9851570b1cedb59b85e7ad85bc037f489895f373c735c3aa60875c64c0e40656

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fca09068a46fc73cc296a40347ef779_JaffaCakes118.html
Size

75KB
MD5

7fca09068a46fc73cc296a40347ef779
SHA1

e63d5f0f50e901e08ec34b970ada2b5c2f371c73
SHA256

9851570b1cedb59b85e7ad85bc037f489895f373c735c3aa60875c64c0e40656
SHA512

8e21a3916aef9d1417539bd7557e8552f32cb3b0db68267d9d7e88957864cafd158cadb49b2be2c7da878a089cfae1220ccb1034c9a9a2c80c7d1d559f59f4bb
SSDEEP

1536:ToAID6fiqxSjU6GSNoFBNuPhbcQonzQH0mYMttU9rDYuL2SDRkKfyVXwwwmExZL+:THID6fiqxSjU6GSNoFBNuPhbcQonzQH7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423126065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b6a4ae6cac60f249a16d22eff48e1316000000000200000000001066000000010000200000004bd896b101e7c3be741bfc4b23e60eba72de6ac0c730ba404851da563e697e2b000000000e80000000020000200000006dc422fb70def84b8b91c08ec72721d924a5abbae05874accf557c3d34f9428920000000c82f03078b10cd9740a96411377d173ab32a1e416dfe52cdd105c49d8932397e4000000016af56d3fde85aedad44ba80ede883d820b2f5ce8984a27dbb791362a7fcacac58edba28ab886d117e9abf0ad0fd690e23e3ec389214f3df1bbbfef8fd425ddd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e052b691b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE3CDD11-1D84-11EF-80DF-F60046394256} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b6a4ae6cac60f249a16d22eff48e131600000000020000000000106600000001000020000000b3915b412c8b64985a699287e527863124cfa846d8310b082543b6bdef19e2ec000000000e80000000020000200000003adf800418691c96f0b5469d1282c71041352c46f909f6a7280631f83a8bc585900000006ec0415b4c87f673271ab3ca2a82faff884639d71181eeb8f12cfc39ce1977802b913edbe3b6e8ae6168575228c6f84658f2fd9d4faca3d7690ac603c324bddc954cee9c7448d2fb86404ec9940e50eff2852b87723a31d5e2db43e3641a0a01349ddc39f79fc174174850cd8e2dab8155512997985f651015627d637a6a884d92fefa27c378856deb8059e10f8b5f0140000000c3fb9c4a20e8428c1222ff7949de2a3fd29cb339889ddcb2cc248f46724abaa16d5c5fc7c6aefba45701da92f699028bf6f138567bb64c9e11c03ec3dd444393	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28
PID 2836 wrote to memory of 2908	2836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7fca09068a46fc73cc296a40347ef779_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbc45da6309a8a3ce3614c68cf93b347

SHA1
478a2b436af0fd82669dd3d2f491d93510aea681

SHA256
9fcbc1cfeced94ddbc54dfa9f7f84b57c0671b7523b73cc9bd6bf9ef57139041

SHA512
f0801584fe5ec4745da56f1fa1cf778fbdd61a28ded5d7631e8e335411532a092c0ac449d878956524942bf7129bef0f75bf47b0e2268270c1809270082d10ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a71aa2fe20ad674ac8797d8ea4e6cd19

SHA1
7e674ad1163445db09a2ca780b390febc84325dc

SHA256
eadfd0db2a956155fb0141f3f6c5a43fdd40cda0dd4fabb130a0038812f1014d

SHA512
842b6b6cffee38fc12dce662d7a75e200c5daf106887e4061fcc5b4a9532abeafe9037dfda23cbed7c1c1f5309ba03ee6f349032ddf619a74a613eb28ed785a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2949648b03b845dfdf3a900b61aa2eac

SHA1
9ba5f6a4d537bb0945dbb6e99acfe56e38b92160

SHA256
44b13f7f77ec20ecbf2f11d3357626491ce7be895e0fb5f04eb578eef900aca8

SHA512
15602fdc2b0624ea07afb925278d35c05c58ab036f228050b9702ee8001066b3cc9a7535d4ac28f9a45a6e6a66808e32761f68fe88fd07f5a293a8f5319472ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebaeb1fb8d2846c90949e85608100149

SHA1
861a9f2dc76b2bc49dc70692efb9562aeb8d5a84

SHA256
8f5fb67e3d468918e8c540ad97c9a28b7b3f9e85571b1b987cb9c5e5aea38db1

SHA512
80ea0cdea9fdaeb85b52ce20311552f077a9bd602832f54be9bce97b9fd74a3bb7f083cdcc3c22985537f7fb8de80384b8e4ff405d57e963feafd47a3b0085da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d45976c0123e301e3dd238396aae9772

SHA1
a12ca081af8bd017c88bc90e7832f7c4c5615117

SHA256
0dbcc82d01668eaf70e5d199441dd90cd81afbb28a34b63c021ae34d5c31f2a0

SHA512
1f083cf7ae395f99b89e998578d3666b271e10529f44ba0a77b726345bf2c1ddd9d52edcf07d891270ee69b7ba135e8f545205f82e9b1c000c146d27adb245fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41baf1905c18d08eb081178c6d18a769

SHA1
06b03cf8ba038c553de979d335f9abff88734e70

SHA256
6e14d1d96bbd4d0fdbb2ca2e9e43fd3bc1ec94831af2d8fd81f1abebad98f5b3

SHA512
330a179e475f31f1ffb6e2d3a2fc063151e51a01eb9a740e364ba30df3a77d35ccb5fcd6e40a5477ce888ae67112b5a300738b8bfb9648daab368f78435e3e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e200bedbdfd530992044238e51cecdf

SHA1
59c8774751590abb9715d3af6fb88e2a5f93a7d5

SHA256
f37da465f976c388e675d5ed78eeae1fcf1557c5be3da124aecb89ca57b68cd9

SHA512
cdbc597c93a7c1b8ff82bd76c8b8f6a97f81e745d0ad518455b3b2922032bdcd3e7c106eed2f4ac24f0c26fe0f05abf9d395c7bb8f0dd9b8085fbdc96c675fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bbf0de2063d1e6e26030ee1ccdacfe1

SHA1
71b11a3959fc9cbf1ad2c3dab1e2a36497402428

SHA256
a145a03629eb148867cc699629260efbfde520378b21966fad18de28af9bcebc

SHA512
f91c9de790ea06d61d3ac7f004b800e1cb4b985794d581cedccfe4c2a8f0930f3f44be2daa0230eb8bed30ebaffcc499e7919f4509e3012524bb180d35d0603f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38aa1263be28d2634a166565515c0491

SHA1
ac966548048bd1329b6f42af32960ce492182dab

SHA256
87b88608ec983eb590d7eea386b46932f0b8c1970f06e258aaad493369abb7f3

SHA512
2cd9a5947b133031c411c2841b2e209142cdd2e55c848171260a3fe2b472e872c4991aaf559d85fa34faf3d4bd68166607e7f89f8815cae560a56d9b20c64959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7a293e614c1de76dab1d301262bd144

SHA1
7d2ee3ec996dcbb3224b212042ebf3cd94007adc

SHA256
7106ed3b37325fa39ad025146280ba8c123bc95ea742c7827835186a1369a66f

SHA512
7dbd6ba1babae46552491771fd7efcc8347b03f35a27d0505f0185b979beff7c49d1bd8e58ec0109996af8f623a97e482bd1041fdcadade082a2589ddfe2b901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff7347cf52f15bb786bd2e41d45ae656

SHA1
8b6dfb1ead89494eb05d41a9f39455ef69ad8159

SHA256
69c44798001ff12cb0e1919bb287b12368d35a0e9713549b22409cb529c3af10

SHA512
747b7c5976cd8e0fc40ef3600301a18a8dc651b732f5b4a3de3c31f1b14b013895db0c8e4619fccb620380781c11381bb5e72c9ae194b7bb4241811a66d46965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9332d29597d23f8339261de54b2b7551

SHA1
8828e69d31fc7684abbebeba04dca7119cc15987

SHA256
fd2bdf6eab54b6489dc70b13e02372368b864103e1c2cc09bff2782b21259ca5

SHA512
eb5361b62a6f453dbb1be2f33074f37ad56d775ecdab8f57ca63e8775c65468d4bd9e3e525c4f68e57eb5084ba806e3f37ab8878fee0685561ee0075af6d5508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c39872899ddc963ba7a770fd7e17616

SHA1
218affb7943bf85381f39d63b33deeff5e1967d1

SHA256
dfadfac1d87dd728dd8bc3347ef7e015e50eca0877f7bb309b3a9db616c8498f

SHA512
8a17362b493e7269953df5cf864cd6ca84dd0c63043c5689d9b7bb1b65cc4af490294aa68a22653fb7e97a2b8fec4abc8a2658e9bee5c51201a6850453c1bb6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a03e29d6a6ca0e7623e8969368e3e409

SHA1
a1df1b8f80ae70fdd70a526ac032eadcff8c4d27

SHA256
84e383b6e398d1404cbe5be4590c2c4948352a6e115cbfa62e413037215a0e87

SHA512
86eb7febc67122ccb84cc94216a919e6f911ea1d93b4dc4a10a2817dc5e86927879e12982541fe7fee1437e4ace54e0fa51d01f415e1ed2a6b797b4f127a83c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c33e2404e8952d718acdebb7cf6899e8

SHA1
203a7507a937fd6cb1daf395e4f9d32f91454662

SHA256
5871e81008e2579a5bfa054caeda8aef707d9cb02a59ea3c5deb16b8451a1e63

SHA512
ae0c9520916eef2bb734fd9c7f3c2f08dbf66c0f79d30b2b7b79c32ecab759aba33412f0480b823ef2bdec1b093e0f9f189cd3abaf5cca9dd076ac2f77f90ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e75146d4020cf01225ee1a586c077db

SHA1
8b94df58bf22a6eb36e1d51358535389820b6f5b

SHA256
45c62e204c956654aacf6b919f23f5e0749ae4e97f75f3c3dedb6e2b7aa56877

SHA512
ece8f50f2c0cdc21f44b158f6d93a9d909fc3cea8122ca8791577e27ebffda1050af03d5030034814ac31c4892562059a66ae61e646cda20c3740557be6e2f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4888.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A24.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit