4048b33e87aadc43a571190f848d14612c9b69d2dedd5269e7cbc82d5c13cafe

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c7645b31bd0d9947f86b518a01abdfc_JaffaCakes118.html
Size

23KB
MD5

5c7645b31bd0d9947f86b518a01abdfc
SHA1

194037d0d73d63922666ec22809f2c9aac4f93a7
SHA256

4048b33e87aadc43a571190f848d14612c9b69d2dedd5269e7cbc82d5c13cafe
SHA512

9673172cf190983ddefe9ef5c4b4305e1894abd571f8124882bee19ffa3a2be5f35add167310db89eed520987e7d869709e00973b035fd3f666677f01866c194
SSDEEP

192:uwn7b5nm+nQjxn5Q/1nQieANnenQOkEntP3nQTbnZnQKdj6vMBgqnYnQ7tnOY0nH:EQ/NV61F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000033c1332eb7ca5f16f71a3653167c71a6cbfc7e1cd0f38f32481040c2463b9157000000000e8000000002000020000000884a26b1694a952c9d5539ce9fca6893746ef6b30851c3c230c82872f8e1a7e290000000a9e119390ad145f24e2a23b6dfaeac6ae196d0adab86f4203cd81b2ab309be049dc7ac9da2ca42f3398e64f3808c241003eb8e1a2600cc95f822a9112e32c602e98076a5962b6c88f529c079ca54503084a7b21a374dd8e000e9377a9f587d0287ef03e410e15d5c6abfcfdf3315ace0c45ac0f549d137ba53786facc1587cb688acba32a7f88367af3afbb615520e5040000000077718cd72332e5db90f39bcf9292d2ba7698ca2881cb2c178a9e4891e4f5a6daa770b4dd91a4b131fb9886ae79c4af4e497339e027d0c3e7edabccf69543c4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a4186c54aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{965B07E1-1647-11EF-8547-E6D98B7EB028} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422330087"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008ea165cbf08eab2eef04e5c2e614def6fed67d2cf7b031d7f0844e22d2027e42000000000e8000000002000020000000271084f7ad331dccc1ab0e2efcdeb14125528549d754872cd43dd0a591ee94a92000000077e6d984c47ad03c22ae1ebaafae810650c721514cfadb9891cf21381d3de2984000000087bdf00fd585d9c55e0f84863883452724acb1e693753ba6209cda1eea2a2cd93f17678fd4dbbaa91f05219603ec0b0e5dca80cd3b3857074b99a3a4467043e6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2880	1992	iexplore.exe	28
PID 1992 wrote to memory of 2880	1992	iexplore.exe	28
PID 1992 wrote to memory of 2880	1992	iexplore.exe	28
PID 1992 wrote to memory of 2880	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c7645b31bd0d9947f86b518a01abdfc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fa178886d9c1405ed9b2bbe788ad6f6

SHA1
337bb146ea982eaa6dee7989b5927ed6fc91c4d8

SHA256
c6b800e7fbb1ba4a24e99c6f7f7d0222c129b7c9ab9a0cb757e9a07d7b74b973

SHA512
c31db115c6861b6dce8629a876bc4f78c8d2cff470a82e1389fce654fd6cecee3dddfc78ce0b26af0cb67d39ce7c021525491121000b829b288d9f77af9c8b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc16664eb80706d6cea2495930b7ea1e

SHA1
d8082e3847a7a65d5cf87d868d69179204117542

SHA256
bc332fbd28d9afb67096be35d716b01276387c91aa84b3fea3730024273bcc3c

SHA512
792aaff75a5fbf7ee0d0f1c2465445bc9f50e6e88f4c2a2efe7aa4615ccc9a69be66af462c6f68e938cea6b2a150f57c8c2cb072cae6734b13fc177261c93c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f885d08b04a79a3fbd46c39e91f04a8

SHA1
feb52bf35c259fc831ab5265a17cc12611d6d155

SHA256
05b9beb814c3146926262e6061c481b5b1a82a3ef81526ba577da8dc5edee3f3

SHA512
4fca136ef4c92ac4207ff2e297b6f57c94e7a1bd832e4dc27224d16e65f1603d25438db47c9cacaeecb06cbb43a39307fed16c2aad130ee171275952aee5bb15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d85148a80f6ea69417e94af3e6e02e7

SHA1
2bbcf2738eedcceab7ffe728509550d3c2279c99

SHA256
f389beec2c350ad3b9ed76ed9febc1fc76a85d978ebab39882a011ba719abba2

SHA512
5e70ba3a53633b13347785ec7c941ebd9be35f68d2aa004a063ea173b94aad07453575507f245c60ad3a86f1d00b6e7fb5f57d673c62ffdd7d492c288350e004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
724c08401fd2a4282e002d7f59c7e1d0

SHA1
adf2396ca80c59754c0a2777bc3900b22ef89c16

SHA256
17a151d073ec84e8baede3cf37a23a141dae8440062d968d2a8393529681fb7a

SHA512
b4bb14ee138fae955b8f8e382848bc78165dd18f8360747b29a41714f0e5b9fe5c835f976f5095902967812437e1582dc753b7b1187647e391fc77f75a5863dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e41078658189165fda9490567d9d1a1

SHA1
c5efe11e4ad2893b2364cf21cf9ef9103bb0481e

SHA256
91b3cfb3fba082326b12bf1b9fccf160fd037a38abe4b299d31b533746282a5f

SHA512
815f17a615ec4757d600c3f34cf9dfba41a5fe5657e707839c924b4c91fa03036aa5b5d256872f61c84a9474d9f70bbbcbbc1b29be74a520e0a5167b8b112d5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ae79c77efa98b6172643b9bf6cc7052

SHA1
f0f3223f23c2ae2132235880ebfdd201e0fa27fc

SHA256
bb60a9d522b97783acd709bdcd7cd099b03feb22cce46ab7fe36c36849cec84c

SHA512
fba5c9302cfe1c1a6731ab48a3231b448364d7623256fe140d773be38b0357c24bc8ceb93cae2c8746e8be6c4f6fe9b1dfbf22a2c30a384d22d610ba22312074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
170944b48db6d0f9bfa48d93ade3bcee

SHA1
2c878746091723de7e3a26884731e51d85cf6176

SHA256
29fbc1fca4696386e8efa9c28cf862641d097cfe19f5b4441b94592c9700f0da

SHA512
f6306c24db4cd5762c04b8b8fe0558ebee1d4be5c410b82ba5bdac1cc1aa7e6db6ba45a520055158b3e4d554bc4ec631ad07c551401af5a90c5e69d19e2f838a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc2a93a6f3a476f256e8a0328147e81

SHA1
9899f0b74410371e2fcaf424853d096b760481b4

SHA256
68f36efb03066b7f4c970c2a87822fbef94ef28218c64b74b9722233b9df07dc

SHA512
2c1ff444933f01b587c5645fe5c3b7972bcbcd0dbca256711ea62b817e8836453fea984deabebff3db24dfeda3f1759ba8197cb90eeadc0b769d092c0b2e0abf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dc27bd385d1bf0d3f39efaead433f7e

SHA1
1eb56ac32b8c54d903858ebd0c3220fc75f05dba

SHA256
e4215a434a5036ef8f8723eb7523e62524831523db44b3759a660ca54a0779c2

SHA512
7f35424c65cefea8deb975de3c6a64bdbd39e5953f06270f17449b0af52ee164b20bfc7baa39b11f1250e577354c0cdd9d66e2fe76738667bb1ee731d2ba5bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17729af030e875311628ae96b812eea4

SHA1
6d20b191f000a6ba42a1c995bf1759bd793aff90

SHA256
476dc038fbad1295714591958c46465843f2807d04855007e0bd5d75941e7d4e

SHA512
d137019a5058704a5c6a4f79d9ebcea5f6dfb5562c83eb4849dcbedaf85ab3eaa29e8c59c220a2699f5452773201907bdd84ff4a2069ed9fd0679dbdb11b5c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4eabbad43f4545d14cf9486b8a13781

SHA1
0e3b111374841fce1dcbba319dec55786a9faacb

SHA256
96a3094f9d9092bd35ec9fde24b3dda12b79833223af436ab8186d6ab5f282fd

SHA512
f8347a2f8ccd7ae8a475877186dfb979c49400d29d107453c776b4db4a13d924a5a7ee35b196424bd792b9bb1f99a7fe650c3112a3a296c5f794d5c01d59bb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3843.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3982.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit