00c0e9ba7e5b129f3194b23cf4c7c444e11f2cbaf799a166d705397078ba09f8

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87fcca6cbde976cfd0d509cd7d4ab570_JaffaCakes118.html
Size

24KB
MD5

87fcca6cbde976cfd0d509cd7d4ab570
SHA1

213f6b7d81f3f34a11b3e82b561d9b9936e1b029
SHA256

00c0e9ba7e5b129f3194b23cf4c7c444e11f2cbaf799a166d705397078ba09f8
SHA512

6674c24d59fcac696603d6c1ee23f718a4a9922b483abe2a6badfb248d5c7c98dbea05cf20624638d1e9f9799765548c98f1ec229903a20f8d94ed9c32e553d7
SSDEEP

768:/UF+Wp1khngy/VnAwjRjfVQte5ViCZbx/nscrh:/UF+Wp1khn3/VnbjRjfVQte5ViCZbx/X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d36e7e2f34f415d9bf3e2b47b3c6520eaebbaa27be283242869fb6123010eda7000000000e80000000020000200000003ca52a033d95525a06de535a49604e9b6b2526167bc53b54e77a7d115f7bcfa820000000e33e61be9e05c38e782a2a5d704c6062e6b47e4d2e4daeac2716a57b5ccf3d0640000000deb57bb16c4b50829aeabccd48ec7eb02358677f654530c999b86cd39ddf28bcc3c0d0bb0aa91ab6d7b10602ae0f89d7928d570181e3707d49a3103243b96602	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000dc14195a617f57f4d455fd80dbbca1f6e3bd0d984075b18d6d6181b9f7358fe0000000000e800000000200002000000026d29dfcdc983d51e53240f895a7feabb1e44e989a03af1204bd75ea064075d190000000d7eb2d6000c1aaac08eba8162a89d7a2f9b65d52fecc6e475d0d407b677417fcd57f960215867fa1f509d5b3eb8747dcfa671e5d4449ca32980b5e97ee88fe31c47b2004ffc290915ed5ae4baf480943515e7614ca47b80b1aa3553911a79cef05cc3138426d09138be3f1b396959e30e354acbba652d746f3bea2bbe76e6f7270c112550cd843af2396da5230a74c43400000001c319e046f0efa73ed048a7571eff32e96660b531a83458d53574a825dacfcfc66ac4bb6271645d79f673d7cc99018fca7e303e74aa758764ceae81c17cdb9de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f1b9d58bb3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423343417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE20BCF1-1F7E-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1560	iexplore.exe
1560	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2748	1560	iexplore.exe	28
PID 1560 wrote to memory of 2748	1560	iexplore.exe	28
PID 1560 wrote to memory of 2748	1560	iexplore.exe	28
PID 1560 wrote to memory of 2748	1560	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87fcca6cbde976cfd0d509cd7d4ab570_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f1b9ea8db4810e1f07cb14591d16fd2

SHA1
9efbddfb784118bb4968802af68906a3def3ae2a

SHA256
f92da7ac1ef374abd68a725e8836a06e51c9b66893a4bc4987602e4648e25bf3

SHA512
659b2a391d2a6a5cd84c0771ac3de154f3e9d3046745904caac97cb3a0a7ca7f3cd2826720ec5eb3414fad4fa91a96fe47e3b5b17b079186ea93bb76efca792d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee6567c6dc0d78bd6b9f0a16b757af1c

SHA1
7f5cf0407abe9f7d3dc0914c0087dccb3325bcee

SHA256
37b8195867c580e6470b20fae9e5d0da4be2c00963ebef183e11f128ae868db2

SHA512
a746774c72bb0a425a660c5fe813b43e3428092651eda90e1fd329dd5bac45e9fd60b893bca5b716da65ee5a9e69781119ce756ee62c671b305b546431ae2453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e21876b9c7e538e86c63ce4ea7cc73b4

SHA1
8d2a1612978eeead35df9029340582cb531f6ef4

SHA256
4a09cecf938cb9e628d03551521e19ff43f48e1ec3fc2515e4b50cb480033c02

SHA512
b243f14597177ddf4f3b3fd63ecd2cdd2350381930aef216469d0eac560a2e40eac6645aad8bb15103a116102f90163008d441aaa7851072d4643fe9d5fa18a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77f427678d0e10249a2282ea6a763187

SHA1
bfaa412a03add5d0496e997ed05ffad73c28f74d

SHA256
4d5fbe4afb6cf430bcee11f9518ae9aed0b7bc841f44e7cebcb22bdc43218ce2

SHA512
c3b8d7515686a7b39c150b5bb74933ee6477dd1c69909b2779778eafdb61576d0f85c5cc556bdf35df597b72d783cffda21e6d4a2e3a5cf9318aa56933d61dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
625239a7faa0a52338382b510954e65b

SHA1
d314b964db4a9e783a2e6d2b0dc768052f01f641

SHA256
a7251a018915f695ad018fc5880c3f9808f7da8f03469332c361a0972ad518ff

SHA512
b492b7b4c5ba818e593b2e97d7117745e6f816567c5e614fc3c159e18d374c27a89ee978163acfce89c5d9569cf57441fc825d63a2e6a4a1f5b1647cd8b2d0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24397855cbc2fbe5d5642cdeea9d9de2

SHA1
aa363952e7f8a52d7c34d755555bafa6b0cd6726

SHA256
ca5893cf5d50268bba49204749669348ca36c1636e29783b69aeef4f0ec72f94

SHA512
d420446cd94283a3ace913651b9a9faacc6141f65a191c788239cb45b1223f64b276038dbb621e8f4f953bfa866711ae2478ca168f364491d0ebcdae35bf083a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4b840d5992a4a1240c4ddc4a107128b

SHA1
0d41afa86075d08afcd8b5a51e41018afe13d371

SHA256
70ff337c9750b681a235ab7ff274d1a972093970fe99eef8c18fc810f828b54d

SHA512
33addcd439c2a81cb6ef124a7b85e98d7e5e259c9b70a6671f46a37710d81e423b2619b173163852e24f508cdf2647df523ef5371ef1bf532f3a066493c67621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a3965f995743179399b5fe4481d373c

SHA1
d4e8c851d80ec6e1eaaa9aff8c002eebdccc5329

SHA256
742c913ead71c981c6cf7af0092325f3560089ccfb2bdd6093dfe290b2241e87

SHA512
70f243b65bc07d43ce6e64c0845fa4bf84eec56f95e536b59e5c543f55fa50d69a0fe609a29f18b31cead4a81e5e4e79bdf52ba8ec90c437e4e641e55bdf2142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3a525aa409b2788f98c763622124575

SHA1
c5586c14e53574bc76c33170624df14093894c36

SHA256
7d97055ee49138582963867fbee8430b23650d3f463ecbcfa9fa7f775309f0a9

SHA512
32f55c14e95c4fcdb86c1faaf618b5e7475a03bf1cab4a322afde0cb2c044e40a6287e86cb6c442f3d8d6b6457d4ee1eed034417a43737568e643b66802ad3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6863aade62c3037ff9cab4d9c7109994

SHA1
3953ca5e276daebeccf953421c1e66247d617c7b

SHA256
52e0a02b80e2c406820be459c560202ec4c1b966d631f1a6e79ec064a896f21a

SHA512
79ee251fb0e96cb88d1617c0428643c3d4430019da534cef1604746ba056ed5ad530e08ad520b68519a71640af4c28e114937fe626938995d4c20012f6350d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a6bba2af04aabdf29c479c4efb4b8e9

SHA1
af9f81faeb0a4c7987aebeb7fab55bd5d470236c

SHA256
6709b5704904e900624ee23b7e614bb66d1fed9bd98c785fc3536ff5ca4581cf

SHA512
00038f4d6b52d5ca48f9e8e91b3eec3a350aef0c562c60c41758939e53371294966b5eb86ede78c8ef555248bd6d541a330193a69a3639267242c0517721be25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4911103ea8cd0d8e48d947cdea4ffc0c

SHA1
2a00e885afb0eaef26c7048ffc5c30cb1e8544c2

SHA256
9cb96439e9172720f7b96a18658c159b4afd686241eccc11220f6b005cbcc294

SHA512
e97f8b62da7798b3aeba0737696ce55104b7973324ec3d92710b31c7215d157f809089f250c6be8009051a30c84723f6d31bdf3b68991d06996c3ee94ee9abbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd718a08394ac2fa8424b298a77d58b1

SHA1
b85eaa27ff2c9cdaa08781a352985e1507b883df

SHA256
54e6d46ecc5143f6d23925564e368503c4ad5376a9164e1230bb8a4f03b6cc62

SHA512
c68b51723f207f7311d56d194235e796d4dce391fea6a3067feef5fd52b441add53050a4f9a4009e54f9ebff99ed7cfdcb5a8153a68f56268da6ea7d4c5fa8ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3c037d97b769ec30783981da7e2174a

SHA1
9ef5301b5f519f0f9b449d6252b86c30f5649528

SHA256
8dfd9da642af3906d1464e918b9773c1f9a364ba166e7664f5b6fbbd44ee93f3

SHA512
99d99023fecfefcba2a9244f4f42601a5e7c4702e4221a54d3cdeea9344a5b8b0e99dd73049008b1bda76e1b9cc4c70980d9710860b3d5b214da11bae29a2714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ed67088f815d824ac5f9fb6d31ab99b

SHA1
3566131b00dfe83ffc72cff87f33e8b9c6fb2601

SHA256
0993551118146bb874b7a05aaad4ff997f6b8ff021a07715b9455f9d0cedf6d6

SHA512
76cf0eebce8108a48646e446defa1a99c2ef1c9dfd1816ebc8a7d6c3338aefc690f2f4dd2bdc29c0e58f48e82e7f55381f6cd09dc5d00d5597e06f4b046ba655

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB674.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB677.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit