ddba538fc89d3d5ee5684ef548d842f3565daa85cc9e4988c5c2f7c79620a100

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

838626e9a7feed97a8da96df8589aee8_JaffaCakes118.html
Size

4KB
MD5

838626e9a7feed97a8da96df8589aee8
SHA1

c9e7e0b5b951bff576a47182182bf68572884ee0
SHA256

ddba538fc89d3d5ee5684ef548d842f3565daa85cc9e4988c5c2f7c79620a100
SHA512

42f151506b34c33dd98a2f120bc3d06d4006fed19a1f9eb4350c81762f7ffc81a32017bd3d4ecaf9144eaecaef312f57941f7e0c35d299868b83251068903bb0
SSDEEP

96:xitIVOp5XJEjEr1RunoAlGCnLvw+aReUd3tnCuKkHa/Ug:8yA35EjEr1Uo8nLvw+aReUdtnCuK0g

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B702BD51-1E5B-11EF-B5EE-F6E8909E8427} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423218341"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b205a5ed819a614785ccfee34f945891000000000200000000001066000000010000200000002ea2570d32cfa10cd16078b7153f595bf1cb62085af4ad8a43d9bc5b767b5f8f000000000e8000000002000020000000dd8848b7cd32bd426286b0089104f5e977cb3985efb64827e6306ed2bbd69ca820000000f76a274c0cd9fc046b2832bd5fff8dd35ab215557a0aedff720bb2427c7e013b40000000d3d90baac4dea9dacfae4f00b2f25da0d23754e3acfd787213cb28d9a50a2d5bf499377fa97a5cdba4fe22f415caaac718acbbd8c38db563076b51b5bbe65f23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403b4c8c68b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b205a5ed819a614785ccfee34f945891000000000200000000001066000000010000200000000855417bc023cb4259a8e8232514029d080d58f0453541dc223679f3e16767d8000000000e8000000002000020000000a5d22ca0c0241bf63b0b119eedde6c435c2ccea183f11513a9b320e607c2962b900000008c94a0f4f227497ff91a83ae6580b77e46d8e2b08cdd4fd739187375b93beb481db81239814d2b9e5cb5222d494b1d732f8c11ab25d6ea4b1328283438ab0e7d55ad9225cc58f9df72f19d41e93c2a1f943b2e20e75eac0ff81460bbc636858854887e111924a5f3347266b0130c12104b482c41c4587ac59b4f644f3c500157e464f37ce3e04dbd62c1f4c9b642581140000000bd91089493a9d8543e51897cb26a950f1ae6314280adea1730a4af71e9b39c800dbeade0d067d3e7e2b5873e7185d5294a40ff940195463c667b62c1c02b2ffb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28
PID 2360 wrote to memory of 2948	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\838626e9a7feed97a8da96df8589aee8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
259ffbe00540a5f83a57059699fbb802

SHA1
6d1a522710007add65565a2ff72567b413039921

SHA256
2d00ee534ae3a490469afca696b90154a1100e18728aac55ccfee6bcb2644200

SHA512
0502079f75400d8eadcb12cdfe7930e84d7442c69ad16cef7b4fe0503a4d701d56b5dad764ff6a7af57cf5d49416d5335dd7b135b54e6bafea4fa521f45e5beb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5fca9a8eefca3cac8ff659023fa9f602

SHA1
ad78c905dadd271fc838e155b65a08687b3773d9

SHA256
a0ca49d0302c2c674197faad80639c0d9290bc7626d8754300a0017278e8f0b0

SHA512
ba607d1cc736fb60a9986986b9069c247d590c6421b4c5edf0b2161f51f817d91734eeec72c1223378fc99e92e63a9616f0d9eb6590e47f36956471288d6937a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f88eb208c3dde650c745f69b8b0670f

SHA1
87c25d08d8c38499c6ed91435bc3685668916e21

SHA256
e5261484e887e739956b73f30c287ff08f91217e8e4a30f69aba57e5a59c5197

SHA512
ccd666683aae3b36d8de8b14b432078c618c7cb6ad59601680559b875bf070ff2f6f0fce1f3563772de407932be69153eb28d3751f2078eab1908237190dbe45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80ba3e9d00e6ae3cdd3d2fb2563040e1

SHA1
e322e9a22918ee1ac9656ca2cbc7c4811c05b557

SHA256
043756bfe6ae53a09518ff6a62a8d5d124a9e43d5add72a594e558ea8d28cb38

SHA512
54822e3d50ef695d4ed459d9dd05884c2fd8d4217948dc2ac0ada13f37a99e88831120d0240ba4f8c4c0d37b8638951ed1e2daf85e3f749c2b6bedca79aaba92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caf3a98f796b622aded41e5f877cd2c4

SHA1
0f015568a0fd32f986bcc40bc8f81ae296d581b2

SHA256
7eb8b11f9358c18447b6899cb71b584ff71c7596f3b51916c4263a19c217e828

SHA512
5f616d9252c8b7f6e99bbaf4c61881896fc9b86de8d021751fe6f821cca39a745271b51024686a517c9efd2b0e9c46e8ea39be0707a959f2f8d0f6e475de50f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6d197139cc52435aab119ce6a6d5dc

SHA1
d73a7da45ca05e0af24c5e0e2448dbea8cd349f6

SHA256
d036625d90e60c29b47dd029e373a7403a2db5e08ec795df559f03233afc74af

SHA512
ba374009e0958129def6de44c297d19904f31d7e13fedcf681a10ef55b0f7fef3413743243252cff9f4da0ab8377f1561bdf9e6e6ccc2f3cfdb72f1e6c2e2624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5489fdcdae5f8640c0e32fd371e7654

SHA1
01ef3aff1695fb2fae984608dc7ecce12e5958c2

SHA256
3e82bd53475997bf98abd7904e3fbc7d43e28644202926c8716aa11a523c2317

SHA512
362b6dc0f5db24f4ccd5d3f999f87dc7c1c97348485d368fa20273a1f7288cee215c875f99b701468c4b63f70967585e71e5f9d65836ec94be91e55fefa0439b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3d5a616ee5ae007a8e49da07887e34

SHA1
1d260cede0c09e047ed5038d8d00604311c71922

SHA256
1469a6e9dc310690c703ac10dde6e893d1d62f44d7a575b671c5b605e0499fda

SHA512
8469b1688bc4fe52d0e20a5869f2009dd9acf620be06cfc2ee40d2a744acb4473dcc0377659c662b003749f85df8bb1178b00ca97d5064ca8d6cd67a0c5e7db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ab955b636a2068d4b7e391ae7b5fbc

SHA1
3a1beda4d42253f56d66315df0325d3550e20f29

SHA256
b75f7a70af30df342c10cf84ff5495a5c9a34bcf8f1cccdbbf05921eff1a39a7

SHA512
1cb9795e320a537c8d73216373cfa222b22695c729481a44b68e0d9fccd2c7b8c1294e4a70e0376b6ae307056c56addcec7482fd74fd879e9d9bd74915b06929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70c7e521e81eaba2c5dba69f55cb92a8

SHA1
b96739eb9122bd67f05ba4b335dcf74f9ee3c624

SHA256
8bb91b09f738d468897a6f5fa12dc06a91cc8fdd01f4a27ef9bbfe317acad90a

SHA512
a9b1d0d92872ad24e075df654c07bf25a76174f917d43189c83e58a59dc9546ac3e9e83c2af0924a726ee63e406b7282e42257b4f993235010104ee89e343d69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
900b2459717aac7ecc025c672c4614de

SHA1
2aae4ac2211c4f35ab58fbb24becd778cbc0da8e

SHA256
7b43b707c576e8bc30e85ddad32381c0de104031be1abe139da098cb4e9c8346

SHA512
79b523cb53a9a5e9b5503da92f54356e88659f9037cff881ec8800b39bc794bae90277a8af1a8c02d0e5078dd5f5589486691884329ba94a16c6d449a40a291d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit