a4d1e4b92965ce9a50959c30fb2341baf1b2dd329f964b8154aa9ba92394d3e0

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88e0fb153d316ca192d22c35c810f079_JaffaCakes118.html
Size

23KB
MD5

88e0fb153d316ca192d22c35c810f079
SHA1

092681c3a9a8497285048090e85e9578c395eb58
SHA256

a4d1e4b92965ce9a50959c30fb2341baf1b2dd329f964b8154aa9ba92394d3e0
SHA512

8699a030d21ae457be924fd4fa14a64b9c15bd6cce95cb67352f2fb0e044ba860dcf4b3c72309a15b49b06c94922b56c240ec23db72921813395faa99b8d712c
SSDEEP

192:uW5mc3j7V4V1VHVtb5nCFq6/C049YGXnkwovnQjxn5Q/gLnQieU+NnTGnnQOkEny:lAj1dQ/m0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423364230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63A6BBC1-1FAF-11EF-B459-56A82BE80DF6} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2336	2320	iexplore.exe	28
PID 2320 wrote to memory of 2336	2320	iexplore.exe	28
PID 2320 wrote to memory of 2336	2320	iexplore.exe	28
PID 2320 wrote to memory of 2336	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88e0fb153d316ca192d22c35c810f079_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b907ae52bff8f644979ffdb4fe972182

SHA1
ae72e0f0d3be9e1e5fe07f91f7cf5219c75764bf

SHA256
ad3904dde5e4b12334f6077849098ee2aaaab41c7b56e29b4789ed2e3dc72b58

SHA512
754fec15fa99235df1de1fb6f61a11fdc3719b5c5b36c7567d167495380c44df189d540d7fe5f47a738d3594b1bf3fa8e1bdec473c107f1feb338a4ae43bf90a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d5f73fbe2eea24cf3f64b0d9789629

SHA1
366823f58e7cee9ce94614b84f102b4415782941

SHA256
d652006bd6cfc1339b0bac9769b1e7e3b65c3f87c82d3bee3433397884790b4a

SHA512
776b1751fd5a4be531a03086abe87dc7c8a9c88b445d71b425ff60b75de543d14c39fc6afc4721282deaff11811b6e9e19753b3ae387c08c223b52db81c4ab5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f133416a119fbe19976a2a34c93300b

SHA1
58a6779131921f972bef73213e4ea1caedcb3389

SHA256
7037908917ab54bf609c1d7256840f11df01beecfde06afca93039d17b10b730

SHA512
c2f456fecc14f70161145bf40e23bd14689ed5316d10909ed5dbf9c5384b1d87649122ccdf372a5237925e6d64d6de1f84caf2c1079759c5fce3537b5f20891f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10dfd791a3aae113e08ab15507adae5b

SHA1
e1a509595ff51d20bedacadbb7a4ef376b03ebcb

SHA256
21c6b438c669c8651483117f0b74a09550fad1d7805ffa5cd8f08248437ab7f5

SHA512
053eba3af670603fdd812751e687d7146d4c37b5afd3c2ce67761023f219faf655b0014b53e0b84404e10fbd8f87f90f79c50fda6158b5d5ef2419c0f463f1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
008745917e1ac37b4d20a6efacbc0f28

SHA1
45cd47a2e7d2c99f3f1d86cbe8406234631b0cbe

SHA256
04771d248d7d17182b2570eb2b99a21c1da2c261c50ad2f2f32f6f90bfe60450

SHA512
bdca5abe979dc43896b3540daf2dc32112a5ea4c340fc140ca50399da28f1790eabc8759af5cd7e5642a6f523f0b0c42b2ef4400fb7db9599a48f79a60979b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08283b612361bbfc7022641e03953c37

SHA1
0b4dea20483cb9143abd135c002d13928ba196b9

SHA256
fbfd43433a1b6d63604d859a9f4d814cbcab9dadb7de9af099e9c58ff01d233b

SHA512
124d6e26d132590714ee0e5a460214124298d50d6d5fce96b488d5aa335091265164284152a5d66082e7572289e5f616c5d68cd5dcdd3762fa804a5037214bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f74cd551f0f4fa1139f3e87bfbc3bb31

SHA1
4b4c2578b83b168a63c92f29ca96ba1efdd195c1

SHA256
7457ca5cc8398cf3b40c81e9ad6e1396f0813976e91295a32b1e206ea43d2a18

SHA512
a353de2233f662af9cd79c6216ab260acf82ab0d52147ab63c1338e2e49075cb5234ae53fa79bd98e0f9416f75dd9c7e4136ac93b97e73efb214978f255efbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfbed5a43dc586c0f6094fbf03f524ed

SHA1
73f33a8c49796d96b10c8d6b9823d15926326e48

SHA256
15167b36caee209db171d5e9b2a6682f68c6876695d984ad7a88a45fe9492900

SHA512
c274f1344ef92fade90108660fd0cc7f1c3c8fad53a221d2fe98622828402ce0898d86fa66443b360895f5f9464401f19567625346b875fecd8bc708f6af5e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60a2fbad5fddf09fdbb87cf16bd5a89d

SHA1
3d99f76746462c133f42c4a6ab969c07d7a5fc7a

SHA256
a116fee55642858e144c1dce0da541b6d6b24a95aa1cd7264b448ab4732f1d29

SHA512
c0584f90bff71cac8ead88187689fa98144ff2ee5256df154741f6d396321029e42b5c770aee8737dd9c14aaf3b55f781892be91bbae926cfddc13b1b3ea6e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02443ca27dd316ef7ae9c1386ebbd44

SHA1
cc5b7c8939ed03ccb097b06f18a209216890725b

SHA256
62c0a1523e0d168ef1a0199b3c67994f43f690a83b9b93cf69fd0cd1df57ed3d

SHA512
bcda88dc7d8e066945418ae51be4c1e312f07a647000545aef4bb4116bc3a9051c7e455bcd353d3e4bf9f48ede1d880adfe2f4ff83623040c44aa5ca0bacb5af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bf62c720f316038ed26a9f8371f2e4e7

SHA1
06f6f8352700fb4ebe3633ca5b1537d281bed3c8

SHA256
05d9e8bb71c87dbe9c3672ad8909c6f26881da5b155a9168eb796843baac9e42

SHA512
a740194d1ef242fa6607072598c93b3985ac4b86f8572566fc7e3d75ef0a0eb8dc0bda4a57c12bb709dff3a980e941b1bc0a8dac7b51c2d45c2a51d0d83a652f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1507.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1644.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit