b950bd92bbf4ed8e1897181181c29c5ec8e8a41522915a9887a42dac4b4d92f7

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

651b20183baf589a06d09d48725f8850_JaffaCakes118.html
Size

23KB
MD5

651b20183baf589a06d09d48725f8850
SHA1

0d94123c03d90f10e6315536de6ccc388d9690bd
SHA256

b950bd92bbf4ed8e1897181181c29c5ec8e8a41522915a9887a42dac4b4d92f7
SHA512

838f78ba830039c5e52b82c072c1e5ab1bf8c58d0016d082968b4a2d9302efdfa781936f3c3f841b0f109565aa005cb9a4d36c69c4e430690b358d2dbe8ffde4
SSDEEP

192:RBul7vFZ7vyy9TsVi7NaNe9vbfKBiapLaWf/Oe74tWfkqBdWfhcQWfgdTnLsRWff:YfKy9lp2iaF7XPBIxLs/WdLcPFM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b25580d3abda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c7a2f1676904d641499510e1ba069bf970d941a38b5de8ba61cdb1e6b98b63dd000000000e80000000020000200000004e9bc9f5b8b219f08c371308427cdf9171c763fc2e67cda35074e8ac8be43eeb200000004b2bc0077111d9dcaa33722a8d1ca9db33f06fdb773a90d926c61c8c496496154000000039c4861edf761720939b2891aea8ad41a67c158aee47797fc8d6a20db55b6e06b2895b4dac5894bff29c99f7c3f21131773d789b4558b11f7d03ca21932e0aa3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000d7e7b263642cedf032fa75d3251e4b819386079a1233eec50ac25b22825aec2000000000e8000000002000020000000d52383132eaa1ae526bb747a1e354b8871673aafc61250c873afb5dc6dcd0ce790000000d84686e8d0ae0346123a011b965c3370034d936afe1f39fa86b6fb2ab918553c63c785e52c3bb30a82ca3d69809f56bb1260f8d3c565a38255dc5715736ddad39217ac24fa2f51dd4c6e201d13e5db6defce58ca8bb992ebb739103f2a3dce9e75ef19aaca51377587b792f084f4d72526e6c043f540057a59e6c2a449fd4ae39eef2d2b2b559031a5d18ce3c8bfbad240000000dd5961ec20fd9ae0fb38ecd3d6005d4693d2a3ca48c6fe1788b8ee6e7cecb9626f1d715c087ac3c3883f4ad26c2ecf5a083a1d564349006cbe8aa79188bb8956	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABB4A1C1-17C6-11EF-8C71-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422494619"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2740	2212	iexplore.exe	28
PID 2212 wrote to memory of 2740	2212	iexplore.exe	28
PID 2212 wrote to memory of 2740	2212	iexplore.exe	28
PID 2212 wrote to memory of 2740	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\651b20183baf589a06d09d48725f8850_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a94ed87e4f8174326427836182641e44

SHA1
8f3e4183f31e05e78f76974968cc0d96afe16538

SHA256
401a76f7cba71309ca6f444b055ab0dd9f468a3703fe3e03bb652ffb872637f2

SHA512
dacf32d863684aa37b04e972fdc2fa49c42f4904a21d25216f0c6c6952e099d6abe31079e00db1b60d3039e15a1cf701035ef4598f34ad40688cc13d473f9bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72562f47ff21592281ab2e5cbad5376f

SHA1
3741f5174a17b92cc48f27e02d25893501970e4f

SHA256
57f41fce3c201e73a0209895cb9a1749a2a9e00c2f0118d91d8df812da2e34af

SHA512
e8617dbfa0848b9fe070b1e6d0e139b18a2549b413bf1c3d225e3c208cfe4e2992b98d327470e7d40f3dfb23fbcae35f5eab6b09b5f127ed836a1d7cc2f99128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f13ef8af1a4a3dc4ab3ff0bad9dd1499

SHA1
cec741bc83b71fb1ae4f5e4087d326f3f027a8b5

SHA256
e0fbd1627b96185b3bf34ab3f28cbf4187807b602c624d988a7cc23df4d3c819

SHA512
a7e3c0b86f5312ee95608c30374c807ff18afd928f1430619d1960f286d84645ecdfd16908c0a03a448983fe1455ee50083438c3e8485d42b49ee9e72396a619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18d7394d96cb3c0debb0ea1d5f9b8ebd

SHA1
e8ee99ecbe55177323912ee0e6888f19a9441632

SHA256
256d033bdf1bc68cf616fa530aa4deb5a0424b07e5f4f4296eda1131f1dee741

SHA512
156ea18b342621d1c8abbd883863e2231202d19fc1e37659085233447ea440b3b44db748b9cbb28ea25a5e21761c3c320c7c147f028e54a9f7c9410472faf660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
288835ef7feb41d2ae98f9849a6a7e2c

SHA1
8fc8f8f6cdf96f7c8d3ec8164bd523c15819b79d

SHA256
729f706b4195de233865687cad2cb9340fd71682467ac3ba04d8b9bb48f0b5bb

SHA512
70095740a925bbef2fe4bc9a99b8767afd0c375310bb972e09ce48eaab536a2b7ae50e13cf99fa6760676fffdf529813ccdd5312dc54acc632263e0580ae65cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54517a35d41cebecdbd24eaba1f52105

SHA1
f248fd3750ded076447a0bbaee854d99ac7ef932

SHA256
95c20cb42c4be04d372282a8608dab9c777ca1fe098c1c959f4d92b80634bb57

SHA512
87da32621c0914f1f85749311ef008c878a32b7e706ca12710826e7189ca6c49d15975d384dc398fe064ad26283e652fca0d7940f1425cc6829d1bc893d151c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a87ed6957007a98fbb7b864d72d0dd5d

SHA1
b19dcb7d42e4744232f8828fa3fce1a9e8fe26d8

SHA256
6cfa03f1149ffa73fa3c6c5fe7845468025ee269ee734423fef65b044b96e28f

SHA512
eea12d4ebb2f92a270175fc55951b4cfb06f7011a0fc01b4799215cd0ebb14ff921a20fc19bb1e3dd8bd20f87680c09d806447f19e7d6c1e30db718457ad791e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9546acc076d79363e0078c1b7b958699

SHA1
a372d2f3842e4bbb4c7c8e489fe60075b94c7b2a

SHA256
4f67569e80c4e316134a5226847734df85fdd03b04c0af45e5cf381153292314

SHA512
6a25a4f18c08d54a0938a6dedc9cac5db86167f05d0e6b9d6694b4f9bc7435bc9f72d43a17e37895827661ece3af13609e0bdf66cf1a39cfe0cdef3d9b5df02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee65f954cfddeb8bbbd9e03ce98293bc

SHA1
94532a09c235a6c947ea4a0d650421fc0b603d2c

SHA256
b4b70a3dfcf17074ed98aada53b4eaf592d721fa8ae43b6b4472abeead8492a4

SHA512
7306908373e68be6d3ef3cb1ed0362c60249324e1af6e768e517fb3187773bb813ff7ce5e96e5aeefd9a434dff878f28570a825fd2b3a2f9cdf53f6eb5da186b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f60c17be84072394ed687d7a2bbeccc

SHA1
aac472311d80bb7e3a6d8c24b33277424a6f61be

SHA256
f0909421005f24d4f94f98d51c010fc003dab5d4a0e230084dc5464bfdb00940

SHA512
92cbbb42fb919157f527e15ebff60808f6f7c4ac4a95579b6074b1fa350eb29a80fc9333cede0b363de3a8031c28067b3ee16cd610c727d95444012d73394a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f47618ed53423b2ec9ff28b8eba3236e

SHA1
c84109848b4c8a5f660daf806ecca3ea0c5b71be

SHA256
ce889fc570584941485929cd2b65ea6cb486a623d597b070b8d0ab484d0055a2

SHA512
20db61b980df76e7334b93a033397dccfc50868bfe9e9623239f4f49dc04477e51ed2b0a3372ab21e5762532b2714213d5c9ff3a0f13381323645d6932e62850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1428500c34c02d034c9e94bb0bcf979

SHA1
19b0331f72a51d9b643af4d6deedf14e59b3f799

SHA256
aaec53f40ca546785f261f51e9cfae068ebb213f3937484ed1011716e6a7e52b

SHA512
6b345a1cc162d65935b8d4dd09412a82d57067aad52090e3a17b371ff567beef8375d655347ca3c6c04fd9bc3f34cc71c0721f0f7cb7bb2394e5367b465e0564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22dac815f3f3d5476fff2ff3ddb3a97d

SHA1
2abd0f5e538fde0c58a432f2a11c6e940713cfc6

SHA256
48306bcd9956eb869aa97da04ea6aa3256b5eeadb57e37cf9c5f79a220779dd2

SHA512
01d962d7634498293e818463620c7718e2afd666128b6eae6ce914bb8237259bad909c6ad6c762215b12c479365296b0131e99ad3486e4f9aa5daed9f69bab9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b4db59c307b116666bde771f21bef4b

SHA1
d3c33de9f57554c10dd7ed49e1bec210219e8081

SHA256
18474e505e2241f4d03532ca1282a080f20fb5d752b7ff7b217b797321ab2ede

SHA512
71017f6e4ce352c899abf57d10b514f41529f79b99e7fa27413e183aea68be3b976467a1fc85f916683cebd23fd0312a634d286e00ade730ba766f6741090bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35A3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3614.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit