3b879ef8ace1b6387199a2ce2d6744db3c6752989631c46c677ee8067b7aa565

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cfc34c1e1ee49ca94bcd21a087674dc_JaffaCakes118.html
Size

13KB
MD5

5cfc34c1e1ee49ca94bcd21a087674dc
SHA1

83c275daafe062c3e05b59d54cd1d47e28e5568d
SHA256

3b879ef8ace1b6387199a2ce2d6744db3c6752989631c46c677ee8067b7aa565
SHA512

4643f13f6da3ef328f2adeb2a32613bea60ddb5cf01fff5efd1a5000143f0e203aee7b331b1de9fdcb9d374d6e45f54978fb94e6b2f130ab1e8018bada6af554
SSDEEP

384:+6ElOO5qBEgLxxmh9rpnZ87ISAYNHNTLXRsk:fKQxipncAalLBsk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005681f6177494dae368d90517089d846011226bd33bb642b527d186b98fd5a7dc000000000e8000000002000020000000e1cba675d6dd7973855ddea36d1fbfc0d4a66643c9e24a29a7227a668d42557690000000bf65e3e2daadf23d6715581da3c52778f2030422ef41c60d6791309b5c3d9c9f0b4103657ab0f0ad9cb2197e650d9ce829e0d88b98725b3890343664d95c3f59e0395d62261bc2520008220e2551f8979ebf98705ff165c15b5cba7d282d1868d1496b60c121a9250bd3d67ac6a34455eef28a1c4b2a9f2d7325fb4dfb340fac4e9599d8eec3f9dc99c2a72b76b2476840000000ba640aa36e7bd72ea9a4ca7439f29fc1ad8a89ce9e603c9f06dce905d874e50d0a9f18e84005f661a40a8625b2f5cb8d70bf3e74ff8513d16aaf7075de75ebdc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f082fa2167aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D6AA0A1-165A-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000004743be6caa4c069e812dbbbc63666b5c68ada8e7256baeb61275c046635d5f1000000000e800000000200002000000097466825002bc1ecf6bc16c6d482d19ffca42d61521a486d078eab396bf6959f20000000f85060fab78f9482c96d3c03bb8d61e0a33a862b0453bf1d070ef302c3dd7a81400000009ff8f1ca6c225a6bd6541446d3cf0d3f54e130001efac8fce2428cb55c7d5a9fde9d26461b146db5a129468c1f1c59402184dd35d171d8a0ba90287e6c0c4198	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422338125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28
PID 1704 wrote to memory of 2896	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5cfc34c1e1ee49ca94bcd21a087674dc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00d4599de92ced84cc1cac3b15aa0324

SHA1
46f8e72f755a5d66972008539256972614e51653

SHA256
1ea2aef002e1563b09b9bdebaa98b15be29b4dde73d83a5c6da7262a8acc88e9

SHA512
d614ce1910860d87b6c714c8a70fff6a448f8e741b1d2d6b5d894b919679e82e991ae26293747b08fb6cc134119544f15339d0dbf1b8f19ee3e51797d4cab321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20cf2d0ada631bf11d80f6ff00b4f60c

SHA1
77b1622795d01bde0a740006a9ea2d6f08c30770

SHA256
7cd51be73353a16e81366fdabf4f860f6a37adc73128f489ae3ce0c86e81eea5

SHA512
3217968fd92344406c4c0a964accb8dd8444d8098d8962cb3c9e1a0f339d4e27aefd6353e96dd77f5bbb2e2f4f7295f706cdbcb214ed1261a509fdf011b1b01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68b65ff064fbfcdf1cf77e60e5276246

SHA1
680ca34e37d2bede690ef1448e72223cfa46440c

SHA256
125f268450f0ef46cb647201a0b402088f21fb665e04d45c6639738f9cf2bd08

SHA512
28aac221b345b31cbef0ac6ba48dff3328169084a59b754b3150d5d9ed37b0121554d58569c500515cc013004e619767facbe4bb96f06cbcee0d0e02ebd1eed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046fb812864e153bc0f5592b310db01c

SHA1
072f33e69f2b388ce0b2680b849871b453fac191

SHA256
0e06f07c1d9a255758b83d7179cfbb4af956b11dfee3bd92a555b6d6a68e5b3c

SHA512
32d832dc0746fc30221a959ad25f661bc02c05fd5f59c1205b2e1ae3df71df135cb0a3afd3be00e88a3e23d0e5a02faa716ced478c4e66593bbce123b9c6f5eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
512f8baafed1bbce253aa8d9540a3a2e

SHA1
5d92446bb518a9781c6fa42f3cc61b9c24d5d45f

SHA256
34239177013be973ed9fc31c35048f7ba196bb3a8d858ed3945f60f0c3a3ae81

SHA512
ca68eb664f42e153412dbd78f0abe8ccd9e7f546623bf81399872880c33d2ac267a2c1abafe746659f35331c3660cc489d39b8ee11266a18b4b2e27d36959582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ba115de441c457a4f250e8ceab5cc4b

SHA1
a71fc9767e480b4a5a9382dc9d9c8f7804780ded

SHA256
b8b673273d2f46294c1fa8f5ef752f04f02da5e5c610b3096e6bec43cc1c3b2b

SHA512
a813337cf0bb2b13a60d8821e49d3011fb9776a2068c360c1b7c68570b0fa8b32b9ceb6259910e65aca7adbcedd1b4d56cf952981ad220b7633fbb2449af3a64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
254416b29aa8b1ba016129883d67de93

SHA1
5f75ffc09e2c72359f964986dc8371f996df3b59

SHA256
4d9a8d8751018018af1d51016c142cc50f9baecfbf3800ea7ed947ea1d7fdb64

SHA512
86f71f74e59e5fe5123fa3305117846b601d0d2e29eb4cd38a84ddd7240e650fe072e9dfa247d02dc77835a76208fcba662653cd3e56a95efea05215f3f91c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4eab2b061f05719d09f6f3261b251e6

SHA1
cc6ae2832e1d3608d00d9e040a0219c5c6e76551

SHA256
0ed364877910de3126d573cec3923c6be2cd8f1d000077955aef9c07a92c8421

SHA512
6902f434b63d0b75144a23ecaab968c6253f7e34597f3842cf78c5023df5aff441287a3af29f4ee01e09df4fa6153afa30dce9ad19e90484c51e97757f647e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ac8a9634b02d3a24496a6d38fc8b6d

SHA1
ce1014c9ec237288f168b87f0cccc85b51d5db13

SHA256
688c15af01ebf9fb271b15605b7003186f72bc1dfb5f15ff293f8569334d0a0f

SHA512
8eff394440dcc6a4d670d3d384a4a9fd1760c773a35fc59b0f924cca4a3500ae34d24b67db76b3ba19752dabacaf311d7804edb1ba1379609ef0423760285c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f606174e1eaa752047c82432dd92fd62

SHA1
48542b98cd1e4486a2c5d983e13a777dc948476c

SHA256
48d0a73620e3a31443e79542dcbfc58e1dacbc5c51b8f30bcf84c8a1ef567a4d

SHA512
2468af6361d7870c18b889608e7b022025e5ae39e1fd013960b140f22dde62eafddef42aea4f04762eed4c6ed2476f6ff35efa008be2d94a03f272e8d604db17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c1641b6bd7a02e67433309cf21becde

SHA1
ac589e301e14168a2d268e67071db1d179be44c4

SHA256
20e5d9b55d2084fd9158869820559dbbd99f762b2379e1accbc52c2cbc4f2581

SHA512
4993c195ed3430c1dbae98b0ffe4022b689fecf8f7889577c0335b89f98459910637ccdaaa5ac7da034ce1ad3c559fdb203a125a228cea7ca0d517b27129e867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f70fd0add6609876415725c5a68c905

SHA1
4f994c4893c7e1f55b30b54cebf1fffbe8dd7a06

SHA256
8f6872b93cb81963465a0dd25c77b883a648e611e03c26dc97898fe57dc5d670

SHA512
44cc3922d9ca04aa4adcd97384a7fbc2572c2de0e51767fbad2f3beaa44243acc4c4746b1cde70eb1e830d29f6e5d3584187e6008e65ac7fedf4623c7260adb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90a93fad2a2e5c23b7ff2defb72eecc1

SHA1
0af5314c3712bc052aae920219120fa322ef9a03

SHA256
e128ede1091c36073e841586ab30ab82adc024e38b598235b84baff198bb8c51

SHA512
9765e154055c6bc52bb81dfe7789988bb950bf60aa8530421b8f66639ed209f898f7b46a6ba4b29dd2948676a9805fdf9beb91f549996177c29d0e5fee1c418f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8950c38617ccd59018238a55749581ac

SHA1
f08d22cbfc2dfbead77c6cf553276d61834f1d28

SHA256
50d45c7eb49fed76566f7b83da32b53ec8d683ca1d3d58b547a69ce52cd9b7f2

SHA512
b32ef443f220a4537d7e093fab8b50c713671268ee50ac0af66732bf9391543b721f40841ccbf1f46b9ff38a55ddaa1d9d426e506b0b67b89365cb75c4359fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caf304eeb4fa2eab330d9361c7435255

SHA1
6fb4f85b4360291f44614ab22e93ba10b38229c1

SHA256
5a1b1dcb62967a0ed06d048038aa37bd5d3ee845190346b7f6296cbf087ee106

SHA512
be2ed4142fa379bead288c3a3528caab8dcb65cade9cec6df70fc0dda413abb4fe55fbc002a78901e4b89920f968f11a321a2df34865325fceb23e84ce2d4dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
099c70cf1e302fda502884dfe7391d6f

SHA1
9aec89754a8a6381153b6d238906c9a41e37f569

SHA256
ddeee14ced0b5da2e03ec8499168590a1322c049b659f25ce5fbfcdf80d62cb6

SHA512
51615d97f972c04f23d964a503ed440601baa1987b97ae85593bb27555134674d02efbe5b9f68f364dc1d91b77470e4f567343f7336927db2912de388d7f18f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab313F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3142.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit