7965b3db097378ee4e28cba327ea7ce201a99d48e8ea0aecad494a27fc0efcfc

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82718b06c6743664aa57f268f66f54f3_JaffaCakes118.html
Size

76KB
MD5

82718b06c6743664aa57f268f66f54f3
SHA1

673d2c7d574a00aafcf4283071229bed238a5a7c
SHA256

7965b3db097378ee4e28cba327ea7ce201a99d48e8ea0aecad494a27fc0efcfc
SHA512

f1b1aa2d9dc890f23b2103956edb5add5f27295acf2cfd079810e1e91b479a6a3706dc0d539df309a2b898ff2c0d75d59d43c7bd7e58d2c48ee59e5a98853e16
SSDEEP

1536:PERcvL2RiWRCC2mEKZomV++rTmjIciMylPvZod9XV3IERJ64z7NAylOvl4Y21P67:x2RiWf2mEKZomV++rCCodtV3IOJ64nNK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a633c8e880a034caa87c6f5dbb4b5a700000000020000000000106600000001000020000000c278d8ed285e7f545e49a2279cb5cd32b8600c5efdaa809bac6f35d41e943839000000000e80000000020000200000009ee56694ae41558a4d620852dc3f0161296df5e8355bdee84e63f75787a4c378900000006043df6ca19f0c2482d8040076f7ac9c5c5a805137506a15dca70f50a911bb8cacd0a47f7517e9793cc401233a0ed52cb54ce836f5a3cbdf202802bf018ec34810ca04952e3a5de3ca9125ace0d0de3394a4148b1603117c233253ca4c23926a6d87ed6ed9ed956204a84e6e6d519471ff9132e080e758436e125309dd2f7f74a02c9fd8c7fbade399a3a475766441ba40000000169003f517efe03ea266f9af26dd8b57c29a9af57ecce9183bbc9e17480d2b5e40f4685f85c6bdec7b9c4f13680dc66ed88d0145707005984865c94e3504b09d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a633c8e880a034caa87c6f5dbb4b5a7000000000200000000001066000000010000200000003a333e2290b6a3224b99e54623ba3da737d5fc8fe69d21cb7fef4fbcee3a59a6000000000e80000000020000200000007df29823f328f18f00462cb507aa58309ce03e431ca70dc3fe2ce05d39ad60c4200000007b5ae91d82f83f83d11b4534b7aa4154a138d4bba8ca86e273ad201f5dc8607040000000716e7d9e465adf58a8d56488c973e0229e7d7c5fbadc5c80a618e8ff1116cade032e59394d2438a742e45d8d88bc034d69c953b3e7f56c5593c9236c30ca00ad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8074490e25b2da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{334BD981-1E18-11EF-BCB4-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423189345"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1284	iexplore.exe
1284	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2264	1284	iexplore.exe	28
PID 1284 wrote to memory of 2264	1284	iexplore.exe	28
PID 1284 wrote to memory of 2264	1284	iexplore.exe	28
PID 1284 wrote to memory of 2264	1284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82718b06c6743664aa57f268f66f54f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d471e020858a340068fc5396e3b36f2c

SHA1
989c609962144bfbdf8a3499d53055cbc6fb50d8

SHA256
ec79a957a3bea7dcce6221fa6e1c9e7521e76a790d6106eb7400a5a7b70751d5

SHA512
ff2ba72383c5ee2507a718eb36aa4642ddfad9326e4de58d3cce3a43fce5f8b62a659443913146e18483c4a6f8f3f68a2d858ab6e15e751c4f4949710ee729e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ae06ce5c6d13b08ba4f0fd8d535f742

SHA1
94b65e7945ae54dfda04a95b5d67c052264a70a3

SHA256
6c5280032e7b0a514deabf41b9558e7242737bf9f90197e42ebb39712047106a

SHA512
7a3fb542280ac4c03a070887c6095ff0b28074b91ce1360b3a519341803770a54cce2b17ce3b2c5b4b0b304cb03494867ec200711a0f3fdcf96d72eabe1583d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae5f70d54ee1ffbbbcb210a9ff0155d3

SHA1
1f094f6dc3668617f730cb759249476c48f0a7fb

SHA256
508af54b7a50fbe2f4e3cb4950ef3fe946ddaffd8b469f1b9d31e14a6d0cd385

SHA512
cfc4cab7804bf2dcb4a5a4b162fadb26f2c293f7c08c4dba11cfeed1bd6ea51bddcc8107fa3fd205247804dfa941088553cef67819d3a0b75dd5e2e6bd1615a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5dd581c56806e4901aa4135b720a552

SHA1
0f37ad6b72c242fd60b16c07f2b9836c55cbfedf

SHA256
06ac6433f801e60dd640ce08e0df7ad997d52ec72efe4f9b64e58133f5d9b91d

SHA512
67af406bba6adbdf04c998f5e6c518ee2b898a208390e8bc0007a89e2b0ce835a41392c7da5df5d685e7525fea19079becd7d84909c8533d450ce66e1607352a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74479cb2dbeee5de9a3fa2860a716b5e

SHA1
e09e77390bb49a49389ff79d1e7be9dd71ef601d

SHA256
5be7a8de554ecb24f655536818746fc3b2a6ddad1ee1ece76f1c0d0aaa8f7a35

SHA512
c1f904c426f99f90d08ab023225bdae22c05cd16040034783d614f618eef28ecb3e9c80144d9bc2e1176549539934e82fc044498093fdd4ad63ef8a239604494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdd83b6b3e59130c94dcdf33941155b7

SHA1
820da010d25f90297f058aa93f066b709a08a597

SHA256
69383e42c3a5b4af40397e50582503aafa2581ed8e568ffb58a4260d0beec204

SHA512
49c2ca21c8b4e003d9b7e382fbfbdce6f4b1a4b9954d8f4b5250d260b1c267003c447c812dc2a8bfb223f6f51a2fb375cc28320f9e9d0c8d01f4a2799c358461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
274cd87c24bdeed846c6eb082d2cdbc0

SHA1
972579be400978ae5501d2fbb2e637be46583491

SHA256
517304412d7236ae954ea758ef14767a4a01b227974038b1dbe94cf7e087d6cb

SHA512
fcc9e4db27457474b3ace0eea2bc5cf8e3c1b72f75ddfc6c112f21f075c200d1bca0d5b2ff174340fc177f9bc58fdf87f3a569eaa65a35876492441133318e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da6dc550810eb1d7add6ac3863cb3059

SHA1
de8a7298a199d116acb5c2a592898f6f78e46485

SHA256
84127bb9311d2a26612e638e4d77c4f4ef0ab398f3e1561b16606a5efb21a467

SHA512
6a60196a1990e45e8b041de37cd5ee0b1a6fff7805c40e5349886e8b41d74aadb59987bda4559cbde0223d6ac12d7467cc44ac4182261aaa5d2a3e9e36bbabab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9607b4b259176e9c505c7d6fb9fd0b2a

SHA1
a0bb7e569d3b26c993ea4fd948c85f6ad7a55e25

SHA256
2a2a8d5cc2b80a3688615432888fcd2b9de5fc691128dbda32f2851f94c2f33f

SHA512
c905bdd4208790f8b44d6265caa63cd38c0b9d6eba5eb9efaac7353d31dd9e5262ae528af87a20949621bc05fe130c99c0dccb18ad7dcf07131e067f14a6607e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f4833f6fcf844e88ee2b1faec8dc587

SHA1
cf8e4f0cfa2556b759f2cf06a09dccae816f6b3b

SHA256
ad8f954f39f436ebd40735a6421242e627e996c16c655f43a182cc2281aea1ba

SHA512
6f58db50ecf0458554371cc5caf82b9b5804a2332df41fd17cb7f2cbf3f9cf40e6230ba4c1fc69e17da095093d41435c83051a746f37235b32b95b2acd8c0f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1ed1214f82c6c261c29fc870bc4327e

SHA1
da094859ed07724718abda110abc740ac1a9f46c

SHA256
0bd50cfa47e93b974a5daf0afb145425312faf61801a29735e781a710ebc97a0

SHA512
2499eb5ea3e5bfffdaae4ef7c5bee5415fd7c8f26d7c1f200e0d141321e6237a0a515641c8546f5f0e06212d8fe18219f9323544cdadb58fd8b265a461efcfef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7daaa8cd28459e649e05a9a49130677b

SHA1
7d6de360f6bd2c2351dce38363250a780da7a50f

SHA256
a930be864d8799eeee82f42e74b24f1be4581c438921e7ff6ed5adacec576adf

SHA512
cb877235ad75fdb4d8ee01e30ae33d16216ca3e2651a1fcb3779209efe41418434c61383e5de59a8bce03b6b10bc28ed7e18517817a1210b8b092ab057d33a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc67a881c5d601756d1d1af3d8ad42f4

SHA1
671dd236a687f27cedb792750b5a5fcf2d3941ca

SHA256
263f890c63a0787f73a02f746db4a01bbd54a325e099d87c3689d863d6bd9c2f

SHA512
acc38e995d6b72a70b2863f42f857bf66e625e7341c9af0935122d433bfd81eb4dd57dbe56c7627b7c254598db1af66d0b7753dcf015ba154a0cfdd9b62ae020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2de8188fb493eb20d1245d7c4bc94ab

SHA1
50bd9462545942c55c11a6f30c4c897f18bbadfa

SHA256
b819e3c7115da896bcfae55e53e1f8d92ccae20968641ce48e06532b9cee624d

SHA512
c6fcf269bfc49b11fe3ee968534e8787228f10ca283927ced3a0454e3c262834064dd188252e32bb8baa7c8dba1cc11763f5ff1ed60f041e4d7be35851f4b3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03cca0274996bfafd0da9bb985c3b4d5

SHA1
551d6aa156113f6fe0d3697c41b4a722bbdb32b7

SHA256
f95161009c9239382b194c2c47aac32dc3e26f80debbaedd72a6ceb88ebf2a7c

SHA512
c896fca461f73cca2f7edaae488713113529f1eddf160dd912cf6791620d321333236fbe0aab75566546d06804ae5111f8e9d871b771e6889595efcbd975be95

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDEB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEC9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCEFD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit