c34e34a5f6ea2b468797cfcc54542c2c2585795e49efff3a1bbf7ab6d716afe1

Analysis

max time kernel
139s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3064bc516ecdb091fac2cafa1fd185f2_JaffaCakes118.html
Size

67KB
MD5

3064bc516ecdb091fac2cafa1fd185f2
SHA1

9c12e619b4dddc253fa8e0534729d603f93b6971
SHA256

c34e34a5f6ea2b468797cfcc54542c2c2585795e49efff3a1bbf7ab6d716afe1
SHA512

b141a18d5496a12052fbf8ee23f16a5378fe72e2994af3d79d0fdf10b2ff2d3752e2118188a3568ef22a45d489a7d0a3b913e5e244f64d60f38b35ce99cebeba
SSDEEP

768:JifgcMiR3sI2PDDnX0g6m1wXvoxoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:J3TsAGTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421526720"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000425e775d07f6b33aae6122d3c5d2c01866cc5f344995ad1d0f1d527cd71fefea000000000e80000000020000200000000b52a67aebe04e693ce8da10c2d7661bfb00c0a75cbda659e1fa2cf55973d67f9000000079f835f1ec67372768de871766d4df74bbbc30f04c7bab475d0813c9742dbaea8a464472b8bb039a56fddc113e89e5b8b76b71fc54f6f07886835ced8179ebb0082747f362d0a090cdc493e0ea6f1a2e353486f21b34999232e9d54c76a49ef22c1196d32b24747ecb67b8821a9433b823ba35f90fa268cdc2b42b96dae1ae50397e7435ff5e96c788b01b66cae7dc8d400000003084ee8811823f511db04b0adf673bde4ac1e26dea3ed8cc00e0c4ee68a4635296aaec572616ab8dba7d1b5a10473019aa6597e62f56a7ec2e7a90129a2bfbdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19673B01-0EF9-11EF-A336-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d5b7ee05a3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000da4e7b3218bce7fad800a40cd11cd2903caacec613fe464970bf444e7e90e678000000000e80000000020000200000005976bbb8e08813598c2a78a0e124695b8edfd35c189f42aa145afe5803007c4e20000000965290987f68df06c5d790662ac61424f518bd6856632932fbbb1bf0949a986f40000000e49d373d1f68d5cb8d46c8b6a3ad4bc3eaecba17c3c0d098dc541128d3c11d20f8e99eaea3a1c49e8b6df0745c908317aee9361f8e6723e4d0e653a0b83569be	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2908	2184	iexplore.exe	28
PID 2184 wrote to memory of 2908	2184	iexplore.exe	28
PID 2184 wrote to memory of 2908	2184	iexplore.exe	28
PID 2184 wrote to memory of 2908	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3064bc516ecdb091fac2cafa1fd185f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1367260d6cde81e255db7694a0da80a4

SHA1
e177ca355cc591766240b4241ec7792ecdce84a9

SHA256
ec15691fe3d2dd9c5b93d6d724f93a7e644c1aae354fdde42b73cccf25ac3d05

SHA512
9ed7dde3bc6c2bbf891b399b340ad5ea92dcc2d26dc4e65ba4e20c56fdf1339b7effb05e85dc27895c9926afe509225d5ec68be65c3194cb54e41a780a4da1d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4d8a99e6487749545ae40fd54b13a6b

SHA1
4625575f1aa142587b6cb667d6d5f673811a0999

SHA256
097162d07fd7434623d1e253ee7c96db443a044680233ead08a0d5181f762057

SHA512
ef2523858d74e3f5d7026d38e4cf21ed89211a75339ff137f44551b8c6e3e0698a18366b6ccc6103329a2bff0e845b7ea39251450922f9b373ac19ee40b48f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b8f591213a11b56bc6f434a31906dee

SHA1
966e31a84aa4553c259b8c666548d230428e0911

SHA256
d42ca1392cf2b3b8e091890c1727fe1f9528150458740eb5621c13d5054b6e0e

SHA512
3386c6680ed1bc8d4dcff118fc5bd8e8e4d165e8dd2fb4f58e04dab9f7ed36095e2114862af6eab81f3e0427cff3252b012b31958462c5566da12a4383bd7299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e733290f7235981174905f5b80b83a1e

SHA1
1329e16eebe4e2aaed0f2cda73b093c4d515218b

SHA256
6d1a725eba444d0fb8eaba8fb070b5a82ce840b0ee24ff327026837b32640577

SHA512
48ae7e1de49297e1d07e8c1286f656ae0b6a1e2e90d052f01f425244bdbb0ed3a35fef413882ae084fc998a5956f6049622cf475d5c644d2e8a29e47059253bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f0b6b5e1a15ff42bd5483bce5a27c9

SHA1
3f40da4640a175dfd6e914021b4236f9f0bdd60f

SHA256
2e177680e3a2db2fcf92033150efc75f23d676971aa394270331f9ec6851b221

SHA512
ad4d3058f5372e2efb6ddda798c025adaf0a7f625413ea6d3ef8612b448430d036bda18223d1b4edfae3cab7f49b3418d3e962d4f384f85bdf33e4286c84f1a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4f0ab6957911d9d89157b36eece106a

SHA1
6a6985f7eacb5567d34b5ec92ad6b5fe41b09591

SHA256
78691a414813276fa9cca9242d76690f1606ec2687efcef5b4c682c35152556f

SHA512
1bc852d8754bd276620c89203f2437f311b4c9273bb29d259af3ca929eed3416651f4c8caa4156ca7316d2e8375a380822a7270ab032c87736df6ff6e5995433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc49dfe744fa0505c9c7c76e6c3f0ae9

SHA1
fe31c4a0b3acfd4c36d957aea1b80dd92716950b

SHA256
06dba9045513e8de09b9cf4009d198fefa9525acc7d2fc5bdc9d8993dc6ebc52

SHA512
186b6a8ce33644ab7601ea83a126bd391d0f6fe00e452ce03373ff96afa21b2a338009bbebfa8921356467c6d8eb83bf80fa4ef3751fdbb3341abc4f711b0258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
519511abc46603801e668a8e82435b96

SHA1
079c7d140fe97ad4e434eb7c546d0e5fac4bf8f7

SHA256
72b3a3cf7ca790f7c878a77c68b2728869c2c789b130a42e5215d40b8e493128

SHA512
5bb8bba7c40ab7f6a9b07394290e13426d24640009dd72fe798f31359f94d5445d847fbab798fdf4d114ea382c8a0e64d7c89efdb5919c5317d885e0bc1b0994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c8a1b75aa3547ab1c93bf55d5d7c93a

SHA1
2137bb43f0c593a2b31c036ad2b3d54f3587ab81

SHA256
bc11139992da6ee35a057ffebe42b4ed1fac1444465ec207a3e9cff27f13e81c

SHA512
c737a6040b33d5177f1cb951d33569c88ba65062a3aecfa30797acebe333fa20620c7a40d9530bd0f7c60ad5914ca4a8f8df0e14ad1fec781d942f6e3ca49c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1574174068d6e0013aa305ea73ed7997

SHA1
6c2ea0e7965704935021bb9d262c3cc35744ee68

SHA256
1404574d648f865722109d6bed85dc34f6e17a42103bf79af14b72b65149eaa1

SHA512
cd4fc5ec819ddce6bd56bd42bc2e7f5ebf4e6455da0d6359e6d2eb8dbb38198b9a20596a15b6019f274592a5bfcba0a06057da0c9d51bf7893f0a9a1ad22092f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8d3b8252fcba67caa5607adffb6883

SHA1
19a7a521ab35d35f9c3820a3d43db83ce183d507

SHA256
57db2204995d53d59168e4c8c12e1f64700559a4ff87d710e29b232eb204fe77

SHA512
f33b6a68aa8c90de673f6781d5a5d498b8c23f13abaf08c4465ff43bff3da85f5c1850b4d19587b315766b602c7b542f88875c33c73cea0a28ac38cbc5b1c7be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8807c8095dd70dd549a58bfef4c48e1e

SHA1
c129b5a8b2148ec6bfcefc882a3d6bb869e62aa2

SHA256
7fb0557f6cc271fe3e091486ca2029d49c9fe66fdfb5492e30c13da0b1c56e89

SHA512
d91e5ee316c6da3d961ed226b45708cdd6f0f423ebe861191752d594fb8e6ba684d24665f40704090c3533f6fd0dbbfb8b3b9cbb6709bc133df0f2e7c69627d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dad386c163856ea81c74bf04726ae72

SHA1
2df38f77495f1be7261cac41ad32bd563e1954fd

SHA256
8d86a9d0fe2fc2c03d6713dd6c602af753767163632e0be3ba8dcc380b63a2fa

SHA512
1624042b7e9749544ac16a151a3fa7dd721cca534778b1cd682f36fbb3ee8805aec74704d7bd2ec2debd70074000340a6214f37de51800dd1f0ed6f8df074cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ba3e25c0636953c2a38e4402b904426

SHA1
a1e7dc8fed38194b6f0567f92fbff95426e1f540

SHA256
cf44a5f741d868fd89e63ee7b9c9d256b24e482ceadbadf2bc9352cf77c6a751

SHA512
97979b24cd7ca76873f2b0c3d0f08df851ea4a32647423803c1f6c0a105f80b585a6d0a40ca3f8ee23516d90bbcbb0f927787190e84f6d24615febf9bdce125e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60e4b8ebee8cfd69978c67b6e4f210d4

SHA1
116064b912a3aa8d53cd0eb5a982d1ae25642146

SHA256
9db489e3174b5f87279ae9b44e6ef5f386b093ae58103eed3765d130d500db1b

SHA512
9c564c5fd4be71fcea12e2ec503159e01009006022e30b6c950b0cd487eeaa4ea4c72b2f66b053ba49b1a68fd2b64bb3b9e019e8903573eb02fe74a4c9e3f13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f14a786226f9d6eeeffae6d85ac490

SHA1
71d848b0a8a4ed234d4fe1d36c0f0beb021a731c

SHA256
864e5ad73655875a2076c26cfed04130f65e6beedb28c6a7da6142ae85f49634

SHA512
0ed07bbd2679fb859c378b73b7768cc44f4a975b99afe27a49b9114406452c0b85bb6e5029e2105a2f1f2317b1371c61d11c3a6f16eea13243843b52a5408f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE9A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFAB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit