71f90a9168adc0eb6a1f53f06deb33fd70c044726a89ebe0d7ec670348d4c4f7

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2811f3d0f384a244c79b2a50bff2d09f_JaffaCakes118.html
Size

221KB
MD5

2811f3d0f384a244c79b2a50bff2d09f
SHA1

32d2f7463c290038ab07e86c78340c3c15e730f7
SHA256

71f90a9168adc0eb6a1f53f06deb33fd70c044726a89ebe0d7ec670348d4c4f7
SHA512

28dc354f81685167c093c88fe1325117b75c13dd98dfedeee76640b88dc6d617cdf203ed0a108bcee8538a525c97286194ddb49eb6dc4a8bffce3c123c8c5e0f
SSDEEP

3072:SP654hCAOzP8AyfkMY+BES09JXAnyrZalI+YQ:SCL7usMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421386862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79189541-0DB3-11EF-85C1-E69D59618A5A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2400	2116	iexplore.exe	28
PID 2116 wrote to memory of 2400	2116	iexplore.exe	28
PID 2116 wrote to memory of 2400	2116	iexplore.exe	28
PID 2116 wrote to memory of 2400	2116	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2811f3d0f384a244c79b2a50bff2d09f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d715151be5086083e8803464da7f6edd

SHA1
785d47c4a976897780e154699b80b869b804fd03

SHA256
ed863c781cd97d037fd14539b8de02d0c3ed76c7a0c7ae4d79e4bdfaa4d5111b

SHA512
27f12b487ddf315be228587b5562bc97465b14141699eb55f51a2da3beefc387bee1ca96eaf8c691059aa857b12403bb84e13313c87d538147872a736f826c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4816cf29012dc72f7ee7848a522dbe5

SHA1
83da4e17923edbfbd4cc87c57f5bd382a44efd1d

SHA256
f663a7239da6eb6c3895002c4fbf9f2e3d7c8437d35366deafecaad709ff0163

SHA512
00e0cb6dc37457f8401b8c6b0355f46c84bf30e57342a8dea61086a31cddcf652605e7ec48869d3d0fb9fd3c68eff73e62abbc1ed719d5055a5fbb91c0cb14c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b93eaa044bd3253028551fc58ca27d

SHA1
2f7f327f10f1d6e1e475cd2fd65613a26813223f

SHA256
ae773d5f1db1025f5e31ae50008e2e9bc5b344e0c228658bfc4d950f94daf5de

SHA512
1d21b70cbd8735e02fec8b8454d6efa0988468b37707a1513051ea208a9c81aa2834ae17062f8325f38f82061360dc1eee7d0e44fc0dce76421b4eca346f3fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf50b297a22629010ef9f5f3ac4e4c9

SHA1
38baff9611e37879b9e911c1fb8dcba261e604c4

SHA256
260a384574c1e35738e6d274c80f58aa782ca41b369145a55f58d9e5cbee87bb

SHA512
40ccb0561e3513812f6967965a80d978b00f4cac3f9fd6efc0f99395295a19c9cf14b3e055ed5b230342b12ef270da6d192a18f1d18614c22b750e42b6045781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6d462539f7e432b0e36506196288700

SHA1
0338bece169f6e45fb935020a3911c1cbed534ba

SHA256
6302b9f601a9b2cbbc2a2feb433f50d36bbb06a0f2f1d58ed33038b62d161552

SHA512
23dd1912ffbcb787bea2b4f44a8316fc1ca73b8ee97c9c6f494169e2ca4fcc9870630325e11853c8e9c6deeed24d5b731ec7f9240a4e96548b5c056c50be45a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5710ca166de6bbfb6cc47e94f7227650

SHA1
bc67658b4457bf3c83ac8cc6ab9b87151b78e0ae

SHA256
a2372763acc8a0086dea48489190b731fc14a0cd05827299f2cf34a750a5fa25

SHA512
8110077dd70833221c626b99e1cd77158ea5ad2b4428c207c11187a19e35831a50dd6bafa4e822ecd4012ee4df4e93631c9f90f927e51cbbc412f455634644a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044e3140b0ac25062cdf5e666e269a18

SHA1
d5836a9e09b46b0c3c9f8c260894a25585d80436

SHA256
6e9247da1fd7815e6f8d4fa2156d54baa86db35109049b7c60a6518deb08b1fd

SHA512
184f8332cac761fde8cc4c63f5b35ae0dd394f67a6953a2ef5ae9e59b716d37eff75492a2905a773c09e7344d702d82e15f39154e0b42e730f5eb676a3c64efe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2d873b6fdfb15ffde90a0c14453af5a

SHA1
aefcfc7f80b0d136eadfda01b3a3ea9c44d74260

SHA256
a21dd76af334e1ed7a49a7a7609cb1f39067578c930d003dce0d07a2637821e4

SHA512
0bcdad3b5d6d6065b51d39c2abbcc3bb2a1ae28a82b5d10c2b805bf86628dd59868211df5620036a534a8322c30730a2b0054ab4e5a2f24c1e72546e65b0c136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d2c9ddbf5b14b6459797177eb4629b1

SHA1
7a2a9213a22d3359048ff8159e1cd16dce907b79

SHA256
20f6793e785dcceb3432552c2f0b66997d8606f85df84e271a9592634cd9ec00

SHA512
4c00218e40bc24f403febf0d1448d62a9245f9ab0dbc9c84be9ef3629cb99a0efb4b86d28c2cee9ee14fa707b04c383733d6888335d9f84f0a2a8387d71ee47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84300b20fa3b5d436ee3e8a41b6f333a

SHA1
6830ba388d210ef4cbab3f7405f53bb7f13c517f

SHA256
cab513db02df98f35308033a64ffe222bfc8604613ca9f031421457fac1abb7d

SHA512
25c5489d7ebe2d6949d99c618138f53f5b07a4df038104c8337bfd5bfea54241e68a9dedb0ea10bab7dd7bdb3784a0d21a26292b0aeac91cb842c0f795b8ea7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9854095e852b6992d073029178b56322

SHA1
21ba0e9ed3950a578806ee97b285bc7a83fc3bee

SHA256
c0a8303bd6ab5e43fb446f45086bd24fc9f492a3750ccdadcd656bc80535bd65

SHA512
20370afb9b9be9e0cbc24206d454a376c948a01f8592da9a52bdcebc9af0e10a7794670d8ba5be69ed83bf557a15c73ac801664748022b9955f3136541157876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e64b34111c5e92977072d43104f56b

SHA1
e5468ccc75888193edf6973fde5390f340ec324b

SHA256
1d0bf50b581df143e1109d7da260fd9de8eecbaef342a86491e0118b81f8b8aa

SHA512
beb511653c49e5e049bfa21f5907fcf5e8c0cd886691fe39816368165a1db62f59e62a8e38973a0b58bda983adb4265c4d8a21f1766869d88b964ea7e2765c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45cce2402cd739b7035d1bf71012a2cb

SHA1
7a99acc3cfbcc94af106ead8561c2c42a6d5115c

SHA256
8e4a5b3179f730ef7cf03cca2221f8a26b5744806c5bdb56a3f175ca9bed7218

SHA512
8e5af06892b3a401c344b43311e9d17e2ab846242dda8a996138f6183b24fb3adebc15e0b89404e956a5d24d63d91c7fd343b0025623780678d7146de416cfd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e35fff114ef5b53829bbfc45b748d8a

SHA1
ddb6c4c88e2242675b3c30e08de767be1680fd01

SHA256
85442b6e9611a91141abad82baab96a18dd119d9d83d9e4f9d59913b1f118777

SHA512
1055e8daaa5753ab5a5ddf356158ec77a659896d0798f7789f84536c9a9aea61e1afc244c3b8bd061fa9b722e8d768e3e3a66e109c12113d99ea03cea1606ba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50fe522d11316c30a5868ba4a2ddf93

SHA1
b47bd16de573aa9d8a56bb09636e2c424f6e285c

SHA256
926ddc65336e29a7177ba9a774ae8fcb0722d29047a93dd24e752fd174923233

SHA512
5e551dd77e5c0411b31c9b03e3bbc7c881edcb52e4655e8c527d52c4171be62a4e0245b9f54b17fa48f242ef71f6707532c66c7e0f51caf5c2e9a01b1851b7e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea5734bffad37460d310f93999870e4a

SHA1
78158e618f597b3cb5203524843462c2a9b64cca

SHA256
dd6b31ad71f8ea8bca89bae887e66583d5884af89d4c473baff375b0a51ece71

SHA512
c9b717dca38d6c6aa68a9b76b2707ba0b6d137392eef7cff42de7de4fbee0dc0ff83e9c7c036a77ee861c7d0fd2d54d7afd17ea284e54c5a588dab0024637b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd76fc3c727dc9bc9fa2d878ccac8c20

SHA1
c4760cea95a65096eaf75db7474c8f8dba1327f2

SHA256
49d5454d407c57075c39faf118d28961a07636e1588b48e009f198a9439584ad

SHA512
c6cef617a20675ff422767b3c429664a7eb515444dd57ed7f2b8fe8f2f7b5cc3a576c8bff65d15d8cdb13e6360176a6ce170d51257d113739ac492d16fb7c86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50e09dbbd43a261088ea1745cfab64a0

SHA1
90d68fcdeed81dc17a054358649354eb973b0f76

SHA256
4755c00a7a2d14c6d508d03b6f61db1934645748941d0462b2082e1540f375eb

SHA512
c94b6992ab64eb69fc26713ca89af7628beff9f035c0f83552c7b263b63c2860f1b708847320d484118c935f6fc383ae28cb560a2e0534d4845eb2eb795eeb10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1bedde6fb45c64b9446f945a5ff29de

SHA1
b344ae3c6f888551e6bdb885415edd78c1a42eb7

SHA256
03554d612bb966d4d278686f3dffd44b5c597544ccf653f70a98a1e2a7dba64e

SHA512
c1412e9bfabeb98e3f1db2a296a14a5814cffd6cb3b815058421a84b5291cf8c6200de8d41cfe7422f51e94e8371c1a55a4e2d6c780c25b984ed03c9e9723e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1509.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar154A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit