558b06e273c4bcf8cca49106bb6402366e3374f413e0d095e17b1d9c79bfc77e

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8384d0572be8891ac93f0e6f1e804e42_JaffaCakes118.html
Size

834B
MD5

8384d0572be8891ac93f0e6f1e804e42
SHA1

9a58bd17edf686e3d8ffc17e8095927987d91810
SHA256

558b06e273c4bcf8cca49106bb6402366e3374f413e0d095e17b1d9c79bfc77e
SHA512

75f353b7e259a3923e8c6b035bc562fbb5a894deb4b0a6c98a0f0b7324fc20522400389478971a936ea4ad10e5b5b20191d8ff7e00a62e01c7e6e9c498781297

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{625DE2C1-1E5B-11EF-8178-52C7B7C5B073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a558f7dcdbfe445bf80d934bdc8970b0000000002000000000010660000000100002000000063b8a20007bc83a16b013b1f8bcf8464d061107ec7d0ded7904361c5f5add407000000000e80000000020000200000004d4c93bc30b64ea21183f55bbf5d11ab0c5dbcd3e9a9383bb1e933b705a65245900000009ffb9c5ec702c569b145781348a57831466bb762d4cff5dba827d8797b18f65261e6fa726d2ee33a5e7bb08c440269e955357c6fde0ac058bac4b6edbcf870e23df7ac1951085ecc224b245603503fe1ce665cc634f765aff77d2d12fb558f299fbf9e66add20cb7551fbe21113a0b0a8d7c2a9caf66294d96d7ce61afab38e6e15e44c5635076acb165fc38ffc4a9c1400000006ee447e806f7d50e6e014c05c485934f8757c019e30fa1b83dc7e2afa2280cc89dc23f07a75e317fd688e4d4723fc3b4ca5b160ca008dde50aa2e43d3af0094e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a558f7dcdbfe445bf80d934bdc8970b00000000020000000000106600000001000020000000a00ec0c13b13d5b91466aa1b87c06df4837e2041f8343daee99bee7e3db3b97e000000000e800000000200002000000029d881a9cb1cbfe109d6badf09e10bb8bbdf2701cb9064a56efd6c2ccb2ed5f1200000003c1d5ccf831451f89644afc761188fa8491da855af2437ba89b4d473fec3eb7640000000733f9e7b98cd05af91192ccee410efc99205d7ff2201a6beaacbaa8aea44a0abbc2d3da9387cd82aacd8f07855cd64182d6aae5840bf52d6c5f6b9502a0b4bda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9086d62568b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423218201"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28
PID 2784 wrote to memory of 2748	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8384d0572be8891ac93f0e6f1e804e42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c3f96e06fdf914bb7b5e77bc84626c

SHA1
ff01e8dcd46881bfaf968121ba973e475e9becf1

SHA256
c146800b1587a1dd8c45c6eec987154c9bcebc55cfd72efc26ed622565e008f3

SHA512
8c5246d11d6127a20163ed0a429ed163937b1dac0a92b9f8624e0b56b0dcfb144c3a729cf7ad4c8a0a5a9589be3eea747f4aa38aa157f75869a0de45ddb894ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ff7e50b22c83e8f1355da893466b613

SHA1
ad17d7fc17072babf277241de7836c6e905c7328

SHA256
d38bd392075c7c475008c1dd55840127edf202f6ad93bdf18daecc703cb775d4

SHA512
c6020168b8b83f575e6e05d16681987d80c160d44b0443456b247944b21b1a1ba17f972ea5bbdbe27f95b3ce86bb26e5c06070d4537f2e9b3fb5fe66bf5987a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c5b9bde255def8a809d364f6344f04

SHA1
6df3ec48f7e2b391d07c15520a0b48cf80b56503

SHA256
9c01ce3d0d44d00fee078d5d2a36fc4e46a53f533999961d8a2d682ead9f080a

SHA512
7a4f57a8006c22a74051511fc2916861a4591d199150fe1514eac9cd237a287d15424ef9377d10e3ec33e382e83c393f10e688958e8a2c7c679f20c4e3944b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a07bb7db6b7e0467080473ec3b2e5403

SHA1
7f760face5e4fc7b613609ec4e2d404e56c64c08

SHA256
b230e60850f3fb220cd82f86b465d41a629c38b3c90c54bd6853ae526b7d542e

SHA512
76ac305f30b51256ad10f072c5d7c32c603bb0cbfb1a27f32c6ab81d34d8db3926c1c4430b174068b87decb5bc8a11280a62aabd2b38aa71edf6338941abbf6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82d85d630c3bfbc7780b49a7bbd2a8a6

SHA1
959a1027b558efc943753e44d11fe8f1cecca7e9

SHA256
1285a9a93362d277ba44e56bec0353d98ebc8cf8dde016512cc9a1dc1da2afb1

SHA512
653d14d9b5429667b9a146ca2f14a146b0a6a5600c8299791cfc3707e06de0504a82ec64f6260531944f23ecacf837f5f3a0b6322d0eff507d1a0f12c4bc0996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0938e3be68a277a22721d8688f4f3dfb

SHA1
e6fa34cc22f72d663b143ee3511e57ebaa401068

SHA256
47d8e53711164df94c4a8dd31c8edd065c3d0292a73931f9baeb21e0f318ac57

SHA512
7b2a3ae0f6819ef8cc8c62adb7b7387e6e0c90c3e4d3a8a1cb7d57d2be9b4ab468d7b0289b55e1d0fe8d5b15104db6c58bc5f0e84eacf9bb1eae2672d781d70f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6ea28a421eb23a64f2dec5c4f9da3aa

SHA1
d888ace02e3955aa702b95c2385ef342cab12546

SHA256
f8145f7cab3be398bc5b1a4d491d84d8befc5a0e7d30353d5b555605551d744d

SHA512
f38b6010286b8b3628c638e36859c0e03cbf61841698ddee3dfc308cbeaa231d414f3530ba978b247616b509ed0e12c6e9f5f8d2c01987077c4291d74b11b65f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
790d03c1f9486b8bee3ae43b88f0917b

SHA1
1937b862cef3e87e93407e70dec9f89487fb1f09

SHA256
feb9ea19f62556911ec07d1046af1cf447194a5dbb4e70e85d9789a3370f3e99

SHA512
5e909e42f1b56254a3b4a466de9b829f4f2f4b58a764d067a81ecc47e725ce6a11aa96b2e10270a547fdad6fad6349cdb0c63fd94b5ce699a907d378f4378549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cd6761b382d7da3c272bb155c488ef0

SHA1
e28472de4723a4deb08b95ea502bbb65c0db6561

SHA256
5681f5f943779b59526bc9ce3dbd4f41a59c73cc40c9646dc1900faeec762689

SHA512
9750b48077fd85688abf5816c797ddd238f7743c714356e619946879ad82ced882a5c6e4055e9c39b7974e1a2aa5faf175620e31cc4976fd558c8dde7add7920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
196da855620f2a647eebc7f16b3a1abb

SHA1
e45e09b5b92b69364fc7c8e0ee10f164d270c5d8

SHA256
9743bdfc2dec7bfa232435d9532ec9330e3bbd6d01ed857f2be7f8e80528a63a

SHA512
776007e76b305938c0c1670deaa74faf78c1054eeb78b0c5315c39436e5f30d86e03490178d3222fd9815d0320b6b655d8d530c02ca0795de02cc77b8979ec75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9084c02d30ba7ae3c9bb75832d70b3b

SHA1
0d9d4a89e25faf392e55fa30b64dfce4ff60edea

SHA256
3c16205fd307a9b4ba91e22613cec691b3eeaebb3617eab4a54fb8ea731a02a3

SHA512
567b00e8e13a7983ff7c99f3388a4311a30796288880cec936fbf7b89ffd98c8f5b32a84db931bc4702232bcd9bdcc2906239a1580b68c3965d6aa267f577558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5d7bb954006b6841a63045cad274b55

SHA1
5715bbf1b1ff999fa693f0aab7dd7e786bc0aee6

SHA256
e30e57568aef691721b2b59e4a748f8e2040750be67ef456244446366304dd68

SHA512
854ebb6400efbf73aca1fcf7157aabb050cd77629e625efd8915e67dbdd922f8c6101b4b08bff1b5481d3f8dd44eb982112dd8478ad26bd55c730f5854bd664b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9fe13503f8d464460c7437fb3189431

SHA1
1623cd6636909834b82143d5a4a2aa57de66dea7

SHA256
1476145c25169003b77b85d88d84d2b3b9f464747b8d4b4fc05b0e7a7c06ed71

SHA512
e069ea9b30a063387d2c2da1c17dda001ac78711fbe4eeefe60c9e6109d3f53cad832064754538418deab4538cd9ab2cba7c20316429ae66ae457d97caab4300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
417848aa277a4817f78b370035b8853e

SHA1
143fd253f77edafd99eba8778177c323c5fb11f6

SHA256
f10ffa2ab7973eb946a70c050679cc26d8b874f791b68fbbc1ef474792fb97e4

SHA512
73407af4f72b80b0e27ad0130fd78e30d8ca9eebccb53ddaab019d2214547808d83e21773d83872c1ee492d0980ee7463e5e8a2d3cdffa6cb2eec1f62afaf79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2290.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2382.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit