9f1960ddfa9df2b1f6dcd9208bbf53af6a03dedc31d1e83539b2780d696985ce

Analysis

max time kernel
129s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

830eef97c8268ac62a1aca1af896ea9f_JaffaCakes118.html
Size

196KB
MD5

830eef97c8268ac62a1aca1af896ea9f
SHA1

9ef2bed94c026a2426e347d26056636cb9f1b5e8
SHA256

9f1960ddfa9df2b1f6dcd9208bbf53af6a03dedc31d1e83539b2780d696985ce
SHA512

01eacd00a62f18c3eaf265fc2540f7f3512cc213cfc5eb06e45a546f4d60badfc8423e5d6a21f5aafbeba8919983eabb94f7e9279dc6b2652f6d651cbbefc197
SSDEEP

6144:SL6l/OPUHMs2sMYod+X3oI+Yn86/U9jFiM:46l/OPUnU5d+X3R8mU9jF3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423206010"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFF8BE01-1E3E-11EF-9511-66DD11CD6629} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2232	2220	iexplore.exe	28
PID 2220 wrote to memory of 2232	2220	iexplore.exe	28
PID 2220 wrote to memory of 2232	2220	iexplore.exe	28
PID 2220 wrote to memory of 2232	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\830eef97c8268ac62a1aca1af896ea9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6424ccf76fbca132c91fb88596d1d993

SHA1
3662c599c43d461bf7e21767b8cf8a653921ad30

SHA256
7f15ed1c154ed9665ab8c1c3a9585482907e3ca331e154b659212705d8c0dfc3

SHA512
69f71db67a23df361bb69eb62e0bc37154e35f596925f1c8c93683e3486001377e6e702d9725c5bdd4cfe423779bc139784363450156fa2950ebd0aee2896feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c04c418049d0e6e82851571707b01587

SHA1
f14e0e3f70e59456e0e58438936dbf133a4e2fb3

SHA256
50af7c62e1037958948d41eea4d53a78b315071cc479a84ae86c98f659ee4ef4

SHA512
567186cac0f896ce0855b5dd12d3a2b2c09ca5990a6828db2987f5479955657cfe6f46a43c2a7d2a2fd87c97e91d23245e65e9f4d323ee900b81f714f6b188b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b768dba898f931ef2355e6b89c2a9ed7

SHA1
85195f92acd2a197055b5682cfac000635c2cac5

SHA256
2d551570eac5b2e79d3efb34b41a58a3c7a588da17cea271dcce9637a1aa9b53

SHA512
dd34d38c0f95446745e41dbdebd7275eabeb85111bf7924ec898bfa417ec0b376f0105180c5232cc0dedd5097a66566f012ade7cfc3421d9cf20b7efb1f70d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdc375addd23656308716a21fb800105

SHA1
4a08d9c29b709e3e02fe2793117eeeb9fce1f36c

SHA256
ccd60348648e2f3047dfdaab63d48b767ea9e09557e613d32ec402b346cffe73

SHA512
de0568f9922190f92a7ae483a3e658aa9ec6b02468658c9299c717603320cdb4efde44111a52beb8aa904874024cdd36fe38126c08ea72f14eea19e181ca3096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f91c6a20a0329e1b2827a4bd7d6c857b

SHA1
4e5bf0577b3192a8e13174ceb97ed13991ded339

SHA256
ad6d80746a984277322380b234296b77661eccea1e722396e4b52dbac7946e3c

SHA512
0c81e653f1af285e2c1ebb57c4f9c45e63afda9dcadf0bb75a4d16b9c2404d95eed972397140bd34ab0ee6c08762dcfb9d9f871bcb4fca60836840d7bcb84d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
318689e74d7f2cbe7ce175111a8b8d2f

SHA1
d68f47086ac96f78af760e1daacbb6996427d18d

SHA256
4fa6eccf79056891fa62bdc1bdee5c642b1828ef8e1cd222f494849e3f5f17c2

SHA512
f21cbd8b6db390a9b8fad2853bf9d2f8ff74bdbe377e2f9a211bcb3197b2bbfa1a7546a90a892f13efd011138a9a565b519efa2fd4c8ddde568f5fe1ce6a863a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce8ffb8ee8c0b8a596269c7128afd1b1

SHA1
42a3804d8d161b7fe77e92df88885b0833cc7564

SHA256
c4e67cc3429e54c45d429bfa27ea4436125c509c38740e2a80ec45645743747b

SHA512
5fa2ddd42e5e3b109a238678d2ad18ffcc91e32ebff188db587603479fb7a1a511372da007fe7a7480387540b5c34a7d4a01efb4b7308857bd12d31f74262882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe90b7df7eabb1c4c002d496dbf6e72

SHA1
1859e01245bc1997cc6e8234988b6f08ffb4331b

SHA256
4508fd84d6d0c9cd3c836c58ec6a73f7bbcb337e3559557acfcc5ca4abe76f0a

SHA512
796a37ee9f62e6420a8a1283f210b7c060eb70db346fa73fe8bcce156d6f6f180e245d327f387869d9308f6098bcf661d4e166c7950fb481437aa91c02719aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
678fea97b9038ddc97e404d37e0e5a60

SHA1
9f464cb6adc817e2b3011115e1ecfce3317ff528

SHA256
01c81e47cd7f0e7a89250ed1f2da147c63d549ce54390af91736eb3563c01bcb

SHA512
b938b3e1d42c0cfe6a432f755dba94fe6abb3f585de4153348b7a60e9185ce15a97db1cec37956beeb81d84ce45fa6dad9af069e395ed6e7fc885f1be8c85c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5073ad2b16597536c81004a616479413

SHA1
b855a2aa351ed5782d7264a75d5b98e9c1bcc1a3

SHA256
fdd6e6cf3f84489acfc2d992e05939cc2d2330fc8d9f6575a0c165265061cae8

SHA512
2c21b927169fa9905c940274de2ae5541bc8e7007b1b71b631d59d71b3d96903c2709aca55635ab031526be9df06745dc4a270688c427e1052f8fc6b4418b029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ba2e36fc8b569d0bc35f73541bf85b1

SHA1
990b94eac36ee914348921abf30602daf5fe9855

SHA256
b17e51e6d0ea2c1482a9aab1d06fd0f07c42ad73cb4c68fd866e6b2b5b739ff0

SHA512
ec3f2f0b9a126d736930b03c2bffab3655b9b7f788db4dc1a8b1ce24028646018bceec718552fe6a690e3ae344728e5a9ede1bb49484101c17036467d8919c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41468ed3e390b0addda2f44dda8cbd83

SHA1
0ad45844d6109894cffbe7b5e05abedab1442a05

SHA256
d37c744d740f4cdbef953ae75f604a92d3cc2a49df57cbe9f10dd0e63d66271c

SHA512
3204d5016aa74106c5f361d7f2acba94333d7bfdb7d557fee0a7378ffdcc7906c4145d385cbb18a2e1669377d2aa5aa219d623946c2d60fbe3c1c45c6d21b884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4014b95f786d1d9f2a7015b600cee2ef

SHA1
358c2414f9a7748ca41a5104a14604453f7ff7ef

SHA256
e44158f3e2b15098d551e947ad7001c5e9e301d23f1c3243e6b566f2dd682174

SHA512
4fdaae34cd9ba0fcca173c91d31a0eaf76c6f559cf57fdb49364e2fdb04b1e3af333b649170834520bf0c2a1deae286fe1d2355626bdac489018c326327dde43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533f4edf3bb87601320cd91e43a80fc2

SHA1
876af16d5ce24646166e76947ab4739dbd72b5ea

SHA256
eec265ab3d0af10d95431a1286a478d1ac52954184ddd40fc6785cfbe18e36a8

SHA512
851c86af3a8df81536d4bfa687b2547f1d3c65e6bf29e926024cdaeaa17ad1a1ed3b9e6262fe9310eceab8b6122d7441fee63a53ac73301c526a4e459554cc7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a12d70eb70b56fe6527a775bbc2629d2

SHA1
a417b271083dc50c35b9d48e4db8882c47b4ec0d

SHA256
cef430e11c5291b9e5d29340b9b592028c30e19e4722bb3e6f1172238745e879

SHA512
d60af1270ec56830db58a86851f63bb58b3148b22988809ea4c522648226cdc484602a469c2fa2fcc2d3fae72fc40a343ec6176285789c43c60b75e771784e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3b5043d962757ef04c9e4e293f32e12

SHA1
44d0e718e2318f523f8a38ffe2e1e992f9db6524

SHA256
c0b25a8ff219ab6f50beb774bf74b9b0a3fa866e120b34ff263058889bf2e43a

SHA512
7f2d5f5dc96f61e0b3435ec215cb5e1457bef52551b62834ce0d4edf682c1cbd67517830621634ffa40efa2fdd8a0a0f4b5afcf765cfb5e9230c783c36059b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54429b3e6db438fb84f65ffc668b601a

SHA1
19eadc441a1ccd01cb37aa5da7bab9024a3560e5

SHA256
128bf5cceca4c6fe1ed0cd324b35d36226ca75c6d2364361b20672b443210f0b

SHA512
2648bef86034abbde853ff9a0410cc3351b9fecc87c408ced526b0bae33bfe6564c907c366da5624d6d0b8e9023460d2dd28a77b7f2aba9d6b9e0cbc70f8087a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4071718d2fa9eeea89fbef7076e3b117

SHA1
1c5ce633bd8b635d859f1042ac81073d9367595e

SHA256
0403ff662edbca93f0a6b8c953a006f18f6a5878359fda2e8901d20fbefc81b4

SHA512
8f5a68b5797222a3c27228f0f327c6a686b7a5af02577976e484f63a245da94be86dbd8873971a7909a931df15e33e2e2fcb4dd190ed44f13bcefadd4327c3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82d018dea831fd960bef207027f9deec

SHA1
f32683962f8da6c2c6c6bfebf5d90117483675eb

SHA256
c0cdc133a5c1ba344eb95053bdfd205863fb528e30b8e14b4e8eea51d9cad3a3

SHA512
143c6f64d472f87a2bcf5d2c25c528faf008539d948fee0fe186ccf6b4f4b603cd0d5877b8a7498a67c51dd2044dd3ff0bec8c5e350d44b355ba3182e212abbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA5F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA741.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit