90ece17bcc88e52cb45d2f65f2b0f085763b220f97e36552bbeee71d9d2a6c4b

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

807f9699d9c3af9195f6654744accf85_JaffaCakes118.html
Size

22KB
MD5

807f9699d9c3af9195f6654744accf85
SHA1

73fa022807bb77c84254a12d16d6ab3696b4bfb8
SHA256

90ece17bcc88e52cb45d2f65f2b0f085763b220f97e36552bbeee71d9d2a6c4b
SHA512

d835f807229d83143eead7eb3822fb52be088130dfe748b6171ada3810dbfb3a184c2ddcdc377a87a710eada9c4286dcfc24db12832f14ecd688e30465bbfa2d
SSDEEP

192:SIpW66pnVAeISvtayZXAZRivZgdFb2WJmG2js3jCa3GL2Ego0LZpGpzQQrk4N4lX:SIynASFpAaox2WA/5u4N4lX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017e9e6ed1b1609469ad780ec019fae4900000000020000000000106600000001000020000000fd011fa63c88db95fb2ffa447b6bcdf07e3a5858cd027ff5e9ee3aa8190b8455000000000e8000000002000020000000b05f46a3b81021deb7a3baeae6b35fabe29a6ffbb591b3a3018873ad2a6c6a0a90000000a25795931899521e2319ed76d34329251a114a1641e2a178d8513f41affd29c3b3cdf1279be96051a6801fd6f303bd10489e222cba9c3a59e26807cffd8c300f71f26058a296adfbbd6312870112b135ce5da6b6020863da6ff7300084e82454232c9a58ec79ecbd1c247e8a0a1a66c5417951eefebf4dccb2b81c67c49b24c39040d6ee4ea5589bfb404900c14a448b400000004c80fe779ae99c39f89ea7ab788dca10d33879f036a6f5d6cebefa3c95a17ca7a7c03018875f9ea51d137aea2d3b96d08cd3a84fdcd1a5b4708f533a9ebafa9c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423141883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1EBAE11-1DA9-11EF-92E0-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017e9e6ed1b1609469ad780ec019fae490000000002000000000010660000000100002000000000adc3f04a197c931e30fa368d3e91b23c25024f2980aedc87a047a7f722abb0000000000e8000000002000020000000b2e4063c4e2f525b1e096f628ac91c64f5b8a6a550431d12c64c10b13aae7e822000000001a0888cf4044474c7e7622f70fa8a7a2f2e54b2a8004ae38271844d5b65c9bb40000000fe8943df31dd57282bdfb6f94b02adc8d50f7b7374a92de20ae2b97a0c705ad002ca3e2f148a10a091bfcb41723b586cd82cb8b8d3f8802d6f9a4ce5da457958	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dd7286b6b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1584	1712	iexplore.exe	28
PID 1712 wrote to memory of 1584	1712	iexplore.exe	28
PID 1712 wrote to memory of 1584	1712	iexplore.exe	28
PID 1712 wrote to memory of 1584	1712	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\807f9699d9c3af9195f6654744accf85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca415f77ff13ff517d8c95919de0af47

SHA1
ea01829e53036ebe5f9a20af53932a83a1d7f237

SHA256
106d1e360241c8e1d32b6e9c4f4cfea1b28dfe08423f8593c68a7731ca3dd2e3

SHA512
e3a8fdc0e8fdec15b5dba69ed51b7e4632806baf8eb70c91f72fd76c9768b4556b33d9688043da94b99c2b2ae11e89141a5351c4e16547d89ff554fca8b500e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c70961ccead04c19488764bc592b0db

SHA1
6b79fcaf72fa8419841ab53d8a8872782fd71486

SHA256
2775727223af09a2af9683a3854518a780422a4ce7bdbbd94189d4f7ba25775c

SHA512
6ab7cf049b65e319e0ada66a6c41556603d59b29bcba5563d4c5ff79cb2a874c1e64d7992af4ec524e4a2ea69e2519dc7623fce84070e8b95f3da5a179d8cf53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97c859e678b96997166c1c652f62e6ca

SHA1
e6715421a55bace95e2c5b18c251bffc5ad83043

SHA256
a90a1e063ee3f328ce0f8cbb68f294d6e4117b58092504654948e6c7696e821e

SHA512
d197e3b532318d734e9193debd11483fda50e248d26d2f33de23934ac5034bf3e427a0442eb3c1c51c28588e6217ddeb5dc6026d9caf01108931a5fe29580693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c7ea2fdba91b50fcf1d0bd2f80df599

SHA1
3bab6351dbd640542760ed92921693dd163c88be

SHA256
bda3c056837ea93b1e9e3859fc9ec08714de9ef7eddbbda7756b622b2d24bc1e

SHA512
921f4547d82de5536c65bc45df615fd24f180bc7e79ce3ce6534ba0dc87775ae40c51aa5cd86e19df32ec209ba967f3f44f164d11c6272cc836a7bfe273785af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36f92b839d2c84a27f3984fb1a449074

SHA1
4090a5c045e088709b25b5a9a7761354e17c97c3

SHA256
9fab1e202a1942bead1169794c6ce58f5bdaa2dd002e0ca5abaa8346626bcb5a

SHA512
d019d34d998e4d2a07b3f702b05c6a719971a4735d2f966cfbb80a7855934138303e1761dec7ee55766503c4daa37061e9286c50034387693185aa3dd8bb6d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9db7f4b1aed08a00fa82e27df7a46782

SHA1
04d41471022b84eeb421d19b05c26eeb6761af39

SHA256
acfb6f8b27f5238fe7ef68b486318a603afbb96fc4385f1a487806982c6debab

SHA512
06d8707ee0639ba26f79a1b4de2bc3572f92c861ee9c41449616d44eca9681930af1a583e4f906fceca3d3ec71d2630ab9013da9bed1a12aa847d80e0a091e21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6bf9c384ca983a91f891a9aba82f0dc

SHA1
394edbfaf14fa8d9882369540072e0714795cf73

SHA256
de62d789e41066771e36b8495bd664061b7d2c1f2bd012984ce321d39c0178e3

SHA512
b4f866624c1daedb19a45933e633ab44a54ebf9591846777e86ccebe5ac3ecb2ca4d3ca72d34a1646ae9a50be5284cc601ba07a5108201f9d7349f1b096512a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a9c31be20743d6253f9cd62fdcf634

SHA1
c12473d736658728cea55fa0e77d1f09fd0c569d

SHA256
a2261133538a37c9ad2e20e0b7c200a8d9942266f80ad90b4f039ce95693d4af

SHA512
46abda47c1e0b3354f9d865f3938116c142936690faec3656973e0890ea30c5acea877433c91b69366f19bdd0bff757c486aa5f95173b5c73a4804a4a10f7a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc96d1c88cbf3fe9b02b3053a75067d

SHA1
b59c3a22e24301abd0eec966285f2104b040fbf5

SHA256
4c4a2c021febfb42ee4c5c089a1f9618eef792a4289f4487e574611ef3d88c8c

SHA512
028dca1c0fa0bd0c75f96f978d8a216b9b33f681d181ee484aef3b739788f4c5e83b2531abf37ebaa688268aac4b1bafcb755f11e012085ad7c87e84f6479a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f31e31768345665a0265f0c09aed4401

SHA1
610410dd6eb9f4fcb43054c3df99491abc568708

SHA256
3564090a3bef3efd4658ef6b9414aa76f6d4b12e8533c6c72c13af20f3b029c1

SHA512
111d3711096458bd2798d90befba01934fc74b5fb24047d75310ab688eb5becf86fef034c96a9eb7ddbbd65522c3f9937f5a8555f35f4189f0ce4b7138130557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1c8f88b17aaf4a817c8a3f08ffd3196

SHA1
ccf52a04817727d1c355bfc3854f4bc3c04ab56d

SHA256
cd8afa92e87b66292a628df17791476c25d1552d6b280ce8c2a091d4d0f35897

SHA512
cb524c02130dac3474c23028f8fa71b3bccc9856694e5b4d5d8b7c74b630275004fbb86cac148706e4077bb95dbe37f58d6f4ceec904ac404fa5fc071461ff4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0241ad8bc7a7c3b8e478b49d01c37af

SHA1
2a4b14a3f6da1feb8a4436fb853f32909d7e2fb7

SHA256
181e1c410215b2f50835c02885a17ef5e22574d43bd2adb906981cc1fe14ab31

SHA512
6fe251a5148543c8e572d0f4c1e6889d3bdf2bc262d481b82fdcf6a19ca7b14a8083ddb5ac58c31438626a3edb41a9f5af36b19dfcba0f4bb191da6e2be9676d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f59902d0044c37cf3014ffa0fc341036

SHA1
80c3f12c758e081f0a9ca8869353818604de5b0b

SHA256
326f814fcbac105ead39412d9c7845f62335d94ce658b488f046ef0294351052

SHA512
0c0e844b6f714197b47031cca56ba831fdda02a9f633eff3b79a867ef9c2a96326525eda1b0d673f62583716c7cfe3d602fc2673a9e35ff11b988ba63b588d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b8ddff4319f3a1641eafa63c0f84e4c

SHA1
ba5fec558c8e8d6dca30fb6a99a35a419a21b2e2

SHA256
6af3e421882a79ae5eb594daea44bbb494135f89ff917a79445997515aab018d

SHA512
dc000cac1e024a5c1fec7ff57d8498ee7053adb5e370f5f1a421c38a4e3f4b2ae1ffcc96665fc304a203bbec15a13cf4a979ab460140e0a110660cc623876589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a26e4bfe781d571a247ce9f003bb4b77

SHA1
be3043cee97f9e1956d16847f797372702270017

SHA256
547d8fd08e6d1ec6289d7cd05e77c260850a34f0fbda45e46bfc4d0a80969f7c

SHA512
af1f4858337753abc687e9a4554e509ddb1699062675a571eb1f3cefe0e514df1a6ff9c48f70e30fa3fe8c0a968c7810cec01b4ea50657e579439a9e2d501c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B19.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit