9fab5b19ba581af33849ba3bf4bc7eeadcfe12955bee4b5f3b5bd9eb01992d2b

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a9fc781071010f706baa69017819d6d_JaffaCakes118.html
Size

460KB
MD5

8a9fc781071010f706baa69017819d6d
SHA1

3cc69d95adf849d690b231abf700544f2015b283
SHA256

9fab5b19ba581af33849ba3bf4bc7eeadcfe12955bee4b5f3b5bd9eb01992d2b
SHA512

d10192226f53bf706302a142c8dc6aee5599606c5fb30cda2200d3c69d5064adbab914cffd689310d415fc7737a38ea15162727c53a619b489e13f4ccb819ae3
SSDEEP

6144:S/sMYod+X3oI+YinsMYod+X3oI+Y7sMYod+X3oI+YLsMYod+X3oI+YQ:K5d+X3S5d+X3R5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0377ab729b4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000045e91e5ec8f7c538efc97b1e4e988948e773727d0ce8db8af5d02a50cb27ffcd000000000e80000000020000200000009038308dceb7e11592dc283674a170e55ea607e37ae47411be442957f5259bc69000000058bc2c8d43b78dfaca9fe94877b0ade3bfa8aa26c24e87d5e31dafee384b42425fc9ffd44c6356fcb8305821160504155b99ffc884499a1a9626feadf487124268a3e2a96854691d2570f10b4b4cfcf2fd0c983dc3548172ea8b97a61bd8d4be775926e637f5446c96b5e3daf68930fbf1e5082ac3f608b6a88f74daadc3698b89703c3c973f9769027e9445ae5b35634000000080952481829e2e57e0a49f0e09e62766aaab38dec66b78d36b21160c8c8aceb12728a5dc9ca75faf86fd3ed47a4160d55915233d5df8ee9221d251e1788a1e8d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DEFB3181-201C-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000070e5ab132728e10c02117f1b46a3f5a9e2e223f04d11c44d19a3f0bf61dd284c000000000e8000000002000020000000863696d307c1e49e2b81f39fd5bf4293deb3a118878f11907c6ff5c681fdf4aa20000000d88ebd106519edb15d8b026b19dd26c8a7f9e1b3434251518597694c682fddbe40000000461c826fd2f7801bcda955e84c097b9093b5eebef5c21b1b8599c03b7a67ad4a808693b0ebadb984755dab48bb3a556319338a9ccee4f308f2d317fb5e42f75e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423411252"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2200	1972	iexplore.exe	28
PID 1972 wrote to memory of 2200	1972	iexplore.exe	28
PID 1972 wrote to memory of 2200	1972	iexplore.exe	28
PID 1972 wrote to memory of 2200	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8a9fc781071010f706baa69017819d6d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5000c88c24ea2485df7285f7b5d57563

SHA1
957ef4f037f3fcf7a19de630541fbe6869bc78cb

SHA256
a31ab64d028b27108e7115ce46e1aa385b2403b3244be079cb78bd83cf4f7876

SHA512
329c147f067343175efeaf59ac85c2b9b0fdf1f432bbc3f3ff86dfd31f2714b92fe329d969efae9e4bf073ea5069d5b64d3b50aa55bdf8dce4a9e97c00265b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb84f4ad61c1fc2746846145c2bf3b9e

SHA1
071c21c6e53c0e84ae782d6756c13d00129b75fc

SHA256
9ec2804f61e804385f4f5dea94082f25443be9d8fe8c0f3b796082dfe195954b

SHA512
f8a92d37b32d672e98cd05a6d393dfedc480030b347504402fdd9e1476e4cd296e66f6c96ecb1656d548cf3757cf5b014a4042059d63450204bfe990f597fdf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7076d55717d5d8548cf562f8345a7850

SHA1
8551c2a305266ead3b079611a2ad01a5d5637767

SHA256
f29d172ef52593ff7e87b72e5191b4e6763632d4fd4d0ec7328001ac481d560a

SHA512
4fdf4108b1d05e3307596e8392d5b04473d41ce023fe2a8a76513762d0747176346365e8a0d1792e61cfb4dc3f79344c132d8e5bc71aee9d0fd9c6eb9cef2253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e02088b1db34b21bfeb71f8872b3edd

SHA1
cda8d3d4f59d6022fe559881fd5a3ff7d4f36130

SHA256
9b304a1fc47074d4befb2e42422a8ecdf8b6d6d10d19a40b7337451012420f80

SHA512
e8dd9bb5e161b6be99a5d8eb3d1b668a953afab58637a2000ad79d755938a58605b0a8fc76168eb27e1af75454124bd5e5eec1dea8775d721bc4ccf3e84c5b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aa8301848b74371644b660b742b5faf

SHA1
8a2dcfc1bcf6f5be5f933af5f9b07ef56cb8fd31

SHA256
e4efc4e76ba335bf2cc9ab1c1e0c3bf516490df4ae37485aba491053459571cb

SHA512
5a592a1c038dfa05c8ad61908e7426609fca44e7aea0684bbbc4100e0fe7591fd28d245ec6eb79271a4cfa45a79c71e8b2ce2783500bb1110e859409aa11f8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bda54e5b66bb08daa90cf4cb7fa268c9

SHA1
66eb7e60acda93b48530ead7ad56b909bf1549e0

SHA256
3e98cf54b0798de397a98dae3fb125e7647e7141a3bfa2aa380111dd2176b692

SHA512
f1e1ed46b22b31f58f1d118d0db81c3e7675d10f750144b2e18b512b928e803677fce1f89baa097698c5cd24ab5d1debde66c9f4d1dc3cdd5a30e5306850840e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e23c73885bc5b61b54258192889ce02

SHA1
7cb331f757f2cff8a685ab180331b0ac99e93284

SHA256
937a2cbd9bed1c7bab24d295a51257def90847847826ec1be7279239be358718

SHA512
45348a596a8aa93c03af664daf67dad401adc85392ad856f3b2012dab07cbce4dae492d48a5e87bf438a04297f11313a67b3dabc975f37d3bc27918adecd45db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b9174cb7936e41ae7981659b94e2f0a

SHA1
43fd7830e9ddf86b1e6b6b4c0b0bc7db38c1a719

SHA256
3a9faecd2795c8981f0df8df08a084fdb65b9872e5b2605abaf48ad201653884

SHA512
d2b8f53c0723fc175c478c338ace4a9150fa51eac9d0f794f1910b0334b39888ccdf77673a00e3621abb4c6e1e644f580d04a728a93cbf1f714fa138f305f6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aec41b2fa05f4f421ba9a78dc09c1d8

SHA1
2138f3a66b71fa2106d082536657013d2d2a5d07

SHA256
196fdc129b3d886019512a453013966059ebe18d731160d50a59b05ff5f05a1c

SHA512
1e2ba06ee88b9214ec25c2e530adf494c55863856a28dc90e625418e6a78afaa66a9d75920368bc0d847983a889195e8d3bd602cc378719bef628bae1870855a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a73a5b07ea485bb12c3df3c693f7bf0d

SHA1
47cd3af0f9c1f0bca3114a4297245efb123a76dc

SHA256
39547bb2640591f3f0202f9acadc3c78b078d14603599d580f3aa480c3421ac9

SHA512
1c08117464c6b483a8b5800da5dd3fc1a59ef68f38f556efa61787191f793f3d3c8c9a72a55b6a89100eaa743d94fe2f84a455b91d91745f0db585d61ae19b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f47dbc546ad8b75ba1d0ae19f4dd80f8

SHA1
cc07efd26b7f4abdda68e8f1684ad1d071cb80ad

SHA256
6308e115a50478072e08c785b4f31352052106a57a9652cd9c409ab321c2a31a

SHA512
1f7abee074de43a580ab26224cf8de38f7ba4d77bf2ef561f41d95b3e397489fb0823e7542dbdf38bdded22a0485a3deb807d08f985e30a6511182db6e885ffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3522b6c487848a11c4f62db0d2f8e990

SHA1
2ce43dae9379911a25d0612caa16fa1412baf46b

SHA256
27f8a76880a2a44107df4783dabaab04a44d1922c46891c56f9306be35f4ebf8

SHA512
99f821818b72994ce1876faf34f23ee08c5d07e4199c914ae7902c5447232cbfc5e5d56d87750ab06fd84fb70e0a1d691001f379c68b719c6b903d5eb9106b33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b6cc388b152445a76d793284427cd00

SHA1
4ab7613553a8fdea2281000db1edaa076378c1dc

SHA256
c4b9da2628e8d405fa59ea82ebff1a4d15d566f0e715c1f06be4ab9d10e12279

SHA512
1727a6fc56d5b6e1221507f7f2f909efec783b3592b6c5cd544f0cf77f847420a8e41ddb7b8afe7d8132bbd9f64703759b76b36da4a19db2616e7ab846d3d1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61bea2c4a4e6126be737ca3c91472a39

SHA1
433d983e153c5147052a9479be71f6cf79337ec5

SHA256
bf7d942c60569fe5c98640db4863cc9b61a1ea17f25881c5033f50106cb31902

SHA512
ca723279bc95725b9635ba67736942eaa29a6fdedb1f0c90e71363ba2c061cd5749f893982cd192ed6bb12d477ae82b3ba5368c6e85e2a4496ba3296d584c2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d5c6102daf2cac27717442ec3da1c31

SHA1
0c68283e03f43590152c1d2a9879a28b97547625

SHA256
87f38f82cfca1cb4ac0325919cd58b669e23bef7db0e4a81b061304b8fd9cb6b

SHA512
824691df1001cd7f0f474e21b449323d2bc4e12dc193d789ada983daec7cc3d900121588b1995e81d5d8ae5ec689c3fe879432500c07c063d00bd294dd40d227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc24703bef27e8c12586ea7622452667

SHA1
b46688be4f49d6db81222668ae3a8c4cec742087

SHA256
ce7d240b9dfb04ca51e9f608f9e66a8d286d03be7105ab9dea764d679087be07

SHA512
2d5e42869eed4435ec2a3a0de89c727c770d8d68cfb8fc0fb6aa50c346d1a591c0347da31bdf4900c28d00337ffaf7f810eca443c461195caa8b77e9a3463390

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab53FC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab547B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5490.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit