0850bee62a6adb8f08086697f75c1d93caac58beb4e498f9edeb0797455fdd43

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e936dc232a421b7d497246aa3c9f71_JaffaCakes118.html
Size

4KB
MD5

84e936dc232a421b7d497246aa3c9f71
SHA1

d2f3d1150713a4e12d9304902bf41c92ad72dda4
SHA256

0850bee62a6adb8f08086697f75c1d93caac58beb4e498f9edeb0797455fdd43
SHA512

26d43a420e2bdfbf54254fcf2bc24eed9b11fb2dc88c4a807c31d1e45d43c0ec0c3b554abd1eef8a48049f7fd903a2a4c9dc6294adf3e6927d85f7230d345259
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oK9zABvd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F4195B1-1EAA-11EF-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004b53178f157ac44e95666baa0853720700000000020000000000106600000001000020000000a2773ff9cf3202d7a754a910089eb5a45a8b35d44346a4e4992876f07a8a3deb000000000e8000000002000020000000b71a4fc7ed43ccabc043aa5748ae262a21b5afeab164f6d9b0e4adb4b1dce9112000000006a2b34fc2c06c6515245d31b4e22fd8049e53a9e01f4ae1c999d9383995d16d400000000fb4f6210b6e56c1c82673cad68a7e93bf2a797c619774e6f7aaf23bb0a49f61b7f33eca8ec86b3941281aeb9e6ed92d4bd46813299f600d9599800336549387	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423252124"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706cc233b7b2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004b53178f157ac44e95666baa085372070000000002000000000010660000000100002000000010a5e3ba38eb9e1d421e5df3ffd1b1f305d7e9929a252afb2a503dc487b96053000000000e8000000002000020000000ee329d5713a7d6a118c711b2a2a8ce7de2dff0cd4752a9078d071d2865a52169900000002d2391179ce83ac63b52ef8fdfb46facda6a5ed57b321cd9db05a97614bc312d97c72a8d1db595c6e5895f1a64a1ec1293c5fc30044b49b59faf83ad254aa29f7caee0760b5bbbeb54c3fabcfbe752497e73163823395124ec4e750f36ff9bc0519e0e38496533a84f3fd33da8808554206ce46453d636cf4e9b096d3b5cc1cc2c991dcfe0fc02213e810ef3dd590a1140000000ec18225157ca51347a8b74838e20a1c3e08544efcd4cef6d2431a469b8dd2c81f92cc024c4b647cbfa6318981e1486333257c45ac598b77cc765928c56421a21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
352	iexplore.exe
352	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 2964	352	iexplore.exe	28
PID 352 wrote to memory of 2964	352	iexplore.exe	28
PID 352 wrote to memory of 2964	352	iexplore.exe	28
PID 352 wrote to memory of 2964	352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84e936dc232a421b7d497246aa3c9f71_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a257ab00f7c4f82b44a5da809eba4bf7

SHA1
f3338d1ef451721b694fe5eeb470ae1e527d822b

SHA256
329073cc15be41ee380cde2ed9aca126310764e00f9a276c7e74d526ce0fcd2e

SHA512
ea71361f6ce93d2e0da62d21837d780cc910c29dace22fe639df0077fcc2edd1194b7b69d870fca0bfd9ecb5e5cfe28120289fe0eb54c8938d2290d5747a6e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e5714087584f962762d0fd35c9ef97c

SHA1
534d6466dd26441f44c337191ffab3211ca652bb

SHA256
49266c57990559e81dee8a1e2c862300a37cddfc4973c5ca3723d032b3d408bf

SHA512
428739a219259f339edfafba60c2c907f7276601bd8dcad217832f77025cb897a56a0b18bcba357323356386d770416648e7487f63ddc4b8d6d6a8a011cdb5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aaa07c2af3bb30292f931c91abbc2df

SHA1
d9937fe69f763c09d9957f5d1268e382b04f9f88

SHA256
848f8774448ae5e4024bd77c8e8f8ce698a95adf18fc96e2fefbfb12b5077df1

SHA512
80874a07faf0f5ebe02c7f02bb8b7b1f03eca6cad78c97aab393b3626608c0a5a85faf6e047d00ecb5edee00b74a51560fbf0a31fab9ea6683bc4a00a2a58ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf4fa8ea297b8cdb390957c35ea524ae

SHA1
80cb3abd0d7160e4ba2f73df87a4f8fc24c61348

SHA256
9f83dbbb4d3dc00a4acbae5963c532be848a2bf5fba9b513d5a3abc8ea348ea5

SHA512
1ff1564ec81a283984f0278cf8fca4f17d625aecfbe0e11b235126f15d0dcedab151131879c397eb56f021c672d00cc95ba2400fcca2ca8f8ddb3ff09ff9e00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4ce983f20cbad49d869a98b07fe95b7

SHA1
a50fae0f04a3d61772ab97b6e6d3ea37c26168ec

SHA256
d7e24853f266f27c1d9daa4d2a876b842f81ea39c116f436e2ddedfeba400ef9

SHA512
f112cb2268a93d9bad95557330bfc69e59f7e2ea23829bc5bbb4212131aa4f9c0f975f15afebc1190a6d521bf5f6d426ec6b0c034b05c3c94eac2208549f5694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb36598e7be46b3e841168b81d47ff41

SHA1
4051e2681cc823f2ee14c62ba4a43bf8c36300ec

SHA256
0acd659a17b78d8795fe3381d49811a1533dc6e0f5b9c751b096a1a82620f173

SHA512
1b4bb20981f3fd28a0f27f04fefe08d02482130f2a63943f69ff9695e811c61ea2458f6f3d790c7c54dbbc2a9df7442aed400e204ae8379f3d823f3dfacc6792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1162bffe1d3ab813e5a3c6344fe05f6

SHA1
de31fde546a66c7161b636d5353be260aaf5361c

SHA256
81875abc287392c384f9062270d471ee7a3dfd252ec90f4c45bbc93db54dc7ec

SHA512
6f571fbff64f9d6a61cbb56eb6a1dcb0b2edc529dcd968033734d4f28e05037ffdea02be257581f1bb42d02cb9a149240ddb16f1efc239a1150db22ca285475d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a38eee241ca959d2d426ac82a10dfda

SHA1
85ac9382d7d0bce56bd412e8e48e438bbe654e23

SHA256
5c8831aa1806a6c3d4275a6f0c5e96ecfc56fdf5e159db96f05fb4451da4cd62

SHA512
45de16bf66acdaf1fbd2fc7fa13eca95310b5133c088dee36bbfa0acb366a7674728bb3a5355250dc9cd4006f9117ba9f01dec668f80c430552199516efb1b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8301f9b395e9ffaa671b46031242021c

SHA1
867787ed4ccd69fe5a046442d66bc2ee095de922

SHA256
119c122020de7616a07b9ace24c2f79b7a1275aeb200671409743ec410efde06

SHA512
8da5fd273989f9c429770e7e0cce42183b71132c95914aa7e26ac4b25eefe4510edb34b6f1e2d91356fa149dc0fc82028742336108663a066c79aff365cb5a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db39358b9da0a7a68a887a2c38313ae0

SHA1
74e50b0a6e6a6b3cf78ed7b7d6c98decda5150cf

SHA256
e569a482ac4b897c35de2f0b382874bf10675fc91ce05c6e42d83eefd1d44937

SHA512
309e318c96d3dbda5454650eefb5ba6527a56eb025527ccc6fbbe86f753be97c206760bdebf02e9226914e8ba2d074d0dacb13910fea25d4788363febc003367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5adaa5b4718c5466dcd26869a6e8be94

SHA1
44091c368e5a568c05a9a90d590dae40b0778bbe

SHA256
9d0c0273344bb13ffb20b4ba25ef0b36ae16919a86272fcfee4f71ef6ae0b2a7

SHA512
c7a2c36fe50700fcaacfeed07e0a0665daeafbab9aa614ae676ed63827b4dcd141198feb5611c198e4f66a18efac6ad8bc601cea06ee9ea2f98355618c5530c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c091a171e6171f1f2666aa323d4cff1b

SHA1
9c33d56cdc97e64d494228e95e0bd8801b150e33

SHA256
c2d14fffce8c5445b9eaf0c5ac7eb07a32e4d4aaa6e10d228cb857f80fb6c930

SHA512
775b8ceb9636ae5fcef7dbbac4324de19eeada19b8200b2ef19f5bc49a2903f4ce548b665ec522ae09ab98db8c50235c087d9c1da66f3991887a2fe276f251e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit