be81af28cd7c998bd033948fffc7b4682ead3321f5caa3170ed6b70fac49e9a3

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c8ced1689f4dc5842de4ada7c2fd7c4_JaffaCakes118.html
Size

213KB
MD5

7c8ced1689f4dc5842de4ada7c2fd7c4
SHA1

59daec73fea51fa6b5dfc19e0918a06e264cbab6
SHA256

be81af28cd7c998bd033948fffc7b4682ead3321f5caa3170ed6b70fac49e9a3
SHA512

ac2d7f1b2cc90c6b1a37f48dab0533c877ad811e9775b0a38b248ed0ddcf6e1b2713f38e7cc7846a8d48d55199d2b7229bcf593be95f74a4491c4b2d169cb4a1
SSDEEP

3072:SJJ8cJomf3oDyViUyfkMY+BES09JXAnyrZalI+YQ:SJnADdZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423052124"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5FC28D1-1CD8-11EF-BE0C-E2E647A5CFB6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2564	2932	iexplore.exe	28
PID 2932 wrote to memory of 2564	2932	iexplore.exe	28
PID 2932 wrote to memory of 2564	2932	iexplore.exe	28
PID 2932 wrote to memory of 2564	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c8ced1689f4dc5842de4ada7c2fd7c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d25a590047fb877f80d39b45fa54edc

SHA1
f202acfe288aa1472826033e52637dacd8d1a3f2

SHA256
555970d80263ea10dd87097386f9ed69b20d571048663c4c09ed22b6bce262b4

SHA512
e40ae390047b91bd006f27e23ea209d8872e71d4de0f45777eb53a2d84af2518b69e58dfac682fa44d64e1846fd48f3528d0e2b2174e1d3871e729e6dac61577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556c6bed08a0ca0f70876d336a620279

SHA1
a28ac6c24582867584fc93ad0c9a0b7de023c9cb

SHA256
e0c1e6fc4822c260a4ded61d17a882c5470305913b2305902d7b20b6fc096ee7

SHA512
3eb69d5f7b9147b093f5878125ca11085652623aa7d93eb8dd351d1e57dfd2412c0985a37a8fc63c9c4b0699caad4740ea76c7e2619241ef23ab577ea9b8dc7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69bc417f12a1951ad60915e2b22318a2

SHA1
d436560f9f0b1bbdb1c08c8bf28936f1d10260dd

SHA256
3153e991e6fdad030907a05e61a028de22044ded02ac8242fbc4137bf294f6c3

SHA512
c1c903a4ccd49f89bcf053e9248a838063f85c2e8d98a68aa1d5debbbe006aeb262689ebce59a99d52fcd35b5463446b959e8dba047e1ee5d75bed0473331806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba2ca1507e4b929bd2c75b6ab1dd50e6

SHA1
91ac30add0a92dc990671015505b18d416b654ba

SHA256
14f2a8f692b83926ae6a4662b6a1c4de8b42024f81f6d4c09c29e3ca77573898

SHA512
5d3d575c0b8117a4219287a1f9d8ee7b7f8a980df3cc1b9ab0576e63fb160878d19ce824f2dd3fb3eb38134eda2a807a7202323e031371362afc73a37b7ba39d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc305cb0652ff210f5fff3a8c698fd12

SHA1
9fdca079bbd39041c50a54e84edd628bca42290a

SHA256
cc38f1ade5606eb65dd91c53fdc0b44c0571c21278801d68503cf71fee7a32c3

SHA512
53d2f1bf81faf70140ad309097a2c3f6ebd2f4a3142114ce588825d2f11d7aa0ce97faa0233adaccb0ab4301de9a8181afb1a5b85e797af8a5cd247b520fcc61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0497500096953943d257c9c309aa683

SHA1
89d5d17020214508e401d6d4a7967123c97c6686

SHA256
a0d7290bef8bc2f13b7304700678334758e50b6d946ae216cde195fb6eb71ec5

SHA512
528de4b5a8a13e61365074bcd5eb19d705daf324910e45c0ec6b146ddd99caf48cc131ea0be5410c3eadecfac45a08762e7657f7f21e753b76eabb2622871e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5444aab09f2e37d6f2a58c3de0c91324

SHA1
a66d9296860efa7dbd0b82e6cc5e53ffe9dd3c6c

SHA256
c1a1fb4abab78b94d05a3683d31b6ea2b41681dc40586b48a737f93e8a2559c6

SHA512
3d52ef1a8551d2d3c3fcb04c971a4319828a0cac2198c7e07d32f1ae336702693ea451edf7cd61ab4279bf7b523c5c89fad7ab09713065e20c3170dae5c547e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34a1ebfb2790bd6b4df0336d75f6ad85

SHA1
ce8f5732f9e5fe4a455219b186e7572110626b0b

SHA256
de662a134f4020dbda196cfd8fabf6d240bafbad3d73c92fb2af104afb4c3e82

SHA512
0ccd529dda8932d185bd5a9953e3025c7b74957721b5effb135f12bb9ae2ea1f30487bbc49c9969a0818bc56aaad1709e9707e68650ead60259fe38aee3ae7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2205ed8c7dc8a70c4505b05b91f9e25

SHA1
0cbd8092edcbe2b19342020da10726c36244dea5

SHA256
4654a6047b6a136579509c4fcc1f62092a6ac8f6263a66f68434735edc32f34e

SHA512
f4be12aab808745022b503fa4e569d379afbe1615620f42ba8c2d2e70f5f4f4abd7301fa134e566924a8021a4d819059d98330c02c94b84cebae025d2b133c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab9b4048c172800dbffe2611460fab5f

SHA1
ef2add6932c235e5673ed8a0ae6d8ba322e2f96f

SHA256
8180567031cd8d00243f2ed1d8d79a4447bdf7fb806791b0a676d01b2c8730e2

SHA512
8d008b5ecba69a0fc353fdf5956b3205562df3546fb5e0489b216db66ab774772a970e5e4c69e9beb945f812443eae0c3fc5f532752df9d76e05ac9961b6faab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcbd495d07e5d49dec483582bb96f67a

SHA1
e9e1a49b4f98b23364472cb887289420390ddbec

SHA256
db19bcea1dea6f02290caedf458a548fcfe9c89aa9d2dd7d1bb2aebbf096ac93

SHA512
878bb97956ed464110b31801d55b770e37bebf66497499be0b9b828818b33ec38a2fe878508811289bc549b4f22661c31d978072ca0f2365a493112daab7a558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04cc47dc90335ceb05d3a9d901b09d0d

SHA1
3b7739ab00f7c96062eb4b7ef13640373ca5fddd

SHA256
1098ec379c5fc68b9409a404296676074bc8b2f18d4c7dc49c16668be39bf657

SHA512
868c4a9165950e7e8a7dc3a6ebe91ce9d6d7a3405d360e94bb32523f10e40cd96f705040ab46cc68c4e67457ef55f828d6e1b9a28baa98d7ced3ddbc4525459f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6d9096f4dc6ec26c5ceb1f42258a239

SHA1
8aa23b41ea84342181af5b056a6e76789c56732c

SHA256
e091e283adb3b2fc91deb0cd3c0efdea7bffbcecff3c11bfc2d88da68a5d2856

SHA512
2a7211df0d755c6aad237fc9e7878b0f363cba54972edc0a24bd13509281ece0d885e6331fba680dc697bec9b74ddc3e8e18bcb655a5f20cf8d3bffe3f7a0d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
236afb153cca6e6057dcce30a72459b6

SHA1
1245f2d7107959ae6aaa57b9cefdb027fa982a74

SHA256
c0976980337d1bbb2d104a4b7fc18208203ffbb60175a3b880608952624db260

SHA512
184defd51263bcc272c43aa7963937dfaf25438828ed1264cb8da4dead94978efab28461883cac4b38b79245732b1958deba779b5649ae8a21410c2fb8242762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9610a559800ddd2c2743c92d12bf7ada

SHA1
d6c8c556f32cf3d354eb8b18d141c7620bb6622b

SHA256
80b41dcabbc114c1f817deec681fd8de8d6ef578488bc7c908f477d9a82d9bf3

SHA512
c5dc98601e9f050723929d6ab95610d5f97781618c52d5f32bc15bfca8ed67dc3d661be74a057ab1e258228f4835ce845d1bfae13d6e7a051c31071f9823a12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b557e1a480392faee516dc7c508bbee

SHA1
583da2c4f2c39d42ba5b3ac75c876a19fba0c61f

SHA256
079a5188c0882435734a7f2b8f6b8d48b6c9e30a4d155508cbcb11c93b59f56a

SHA512
8addb56a620ac50d649f9195882ad30a3ab99f75768cdabdf7fa2499c3fb703b5fddb7253619d082b9836f6aef7c60934b79c87adfba73db2bc25ebc1546f572

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab80C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit