cf6c04f0951cb8dd3e47469f642f43521e66df328ab4ca8b7b91b91ec1925b64

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

855163c1b2c2add75b5419c4c3f027a8_JaffaCakes118.html
Size

133KB
MD5

855163c1b2c2add75b5419c4c3f027a8
SHA1

d5a5abc914bf0b153a2522bcc2f31fa267527055
SHA256

cf6c04f0951cb8dd3e47469f642f43521e66df328ab4ca8b7b91b91ec1925b64
SHA512

340d53b133068e3f6ac7f4708af1ea75743109d7890d76b4192fe8c11c4c045b4ccfb766d1c7f9a03f0f91492f2ee7ba59ddd4ca5128fae58d481289091ecdb6
SSDEEP

1536:SKDDyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SKDDyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{537EF181-1EDE-11EF-A0EE-F2EF6E19F123} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0692e28ebb2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe033c9ad3878c4a99ccc44f8f4c27a9000000000200000000001066000000010000200000002dcc1f896ec4ad942008d4bfca9126c5d84554443affc48b2bba49f22c4d6e25000000000e8000000002000020000000771a28a4b8969cb68aa41771f32cea0b57574430565da99ae451e109d7dcfa1720000000e4a37bc367b4c56919d7f5af1e7e73cc7ef8c6c3860028f2c7fa780dcbdb164440000000979945eac98706c25c32f4bf3fe52b77b1f42760234955c13c82ec0b276ced444fbae3fb88a197003bf861da3d23e4968f5d99083a06fcec66320b5a5a68e608	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423274453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fe033c9ad3878c4a99ccc44f8f4c27a900000000020000000000106600000001000020000000a44acff3da79a27c165441bffc16af27642ba33bfaf40f5f4940a49fc578a028000000000e800000000200002000000072d28988a66ad892cde9fc8b482de03977cff0af5e7f5fa0fc4d6e683dbdffde90000000bee635db0495ba92c10cbe21b0c13f22216d6eb785ef3d594b77d6a09cbba52df2fd1f1d3f409705e0c6e3b2202ba11393271b943c806374ba1e52936538c61808d7b90819abcf867ba5757fe1991378e48af09ac7613d3592757345a3624a346c3e2d01636e122ec2dc7afe74cadaf194fd8a1c7dcba2db6591dc574a5b7fdb93be7a20cec4d2ca0f45f0e3cdfd2cb54000000088e6156a9cbe5b9140e379f43dc3ac7f3aaf6366d4c1208195bc65e15fdc58a93143170adcf1a8af3dc78538cdc3856a24a256d509c9aa16bff4f4483cb683e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2928	2876	iexplore.exe	28
PID 2876 wrote to memory of 2928	2876	iexplore.exe	28
PID 2876 wrote to memory of 2928	2876	iexplore.exe	28
PID 2876 wrote to memory of 2928	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\855163c1b2c2add75b5419c4c3f027a8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf2d8fd722b2f4b53cdd440b648cfcb2

SHA1
42df0b49731d9cb2fc760f9b9511816112c78e2a

SHA256
bc642c17b99cef8b90109128f5387dd48f7d766932255f91d9836e942f42d2d9

SHA512
7841e992e13613cbc945c314f34b33f9ca2b5e94510d7fbb0eed596868578315a15985e949a40166dc4b7190bb18f6f9d9a164bd1dca4338750a3acdefcf7739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a82156217b4d86bdbcc5809382ec8ab

SHA1
5a506ed9b955d06570df5dba97476918452db017

SHA256
9530216c8fcd742397c14a3d2d2e1582715eeac3d9c9d308171b7d1d18043cba

SHA512
a2ae9f1fb0b11cff26f304bbd6e4988a95c1bc77ff6c189c830cad2ff4de5154ba2598e7eaa13c4f5c5d63528f8600e173ccf168ef8dab5ac041b52223da2759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d60fd829325abb7f2f427e16ddc49d

SHA1
3ebe360e959920cfbfd4c9e84c233cee23cedb79

SHA256
a73d01944f2b9096166272ea69aa46650e0f96cc5122396143b9ef5c7804c5a2

SHA512
e6c5448de6569d16a5bf76d90b2334a96425067d6ac7b025c76bfcb4538d0ef92c84f6ad427134f56b254089c8ac77768451302f35734db791747425a2f8172e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb068de240e5c6efafda351f72eb7652

SHA1
747b7ab58c087144bf17296984948d05ba60ac06

SHA256
0c9a8ff0a15a39af0735cdaa826223c35a389c39fe7bcd48f029c788bd5b238f

SHA512
bcfe85e6890982e4cf7c532b16bcd9fe132cc75df5a7f928bb45e9902168761d919056a6f67ab00009e64398b2c2c0fb72e2698fe7926e66f3991a47c04b0f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf3edd0fb2ba1a3d09a7417429d5b774

SHA1
8553ead555f3271cb4ef90d60e15527c7c6cb393

SHA256
93afca8d2aa999771f8b284e8218d0660367fdd64f2f78bd190ccdfd37b87292

SHA512
166f0ffaf3a825915e9d0da6d0120049086d1fae7104a33901012618ecf74ac30cc8552fb51ec9790f8861860429b083735dc9fa498299d43cbf1d69e0de8f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e32e063451850c6656d23391f302e59

SHA1
2d252299afc5436231ce863f35ffe0f6743cfb29

SHA256
d3ea141b1520e58ca1ac4ecb807b121aeec7f1b4796646fe1950e2f165a7bfa8

SHA512
e75237c282c67d348b0be6baf1bf4e98b1fb11918e22154782bd65fd9320aafba55ac741d3a6a8e8962795400968446063b4e7a88f61fd5b6c2b020ab31f3433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f523398f5cc2eb9d39617e875ea610c2

SHA1
6a4fad0fa867f3ad11908a846245439cedbab4ec

SHA256
75cd229eab4350089f61ac15a6a9380b35f1163a81f695985e029a581752ec88

SHA512
8547649a03afafc2e544ec8eee6561643ed139de46fe27882cb729325709dcac3abf4d85ee667a16e8c5608f89d5add69aa6618761b44cc0dcc8fccd5b8a187f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
248448860cd970a203ecba29909128fd

SHA1
c7273474c46f80fa54292c2b0a53f4b8a25ce010

SHA256
d40f1fd115eb528faf6e5b28da81efa5553954b504157205c82726fbbfdcafb5

SHA512
b99fc1c25a54f287901ccdf9aa73ff1ed91bc268518c3653a5e44c3d6abe57c09e2c1c92c4ead7e77e80eae324e08a3851360fd024b7c75182d26b101f579fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
753a39b6cd1209ab66a03d12f71f125c

SHA1
b4f9db2f88ab9d9cd17aba76f5b642d25a99c6a7

SHA256
c8aeed451cbaca6a0791dd11ddb3e4352313cc4b0dbcf699fc500c832256dcfd

SHA512
b3faca786693cf13df5f19632127cfcd492bd9e00230422e2334a9390b69069cab35dc202fc348abf63e07557c075202958cc932d8492728f4f16585e796dea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7157eda9298a234c5a8fbd33ebfb49

SHA1
295d5637a6063648facc64e86217a4974194ad8a

SHA256
f057301adc48e9a49ac8a1e0f929374989481640c314545eaf6c71a04669e41a

SHA512
2835a35aeffe98b8e17994784e2efd3765f8a3b457938a981660d699a0731a1528b13f186cff68a3f99a6b556e2005952cffbddc36310ccf1ead33cfed6959cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
288f8d68ff1210f46f36f4a6a6c2275b

SHA1
fd547cae1ad6e1f0406f1263bb92c2a442eb2e48

SHA256
e2140e520aa48c253d0487b91b0dc11e738ad492a69dd17c6716d0c52fb6e901

SHA512
bcf963a6b5af81d0aa640d75673fb2a358eb7ae976b3a98b19b947d9c3688650903c0ea6f910eb786c554142bffed726a179615ac203a689c6553f0066d7456c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dab633af9386a4bd20bd214e2f4bc1c

SHA1
874676cc3e0a1458ebab25941d6e6e2b1d359f1e

SHA256
635dbdf428f521375e3394020880f176eabc04d00ba075c21b58e06137ce30a7

SHA512
a8dca45feeae83536fc6a6d291e1be26f681e87a6c3172a1e61a35f98f4ce43a0c4ba6a5a393740bdc20cd206053b751b6b5beb610d4d3baf9c5e877d293b37b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6552cefbec53306dd7cd13ca5b736a0a

SHA1
93d51fa330d6769c1aaed1d38015fc8daae63fef

SHA256
d229851342ec4a3ac301f5fa7014c6475aef3fe62444812e4760cac79218c0fd

SHA512
2e2eecccda60d2700feea5fd4e9a12a1a204c3cb21c17a22337c3a7ed8b5c297e69f802c7a37640af3b53efa3607cbae0f86f3d4ba113fc5adbea7361a88b48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1650.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17A0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit