93ce9f5213e7d3be3e54c331f20bae4e9813caf257dd1c569456cabacc799ddb

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e4b1696d19615869738ddef064ab6c4_JaffaCakes118.html
Size

220KB
MD5

3e4b1696d19615869738ddef064ab6c4
SHA1

222f271a4955a4d4d2af1f7c010a50f84b5a42af
SHA256

93ce9f5213e7d3be3e54c331f20bae4e9813caf257dd1c569456cabacc799ddb
SHA512

17c3bdc4d88afb0daf67bc7cbc4f9af6cfa2db27c30fc58242f22aa412d5b1c9c0429eb4d050cb18f79aab5349dd2a79803147514e42ea9fe2b42cf54d6a9137
SSDEEP

3072:S4snqEKz2Lppq37yfkMY+BES09JXAnyrZalI+YQ:S4yCtusMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421746045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2382281-10F7-11EF-822E-56D57A935C49} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2344	1676	iexplore.exe	28
PID 1676 wrote to memory of 2344	1676	iexplore.exe	28
PID 1676 wrote to memory of 2344	1676	iexplore.exe	28
PID 1676 wrote to memory of 2344	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e4b1696d19615869738ddef064ab6c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
911ab3ef8af811cd694a1ce6ab5143d4

SHA1
3611b22eecde694212a51ebf04f16509f6530681

SHA256
6fa80b4c20a4b76c43dfbb92254e6ff4c716edc4b018c5c156e49ace97b3651d

SHA512
e5e43c27fec40f504822339d11170141081570d905e1f16b44c6f7a641b7749e48bd46b9bda332e9c5ea19cdb01d846a2d88048fd68a5aff8994859bf4a25399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d8a18abebcbde523ab4f5e38b4de234c

SHA1
6239a6fecd82b45c6d0d5f4204acd9dc7ed4d973

SHA256
e211d2ae94abd52a46f2d9f69f5c7d07e3d576e99c14c1c29a42595869a6b756

SHA512
970ad9ce66999556da2670ddfe130f0b26e9a494745b1383ee54751272ed45dd9d0e02561474badc97e1a66110fadc692eb64917455d410ef295bae9d73ed2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e8ab2bce12e3fa62090040af2be80f02

SHA1
ab139fe4b9edc0f2866c167228b06261d7d1f5b9

SHA256
9fd1c1494d96fabf7ce10a5d5a07c203f1dacc925de67bedc34569814f158e73

SHA512
8cdba33b7f5779160213a991726cec2210738705fc4ce57dc89a14e4f18f6f761bd3558deca3df255682bd46e9fb5e6ca78962390cf17ecf7149d1c362c17bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f1b9b3995a53bdc1646a27911969eca

SHA1
0bad1f8dd124b3b83fe9807ce8e64c20d68e30c7

SHA256
add42fd2fb774735c71bbb20713c2dae0c4bf4cd5d18774782e344aae7d2c836

SHA512
6dcbea2c3186434357ff9f464dc781473ce3eecd4ae7f0d42d9b27085828a628aa5abf77c5d1c5ebcda3634bed1538b7c43b82a52f7aa51dae98139b495a2983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed4590f9345aca6e93811b8747103561

SHA1
a309f7d5f212e1929fcf6f3c7a9f629d20c81ea5

SHA256
d832147e2f528e038b7ce36defce3f156587cfeccd92921d53418623708b2038

SHA512
3c3181cda7d355b8b1eb3b1876f02a5064cd583062587912558568ab83d7767dd56132f62bcee1b26f7404b9b868775fd33268367e841737a4394910da30a823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
27fbb5d101454d3e529ea67597b331b2

SHA1
b627207c63e6a07ef04ac9da763847b42dd04e3a

SHA256
06ec01db415e853d1b14d1159ac24e3e10648aab4c8ba856caf6e4cb6b6fd065

SHA512
6ecc1eb29e152476cc683e2d44777bba8dd7bb9a6ce1271ef6f36846197bc1a85ed8ee56564caa58ebf97226d2355445b49f8943a71925f94b512c1e5e63f3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a76b6b972d58a52bdd7d45f3abba3d10

SHA1
d8b7e16a5cd98942399388b41ae36c560540a111

SHA256
60e4488df8b8ccc137975758c2e808a972b81099f9562bfd2f5832ec289aab69

SHA512
760d6a3a3fbe04843b2566b9d900caae59f5f6d732a3bf78c5b2b9228889cc5c7e6cdc5c4e86e075ec8e6839a2ffb73b437076c80daa874b8060535c67c300ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ab907a25ee0223d650a0a3d88de5e5ff

SHA1
edf82cc094ccddae13eead61991860c06f67ff19

SHA256
d1108de99e2d442e4abf363a0770cde405a0edd75df172783cb5cc06da1165a4

SHA512
1c589fc1f95840f2be56b9c687c1ccd3f659e7bd14ec15278942120d68e4354d4fe794a490b58cf410a9730540672d69410cc2643ab8eaf80c80602e11750731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8ab80c6cbc23a9bc22b948c53dfff58c

SHA1
099af57fd563c700b6529c7dbdcbc522485c56f0

SHA256
3765f5be0c05e5759ed6f88d97c37fb3a7f4d25e4cc145f97e92ff13c89c94e0

SHA512
a51f1376faba8ef9f9e6634d8cfb349750e2e11b3aac4e4cd536ecd9e62f00a7bd55cf399aef117e63387d2df9b979ab1c04bf1ee4dc7ebfbb3f8378b4362a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dde3f477c64148bab61307be802a250f

SHA1
3f9bd823dc363da08b7174d09bfecb512fecfe55

SHA256
30eaf464b6a49d1af92df9dad65f53e149ffe50c85cf1b74be0ca449ef97dacd

SHA512
16095694aa77cb31e02f613a5ad7230986b2e834ec3048e83d451ab310b20b715dfd4066ebdcd46e15c230e0beca8696180e2b7e7a8446e6ec0ed7c7e70ff699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7358eef1450f4d5846ea66808272897a

SHA1
3cd3b117d135715293b292b88053985547c85829

SHA256
2c84ca0794fae38fc5cfd9eb0a8f732e63c1ed1d6df478c4920427fc24c90308

SHA512
63d19988e1e298434585e4d245d89b3cdbeb74ec15c129d432469230604a8fcc0412718a99237e533b9f21610dd9e59816502824a39c33ce681ecd7cd808b20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2a8fe43019b2f748d356d948f8a58308

SHA1
d4347a1d3e44be3f9298f83bf753236ad71b695c

SHA256
17a87c2b49e28ef5a4da670f0d3e7e1fd7a430abd2f516c670966a2ff46b08fd

SHA512
6408193b9e64b294da09564766398ef5e0b691bc49ef28c998bd7b81df3f9e0341b01ca156785a98c874678738de43906543462899d82462cd33f66013d5c140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
116d4c497870bb1b7a599d40e86fa7c4

SHA1
05ac4c2e07a9dc661381bf3b25ec480941d7ecc8

SHA256
102bee05db4f59b13065cbd35b18d0927bb0d8d59d744f770be5ac7f42670489

SHA512
f7f90f8dbde520b64aef1b4d86d7000d393c82a580a21b75b1f3dbcd961edb12781a4184948000fd29b4d0acc61c5cd806d6140e2d24ee941921b42d0efffbe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bd2c1d41215e6dd231107d2e8363add9

SHA1
8d55e253af0a1fd1b8fd0f68c5fb58682ca803b3

SHA256
12ceb506eb801d7872c85bcc051b41f310cb376049630ac9552497dc4410f48a

SHA512
516e2378d591055c304e0bf63d6db234a0af670b6a80ce3ae913d9723bf66bce537b3823407de61cb3f412fbf2d6ec634a339cc0a04d5307d8234d42699051f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bdfd264b919d8c142c91087fcffdc365

SHA1
9d47b9ee54c8feaa6094dd90afa2b2b90735d743

SHA256
162d114b06d4ecc06ed8cdd285a9dea4f437e8de271a22af49e325bd2aa55abb

SHA512
0c3637cbda29ee985bb714ab39021f0113f04287b72ba868ad533b66a9cb63d12cdfa9e5494c6dbcd6d1f2cd41a2eb12bf47d8d9fdfe838b324ebed25b9c4caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0961112740965fd8538a0674c6d0ccca

SHA1
8c681c313951187b179cd2f72eb84508101c213d

SHA256
c9f21c0fb46a2a1042e0ea4dff0c0bb0317c18966bd1055c2610364b6faabc89

SHA512
65f786da23f099f2f9f84dda7114be3e0e1816c824c369d04c547818840a95387b2f02a7e3ca6067beee545d06b2dc0a0311b423c372ca033e4d13f63d42ff77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1970ba59ddd3956dca020f4124a79a9a

SHA1
2442a41639ffa815fce27d31349a310db55c3af7

SHA256
e4aa0419b9c22b2f943b3d5421baa95da633e037bf251ad4c2f2714323c7f07b

SHA512
3a6099212846d258dd8599da841b82ebc5f47e778fd4d6b2a3a320aad5a21d59f3c63f01f94edbeda503b5d2b7f3df49d15d4005f37142d232420cca36579611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
652366eca33ec5c90e8b93ba19b13cfd

SHA1
bc7adbe758157cdf3a5cde2f395c3f03bfbcc17f

SHA256
ab424d7f054e2d4cc3d026812687c99763793b88613e007890d65e8787ebd253

SHA512
1a849116ff30c0d779b588686ed8140dfbcb9ab64ef161d320fffffe17ddbdf716edeb8cb19360ca0a19f756e8c79a1f317af2c6c64096eab8cf990349bb0bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
012a6c141d69fd3438d3f06184517536

SHA1
ea8f4aa323cf498883144bd7a4fae2bd126d749c

SHA256
0a1d5a381051bc7af2240c17b41bcda380ec0907a72b17e121db47ac19f29932

SHA512
e2967321ec49683f2c660fbca8f1faee91b688299fc1c0a1f9884ac4adbb0cc69c0f5645881c86e9b6b7161cb3c407383c2b5deb8193b6fe9f62e79b6079b256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BBD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C9E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit