bd6c96b54576a5f372c6bf045952edb2789dc62d8e11351e976f0556a7faccc1

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

354a839238cc77c84cbb3df71211e15a_JaffaCakes118.html
Size

21KB
MD5

354a839238cc77c84cbb3df71211e15a
SHA1

a7b43e223426b24c5dd9241ef0d965d3be4bef10
SHA256

bd6c96b54576a5f372c6bf045952edb2789dc62d8e11351e976f0556a7faccc1
SHA512

a9d96fde44b20f4efeb278a8696cb8b66806e3324d15dfcf74c11fbc9d00864d0b8f5b0dda49bf113988603cedccf6d141179ed2c5a81e6274fb5f8ff4cfc232
SSDEEP

384:cqdvUimF6cbXvL14wAn4hsJSpe8eV/eSeGeReIelere6e6elpVwg9fhbtzrb/3py:cUbcmSx6C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA864C71-0FAB-11EF-B826-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fa059fb8a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005e2178b0a497236bc45d9509652724c0d350af252e846b974dfd8da564bbd08f000000000e8000000002000020000000fd0e039e9116c2cc3b4dfeeda51a6927657b4d7781c6a5e144a1d8b83eb7da5090000000061a515eb3bdc81b51d95405892c9963dc01b112f60e8d5ff6f79da7151bd0f75c100b3494386c66fd94941adfe2d01c71ac20d0cca2d1ec0357c93b94fec3b76417c7f2e72e6052cac02261a2e3467c9a7b7528b9b7d45de134d02a83700e3085d42ba61c92e57e6e9dd44681556b827df36c145c24aad0d5d5abe4e51be7cc3cf2bd6484fa972b6cb3d7b4b3395dd44000000059c571060b765258e419bf3def38448a3d9665647340ddbb96c5a45e7e31ca0c721b929e69e65df391b5db3562c1305a6ebc602f1e95eb09f793e05b1ff548de	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421603466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000054c7910bdec590898dd920c534cf3f874ece50348ce1bcf4b1374a4162991af6000000000e8000000002000020000000b003f1ea76c35ff1a821394604c524ee4024377bca7482bc0e4731a2f3e034d9200000004a0b21c575b5a63705eb3e58d115da3f0ae4b6a5d3e9e3d3b26273a8425ab1c8400000002d966a14e03b5d55d6a303c419581f4570a726100ec118dc4c8ee913f54de7ae0cb20f9d8cf899077873e671b7526655760b70262529ff1f10590bdccbeae6be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2144	2960	iexplore.exe	28
PID 2960 wrote to memory of 2144	2960	iexplore.exe	28
PID 2960 wrote to memory of 2144	2960	iexplore.exe	28
PID 2960 wrote to memory of 2144	2960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\354a839238cc77c84cbb3df71211e15a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4da3975bba12bc84a3109c1c95be315a

SHA1
0e80753ae163031463d010fc0be111a393043c71

SHA256
6cac2146ff3853a5394ecfe904b39fcac9d1385d5703f0d71d446e3e9cc3cf59

SHA512
c3934887778a43677defefd54a0ee8dcb97ad3b0206296f1418d73305ca0b87a712c7894a4c43ad478ca87a31f13e35e344401aeaea6d537b35256988cbe351d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
407814a51061884516ef1a54ff37d665

SHA1
aa1437d7fbeda4bbb9411b9bea240c3afdd6a8dc

SHA256
4394d936beb89c5db7763cf9027f126d2d73fe34cfdac168faa26c093b26385e

SHA512
eff7b555e9c68a0bd2d55a2ddb8cb8426e7056cf0aa524158d7d10d54e7c39dd0bb06f06ae5248c0865b919c8b6d7a1d99c60c5090b98516ab0ce188b56da351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
296960462ffa96f5f0b3e4d3208cf206

SHA1
1f0483a2b9e38275772697006301ec16d2e7992f

SHA256
56da5b2073a309e429481c5448e744bd4ec0d3c6b8df8fdfd169b77e1be781c1

SHA512
7408810c4172fb576379a6cd16d0a103491fcb829715f3790c8b88d7425dca7333ad1a1c6bfc4549b35031a32b891baae50a0d76f4d1170876d30dae43743c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0a8574dad238889b9c12966f0d12ef9

SHA1
d1d958d5f7142582545fddb2971539dbb321281f

SHA256
b42da533f2d42e1190dbe4b76f5f751a1092cb57a5cbb2c084c7bf1ef205988c

SHA512
856128c0cb8830ee5edf01da7576ffb7fe9b0d3ac91cb516654d29accd7b674aef42eea7c87d41841de241246c4177778b57245df562fe9685fb181e2156a0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad3b1022d13ab6073435c25be24b0c0e

SHA1
6d0811251f3ab34acd5d414eea51d164e3f4f3ba

SHA256
78d8417b71149e6bb6ebc4f35b0008d26fc3f7493a6f2d19e12cc8af0348cf62

SHA512
3d497a813c5c1bdd7bc42c7c250e5ded1b21996ff205632dafccffccfb9b4814092ecb9b030b0b8268ce873de544856088f930a93b750a5c1e8f7ff273e4d4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3135a5f0b1232284797e87f793123912

SHA1
3df6149759909fd16059beee946dfdef261fb073

SHA256
f1f6201136976e90a4a134eeca07ab51a80214cea3e53f9466471b4e5e237a2e

SHA512
4cff2cf9cf68b0051a250cc145f4f9916fd9e98cead826465e346c66f9d68e0d072acbad772de2a77bf2e462cd8d255ea4f40335d08d1b35cfa5d2b40f466eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7011797f3a0aedb0f526d8e9596d62d

SHA1
dabe3cc5ac258d2a703488bab18c0d3f220d7603

SHA256
fceef593eda064c1838230061aa12095b89018736a38d9778548f8ce6daff72d

SHA512
2bb5db3d4d89595e2f46569fbaf47a4110addf820a6a19c6347679f93264bf8b496dd93e271fa62f6d69c39d2db3d2fb2ef6a2161ec5e788b88f2d8794b4522d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1ec40377c0f20b9af8fc4230c8f32f

SHA1
070751ae349b489b7a353f00467b07c64e3aa268

SHA256
f2df8fc110352e85379a31b5aa12f44973e1d3f9c66d8918ad4bc936224717bd

SHA512
20fed718c04082db80597c331b488e96bdce2cf23daa87a5ffbf9740d586ea26c439fb8f95c30b80714c64c9705525bb05407169d71d81cc9795c010230d1b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce9b707df942839b1bfdad56492aca8

SHA1
531866b186cf2830ec2711cc4a4c78f2e639b0ac

SHA256
264fe1b14ce86f5b1bde9df83da746229433cb591091e6673ee58d597089cc5b

SHA512
3c8ab01dac0d0daa3157d3cdea27570988c8c3ec420c1894548824e81b3094c96c94494911889171bd803cc644f0dd465b70b800c09e3c01de5e132d66b6c5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90990b7f32b2cf1af9f9f34254c730e

SHA1
09776fadebfa75e2b7e44ad0e9b4c3b6d938365d

SHA256
23d1fccd7a20b81f42cf0c90fc60f38a5fb1e073b2bb23d025a77859e2d09a54

SHA512
2c592c52e81eb27d729006b2d6158c41c40e7651930da372ca96b8b8ef796f8872412dc729fd1f0b60bdbe6a29729316ab8fbd32cb9ac0d18101855f49d2f812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
955fb8c55f45a9d68fbc29a182f87647

SHA1
02f9a5dcd59e7e8b38d858efeae247ba2110e3fc

SHA256
952c0f064a4863bdf79122a0759aac9816d710ba3d49519d300a57a99a644ce0

SHA512
f30c65f33b886a4dadc4e552d9b8369533d97665737c169cc008f44ebde318049b362cb0091161d821f456a3f831071f5e76d48f923e41273bc8ba8f300df2f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04627f7abdff7d456b260c3aa0ad95b8

SHA1
f6ce14405710355640415059afc50573fa5d5e00

SHA256
95574f06578394f6f8f3417ffc4b4e4c7c22b54b74480b417d8b56ee9d1bed99

SHA512
e2468dabeba9ff8141008fb238361a4621e34aee4d09f8bf6cc1d7684414644fb5415d20d6658e4a6b4a5426b81063bc66b2ff1b695f0a88f7b7c9637f563a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd3cd58763eb1406e20f905afcadcc82

SHA1
e3a0cfb9fa595fc69afd5ccbbfd5efceb056ce57

SHA256
4380e308a0f9c0f5e500cb01f1311ed92700485c8f7f2b0af60c1948bb34d90d

SHA512
cd8769f543ae3c942a7c9ab836900edd382b98752737c0bf0c2b005c6a49bd3a3d71dda7e5cfd5b576e25c023688f0fa2e510701896e5fb7e99be22413c6af7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2425d18e3c0e140e76e611653d6ac330

SHA1
d2efda09b72d42b8d6ea676a5efac5b1b794d21c

SHA256
4a60f70d3d7e0a3d89940508eff9b28286334223ff1c9221344839092f2701ed

SHA512
5c655a1b23aa8680b4f1eadcd7df55d9cbd77b8ca8763dec429eb760a8e8db507e294a17a2878b8816ff314cebf84a981ac29c7e59c88613bef3fc0767069eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0e8f4b51be9cdd04e7194a4a2fbd8a3

SHA1
4279dcfe894282e21842a6a9a951b0b33cba5d52

SHA256
9dfacf51c816f5fb555f56f1e667d2f61ca05b5b3d56d80e26e835e09bd7dd8a

SHA512
7d60c784e595277418e0e4f7d1e68428caf8637d9ddaf9585dda2d6df0e8642a413b7597c187cc6b1e6d9ee6f21964224503bb79eaa631d87595032a225e0220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45bc599438d52103d11ea520c91522c9

SHA1
d2da3495dc88ea41d2fb8089acd6a2214b54dc4e

SHA256
d952e4ade976cc5e785d67f5c920a508542bb5a3381dd2dddc19cac53a1ec58b

SHA512
a7660e0fea414dbe10806c0cb1f473df450bdd020ed8e1feb396c37c84bcd2790f765cd9e07ad3e49a0d03f57b734e3aea44c0458c9afc3f8d26648503bc2970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ee2a4c24ec76eec757184187486a7e

SHA1
8507ee8a55989a6176360c5f49e67a5866043378

SHA256
98f01b1ce7f69414d497ffb1788e5d2247a74687bb39f26e609056f5a78e8640

SHA512
0241c36499bd3ff8ede7eec6642e1d8342791a62450061c4e7262cdfa7a4589f29db7970c7bcdf68555a0148707e32dff116a078324d7c03db00bd330448edc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3809.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit