff12e722e57bd67d8938c6334f19c1ee8db4ae6b00e6673e9a7d60650347aa900000003c72628bf8ad272e4612a2e492fce8f663db46a90eccb580114274d9df37ef5d4ce10c4267a312b6ed6b3b1c60445aa7951bb0ed10aee6451604fefadc8490c20f266e760316add5d0818ae08a2a4ef60792ff0912ba364bd7f1529d9be7c30fad3952c421d8c8f9c8a0af4be554fde4ee7eef1fb7dd4acda21e997645983b0165f13eca74a27e8ce4a52ababa7dbdd44000000078f28e3328c76ec0c585f397d66fb44b810d6fbdb01c4389ea5442edf7ad2402e6eec57bb2263cbce25e31d303eaa48aa323a9662d04628e4ce27a4611fa01b0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A935571-0C54-11EF-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e8123361a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002a4cce821d37ecab3ef4d88632c61d2cff3c416f5165deb05c45fe53899dd4ac000000000e800000000200002000000061518e4ffd7430394cb1d5217153b08eb87412bda4bb178807aa8830aa21d2ef20000000104aac93cb9d71eae4794c3015ad10494967e4ae7e4f0c749f9ed5baa7d2ace040000000bcea98cc7591ea94cb6780ce9733761a6c52c7a5a6c45036607e8745063f066891fa3efd006a5e4c4508e26eb5b33378c3d579d31e4ba50c684fc75f5c6d9034	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28
PID 1288 wrote to memory of 2168	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\202f762d33473f41c60675219e1dbd4f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
820ba1e53856a061d932b65f0fc609cb

SHA1
32d57e44ebd1ad270a3c3c3952d29b5b575bccd8

SHA256
df5c8cbf17c15d1a593c90885dc29caf17c8a0e5670f10604b864b12d145b7a4

SHA512
c7c5c42aa2bdd01e5415c2a9269c152ccdbe4f87195160daf129ff5dfbb3eaabce5ba8301dfbc3b0ff929b9136effb721ae032ef48f185a820108379d80ebf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3406ebf6608b02412fad05e189789c6b

SHA1
efc9cfcf916bfe266b0f85ab85c62d10ec2b9c50

SHA256
3c705064e1f4a2c4d2365c3754d2f84f4a8999908fded2818c2780c118f976d1

SHA512
07cc0343007428ce21036651ea39f2ec042c8dfda6497aeb67985f6b919033097a20862e8476992bf2c17765eaece3147b8388bf7480355788758d97cf3379fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
609a6aff74481159ce36c99901ba6fa9

SHA1
c7c6c79cb8d21b8ff7ce694ad83b2d6c089f49ea

SHA256
5858ceb64c3aaaf6aa66b50c076d6cc52a4ce60046007359f91c2a6a0f2abd8a

SHA512
a8974f075c891df70f4bac2e022dcc295e6016101f69e27ec3200ffb01f28933a276a9cb58f870d6ee1cbfa4eca7017c53e4afb885c947529610d23a663ea656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da47d93fb697b75ad430939d677628e7

SHA1
da4ebed0f1d24a3751e1bfa5d69e60310fbf64d5

SHA256
9946113e90a259de1209443acb5e3b838dcd14e580bedd334d168aafb4e0cf6c

SHA512
d0516950d17e7b510af6254916d478805f9b5726d3c8281ad971153203409ca45bd4e8008a63a118329df9762012aea9fb608b95aa988d963669746007a4d54b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fcd33d75d768f1eafe9e8e6a2ab884e

SHA1
9f6d9cc817393c99f42b7b45e8dc117f2ad15cd7

SHA256
6527a61a635c0da11c0bd62dc7a755f9e9633a520a9098ca21ee577012386d44

SHA512
d856f538eed1b123a92807c2274a321655e9e9e1dd23690c4123502a3db186bd19603633724d1e5ae0a094dc8ca90f884b07f49dd381ccd239b96645cf596b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f638078333b2a73dd97e19cd14f14a6f

SHA1
f31d502b7ee123fd5f2e95b182769bdefdd05a6f

SHA256
c69850b07f75028146531b5a8e940a12860a7fa38b825d368097eda338bcc8d4

SHA512
84d2b84ef31f49f33e2fbcf696e89777ff8047291621d9f6758b170bad6e8e33f51260892217b6a119c63e23ccd3e17d14ca3f7e743203f4501fc69261627919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c0f04e3f57c00403a38cfa7211602c9

SHA1
5a6080afa05d90a0952eca9d3d0516d43716e9f4

SHA256
a2b0b6226f60b296d8c9119e5266bf280d612fdd4c4cd117987fba891bae8c32

SHA512
0d4ea874e2878dcc7f157d1e5047fe2d4a08755a6b4c1d869304ff62ebc4116c4024d74e79e69881bc736a522a0e8db6fc2126fc979c27d33dcd8413843dd39e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc2f1f6df11c60d89459056d4622cc60

SHA1
c159de77821b7ba112ef58991a01d7be669384e5

SHA256
8b27e14c6303134e552bf3bb7db4aaea13bfc2bc2f6dc83168210c3d596509f3

SHA512
a63a1196c3b5921233805b57db70ab537e6704f3957f22153711cd55f67389dd2aff2b8ac2d89612a58c266d477b07e9808d483575e459e233711470e284a36a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892dca617f8cc6a8fcaade4c95ca8ef1

SHA1
47eb668b704b5694628cd606a5f0b9bf394ae720

SHA256
9cbb406f2c61939f92d5ffc51f1236912d32ca1b7274ebff5778cb51537e6566

SHA512
5a8010e505b447b6fc128c41598ad7dac9fe1fcc91911253efe7fb78b2c2fdd664a8af77ddd451d85bae876ee7605303f7d6c576edb2de34c89a3d6dfa520864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5f5de41315cf028bbe43034ac3679b8

SHA1
3e387efdf2ed310e30452f4493c7c101022d7e99

SHA256
302deb12f8e05ac72605096f7eebe60f893d1724087f7126bb05b7b8a1f150c3

SHA512
d02fef7f66c2b88711f0f98b3a23f87781dc331c5efa046db1f3bcb8669fc195fa390f57e0e8e98f2362186ddf231b2c379e57ddd747396d80128488c6a23c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2ca52ef9d97e9f0629a79cce3621fb8

SHA1
dc53212b083196c4829387d8f9d88669fb2f8b1a

SHA256
c92bd6a0bc27ef601218962c6640b924d58c02d553c4fd187e838cb74a07671d

SHA512
dee56bb7ff9e2bf474c8990bd9f7006d0578d22c5f6e317b7283e4f8b67c4768507ef858951a6cb89791153ff6af3409bf27b382f0d66e939ee19d56178e1631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0688513b903f1874889dc1246c1b1ea6

SHA1
3c64654c862ffb49b5d758fb57b5629e7bda2841

SHA256
c4062ff976ddd582611d28d170a070118fc9ba520f9429bd254cd8a5a340eecf

SHA512
b8e5da1bdcf616b0fb366c1d6ccaa5ed9c09eebe14b7a645e6c6ed13aa8fbad035fca826826273c9bbf548baa7a3d80b85ee71c28e1ef38261afdc6722277ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b454e47b64bcca8885f19637bc7aa6a

SHA1
d6a243d702b4f326b3f9e8008324b8380236ebcb

SHA256
c6e1c5020a412d214fd3e102007dcc38e2a36c4f6e1a8c6641867b611c1a6c82

SHA512
33cac13556800ecb24cde12a09bdb2a1c4db8a97772cdee3159ca8df2a20fe84c265ced3ba0ea9866be843b634092e943d2513f758157f8d3f51af8bbe74e0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93721a0f7dd43d3374b5757124d2afa8

SHA1
520a71dcd9b1c2eaaa5c9e4cd733b6e89ac2ed0e

SHA256
2f85c48d8120cc35079c66261ce152f809891b06aeedc1c2e84598184e13d098

SHA512
c988fecedee359fd1b5ddff03bafe461a7e3825a1d739eb90c071c6eccf0a769ac9ba9c94a0e8dc66164c85c1af929e47a4dd60285e57ba458987b323788f766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c05190fbb8e6745ed6f2d51b766a68aa

SHA1
0ffa02e84e5a8b2f907064b9e868b189468430c2

SHA256
160df19b7147a49529abf357d3de3788695d9382a0acac986eee0592f6a4819e

SHA512
34d4e66dbab27c4eea0e343bcaf87cabc099943c4a055f4fae5fbd0e0bc56810e7e59af0c6b923f9685bbfb76908ee3ed254e2f6515e16cf92ac6eea76928e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64b42a3e58f69570ff829bf4b577575d

SHA1
5b3db16cf7f3ba01484bb9dd1294a8d3735eb16c

SHA256
d648b164e89498e36b0ba1b4284a31487e657e205dea4ed6ac0cf619c7a40298

SHA512
b7705b113c03b94c7e3a720e02c37a95ec39446e63262a1ff8261db6c74978dfb403c2055badcbcead47120fd12bb62013a936c6d1d3620f563c28a8056fcb21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab430A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43C9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar43CE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit