f7a07635a5da04711d6a2dfa4ba243a7caaf43b74d78967b8c88cd9c31fe95dc

Analysis

max time kernel
137s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

885df33fddec03f4a0c9fe58c523556b_JaffaCakes118.html
Size

349KB
MD5

885df33fddec03f4a0c9fe58c523556b
SHA1

dcee57ddc267c220e64c7e2063fd4818fc40bfb5
SHA256

f7a07635a5da04711d6a2dfa4ba243a7caaf43b74d78967b8c88cd9c31fe95dc
SHA512

7016c63dedb7863e846fbcf702495ff48cc5285f80b09b7b8a755972046b9a1b740655e9d33e27eecf0fb4cec6588e8f7a121c977389e14b3e80284b417ce484
SSDEEP

6144:SrsMYod+X3oI+Y8sMYod+X3oI+YAsMYod+X3oI+YQ:65d+X345d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CC8D4D1-1F92-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423351791"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000286aff4735e4a84d85f31b8f071c999100000000020000000000106600000001000020000000e824cc6944700817c3cecff09486d4e03e9262051bbcdbda2cf93121dc965f32000000000e800000000200002000000068d29f81fae48320156fa81592afc4a9e9fb1a93ed7a7d46a1ec8e1c95079c7a200000002240fe4cae377c47428b5364867efe48fc05bbe24887c7c7ad52630b1a546f6440000000a85c64d5ea58091e22f2c1e30fc1c6a26ea3b7420bb3a7601ede04c6983236e09d05ad42b9cf3095af88bd7296f5580a2eca5d9e980653e3bcf124835ca56abf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00474809fb3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000286aff4735e4a84d85f31b8f071c9991000000000200000000001066000000010000200000005d697da0ac8d4dafb43368194466937e66de0b5d613387ef6e1e7b6d3758c7ac000000000e800000000200002000000051c17a519015f9a7884358f1601e0e18deb0ffa8d78001dcf1a17b9ae0e9360290000000e5b162fbdbae567a139a57b412c379811220ef4b19726adcb178fbe6c9a96deab29e4c3b8d69b145b76b83c873192312585aa58281997b6448db983cf2223acb5861beca232be91bb455c83f01a638095a11c91cbc0aa5c0e09ab8e551fee00e2a5c0d388e5a97692a64e0c3c4f35ed94df351ee59d0579e07d5cb1e54bbf710d667c7419c2f213db0ef4b192eab16e3400000006ad3e0d3ced95fd6c9eb9ac914d4e960f35bd34d989a556315b310277b6902719e3bdc4533342f731d3a56b7720f6eae21e61368c40931a76918a872b79fa3ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2548	2760	iexplore.exe	28
PID 2760 wrote to memory of 2548	2760	iexplore.exe	28
PID 2760 wrote to memory of 2548	2760	iexplore.exe	28
PID 2760 wrote to memory of 2548	2760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\885df33fddec03f4a0c9fe58c523556b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ecaba520cc1c5d50bf0b0d83196a52f

SHA1
07ce5b0c7a0d9386134f96d4f489585ca6705a31

SHA256
20a29dbdf1e51cfe8cb8790d4159f6f65c9241ebfc124aa9b7c419589b6837d3

SHA512
18a55f68b51091d2bb1bc1e0473be9ec4e13d7027e9f60a0ca524eb75cb1fd34258e9c6f42512d85bb3df0af7811e72004e1eef3c8f4bbc87a5c09b235e98ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03acdf3ad7232b8bfb0aa8da3f249268

SHA1
6cfb9f7424e33ef1306057b3854c4c6d0ee13697

SHA256
ad2106af76c41afbb285e89ebde923dc47296cfdc37efd1d988c3001091db997

SHA512
e3f1d013fe6685146261ec9bd3677198234037ccfd7d8d6e62d98511c5e91eb91b44101f2213f65232ce9b6e93ca05ae0599011488224671c7992a9440635422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b446be33af9d484f5a96745388d9cf06

SHA1
21bde197da071ba77e8de64c63e60ae91d2af317

SHA256
83e7a2750a40e664261057341d3436e67f699fd0823cedc681b0457f1aae0d9f

SHA512
015a2aa3c646b922c31d2db356184fd15d990efdc0f8fda4f4ff185d8e2381da8cbd8ee02f1196692fed99690be0a67cc0ad9ed1b69975270a784efddc9f0086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa7b33315863080d5bad9a3fc234b6e6

SHA1
35f544fde048b2861a9e513769d5917c1fa0dbf0

SHA256
23d474ec83018a4992b4a2fc7036e585d2178677bf69b1056878019f0e1e611a

SHA512
4c028caa0339303a92621ba784b6c8c9bfb60ca020cb1ecf4a71d28eb3ecc09139e3f1fb807f1af1de415debe6754408fdbad4bbf9aaf4adc08cfad5e20e131c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfc176e51c618a6c5cf67c1d468868c8

SHA1
0b6c6d1dbff3e1dc99f0b88a26cb69bbb9d7b33f

SHA256
99c48db5b3619b23bcab1567e845d3ae0579125962e51134546fb56643853850

SHA512
46c52cc25d0eb75f8262531fc145289f7825ae33cb085e79948524f0ad2a7afeb7bbf2f2fb00abb9323e4740f304b83a1923ab823dc0fb2b5ed5ddde89624486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0b269fada9cac2862098e6f8c9825e1

SHA1
23ae853c4886c8c2e26f18f7507e14065499e4c3

SHA256
6b3c504ff986e7e297e785b6de57c7f1f186db3a729c2e47992ce7c0788aea18

SHA512
1a3d27ca06b7cc86d6d143c81cf688b614b6fffcbe4503387969e09ffed2363b89b8c689247465d249d1ba3ab8b474d91fdfc0989c459794dd2bb9667778dddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a6e68e3c1e37e23c49f94617871004

SHA1
b8b6863f21ff5eb65cf29eef3dd9188e1e387f8c

SHA256
28d56d585aa80db27836b7aaae04fdc0cc5140f35974019a3b36f551bddc232b

SHA512
b6174af7b1b4903daa5b1f01de8417a3bee1bec5616a255779f643a5e05ff0ddeba435c99da99f673126009b0ec4485d48054858bdf02513a51a83912c10bd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
213a1e7eb3f19213441edfb4e44b3ac7

SHA1
6308d2e8ae035e23f7d2d9b053e7dd7ae66fc324

SHA256
c7639dec573793f6efa818c22c01d6c7b6af9e40a8d5b6e52ff58b06a3f2968d

SHA512
509b52b837413ad8854055cd070c4711ef816c11a7a179944ebf19629fdd7e2ecd874d9a4065b00df8a322fe388454d744437ebaa800bf7ac4e257b660fc7e6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aa3a7cbf742c40d9b395a3ff61bc014

SHA1
bcb12f8758d22c411577cbdc441f1c7c57f965de

SHA256
be83b05e5f64ceb8d167dff4daeba58079bc46265e5d3c96a5fe09dbb44e1a05

SHA512
d57efce53bf556f863eb5ee1e4198f59d8b75f8bb5d159116a5e889af469c13d2720cd578a8bde053b87f6929838f6df5de50ae0ae667c14c29fcf406277b84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a172f62daea183bceef7a505e869de9e

SHA1
d3da1fa448f031183b042664170277781bd1d234

SHA256
d40b3498345c123f60717d5039e318ec622d3e65d81075439c1ea447b4ffe3b7

SHA512
c082e57f9e58b688ac07c81a7be2e3002028b4f805bf053610be6bf9ca32fc19363437bea9b75a477c7d820a49b41da249edcb8dca3fd94d80a301bfe84939e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cc8b478262577c3ec18fd38c140aff8

SHA1
8b300023838b5c3e32a4ba0b293c9609e08ef722

SHA256
30efb634a051bf3de1071d9aa134773870cc6fdca3ce1b4141b2a1dedb44ea12

SHA512
5df8329df921b767635e52d2048946890a65426638d646db63fd8cece27ef9a7f578d2cba6fa311a40fbdb15878fb0ec7a7cb012d2a32741980bb7894d16f922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47f404086f67970412e09db4a623684f

SHA1
75a36c602fa58e49793796802ea09593981b5901

SHA256
af5454f8a2eeb07d5d196cacf66ac09b45ab454b7be39d72cf9038b9422bf3bf

SHA512
57de914eca5239f24e1953ec3c5ca774378bac820d5f6841faffe9dde7b67f4929cae8674200dc0cdd0bcaed29f10f7d29c511ce42a3b2d35e8f20816a7c1856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaddd512c1bce4a1ea9f32bccd942c29

SHA1
dd2ea33270e2b6b0698ffd926863834855bd4eca

SHA256
565ab4ac4a895c94bd250f84a026f3224aca2c892861d0729e33e93959bc7388

SHA512
6245e3c6aef30047e5d398948c34d60a5803de33c4f9116c01cf0c0529c74c764f97c2fdc05526b8dcda22148ca1be771f8de069fcfcc3df4e07edce18d6d0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04aa16e4af051d88237fd95e56d89f98

SHA1
82034cc6f0c0d9009c102e171e67effb37d07254

SHA256
adf3b1ffb789e50df3ce2d4a54d42759c62ad7f0291cee98197c8ff63e50da7f

SHA512
0f412c6118bb07403259f3e68d6ced401de6974bcaf1419b56cbf1f219e1a7e616b3f7bf2823c036127243b69377834812d9bee6d9837ebdb975b92d9a25c6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fcda6e7fe6057a7f1c95493ce27bfdc

SHA1
e9e826903dd32e5e3996972a1a6600424dee2192

SHA256
708738b398a449bb7ace4bea9b6f4026b740607bfd9699a4b98ebec41d6a1f6f

SHA512
c71d10989129d5e7ca89bb4d75931be2ae809580a415edf82fd0e0f7a346f7fca16843185fae37b39bbc64c7659fd8039254d684210c0ad5d4c2466c6d679f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ce21fb22942f461eed56a7c221bed4e

SHA1
fa8346e0572df3d093f118034d99607aaa9009f8

SHA256
4184c0ae3feb7aa998dcebd62ffd961fead09c1a8bf2b51ec8b29d8660929d2a

SHA512
df490d084583be4c5a1d429f077b84bb4934500c653081bbf45cb1447da02027881c50b616d6cf3217587d6d25a015d14adf528e7c4013bae36db3704653657e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar809E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit