e03916f2afefeb2c9c5f8bdc0c304bd98b7a0a65a0a65e7d14a62f62839bfc7b

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20a81cacc83f7034e42b83be6c8219f9_JaffaCakes118.html
Size

40KB
MD5

20a81cacc83f7034e42b83be6c8219f9
SHA1

ee800bbe6e42bd53944b89df988d78d643fccd90
SHA256

e03916f2afefeb2c9c5f8bdc0c304bd98b7a0a65a0a65e7d14a62f62839bfc7b
SHA512

2998d2f671b4611be07b28cbcb7d2a4b9be7f4a418485ee76ef31a249f97e2f032a62617de6ca723399339bfa0e60d0a7d70c6f4c5d73adb4cfc3fb7d3965278
SSDEEP

768:woPY5kJa0Jw8taj3MOulQBY+a92F99qB9f0xg9LgB4uPldhOEX:woPY5kJa0Jw8taj3MOIQE9cUB6gm4uPv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0017fdd7fa0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a44a30db32a05d8a6b447681a9ffc4ab42504d9ffab4bdf150a13a9eb7f785b7000000000e8000000002000020000000102f44565c7f8e039d1e14813ca70bbd152276394ea469ab15bd342d8e1168519000000016e14c69577a7b92f72653984d972ba3f6642892b1921117deec6f9c0713e1ac84b0f9d49c646cb136d08cf27f690b313970b04f1222e231ff141b8e546ae6ae635fcbb7685d4859a65fe2e3ebdcc862719cf91e6e76a551debe72a043598724d8f071c84b77c57cb89e4b03b4b0455390702614cbc537bed48806c175133f2f3f43fc8649ca571a802c3864081dd20540000000d07a61512c92c0c704095a91737b28cd2c1a72c3ed2acfcc47a5a7ecbf743ffdef3a2499cea86032bee6b0d8137f34daeaff1b451600e0e9733b903dafbca696	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF84AF31-0C72-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a6f1b99a07cd5001f0f4eb24b787e96bed37594f2750386564fe9a47d6b6daa3000000000e80000000020000200000002f0c93af0c714c4dd168b30fc80a820306c3a746ecd7cb3107a8d0ff9dd5b20f20000000e5036bf6fb8dbdd8a5cb733c72607cf27885c1ef8dd08e71b3317f10d968851640000000ebd1e0776d5bc7d51b1d6294bc694e78b7dd3949aa20aa997e43aefddbf5b9424d20d37336d948d5431183c26b1812d91967b2d85a8641b3c61eb099b9c48d69	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421249195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1536	2292	iexplore.exe	28
PID 2292 wrote to memory of 1536	2292	iexplore.exe	28
PID 2292 wrote to memory of 1536	2292	iexplore.exe	28
PID 2292 wrote to memory of 1536	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20a81cacc83f7034e42b83be6c8219f9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72f7f9a52f16f3c048ce9b0fd551f230

SHA1
6a4b0be5e9830aae99e477d58f5d8214f32519ac

SHA256
2cb22800591ea5cfcf0ef20fb7ad5a56be9f1bc08750a776e414edbeff795189

SHA512
3297e66d0a04e37698ef93c9b51faf36321ee289fe204c1addc7947927ecdc5b9a6107d004fda9d29e46640e49be02702b1f613036f48bf6da46d741072ea25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a66c370fc1df5a08e493e6e2096d0f1f

SHA1
6c858e397e557e42f88578e0e888643c52f54924

SHA256
b944510d705c9e9a19fac90aa167e9a8f56805a1b65af2b0c5412eea4cdce6d8

SHA512
ae056c12e93106b1828e5768ec6963104d1af3dcd0168bb78c0dac0525da0ebd4afc3a2640afde7a3a0605e2ed74e89ba753a702ee71487c2e55438498b6d3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
937805239f79ffe3919e9e988c233d02

SHA1
e5c7a20c920af19ef981b612bc8f9ff470b36d6e

SHA256
a70956b8ae1ab0065d927117eacc7b8ac13869e87d8611eb27843d6159c42e19

SHA512
9dc838b4fe5d7dec9146ff125bae49db787593396b5d01e020360fcad8ce0afb093858cc2ff4107c175a017cc8a4e565dfe818634f9045fd70e060aa886dc7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0230c6c490e2ff66a027cf0aa2cda67f

SHA1
bc87d439b6b51fcabf8b83db1ebfd054772e94d9

SHA256
20e6faa2c50433debf134c271d554620a46b0ed8a5bd7c89949e61e367485ea2

SHA512
f563f02d9699675d4f1490746913573375c6a5a02c051315fb8e9f62b68f04e05d6ef238d1df61d81e50e02debc2d6acf5cdd6d9437579f95bbd163a2e0540d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c7f46da6a855ce3d20a934564b094d

SHA1
56b26d85df43523ecefe9d563c4e112a7e7b0e4d

SHA256
72ce577a096e353c577ac38d5347df5b5f58269cec20be96cd35e29d288cecff

SHA512
e9863f2c8c0abd8ed14c1b563c1ce254be2c00e39428816dd563a2e62b5913fe8e3aa63e0a65b61b294c3a70b4273cfb28b5d2f2783348a1af56db22d82b648d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a76e5f9b31771ffde03d1caf23e0409

SHA1
f9e444cd701186e2e79316027afeede2b70c8b6f

SHA256
3e221e895cce6b5658a56d28c358b3e993c46efc7ad5f6e85bfb8b0b50241276

SHA512
2e27e549bb63e37ef28eb4db4d2406fbaad12ac57f9c371b8129af0a437405bf7c12bc985b85153b1339bf58b2bb17fe7b627f472506d49faaea1b386d28c040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a60c64ee6240e2914d9b716d3bfa0893

SHA1
6cf0c5c92087044fe3be5e7b075e812aed55efc5

SHA256
1902ec8053a6ce676c3f466a17577a90ff4d3e1577de8a70a237b25ad6941053

SHA512
eddeb2a8b62f67ffe546399b159fc16cf40b08ea86d83714d0f062002ea68699abf672ca04b2e56ba5852b2abe130c6a7cbb9259c9313a1d038bc7d5112e4ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30ea7da81eb502060b2d6c6809746847

SHA1
3d3734c0ad32ff8743f0ac63f374bab4ae60498e

SHA256
48520df5266f535c951a61bcf1c880c234a24c9cb9d08f18d39f5088294b12c2

SHA512
c28d3706d41500ae7681a5e4ba38d27423e8c8482925b64c1f52413e04b1b8073cdc1b51f4672ab90f452bdb7fafb96c928ee673d43c7a860c4f88c6e0da8492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480129aa493b82b5126d7471dd6fd116

SHA1
cca2bb4ee1b5ad0f0bd1de0b09045231e91fcb16

SHA256
24425a21e80afe746a72e3c57523a60dc1d22b02b8f4ca8121234afed91ca05d

SHA512
ca2b880f3a1e17229a10aa6b636029302efeabd207909334fe03498101e2c474322745aea0b2d72cd48f249805d7588d0eb5f4e89adb8cc7c6a16b0d78874275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21bc905c8195f3a146930ece16d486d2

SHA1
0e7985bd563512a87fd6a782aaa45573cdfb852c

SHA256
b2062db0e3660c812f225ad14983abea0f524e7f019da1d7e78caac5da29efd8

SHA512
b0186347a31c87c4bb062a2cb5a3e322d9252e2bb3df96381d72ceebc64c1b6f779d8c6450a91212f43fe302272ddc1a99fca47e0d67350a33e9b4286f9fbb51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8f448d32d883690178c2c7f2333ee14

SHA1
661c2908e81baaa5a806ac1281630e6adc0828c7

SHA256
cf99b4b15808ea4387894f38cf93ae4950a4fd0ecb8089993c28c6bb82d7add0

SHA512
6d444f59ac7817f8277d90bf9f71e3d6999e04e5c547daf90b21f8fd1a57b22cee7696ed1c60b06391d2334da6bf9b74550a322c09f4123d3305afd54c409689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b8898762f10be1df4f6755e9c0f04e5

SHA1
e93f1ea4f2b2924a64612741a6a69620b3272177

SHA256
8e5339235409d6d7507bf976e84e780da19704674f15c436bf5ae0674bad347d

SHA512
d28a27c0764e5a91466b0ea5d719c23484afb13bbcf95487bfa26213b2c950a6973e5a17b0b09d634bcd102e9649ccd918530f6ea6975aa14f197ee3faca7411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b90d64876704e051372670841c23cfbe

SHA1
aee722599c1b6c49846951bebf3e625b5ae4b420

SHA256
4ef0a0fb5db0fa088ecfe62137c32367db222ba83bfaec9740993d4c2d9d2895

SHA512
89831b58b6141e743785c3872c5a19d4436036723e62eeba72eacb3437163b0109f08b6b3cfe66801a65277cc78ee5ece9029803c50ebe42b622d7eaba532ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4c684d519573aaeb7f70b976860499

SHA1
73d8b1e564e776114a5ce1031501f5f3438fd2c1

SHA256
def6e6246ecc4e4854912b2d2077928078fa8a4c02dc822938e84b90ffdce057

SHA512
53210d67dc91dc4478105364ce4ffc385d7106ce124b126b1db2b7d04f5b9213ed2cfff6f060a5d78cb7c64c0de6d2fe8c805d5ac4816cdb26e888f0011cff76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77362c78ef91b917d303c446d705af75

SHA1
7d626690ae3f44190a8012904f9a5a17d445fea8

SHA256
8313e0f214e9315f0a4541d933d0445bcfa4268ad52a1ccf38e47961c8bcbfec

SHA512
b22d4059dd3805c0320955e687fad85309ecb891741adebb1af6957ba4416b9ab9a47186630d039bec7b905b0af52faeb6cb6d9f9cdf63d2820d418044b02194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee492e0b1af76ad365da0b38885ac3a

SHA1
ae0c1fd6cccea5a3b0601c6faae3cc6da3de67b1

SHA256
e62ceacd40617c11d3b182c0ccec391945c5965b288ede7db4a13402dbd89704

SHA512
d01b633305ec52f3e9beaba4b4ba4f778cfb80a92da4311de17b3e1c051e414f4ccf71c807fe21c93ff414d6f05545957464cf22f03d8ffb1c94ea55be6dd1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41DB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit