1954efa0f4116ce16eeeacc129eb44ed775aa118e808c7f7502c939ba1d2c0e0

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a0894fee5e316917946da94cb206c15_JaffaCakes118.html
Size

58KB
MD5

8a0894fee5e316917946da94cb206c15
SHA1

6123efb1fc3e275990f3b940f0bf6df4ee60d8d8
SHA256

1954efa0f4116ce16eeeacc129eb44ed775aa118e808c7f7502c939ba1d2c0e0
SHA512

4f4df3f78a4683e6f048e0c51548bc058fdff635c40b25f113f705fd1451acc692bb8bcfedb608f2568d5fa4984d0c1c5b6eed467afca04f1d0906beca3945ae
SSDEEP

1536:UelY8E1NfXbMCFT9e669/Ucavk//bwgvoiPSk6qD6d9rQuVFz7pAhDMoSbBY9srJ:vlY8+NfXB69/UcaEwgv/Kk6q7uVFnpaI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ab71b605b4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006f76b0adafc381b23660c1de0c6c22ef1d8fc236bfcf8578a5b3b7986990cf13000000000e800000000200002000000087ee407fbb5c706d16441f78d7773839708e4d15572f4d36d04f57438a99310d200000001e6e2c7fff5d512c94f09b75cc5d4d9e8ef9853c5d73fbb559f4888ff866ac814000000018e6760237881a24ec3056c490c2d3af7f7caeef44cb4e3c3ba48cbfec094d422c4befc56fbd6ff771b04450e50fe8051a15cb1b0a5eca405095c718d8da5c02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423395794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1DB4991-1FF8-11EF-9BF3-52E878ACFAD8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d4a08990e0d94606ac6482b5230819f7aaf36d0ab523120d4b0089e3a81876d9000000000e8000000002000020000000d656102f20fd6128807bb65d12d418a751c80a891203952ea8b95de2bb5ed49a9000000038c1dea23756c4376a50568c9a509cb44594b037c9d4ae06769c746c3ae244e70141a371a11dd2c78f27b4b97eff85f56c730caea891af57cef01374a32b35d1da7f03f4e39b51f3752292ad025ad3faf1d2ba34c1de6c1e9d2e3574a6c30db3745128b09d776b621934052b4e107d9b3db34f1f0e20a7ed1597227fafc0d8111100d1298d8f7242986247843bdad8bd40000000d7f5630fbec0885ef3f181149629119861d2ede23fe57bb6c8563ae4957b55c7e0147bf6f72ab3ea596bbdab026ee6ded0ee2a62bc5e03986fdaa45c062719d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2296	2220	iexplore.exe	28
PID 2220 wrote to memory of 2296	2220	iexplore.exe	28
PID 2220 wrote to memory of 2296	2220	iexplore.exe	28
PID 2220 wrote to memory of 2296	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a0894fee5e316917946da94cb206c15_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07c52ef3f14801e4a12d2c2fa99dcaa9

SHA1
cde9141b93cd7b965c865eec11c962f5f097edde

SHA256
f085f0bce1a81ab26a354184bc0e8a08277a9ffa06207f4f72cd736804cf965b

SHA512
5161e54e00953276c202c4f8b62534a479a6805cd1d348919d7279a97703078ffb66012f399ebf47e620dd6e3675484bae3709bb784324ad033463e186cbc341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4b5b69489843c622e7324bb20f19dd

SHA1
d1a8490e0aaf03f9b077e92894d2ac4b5a2a66cb

SHA256
9a0e88cf902482ba24b510898e161304d167255c6d2b08efd30fa457a35c146d

SHA512
52496d651722768c8d8e9a7e26e1e8b341f773e5f102dce69708ceb1dbc9635d2d044fdf70b0941a15a84896d8d5e5d0ec2aa4f8332d27dbe9cfa792f4b824cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db40fd6dcae331070f845bd1c4bd97a1

SHA1
604a66cd9429bec54861542f33173a4a5b66ebbc

SHA256
1c47a84e1291ba92246bab810483b9156f4c294f8a7dbd06f5982ad37ded3186

SHA512
3b15c2c84f9f279abc95c9ede34ec7aa1bc6478b4523f76b40d564c7984195d88c761c79ade7a5640dc03cde12122302d04c5f259c4d0d2cce33e1ab7cd4684e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e493bb4f6992969a1d730a177c360566

SHA1
5e1370d24745ddf38d3ec5d0bd0077cfb060bfdf

SHA256
840e381d368c00b635f958d283a1b6342707506c57ab92229dafdd3f4efc7baf

SHA512
f96491a085b2937bc68327dd4fb8dc0083fae870824e2002c96ea5deb9c22d94fa9adef17ecaa3a882342f40bd42746e32afaf54ee2471248e771147bf7da2b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06088651f1357ec8fc121bcceda4f815

SHA1
bb8b26782046eff6bae632e7b251b5c63e4c604b

SHA256
b37d02291519bd80b227ce0b7b51ca2f8ddeef1a747354c1174311abae9f2945

SHA512
b5627f01dfdd5f5a2945efc39f12a7fd485d2d879c99e19c69cc9112c98c7fac374fd25aa1f0634250a9ca625271914a84a7200527a6eb78878cce1ff846bbe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90951eb6ac8c69773aa98c6df079fc4e

SHA1
5865c60f6985dca90f2fe30bfe4c32a59c291a8c

SHA256
e75c0e8082ca830e52c57b8cffbe072f3e49e2d914da371b6986803ae6e44c5a

SHA512
529e59eb36e0a60346aef54077fb9b039c701970d72875bf55d6b9c57cc2cab0d82f082b479c1212b18ae94029f31bcfd6cc2d5fb6f2dbab9a642995e34f9ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
429cc8216be54c6be3884f1418082195

SHA1
49097a32b623f10c5e530bf6978d95a8943871c6

SHA256
576ac8d1b9d85e86e1adaac30a67a7e2e1dc2bbe2099a3c4446eb4829ab01076

SHA512
b7565c0fe41318898e7d51cd9b3f7cc80de356ef7a3c418daa45ea0c4a29142afc96658ec9f095fb786bbd2febd16468af9e8ebc0af19a45fcf068dfb5dd938b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aad1a9c9eaa7445f0a102c6e71eec07f

SHA1
de471bcfac98ddb42aa246677415a789d58d004e

SHA256
070ae3318dbdcb5b3b0ce524bde4767ee42bf16bcaa2abc368d6083e866c9787

SHA512
4e52cb36fbed81563d6f377a4f0d4a46874fae272057b6f02cfcb5f7031a9e60ee5ccbe2a439e244553c063abeea002ebcdf209fef4aaa461581cd419dd0fcce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c820cc0025887dca0dd7f5c9a10685a7

SHA1
3d251eced840d619ef9502a7e33b178f3595be8f

SHA256
2f5654a5ef04c7f1ecdbd132716c74eef7c17c8d2e024d11d7fe4fc821f14ebc

SHA512
75290ffe0eb9d7b1af642a6191dc9b882723b7dffaea3d8f84f330b6d069e072a6ae38a2ab0c5335d2ac52bb4ace8965068b008729909afd8d2ff96f8a321611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6898ab9c39a7c35ef7aadd90fafc392a

SHA1
03b2f18f55a97488db5a0dfc947ea25e7459ce09

SHA256
85683c889e927d83c0820478feb30d93922311df59192adab573676cef41ccbe

SHA512
079ddb30db4691ef60624ad77c78061bd32013bda4ccd6c12632916098313ffd3f4a160e9986cd84af38436881e75871595f0f14e951c16520a96edbf81308e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9bffe1fc8f4d3fe10ce0f8ca238c198

SHA1
8b73ce433fa8bcaa9a989758ec7e4fcb997b0eaf

SHA256
4ade924fc3b9d43135d675cd79096dca5433b5a3be7296b258b31d35713cef62

SHA512
f7937312ad70ded66f0bbe1e9ad220b94c7fd5ab923f114d7e4e505dd4a4f882fca801cab05025892d77db0d6b5cad08f7ecf76c3fec5533a027b9a1639e7e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0970e187026acca6ead2944e4f9585

SHA1
732f2c93bf1054355bc082a98665eeb9da6e43da

SHA256
096ff27ad4fecd2269f0754d1b60b95df4fd0f87a743cff3ab3278ac2263284b

SHA512
8637c40b21c5f6107257519680115b59312a3439e10ea62272a95e2a5d13f316a11b171773e6012f49fe6600101fbb1cfce554c3d90ff43ac9a8b570e7fc1652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0367243b6b2663c8e3f372a56fddb7c5

SHA1
6b5c5bc5c55745cb6c327b83e61c7c37129d456a

SHA256
0503bd8e20cbab25d9484c0f8939fa3b90fe2c7a0faa9cfee68cdc7dfe57495a

SHA512
c64fc08127e487acff4ba040eefe257d1d9319066facc69ee4a691f2bba261270bf81eb3df71b7bd86c500acd4736321a710b4659584d77636d9e3eead037371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3171f7d0232d60f043c7b071a8dddbaf

SHA1
1d513ec73192800a8504f41349c5aa12219f0907

SHA256
3a4eb25b9a3a7ae833ce2d3244e674c93b08e56b046999381e17b8a7b72f2d9a

SHA512
9af097872b3f3c3d9354b8d7042603addf920a41b5d53874198bba352a90c854191891b965eccd41b96d72cb4a63380e76b4deeecb02e1e9f11ca1530c4617c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f164c37a0bfa017605d5510a09109f4

SHA1
0817854ea392cf906738d2b1eef2e6a18e72bfbd

SHA256
03d9f14242c58095cff60ca693ac1e344d73838baea1ff4105d3a809f9d14e59

SHA512
d995e6d2a2092017145f7b31f9ae146caae4e4806c9b114ec618bb3392b6e2edf401018585a3c115e4c66a96134de23499ba869bab41b18becf2b70999e6f776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fb3f174b64ef13136bb0ef062b9c6b1

SHA1
11b9bdfc3a87d2b01314a167ff61958c17e689b8

SHA256
61dfc417cbd2e8e0f0c708325518dad18564501f938d837c3c823d5988b42eb5

SHA512
3a6931ae0021fc3235300f06bca0510cbb1a5591eb0211094ba3a19cebc71e711964a8b7f7404285041657a71539c2235b5401025c8229970c3e8633370edb0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C79.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CFD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit