bf52d68b07898c71dcd59dd3989962b7a96f38c3fffac982a931652d1bf218a7

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8463f9c7ff9291dec800da8150946fe8_JaffaCakes118.html
Size

34KB
MD5

8463f9c7ff9291dec800da8150946fe8
SHA1

633d7ae6276d23c1818b0dbda6f59129fb95699e
SHA256

bf52d68b07898c71dcd59dd3989962b7a96f38c3fffac982a931652d1bf218a7
SHA512

bd9a40e0632e2b92deea5e7dc4de30af77377a232f59e6fbfa8506a79d50f7b4c1590ae50476dfc3e6e7f988af73bc2dc9ff84a3d74cfd97879bacb300cf05a6
SSDEEP

384:piLc4ItJZTWGUDAMzK+m0j5zX7NjK+1MAZHtbircKcRk6NQF3RtswY1+Xu:fDMzK+m6rj1hHt3RTQly+e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2E13CF1-1E8C-11EF-9DC0-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300f82a799b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6fbddb50d394f83e83d2fae6b981b00000000020000000000106600000001000020000000683eaff62c07b2e13e50cd11bd2db1f6e7fee4f4e5882c18e08096942c494ae2000000000e80000000020000200000007707ecd2feb19d634b504ff8b190db58f98dbd356002e6488276c7d5cd06bc4090000000f8b2715652d2b3d6b91ca8554880356e2568f16a4b305869186ca009ab3212df285073884c40b554110ef6b43ed38d15e0b92793605d2d5154f5c3e02fb47f53c69dcbeef89696f41bcb62b90b67adf608eacee1d088be65ddb6fa1a4904dd651c2f5d42993c9f310831f3294a7d2888c4f18358072b932ce6a63b1abe0e8be930d0abb0af3ac6071bd49b103b96bcf44000000048b5314145b629f6765381e10a6a2ce65d6eff16bd5221a9bd0960616966dd045fba9a76d35265454c469b3e68462d567927e234b56219bf88cf0ebc8c9bac25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6fbddb50d394f83e83d2fae6b981b000000000200000000001066000000010000200000008fab3f22fd8e0cb81817919c3275008e080039e089e6a94901af9ce43d5f2a1a000000000e80000000020000200000000c8074e5943a27521c98f5f5476957676db08460f7310d3e2d69ef88e8866bef20000000c62c8789ccefa8ccbb166795916b2c596d40b375edaec6e2435ea5c2428052e2400000004087416e676e2018a5b8974e7c8c0273487cef4d47eb210d0e94ec978f37ae8516fb69cdd7a05259832016a38711ebf7bfb295937c3cf6ff412fedc89565bd08	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423239434"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1888	iexplore.exe
1888	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2972	1888	iexplore.exe	28
PID 1888 wrote to memory of 2972	1888	iexplore.exe	28
PID 1888 wrote to memory of 2972	1888	iexplore.exe	28
PID 1888 wrote to memory of 2972	1888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8463f9c7ff9291dec800da8150946fe8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0988fd5dabe240f125b5b243aaea2c7

SHA1
51ae57893f2bfc7eb546574f572757d9bf25ee07

SHA256
20d79edf77c0fca24d407386ef3fa1af331bec2a766a25a5dff22f0631862302

SHA512
0d266f6347d41f207c7e0397ede98e97f369399417674cbe81b52c478eb4295a69cb0c887654b85f9d5278e18dfdffcab12e02dfd2ceb4c3de6fdee9fca2deef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aeb46b3b5d3f9e4a09df945c1cd7ab5

SHA1
8aeea9f539e89e887975c0cc3110ddc7b415c6e5

SHA256
4edc536d5f1bf291a1b5267b69c3d9860e395e47325ef02c5fd15fde437f4e43

SHA512
4227939423565f43889d143774256f09a4bb2976a5805279d0973a4661fb1b9a404bdce1ee322e24e462592b764e3fd7445b0b6d792dc4d313b818972427a4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c39652b60dec6f893ed2a824e2ad5a

SHA1
4a5594b9107c2ba2dfe164a223720061b770cc28

SHA256
057f901d03da67cad3c2b504c7f26644423963dd9bab31c1dd423faf64c73d94

SHA512
016835713e2a1efa51144688c5646ee1c37c1e79d9687b443fdc6b1b208e34eb76207d2a1328e7f200c62d9a316b8cae1d9149519a453e91cf08bc12720dc88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c2df06abdb2a076169724f30506fc1e

SHA1
aa053fd4c66b33316b4489a2143b68d44c85878e

SHA256
0ea61537a4b6531689064f0fe4b6aa1a1921083f892f110874590a8e737e8c89

SHA512
714c96f019d67d380aef66a0abb51af168d3fd3bd6baca891443bdf4f48b835ff62e01275b58a1ffebaaad792d73706a670e8464dd6586b605bec299d14710fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f06b857b2aeb55dbcd1a8da28330aedb

SHA1
0f0120a4c00de7c7339f92542018df9fa7284461

SHA256
6ec32db46287425c6aa619b7a110e1d4788fc2f725452ae6ec84cdb11b3caca1

SHA512
8105fef7055fcc154b00f15528f2af0dc51b8b5f4d4d1ffba6c3b832a506c18269354a28f8ec3816e8c09bc96840bb3dd9d05ef0172e79cf9d8660d2a4db5701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
447ff3985cf8beaa9f7539c3101193aa

SHA1
58a5012b28d76a8b0563f0abee47312bcd241112

SHA256
0f05aef94c839701a8cf0764248142bcd271bc1cec69c5648ebfa60f035ddd9a

SHA512
3dbaf29bf7aaebb8dcc2ec5cf4174eee4e292c2e0281c9dc7209b10224977492aa84e9b1bbccf191c9a43ef327845db81b04e765765596dd21b15d3989abe222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97b8416d8f6420d09d38bf53e5ab8e1

SHA1
26ad2402d7e3c46443b6f6b54f8b294fa73746f9

SHA256
ae35d26dddd22ae152bbd87ea7e63d3e0a08df735a5c8a2dadeb08556d21b8a9

SHA512
efc167577ce2a28e8a7462609a654a26498aa2029463292c0190c122240e39a8b0222c573886442686644e3830804f96f4b8c7591089c417cdfba3451f301c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e05638b1ec6d3872f1445e97fff1899

SHA1
9fe0c0b30f1cc7f656eadb09e14cfacf37f59651

SHA256
807ac007be9efa7cf022782698bc07eb503e46567172961c8cbc04e492c8de1e

SHA512
cd2de25d28a2297d53f3a3bcbb75679fc9e445473c02f41e17a506ad12d68d873105cb5ed73b45c5c8c4571f93a72278e21b7870d3542d91575938ff693367fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ce7370484ca3a66929d0a15e2ee4937

SHA1
cfb7a7140b2b7008f070872b446355775aff02cf

SHA256
60449a381531a316483ae3cb56f584a59373022a8f81bde5ebc1c502cd29c797

SHA512
e5d9902ea50c74e6c2aafc30eececf4d5807793727fe036d19487380eaede682fb280f061ef8aee759cc51df101de503fe17badee70ac59fbfb4222d81a72cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47329b37f9227e9c824e5c9ae0bd53ab

SHA1
309302519fab79e290a189b9f650887d657523e3

SHA256
583e7ae036d7269af38fcb856ee05070467327757c3337ea2281f7f8b0061ae0

SHA512
3428b495956081e78ac92d49cab9a8643bf641754e1ff8131b99b27d977874a2776b402df30c04a3638d49676c4035998dbdade92a9e3671af3407a723274e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ec7c15218bacaf8e7e6559c2239bae

SHA1
ec7d1f9ab42fad5160d651bedc656e2083f13977

SHA256
52c769a87827277a3c6932f87d9b5fd1971f7a580b03557b6e3567131b078095

SHA512
3e3a193c1b62a4d662a3106aa97c276b4d657f8783dee85f9572e1f8a6e59a4b3981bf39970546b8546de257c3db7f9999e3e6db10af77d3c264101730e7407c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
048276e46e5b953d75b8a3a85f91b38c

SHA1
0c56ddda08a8d8f41f26287b9d2c5181bb4c65a6

SHA256
0e0bdf0e2b38d1de247d42c17f183002cec0ff158fa21c24bef77d1f2c5d06b9

SHA512
47fdce1d8ef68c7033e502afaf71e24805b9bdae9954a6ca1f8adfe5a61adfe8929bdbcac1834ff1323d30d205eb222d829291e5a37e3677b93188a171dc3137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d874f866b7340dcd0d69244a8a277bbe

SHA1
0b00a29367f175fa408ac9270c5cdeae8b4742ff

SHA256
540e6c1719c39e41090e9666892c3d55bce0aebcdb3e7ee42377e03ebe43b0da

SHA512
1720fefb593d9710499c2ae606b7bc0a5b1ca58cf1ec1cfd92f80e766eb23203e2bb268a1f3059dd89b452900c80a2e6de72b7f1fb53fc75171d6bc03114ec03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8e1452ddc810b70ab881e9d339218e3

SHA1
d362bb7373632b56bd85a78529e62f605e12a2f7

SHA256
3b1a2f0cc6a0302cf05a00ed77d8191873ac6128a70fc277e6747383f460f272

SHA512
0106e8440258384e5c7f83f3dd76ea5443df87fbb58a8cb6e1cae2e2d0ebc49a67f21184410ea204e16a4bd5e3b9c05f66068f9c5fa72d823300aa2f980d3d4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8334ceb9e9c644cfed8ca75cae627574

SHA1
f3f18e4f6aca5eb37cea6bc882e562d0e24afbe1

SHA256
a21bf6a4e126df760355edd84533cca989ccdeabeff1b7db3bc9d3be6bbda244

SHA512
179b3b7ec09c3f8b6b1668d2fd71c5e7dec6fb2e94d6658421f684531cdc105294835b37a47ea4281e03e246309b9c02045369fe6153a48e504c421484ba1da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4877.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4998.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit