a020409f615a8dee5db3b05c77e4f98a68d95c08d68147bf3980c2e652a46daa

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80d8cf2a3359ded63aaac098336803a1_JaffaCakes118.html
Size

65KB
MD5

80d8cf2a3359ded63aaac098336803a1
SHA1

9ca88790846e4bf135cba9a26f3405af2e684a51
SHA256

a020409f615a8dee5db3b05c77e4f98a68d95c08d68147bf3980c2e652a46daa
SHA512

f57c3c136ed205de5523e0e844027b0ba1f361ec00a3eaa6ceec0ae815fd8c613bbd9c73b80e7e5dff67a50dfa622deda9a5b1fea275b57ddcaeaa74e7867e29
SSDEEP

768:JiSgcM8St8tN99OIs7PFOPcOPyTYOPfoTymhCZkoTnMdtbBnfBgN8/oyo8QFVG8W:J+CYyTNgec0tbrgae+NnzAC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423150082"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9839661-1DBC-11EF-8303-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac19a5362129a74798c3a3d32bae152800000000020000000000106600000001000020000000eb864ee3974b5790caf88de21db3c283de82919448ef3767716411a031f5242d000000000e800000000200002000000045b965e11a4f0d1de16719a8f57feafbf779c5b942fdeb2e12bf4186a1ba7cd4900000008fc7bc0cc9f78a1c3f0068ce830f6957e51e85225afb19417f5403cffb6d77c7ca132e02401fd1e5bfe7905ba0a14ee73f0249590fa912616f976a27a9ae5e04135573a8322b502846faca88d7b33f1550a3d5c77685699c5a6838754eb0690156e859b23657140b7d7cb7950e54433dbbdb7b209c48603bf57ee5f2a52d49f5fdb7dcdde975003d3793c63ee7b591ff4000000010e276746f04aad1f04c5a3aa8258fdfc360d1844a9980990fd8a7b5acab752b45c34bb54ede0ec32b92fe8a6edf89d29df2ed713d13509c45cbe8e4b127dba4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac19a5362129a74798c3a3d32bae15280000000002000000000010660000000100002000000046f9603845f9fd2c91326b65ed322da79ce5c1cdd331955977115aeafc11af3d000000000e800000000200002000000013a7aa45fe200107c3c0341d316e395ef9252acf336f1dc0d302b5dc1d1e82d2200000009400f1cdd5d53cb6275ba05c50fd60900445607b97041dba9beb4fa0b555d5654000000015266ad329c2782817dfcc5d9be6e870c2e2c25124d3f9cfe683673861873f69c7fcf7db788eaed52d69c1c0f65a3ce33a4a46032fe38c9c4aee7d4b85a558be	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0275f9ec9b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1704	2080	iexplore.exe	28
PID 2080 wrote to memory of 1704	2080	iexplore.exe	28
PID 2080 wrote to memory of 1704	2080	iexplore.exe	28
PID 2080 wrote to memory of 1704	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80d8cf2a3359ded63aaac098336803a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e8c83de870673a29c8a158d6aebdc70

SHA1
8a8f834c52bbc638e90fc7e387fcd860dd0c283a

SHA256
1415df325f99ac67db7ce9b1821c341136c17af4d62431e7a09343ec3fd06e15

SHA512
c6601239daf571971b4c13803050f14606fc678d2e9f3b73ed761ce5f22e4e87b8ca4bbd2fba55654038523d811e8610c711f1c9ecc2356ba9c53dcc6068568b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28fa91658c5a6de07c6be3eb22dd059

SHA1
72f936dc13f59fdad4beb7e9fe530fe99332f9c8

SHA256
c974ee0d19ca773ff82ff43a743805375e3d96d52055d1477900b71230148f61

SHA512
eb20a7003603ce03f27d7df78ae984ad1e6f836892dba8df0e98117bf062c09912893480384edc08070d6278d6fe03a2b11885f9b1a2ba98bc48044d09220897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06640d8831f1aa291ab41e28e23a3564

SHA1
397d7fe028a273a5a2eb3f259607fbb34a8377c6

SHA256
9a7b458f4d160709a36b1dbce8d3855cc268068eb641ab4e6e7ff2e9b1c71f51

SHA512
c62be8c5a9905351d4bee3a588194c33069208adaa67fc09411f11923ff59b07055847e764e5d7738c2de15a1254a04865e0e70c57226ac18af2b5a17d54a32c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05039cdae6bdee616db7f780909e53e5

SHA1
92d260d547c7ec3073e52a4121100eed5d014426

SHA256
84d107184dec77371e6a898c508ace4fb22c60818709f2520c2bc54162b53079

SHA512
520d1248d801e0807c78f3616c144a335297f8997e4668179cbc8e57466a1313927191f325be065f28d9a188b615f0648d8ab52a3710a1ee51366c5dc2b03857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d354b7a5a6a30a093f9540c0d733815

SHA1
7e7ab579b2a09fba5658ab1827b64a28c3c1a589

SHA256
d1722f8a31780b6dfbca323f27151ffb54c62b0e8298b104d91f4e6606447acc

SHA512
58587b6dcb6e695e88f27826785eef66301e1902dc5769d4bd4216e2efc97e2a3358d84add9236cc59e67e5d02301186bfada3a991fecffd42c490163c674a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc97d4c6df247ed96f7f1b567c54e701

SHA1
9c762d9e2d1a77ed8b7a501d34f4b2590942eaca

SHA256
fb1dfabc8875f54a78dd2bf4be83f6ccbc3f21b06e6ccf01846baf899b264720

SHA512
4a70cd8bf69c3ae6867eb8e39368c0a1177d84178491421381a31108fd4e6895a69043e1698d196626874be80d179d5c696df2f957671c1ac1b05777ed3442c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b22aeac081ab53fa4d9bffec8f719ab0

SHA1
985964f4b2f035a979f1549d0271be06c51ab891

SHA256
5d128ea061b790b969a4679f26687798c599e277d65c4ff71712f9f6e1298ac9

SHA512
eb6481219f0378275c5fcaffc32a0574b2fb9bc232536e1afa321b93ecbd2b5af14834aba59aa79af68b2f9bb6802b7f92250049fd7792dcccb5791d3a157b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee574de68ca6e7815369c7d6c96f0e26

SHA1
92086a6cec7294071996fd01d16a0111a188b713

SHA256
068a94653114367f388649f70a96a1df764a4a3bde871a5831c3cf922568f36b

SHA512
f9873b4fc41fb0cbe9938c463abc1624a97df0c1aebbec5fc91d4c403d0e4bdcac46d9a1f79c9984c22a22dec20fdad6d13d09e379dc869e07cec4d4a8bc7ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3ccf492dcfc527e38b5513c5e09bcc6

SHA1
eaa6fe3aa34c9315c1287e02f5e9c6df583a8ea5

SHA256
c064833dd14a10d453902939d5e4d0bd05d06e8fdf04609387a48bc8bd45d7eb

SHA512
e8d9d317230bc36fcae5b0d6bbdf49ddb406334227f183bf5a0cb736ae822f5ed8191a5fded4fd3538b1a57640e7fc331d8523bab9a36d4e8059dd9861e2edd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88d61ee2ca5d4c013ab33af59530aac6

SHA1
3704cc57378a3a79bc14500b0a48f43be0f13d61

SHA256
614f46495860cd7fe0d5a2f110d2ad3ea5be0620864ec0b133acd9c47aff8d74

SHA512
b802686c5f2df437500defc7b2cf275335236de06a9e7448636d64770e102372353ba88d426f0ee66e286f97cad9581016cfaba27327a899eb89cc801cc6290c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d390577164c1e8acf8ba6408a4a4770a

SHA1
d4c34761bea16c701e19213a2d2dc5bd9487e186

SHA256
f91b5f1e0ea6e89d46ab6b833a234ef6df474d31c337a103403563994ea4a0c1

SHA512
d151a03b55cf4f30822e815705ff9985d76affa5edac784da6463de8e1e00bf972ab923a7bcacf112d2bcbedf4dd20d6057cbe72619a17e775d3e013fbca3eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80ff4c9e7f2fea8d43e26bc565aa6115

SHA1
e5b86134bac855f5f93e48c745f4eba844c7823f

SHA256
21951560b5673c013074b2910a7eddffef7287caabd891597afdac3bbbfb630f

SHA512
2db868c308a3854c91f03de4c71ea3e2ffee18408f2599ad3d693c357141b2873f8e92d1b74791578e43d7ea3b147f13b14642f75f520056f38b1a93431750d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
016ecb5fed83e0189e502f63be54691f

SHA1
694b98403e563e293bc50ed4378d2683dc5b9379

SHA256
6aad594a69dd300166255fdcdbedbdeaca7002c246d8089ddef1ab5c67241cac

SHA512
522e63ada9b5f5ae5558acbf2650ffe445151837b4414e3f3ddfcc93370b8fa49a23b287d4243523d94ad57c7e22e8c88f61eadc6a2a5a46fad6d851675c102c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ac99b615e168dc25a9949d8c6d3a320

SHA1
b5d1d6b2ea2a4d35b11444851c3276c049875edd

SHA256
78126acaaf019d88242b55784f8cebc1331c48cbe4087e75fe975795f3e9d1f8

SHA512
7352c2431dc179d674d56c1b30b43360fac78b54cdf6a7a7b9573af9778e34f9b9cdb5c18340fd4b6277b10ef4c46427a0309e78eff29fb5674d2dea111d3b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20cec1bd89e6eeb2b27a8c99fe7ddf23

SHA1
5fba5c674f900d3515ab4d744e573574d756e345

SHA256
463457c223beb0aff7a6e4c43c16ad90784952cc8321cff3972557a893650334

SHA512
98a7dae1be01853290c7632a2453d3a0dfe7608b560c2a37e1635b0446baf6a56764ae391295620849a0a194246ee7d0155ddb9a784537d95f240be730060678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c15952657478d5cb078a264946e5bee

SHA1
eefe1e628aaacd52cdf3c67bfb189f9baa07314e

SHA256
3ba5793f3aa4c7586d0c47680be5df1efd638bf44dc6dc01d57ac4b4d5bd2cc9

SHA512
029db6505827ff00fddb0918f49d445cb62439eebe8425a38cf521f5de253cd0e920e3bdeae1de500759f30b6504d371c96b98fa63a6a4939226aafc11035c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4319.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar43ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit