33c68bf58842e48158722bc2c286f4acff05f546a8b4f98976758398a286abf8

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aade14fc555eccf50fd864c9c606df4_JaffaCakes118.html
Size

460KB
MD5

8aade14fc555eccf50fd864c9c606df4
SHA1

2ab260830cc410efa033509cd0283edc9c9055ac
SHA256

33c68bf58842e48158722bc2c286f4acff05f546a8b4f98976758398a286abf8
SHA512

823ba24a244ea24a815b8e2c8a2fd1a105ba440ba0ecd78646e831797270703d1aede82d26b85a2463a091dc8df490f82fe3ef972ec1f32823ec0d07a7decce5
SSDEEP

6144:SVsMYod+X3oI+YhsMYod+X3oI+YwsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3r5d+X3Q5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000365895346888c540b3fb1f489f95ed8c00000000020000000000106600000001000020000000a95812f57448f3fe5bd47ab36a28f344908aa74b52f29c1e1abf96befa89de27000000000e80000000020000200000008d880f7d1d5c2f1a5dc730aad82e73bc403837ce99bb266869cf341486e30b9920000000706608270e742f2028e71c65e105422bae94d7a3eb3b70cc17785d80f253cca24000000055fddb37484298790a14db5eed2f717f2bf4c811bf902d3b26740e6ea949fd0dc9742c5e4a4fa39b1f40640e423ad577c61ca68a38def89e52c8f43ef73789c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000365895346888c540b3fb1f489f95ed8c000000000200000000001066000000010000200000008aa4dabcb758bdd0f089c60d1a8fde3f066b659ee0881f1449b674fe3b9f9f15000000000e8000000002000020000000089c715a9695fcb3b9345bb06b0cb580f401838c4b4c57b6542473000de75f0d90000000d21ad2afae114f45bb27899bd4ff5d3ed9c8d1de22258199e840afcd2d4e4199cd44a0fed8688656598af20a3dfc50396118fc4763aa3efb635a218255e72fd5ef4f64bb54e5967b232e86f7570142256bd8acd3dd79dac56dc3a2c9905f23cf12f10ed629a26c01283620b7fe90b5faa97225ca4da3b17fc3fd993dbe4969ef0c1e9c412ff9a7af67d88dcd62713a08400000007e1f35dfb7efaff2636f7000ad574a05f561217bf06fdcbcb9cd668245edae1a739e6e1a17eb092c0bafd207d44bb2a36168e4b70ceb2bf8e1023f53d4f0759e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ca8edb2cb4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423412600"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02FD26D1-2020-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28
PID 2924 wrote to memory of 2112	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8aade14fc555eccf50fd864c9c606df4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
284774e42fafe9c52a5a797d91ad6e1e

SHA1
b5ff40cb4d957526de683e381b9a2ea344c7e1b5

SHA256
8688d44a0dcc79522d66baeab2bc3631eb62f8f56c9683bccd813dba702364dd

SHA512
6bc3872d0a2bad22002c6e8e65f3381202ebdc005fb0b78f2ab6c930d3505f12b56e5122a0a5ff0a9b81a1fac456b2f8f51c0c36cb3dd11bcaeda5aa8bd05684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0158d3e78c10260be81ed293e6bdd1c

SHA1
1564e2601c31f9f4ebb3e46c15a4dcd318b6144f

SHA256
b2a808686182d4e0634182322116539423c98cc69b7dd47ab5f52dbf94863cc8

SHA512
580b733afea543f4f2ff44694165a50489b2f167d57961a2e19cac5e6db96219ee2ceebcb6916f3ffe9e0a833373d1d0f19bfda0ed5d67c7a9c6013d0557730d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3390c8b6daac65db3fdc467fd5c22b80

SHA1
b32af451cf9a96d5a56b43fa33adc9ef70f9086c

SHA256
eaca8aeacf20a2d0632a1741aac35ea8c27d5dca361837f15370a7d7fcc0a726

SHA512
a4a1cb7c91923a091abcd836feb984900fd7c42ca47a90967a184346f9cdbd4d8b9396bfed3e19cbad40bf196c3c778ac8212899a8ec7c36df5e83e68f84fc04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd003b94a5a489ae6e092d11261fbe7f

SHA1
480a660db5c6d77a25cbf5f1351998eee641e384

SHA256
73697ca65afaef602d94b240809cc1beb6463acc161a731381f6f6056fa6aa91

SHA512
6d994f5ed96b818426b11587689aa9b6aca618a0c187b33f4424fc7c0d1db6e930bd522ff1474ac4a63f20f3eb17fa9478a64ab5464c65ec7b5a622103e56fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b03c643d73209d4612b6ef5ce0ca9fe

SHA1
3dd7db20decfeeab2aabe81f367565788fa92a2b

SHA256
245c0c0e9360208a581ed5faa9050b919059d29ea196862e18c81e61b5448091

SHA512
49414f08e60865ddd239274de869e4ef4c57aa479d1f290e13da303e5b29ec452bfa6a4d96b998a7d759ac2017233532b627bb258906170d35be037a24e69f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2f1832b5a5159ff92cc1bbe6290f654

SHA1
7d8704d23302a931d78bc95106f4afe1dfabc2cd

SHA256
1f1ceaa8c20ca947eac26fc707f95ee179ad79ed8c9bbda2622f6637b2e4d98f

SHA512
ab2e94a6d566c4c092b5c28a720c61a014da704ef154fca3d2445145bc9c60d273a0d1d6ee91e5d073f29d78e28069d8c9478b4104c25ed40f8881649df57310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
632844bc68d6ea9df394cc0ccd422346

SHA1
db80aba05002f30085c2d18477248bddab8db0dc

SHA256
24e49fed9374683ccfcdf22668393a9e729a1cb90c55ef23a6d73882857b4c62

SHA512
f28c114ea1512083a765d71c27abc65f09f9ef51360d42ffce8b105fd7469d7edcec703348de2ab19616a63bb8f7ffbbe883724456c70c23e4562c3f2342d67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81ff31d61df175efd6962e2f3273bd8f

SHA1
8ca326b4fe6ab58228e8f553340782ef8a3cc6ea

SHA256
23ba62791289e61762c6837922027c603629e3a4ad361247d872b30ac569c365

SHA512
ba9d5abc16de6b41a94796e30282044fe54e7331aa8a83ba5caa6ee62b103fa85012eeccbd7f152dbed0f3f8865e3791ecd6d3d94bc0e9bea522201c60c032e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
805a9c8cb74e16a9f647059571cc8c96

SHA1
11682a3ec0a806e28172dee61249854d41f40284

SHA256
704007bfe6428969837cd4262d0c34c2586490db1467647add4951579f8214d0

SHA512
1484dea02dcae9cf16aa7f56ed35226059d99a350f7864f7b7a065127a85bfad7d5deca1570244ee0b17dc824b523093f7d33124ba9c3ab5d20c7e5a19e666bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
008d69e40a8ec4558ed343e537b8c6ad

SHA1
da4a1bb2aaf8443da436b366c7dd72520a7640a9

SHA256
e67f04800f2d61cf50032953ea4753f7bc97717e5cd825c665a9bd827ba2d4f9

SHA512
dd0180840fb1c814f42dd52c574b0372bdf3c96040c501a25039b3a561b501e4537e672cf81b086b3ad09c652c7611d9610eac21d842a3d21dfaf09cef0f00ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4888.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4988.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit