40845f0230ab33eb4e6cffb9f4f333c0b673ba5ae8c07709633baf4c316b8eb4

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8214819646afb43164d1eb3fcdc7c908_JaffaCakes118.html
Size

18KB
MD5

8214819646afb43164d1eb3fcdc7c908
SHA1

30e68cd77282b74b1549a6f6474fe184b71e65ef
SHA256

40845f0230ab33eb4e6cffb9f4f333c0b673ba5ae8c07709633baf4c316b8eb4
SHA512

bad3f24896f95483ddc01029f913e90b6574cd70160eb345b7a4beed88850741d29b8d23b343324f6cfce1e75b5b8e6de22012c8729db66098b2fc4444a6d8cd
SSDEEP

192:wbuWfE9yYhXSHkYtg3gZqsLLrr7Lm7PAhrK:YuWfE9yYhrYvJW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d085f49a13b2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423181855"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3B21641-1E06-11EF-8E44-4635F953E0C8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000042280c20ebf0ab77b348b4a123a92bdb06befe284769f1a31cf2f33d2357c6bd000000000e8000000002000020000000854bec3abca2a44e0c9522937d7ee37f58d4d7d3b85b52e05a1e50ff53707627200000002ceab39918f541641544162947c6c41d34032e6e43031c0550dbe0a8e236aada400000005d8b959820a7b1c44bbd6f291314192419e4e524a497a1329cc6357244b9232e6b1f5d5d8277f8aa8c11ff85a9699b83a7ac10039986fe1477585a97b07be13b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006a36d497f43c5feed2808a4e8a92f284d5fc3e95950d154ea4e44903ab343d9a000000000e8000000002000020000000999f313cb8fc2a0e21c9f00b4582519a4fc8391d2ff4af22d35b1df321c5c85290000000341429d67e9fdf9856dd0e0b2390f83030b64cf113e9589844616e2eb560c01b1f39235b94018fdeac92599abcec5d831380b48ab64803c26d0717d0531cd9dada64ef1f95d15cb88eceba2236120c2e901cfe5af8806c05e9a92c556cea942ee686d9cdd2c4a72832efa2b22d97a86f49ba5155910b1f50160122b228372de52c0700804648ed9247a77aaf69eac95e400000004b1be8b359ed6a3ce43f78b3c919492537f0d1fc6eef1ff74fa17f5414dd240e25b0d35f17df530266d105f3644b92aabad0034d196cf274708a45501bcbf75a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1872	1700	iexplore.exe	28
PID 1700 wrote to memory of 1872	1700	iexplore.exe	28
PID 1700 wrote to memory of 1872	1700	iexplore.exe	28
PID 1700 wrote to memory of 1872	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8214819646afb43164d1eb3fcdc7c908_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
110458a60a625fec95431f4d7132feb1

SHA1
4667d2bea59cd9f5ed3567d0b384d2ab0e2f8281

SHA256
80cc67409d840cb1f3f97c0eb412d342579eca5c2af401dfe04512d7c2b752fa

SHA512
8632eedfbad070c9579eba2bd1d86f334e8e7f1f39706c5bba3398f69f9c610fa4d090f89c14e2b6e12f6821336a1b4959a8f26fb3b3e074de72aa80cf475a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c430f9e1da75a5b1d2c22dc79f6376c

SHA1
df5c9fd236c42523a23483a4cdd7807801bdf0f8

SHA256
84a48a1e2b19f00bc87b0c95cd0af78c55560e134148080f1a29f5fd5f3b1a0c

SHA512
fbc5a1a070b5c4a7eb3950bc743c6b026263419f1137227c058deaf1bdb31448b61cad58608158072f9ca25653377c397b6fb2ed2fc80ad17cf160e07fbe1a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aefd32f37891abb1967c3cc083ba8a4

SHA1
30e3317a5ed8dac6f4ae65eca90a838e81879b10

SHA256
ca28a3c5a4880659263c794e97ff2cc3ea1db5065bc09052428405af3de18cb4

SHA512
a9c260e370b2375a08a192101ed68b19813e4fb90a216f5f7b48d49ebccfa84e9dbb3d621402b0b881619898ecc61efd7e6c8c9c0255f82da6d972b218d58c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ccbb876a9cc1a48593e89c70b6f5e30

SHA1
bcb99937599eb1a0520707748873cc3550eaabbe

SHA256
b11423fe42d640caaf2b763f90a5b7664e724398b9e539570f250e2553815096

SHA512
426c13fe2521ab4b2ec85339c99939cd58ceabcdf433254b11cef4a3aa2cfca0cde77b8ed6609b2c42a2208bd3c09d44442477c30a0a35208acecd1805addd74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f532e85c6f47f7d4935907d80b1f897

SHA1
b5ace8a19f8afd1e3ac622ae89ba94fdef750114

SHA256
e1a50582fe71c539c98d36a93f678499736175f4962510f8d62aa1fe204f4b16

SHA512
a51df958f184e38e66521693883436ac38289f8b8255d7dd610f3a8beaabbf8791eef137a5c1244c2edac1e694bbca6248f3ac243f3f6a4b1a0b75c87e41b2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb5dbc7f7c2876dcd7ab746e9504e645

SHA1
6c80f9659cf9fc8bbcc8e5f17102b457bb35f558

SHA256
d855523dac9099e7c1ec1321b357677dd73a67aabbd4187f2fe33fe49d18af27

SHA512
319ca98b7be9aebc8a6121da04a15f536afbd4ee4953584d1a02342ab6e32252ca4f3d869bc4b61b09ea10e79f07bf2ad14e042b0b307659e54eac2c978c1910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd81642378fd24a77ab9f2216e35537e

SHA1
5f58c82484b19f305b5ed5dd27b9a82cf13e37fe

SHA256
933ed821111be04757af045dcc02ed1b85f0bdf439cf5c9d309d440b419cbca5

SHA512
743c9591299132213fb5994e86b588df47833232189a5d40990f5bd5778e784beeeb1b92a1baf98761a30dc7e078082f0ebf1af7f0acabcaab23ab99cdf631cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a06030d9f434ba395cf25178af7d114

SHA1
0631c19a667c04bca7425bc685390a5c855278c6

SHA256
894723f9de04e26e6547462df606180754e8193f1b991452ffb7938c8714decc

SHA512
95cb25e036260392af70efd81865542d2a754047c926ce5764f38e2e0fc168d98473fb668951ef84a12a77f45408546cf6a2eafc63dcee1f71faf82bc1f6c48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed1471236b7e91cb460391a35e8820f1

SHA1
db9185d8bb0e162db5d7c6f5d9accc72a6ed3499

SHA256
5f7bd528e0ccb3853d6fca5fb2fcb174e2c491b06410133f6fd3d228e169338b

SHA512
53a0c9edcf697e8b4e75f59af43284b435850ba0f99e610b1f2a54194f649ee9cda4489ee3733fd08653e5382de6bdbd28c236373cd78400e63fbd9fd75c279b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d14a8b8fcb3543a9b80e4cb296aea133

SHA1
b8f527604f784c98218a5c44bb507052f7e7ea46

SHA256
68f33a0a9a25a2c174e677b154400eb011778cb73c63b4b3a3322a6add5fdc2a

SHA512
929d9fbddc6804d491e966f1b5f7aff7f9d34a986e291581d7dfcddb1af1bc615a41fc2b26878872e689f69355ef86d58dd9770e4480a614e3f869491d605b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
356a7debeba2d5866f413ed6a31ce824

SHA1
d25bb76af777727dd3250422ba3fff07bcfb8038

SHA256
9b2b6d60b638a3dcb95d78d53996362f8658284c7031c09b2c088a8e5f78a2f7

SHA512
7b84a2a54921bf76d5cc6b082d51fd2af2b7fb12fb33379d3b64b4ea5eea49e642deec54633138a11083ada983481b26a06e83fce9f74cb6bc8575f84f5d8dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08d2b8891a061c024d5d215544334b3

SHA1
99462311bafc20997daaee72fbe09da088c81ab6

SHA256
ddff75b95ca411d53f52d638cf282daafddad421500b2b9d77a70acbea27538c

SHA512
ff292274aa9309679627751d4848a0a7d5c2c41ea8beb7948ef8e8f4ad223a068dbef9e8069ffb92c8975470f6b9057ca239e3a8f5cc602b7297f1f6392795cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e96ad377273e9abc22630b146123654c

SHA1
2dcf56ab5eace16222d48ee9b23924729c58a751

SHA256
94fe17cf86642115c1fd1f8e406e8e21a7afe6561f71507449673a19f9450f6c

SHA512
b90a0e17243b234e3a3686716f8b0d4e6739703a9a5c22a9e58f7455bc77fa6d1f15d3e8a267d3343de1991fa825bc22fd13b4e7dd30a72feae634c0c2a5a118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d57e9e2bb2c2d716c7757aba6318829

SHA1
ac3d2cc42caf12704d2403c39d3131a88a03c73d

SHA256
5e20affa5176e9ee0687f7b373653e4495ddd74e4633d4a995ee24ff0073ec4e

SHA512
98d2bac7a46225e54b9baaaeab7a8dc93eb8dcbfe7ee2c502a28ecf446f87664cda3e3fa8e878d218a084c49b4071ad5cb8a532e8f1feb07a2025bb54af5ecef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
759c5849335cc4e3a5ac609d6e43d2ce

SHA1
e1e9f544f4152a1710409e0ed508a5c003be5f66

SHA256
be3683bbd83e4ca936b4fb92ab51a4c8b127f0e6fc1d9738318d6bf048f504bc

SHA512
0cda9880e8f37a6f75544195e46485c195085689697ada61424307d44edd633eef6b631a1b08da013eee1219e88f135d0d3922b3b8319ef443b80aaf6d23bbc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62AC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar638E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit