09236fa8b7e6406af23dc0be2ffe1161d3baed5aa9df605721d29cc15b233934

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8039954049738b109600cc3a7b1b5024_JaffaCakes118.html
Size

461KB
MD5

8039954049738b109600cc3a7b1b5024
SHA1

f1831bb7f7e37557ccdf3046be85ed74d79fb1d0
SHA256

09236fa8b7e6406af23dc0be2ffe1161d3baed5aa9df605721d29cc15b233934
SHA512

94c3be62da3d10c072533f44f41ac1bf6b4efa11a4a31045536602b2e99e9ab96624dc5b15aadf51085c0094a8f06c96ce2cba3fdfd1c7aad57f4ff4e2cfeed5
SSDEEP

6144:SlsMYod+X3oI+YYsMYod+X3oI+Y1sMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3s5d+X3T5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423135937"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8A71E31-1D9B-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804291b1a8b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006eefc27005f0af44b8525c52095b95800000000002000000000010660000000100002000000019f5e8f9d566cdf81cdd6ce88242afdf3cf8e426209cad82740d34efa054d7cc000000000e80000000020000200000004446499c18f0d2e27bac8041b70c7d157bf58dca321a155986705edb52667f5590000000664b313db6125e94e41de800fcac82e9dd588b1a43e4d5279cb8d5ce86ff09b7099011c4ece7a4c547dee36768b00910435bac715b266618029d1ebc9426b6244c5436b156512a33a8c240b2c7bec7cf5638fb05af80b74cbc6f16d91d6e10b6d55f3daaa9a096ba94a0f08300915354198aa564d861e45e40db91abb6c7add861a0e8b065aa39b08c77293765af46e0400000002b2b4b22b784e151c2307cae43de3102981e80d9956d2f161114995006c56dd5d5ae89f583fef48cc4a020201f8a2ea8ddaee49e6b9f72f57cc297671eeb01be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006eefc27005f0af44b8525c52095b958000000000020000000000106600000001000020000000eeb07658062393e0d538e144e1b349095885bd81b7ac011d397e6fb509c61996000000000e8000000002000020000000594e8660266548e614a75722ae70aca1f1c91615ead5ce1c69ce5fc54669b3fa200000002c7318321ecce2b43c0d1ee99650dd2c89a543c5f93bbb8664857be2632f25f040000000c66467e3c1a26bea61e3b1df14b299de51b7b914923e953974cdf8a4d12580a182767409f417ecc09419efc4e07096c55113ec6f0b4b1d8e087c784c7deded35	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28
PID 1100 wrote to memory of 2300	1100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8039954049738b109600cc3a7b1b5024_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9a7b5c108fa7529b269192c77fa6ae5

SHA1
5e45a29eca73674755efb657736a08d743380964

SHA256
ee097f12bb1d3128de49d8a446211b268916f638962c62bdac8f5be4d978f856

SHA512
9d95cf8a98c2069bb081cbaf90b432fb0a122673db2e3cbb46343c8745a1d8f4d86058ace1e0750cfd75d2cc43cd47d0363e9e5e467fe0b7ba8623559eb2433f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c694689ebb02865ccaf0274659e78e76

SHA1
c991651bb9af240aa413728540ba0bbf6916335c

SHA256
6af6d24f9c051bfcc17ed60b0c8a831cd0b9d98ce06b55072fa5711bbe278235

SHA512
b090fe852e4796ffb12a317882bcd198eceeb1b37997279bbe10b08871e5127e4abb907d8abd9c12eae7ae14189b294532d5a345f537aefa16a0981a390db7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
117c31596185ee6e16fc69a68e7cb9f5

SHA1
512679b627f933759cfc40b91d5e2e0c0f58b310

SHA256
6b0705b0c84232b7b915c04cdc4b4de708ef61a9b844bc010e5df3d62d80f74c

SHA512
0a417ec09e4142c0b55f2e7fdd66321b1af04775c910cc9c21cfd662cb33697200ee531ca7b3360fd2ec93b0c62c406838ef266bed8e37cb11443a0751a015b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b05009be7d861510b28a9c7a9eb0c688

SHA1
3804048da352cb3752b3f34915c31aafe538c6af

SHA256
4663ea49644b95d96367acb8e8378f8423b7325a2c06c91fc888a1404a9d1e0a

SHA512
9d597de6c43f12f65857b1e133b6cfc77e9341fbe5b608ca109fb4f11caa9f43434a23f2ef99dc22c131339594f14bff74b5a4d7dbd9e2a7fbb79f01b67eb76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceca56dd59feae23fb49a284d6bc6d00

SHA1
8718aa3a389d1a02c8544f6e31903878eb75bb44

SHA256
c8e4e6fe81eaa257e10366e37b35446695679a1c1b3eb6902d87a1200816f61b

SHA512
cdcc766696496ef46dfe621023227a1d7f7b4be39c73afc353adf4216e2b0465344ec842fce5c43dc3527a59f00a6e0856a9f5423c216b5d8b65812966005822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b64f0c71e921768342fa0ca77e7fdc09

SHA1
2487fa89edffacb4eaf8bd11142e0fba1672a842

SHA256
190fccd4ad4752b129b2ee3d817b0fad350c03e5d807a904952b9cc2caee8a34

SHA512
0b6fb7fb99bbb46d269ddb1164531771a909f1697dc3a9a32eb05b9a26eb04446ffd2026387ba96129dacd9b0c6e554b2fc633b8e63a4307fcd1297d5542c8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
045092573b616b75d916342fd44f0405

SHA1
c199d7623c7da536bbbf3231426eef296bf6c7e7

SHA256
cdc248bba21aaee316c2e26368018aa8df4fa86cc326f293b1d12587bfefc21c

SHA512
f2100291fd33fb310106bcad7509ecdb328668b6796b04b66ca8ada2eddb46eb2b7906b371f12e0dc52c0dd97c465ddd6ca3d2981b8eeb942adab70e7a92edeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33d972e156a5679892467ad952138906

SHA1
6831869df75dd9c795379e52b0b850309679cdeb

SHA256
f17268c6c07955f427e14bb00dd7811de54ce69d42292b9f29ab117aaeb7d45b

SHA512
54ef4a91c949cd4c5a536d95d65b0098da63b4d340d579656f3b5abcdd79260854badcbd07c198dc9db5656a8869e4ba5f4c8a5ae17db5f47df1e52fdcb8dbfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c59901a906089cb96b9064b9b3228b1

SHA1
e64e57bbbdfd781c34fa538062794c8c9ba82b97

SHA256
be84a15ced6c48a09e3865c5f04b78bb47f42b6d82e1f8013d2d7b4bed19224e

SHA512
eb5988dc2b8eb0c040126608d29e5ee9326f5fee42e51894d520e3d32bdcbdad9c1d8112bbbc3a16af7a0114c678cf67a7b278ed74b6ed5fd5f932818510a02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2af2aacb2b5d2059efa1df2a4435e0f

SHA1
dd9a6622e9f65c9e06957078c186061815c58433

SHA256
18a35a11bd8739924d53d0fe7f26d51c670b3fc5c3c5ea6caf3755f4198e288b

SHA512
686bf051f2a74512def11f9000fae2fe669bb7d4c2bd49ad9386abf24dc147c52cf4f2d4c29c6006a176c4fb17c3b9f456a370f4bd5caf7122637fdaa58e7cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0288fc5ae45d72d303f5fd23cd04f3e4

SHA1
e0787d7d5e72b948e88f00a09eb21222312b4f4b

SHA256
6fec3fc5c4af7ddf81d4c4ae24b8b59bd15155b8d030691b09daabcc1e7ef0de

SHA512
055e184180d4dd79dbe3707799754b8731efa4326125b2dce18d63c28ad6bd454b5c83c7f2dfa666ccd1f98b5c61edd042be28b1dec2dc4b3f7792a1884d5f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae6151b8e88bd8cb16eb02fa0a4800bd

SHA1
fc380a2d4acfa73e63bd1873c3533a4da3fe0fe2

SHA256
f8a2b8fb74c97e9d064255f859d5e3d398e20eb2aa913df0d5f61355019a60c7

SHA512
13dc36724029bfe179caaebfc9f074e53a4de9e90ed382c66db715baf340432246b72fac03717c41db7b81fa03892641fbe2eb5631a00af8218b672bfcc5f526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c7cfb04418fd3b70a5b8fdb6984d9b

SHA1
d350acfeaf5c398432bb3042e2973f03424539c7

SHA256
81673fbcbb6db86cafc7a7748df804a1cf434bcb7c7821b8f38aa6a4bb42720c

SHA512
23ffdd89d898553ec1ceed0bcb155b344cabf22947b3f17143f1dd6c02f0d5a1c0703ac90e40504c414bc5d7c6624446d297855e0aa4213c114bbe893f5118d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c9daabf510c338e64769313fed719c5

SHA1
ae73dd628970197825725310ff3059aa11e9c62b

SHA256
2e8c9586c5423be12deb7343cdc4a096acab051583680ea29ee8e6a000d86bc5

SHA512
3f620016d8605397a6bd1ab289dd63153e9e8e1fdb77c927aaa661cf898e0de5aa8e97baf2a884df5dcaa6efc5cea2e8e066d9cc19e6829868388ad13d911c22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6061beb7414002e03ad09ee73d5253fc

SHA1
9b2c4f3a8182134c836e3fa17decc12d9e318268

SHA256
866ccb5e9779c828e0417a5ce2e5339ac1c58cb3e45ed3575c7d242bb4236a46

SHA512
60a0f81ecb8a9274b0749bcec23103a60cf47cb6a3940fd4658c202249dba5c8a27d123df7002c6e0ef7d3edefe3a90d642960c5728bc395640e6b023254b470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
666ca9d9b42c1aa59ca9462499d00cc3

SHA1
c512f26ff06a4e5614cb7951566ce42419d291a9

SHA256
e5b4bbc5431dc828874e66253fd2e12385afbcd88d093cd6d22c34568ab03a26

SHA512
becc4598e42631deca6641d4f9409e235b2113181ca0248eac10650573e4c893ba5733efe54f6fc56d2cef07533b5ff3ebaf3fbd21daeb14ffb42bee0143cf4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC746.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC868.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit