8225f97e084f409f836b1b901314f3abb729acfc45d07950e86fddd2473fa18a

Analysis

max time kernel
133s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

454f782c99c25a4072f797f37315a4a1_JaffaCakes118.html
Size

220KB
MD5

454f782c99c25a4072f797f37315a4a1
SHA1

1e2e090c94b6c8ceb29c3fca95b2f33f64bc82d7
SHA256

8225f97e084f409f836b1b901314f3abb729acfc45d07950e86fddd2473fa18a
SHA512

782804650c6eb4263acf32901c5582e779e289ecc33a421973f62d4378e26a0587553caf212423f960ca3e4279284f952dd014560180106dc43849016703fdd7
SSDEEP

3072:SQo7mheHiLA9LyfkMY+BES09JXAnyrZalI+YQ:SQvbAgsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421923398"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B171F4F1-1294-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28
PID 1940 wrote to memory of 2368	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\454f782c99c25a4072f797f37315a4a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15f3548f4697104f8685bf7198670f2f

SHA1
ddd99c80d962a1e999adb39579f67350fe48d502

SHA256
6db4ba2384bf4e7aab8354a7d3ecdd56a82059357aeb9b99b5bfbae9913cf3ed

SHA512
3daa154e2988751c29edd67751983aa7034f4a2dfbeb3329e4844115b2368c9bd67b38727cbb909610603fae2cd66f20aed9f80b38894c3181d12f098c581826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b71106eb0e5883361b3cf78ff1c97bb8

SHA1
4a60f372a73533d17d2b4c81de6e1e02a503faed

SHA256
1b7b8bd9b9fcc433eae1ca2c9e187704cdb69c3171040af75cbc0509119cf89a

SHA512
9f271bec6035825b672c0b130cd07953d844f6caa19550ea7666d5f4e8e8433c1d0efbd8f713ec717fa475050500aa194f38e0b862e3dc4baa97da9b51711d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30a282b20ec2532af89fa77e91dec707

SHA1
0628835f9e7adc852d2d73e14b17b7c053f37dd8

SHA256
02acdcf9e562915d80f0169cd87a0cd25a45d7ddd13f740901ef4c3fd26b8691

SHA512
e0bf4a32372f125407c695c0f6d717eb73a3528c57c7450b78c240fdb45222badd2558581ccbbb9b4078465fc1eec73034ab4b1fa1509fe2f0758a18df81ace2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fa987b46c260a34db240fe36551d19c

SHA1
cdd896d39eca42672e9598c277e2be2069abc4ba

SHA256
16c854616ea5fff8b84a990513ab13737bbbfc93ee7a0359502986e75a44c55a

SHA512
85c962ea89d621049e0cd477b454e5840b176c919b2db6d349c5e0ecf86e3f3dbe34160d4cbc0cfe7cbc013223ea2d6ba2d84407aacd79badf75d5254ff01ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c43cff0eab8728314413600923a276

SHA1
3314cce0ca686a64c528ffafe6f62c7fc82ee8cb

SHA256
dd1e7fd03a6fc4d035a6af07edf8cdd6252fb7b2dcafeb2e356286a8ce7cc182

SHA512
56b871cbf49c5cf8aa305477c5d2c311ed98a5196f2f55486f284c9987d8e6f7d617f7d72df7ffe866def2447dada60e8d1229cbda3b666ba295eddc0e0f1895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90aebf1eff4af8f09d8141a8411e3cab

SHA1
a3c93b8475e007c3152e1d1c9164d533cc9d6f27

SHA256
fd536ab8408ca321f60fbec8a023a6c76f8f2873d0049ad0d25cbc9bd7bfa414

SHA512
0714bb69ba323f44ea6a69a829348007e4a965058fa59aaf6ed2508331782dba71db1dec1a724f15bc2986cf32e1b950b2ef6d2fc80abf87d48bebc475f520cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983c4d78d6216da9e2b3ffd44c0f225b

SHA1
884f434c60015ecad603371c6f7febd0a8368889

SHA256
fe8a3c627c00dd3511ccc767e57051f404639507e747dbe037342b6e76e32c00

SHA512
1dd2fbf4f25499f99e9d6312cfb2dc8578185616b0885c2bf310e6bee7d06722762433651637c844b659071ed20a3d68d098ab8b8df89d6f6585e8811a87ef12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bcced684d3bc202a906a032c0d0e420

SHA1
1cb75709b327153f10776ebf30fc8b1c96853f84

SHA256
21ea60f587a6655252a48cee88f46e4d3074254520473e77af65bf8104f81d67

SHA512
17ba7471b4565b7efbdbdd20a00fc364454567b0e79d96486d7a7134652c2ebe173ec2dc324b690410c4f02cc57474a8c489fb78bba80f6fb122a44cec1a432a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90861399177b0b9869afdc813932318a

SHA1
a7e3a1f603843f7dbe66a10fde906d9c8f5e9b26

SHA256
5649919ea5e128eaf1436f6da2dc5bac73772ecec37e234c75d0c6f271627937

SHA512
5067ac30a7eb98e9f85ffd352a4445fa9bfdb4f4f445b70f60a50a4bed5d5dcf2cd6711310f36770e7fd42defdbd9ab1a08f3bfcbe6522e5faec219c6ee1aa74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb99d8579a84a6d9304ef6bbad6451a8

SHA1
e2649079e70871ed4d8c004d5ce27953cab154de

SHA256
7fc65d737ce0e1602c79fbe4d838252f7f4c67965b17d5dbb508439316b09190

SHA512
8fc46d6a55c4d04b6848f35895a39b7da1fbe6b6e22007753a55a1f621bf108b3ef2dd62732aaf3aee2f0ede0ef6ed877095b0d44de706bfc604a2643ed6a04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6911288d729082dfd17f73842a5954d5

SHA1
693f48f12a8c8e1f61c284c5a0d34ea20760e6ca

SHA256
fedeb733bcce6e45c38a8f0d6699c4d1f61ca733ba6f25f40210c63391baf853

SHA512
dff010df7cd774ca72d00d5bc507d745902b912266608a2bc214da5b2cadcf408bec5a584f28e33ef2dab458c82d8d57fcc3a997ed2b3264a64143798222ac7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e5960f3fcac1481f30ffb83320c4094

SHA1
a0129544fad39de1f75ad7c4e6d3c12d95f856b0

SHA256
dd238b384cc5adecb5238946850b76231b2cfa36d7f443f8a2344166bc560d61

SHA512
2ca4a82932c47bb973d3f289b50aa413265cda70734c28bafeee64a6e94d7884debd1e3a800aab71f0f2436dcc38c381582f9233fa769d3fd8ba82c9221ccb1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86aee09c9700dd8fa258c9fc927be707

SHA1
4c5e4b73119ba8cc335079e8c02768b68366604c

SHA256
47917967a2fdfe9edae3f0172f6932faaacfdd4decb30e05ebf56838782c1b3f

SHA512
bc0bf18f0c301788805b9ae45d48c215df9d735a9bcc35e31726c0aeec9d20f03ef35753eeac371e5a9b7a2a7cb3031ba9b5e6d77529535ad73a57a2497b521c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04dcab587692941451a45aeee5873561

SHA1
0e68c86fffb7b9859c04a418d6c199e01fa4ed30

SHA256
b8cbc3332ff8aa7be0f6b5a6d92e04cc0591e3bb44636eff85a4d0d7f019469b

SHA512
767380038e5201135246a0d70842b3ff1b1d11a52ef7862c5143e41f02e79efdf40ff2d4a9280f72a2e5a122fdd528cfb16690f5ef5aa2e69d311735b1a5bdc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfc3b6fbcb5aff6dd3725e7a001b7dc7

SHA1
f367f5c14c0339288b0f196b4e23534b21a88ca5

SHA256
d492b3f838d730dace7169a3582ac9ddf3a5ca4716941349b2c29bc176de118b

SHA512
0b32b76eb56d6bc3ca8c73949cc393f375acd3d3051c59913a341ccdd01b916f3564dfa0de5178a06ddd0b43094cfb41d0133644301df6584db85c15fb90f456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35d3dd092af8ea964aa45ee488e13c45

SHA1
800e9b8e3e84ef8be378a76b6fb8ceb5a3160e61

SHA256
6882c6069c4998c35501977c8223978d5c542e640fa0a0b51e448ce05748e29a

SHA512
1c7be3da49940036cd617cadd5dec4fbef3e2c7d2c37477c323eb464a06bb86eb598d60398a8a988d142ce8cbb1d41a83a51c0ae6581777a12ceabd95ba7d8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4551f2f22a6d8c7e90da19e03bd20d2

SHA1
e45c838f6a7821e68ec3d9edef7d7a75f6271472

SHA256
8439b7cb5e6091916bd066499a7d6e9496574291015a1a0cdd8af4d6106ea068

SHA512
ddf4bd8541d156ee362d9ac4e8b890bbc7c18812ac514db21d014a8ec84d8c200affe5ba85a7bfb16933576260a9536af19d832cf9fe11366e59e2f12acd605c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11CD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit