c8ea309402187d045b2d1e7d7fa33298d30cd6fe4174e2cc43924db356458afd

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

514f02ec58af6926cb2d53862372ba66_JaffaCakes118.html
Size

13KB
MD5

514f02ec58af6926cb2d53862372ba66
SHA1

1e3b16f49452bb205f8cfa757d911dac510fe5c0
SHA256

c8ea309402187d045b2d1e7d7fa33298d30cd6fe4174e2cc43924db356458afd
SHA512

febc5c3c9ee914d3020f99f09b113c10d803d60106652c32f7d3d54cf28ca99ac8b69588ced4d4325dedc6326c3db86354cf1ec56b781524660c714c2607d625
SSDEEP

192:iWd8Ikke1R79PRSxNmbF2kCHFNSP1RZD+nVm7:iWdWlR79P0x8F2kCHFNSPHZSM7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006da779a12634fbccf56cae4edf3f3617e8c0fc9f3b1530095dd8731362444da0000000000e8000000002000020000000b83ba664340f8e0c5cffc032e143135adaf4e390ccfbf80800a05f35f00f55fd20000000c4b9a99736dd1199469e01ea9523de636e3adadab7f7cd1f94add4ad79af393440000000238737f52249267f8012441668a21460f7db11e51df9b8685239895b80a2bc68da1d50ce88d2f23cdb4a1f5a67a554a0d4e66930dc2e30baddc014d8378aec5d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000412a75e8ec95af4e1dc8e7327af81aaf7513eda503fc6408ac2e80c37e60f58f000000000e8000000002000020000000002388368b8929c0563280360fd733ee0dde3eff2ef364cb9441516c0e14251a90000000a61f8eda7c30ea6ecfac680f5cea7c576ab72c53f4f363081c80da6682a35a2de14d649a8a973f6091f9911bb57d5567ea0b33ce908cf9a203897c38f7b16f8ba41a700f8555fb71f815737eb7ec6dbec46a3f6b5908cec8e89237f8fe4228fed5ad9e6de25bdfe4be64a6a104bbf47f783b063ac247824feebeb2c4e56022e152e554a2ea639c33d9e44aa3787ea6bb400000007515cddeabff37faca2a0533646f88999e513fbd80557b2314113d955c29e0c51310d91432e77571788225e19b495f05cbc1663ce88944ea8b0e9d486e3b1dbc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422138944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9057b86197a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CE7DA31-148A-11EF-B781-461900256DFE} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28
PID 3012 wrote to memory of 2244	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\514f02ec58af6926cb2d53862372ba66_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
921be02147093bcea4692b5da6f5928d

SHA1
bc91b306b940b24d268fa82881d1e3d2bd8dbfe2

SHA256
e5bd20311c6b6ce7feef8f0e7d8814a4edbc999bfc2c23efe7aaa0003bf7bb0d

SHA512
577f7db5e914127392d67389932c3fc75edda0e6975dd4d4734c1734f4c3d097e9f88effab1c7bcbbc5178cd65f450bf64ddbc5152d2112e279089b781a49e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7994cc3b065e724cd638011eff4f519d

SHA1
c281e22eea86b6025e4cba91b4164f205b4a861f

SHA256
a94fe775a5712a99c58fd2a750833a3a34e124d5de00968e7e4c9582b87e6f55

SHA512
f15dd9af2b09014eac7f68e107e90ac1c43b17eae15cd19b7f226cfc902b1d24bcc2143d3962e3dfe8daaec4763516da55f97e35d0358887bc603154422e02aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76a8b10940e4b670bbacb999541c3e00

SHA1
d737aaf6970d01bdeb8a4664168f6a4c9f33aea6

SHA256
df0e4134ca9d042fbf50bbca20effcb25f87277f3040a93985d4cde9aaae4e2f

SHA512
fd3aa4cb37ac52be7d975933c735cf7c6799e7178de8d1213197576ecaed262eeb15cf33a9edf7e4b09bcc5e14bea9e6b3ad390fa2394b8e31721f6e65654601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38412940f561658ba21de6f7882bfd0a

SHA1
4128869aa1786132b7f64a3727e74a60ab255111

SHA256
750a7e5a422a2dbf10ca92c39f6a58087cb6d441114da3c4a46ad08ae6ea7dd5

SHA512
38461df303f6a6904eefb70e9468553924d31a2eb70eacfa2038d401937d0053b65d4e24f23308b95fe12a1a8f4bf0415e82089428cf7deb59a654dd0e2b7bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae8bae79797aa7dff6447b302414927

SHA1
db8756a297707d373dcc019b2d4c3a224136aab0

SHA256
c31fdc1c934002544d69b05ad4190eb5a7af3ef2c11c566ef10470654e0dd777

SHA512
969fccd4ba4d1676695b85adbbb6ccad32e978244b842eface1f95f39ded0654a6475247ce7d72f467e7083b24100a9128acd667ea7d724bd7ea68b1cb9a786d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56712b2d2c1680480588d7bd267a0eb4

SHA1
62a0cc8baf7182ac5e974ec347b5158329a56121

SHA256
534f90ed10407ff9304d3ce463c6f9b92eec5ca2542d3455f2e829d0c21a5219

SHA512
4b667466c3939cba157b381672200da7783d7214b81c8524a30212b15599c83ea3ed7da44638750502e766b7446f401360729507cd7879338c07195c1519ecf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44c6ebff635c6ca66560e8d4a4c447a5

SHA1
199e9008fb3f75dbdd6e3c6a87e4d5fba7bcfd92

SHA256
0a137e4fb6b18d8ad8b06cb84c055aed839e8f3b23c100fade5984567457e4d7

SHA512
365d3422889dfc11f4c4df484e869108deee05d6f8bbd1d1fc0784e4967b70f0831bec49093fabc819867ab003fdcb5bbbf6cc17f7f46eb2626f6cc81ebd872e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6d0aec5456f5322dccf2d3dab6959e9

SHA1
078e1398cdced801e97445523d5a866d4fd6acc5

SHA256
c01186685da6d6a327cc21398c5d82bac87ab4922fd46ef092b6f3a6ff2954ad

SHA512
56a4c9f53d52f08a6966d1579476d2ba3050c86417d11391b9189ac62a5b2efe110bc822aa0d0e506481eac15877edd55f7b21974d6e6e262bbbc2f648799f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6baf23fe24c640240e998c2f7acadea0

SHA1
5a1bf5c849c7dfd3fe0ba25166e52f4928e08561

SHA256
c329ccc43e16b3192a5546c751cbc1a6ef60c5890b3b464cc71fb69a032f0ca3

SHA512
a1f453963e2a51e88237f9d64172c8692c0107b54c6eacafad964c34c568bf6eb4b0f9e3448f3d948e092ef229753de87fd25ed247d7964d170c4f89a82245a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
823ac747c2a73824a98ec6d80d45a5dc

SHA1
32e572b972402a5c402125b7996289c6a41a9b8e

SHA256
02cdf968cb24540fcd2bbfff2d03321d72aa5c3c3e401ae768198a1900193d59

SHA512
593e3617987d607231f563c83fd4eb67e49a9d1f27172aa29d074477a6820849f17a74286bfcbcf277a2630d3b648d01f803fa8fc02b4686e9f17682bef3dec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f45f5b79ae4f4e463145f551fcd9127a

SHA1
bc6ac82d19d253c767d148ac116850231c110231

SHA256
9757fc83be95e8f83839ec41abc8123ebb6be220567a8c574b9750a303e12711

SHA512
3b542d6aab592e6f6136974e9de3eefae02c96ed346b6b8d48abe8e656faa4402431713ead652d3f3c325cb86450949fffc9363b55810bc5ab2d45165e47de4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7f6b9fc70cb56e208da31535772cdac

SHA1
f780c448408c0c5bb37d4533f4c3530096514c4f

SHA256
69696bb24310c5b3b751a281646c1db47537560797e7a27ad03dd8221801cb72

SHA512
ad14455651196a94164f5da00c00072774be09033f34942bfd56aea97f9d476d9012768cd8c8cd200b365a56cbadf163888906f35fc22f8ebb736f11872552b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf91528567863441792e2776bc6e26e8

SHA1
1bdc02f0914fe17bea63bdf71e99f6c00672bbba

SHA256
37d925cc8765f5bf6f1c9e120717c4877f81824320f3a6b9631f1f2957b162dc

SHA512
bbd421bfa54596981a2a7dc2c4d7810257c3f2042ecb264881ca6bc03a09f1b6f7d225e8251bb9483597bffe9b5ce0951c0623c17131d6c300f44276114c29de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C41.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CA2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit