929314dd5cf4900675771ab41f84a76b85d3bd0d674d1cfbfddd82a17129abbe

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b5285ab79fef85cb535ea2c983acedc_JaffaCakes118.html
Size

971B
MD5

8b5285ab79fef85cb535ea2c983acedc
SHA1

e03bbb076318025d8f6b9097e7d9fb3f4068c356
SHA256

929314dd5cf4900675771ab41f84a76b85d3bd0d674d1cfbfddd82a17129abbe
SHA512

2e5ed79f38f2a5377fbb5a4190a2470ad881ca8ebe4d4c24b4904f36051cc995a4a891c8f0fdb0eb5ff916207de1bf33274db9a563f8b594179f1d52c04faa70

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1032151-2042-11EF-83FC-5267BFD3BAD1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423427469"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027a28a94bdfdfa40b1d813126823e1320000000002000000000010660000000100002000000065ba0c050d9142639e5273773e07bd250ae1b304308cdcdb072ed674e7b3d370000000000e8000000002000020000000bbe7df66a88f6733f2d2ddffd0674307dc2a52729756cede1ed6acc0231d473020000000c0264156e243692fef525772f7e91d731db804fa7bfbf8b5cadcbf9aa2febc7140000000e4219d573dc05cfdc409b22692f2d070040e4d9662049cca31bdff696e719e3b0e7eaabbbdcf6ca6f23e78fcd7ba5ad3a00066f4a1cae1c8930ffd0024c31818	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027a28a94bdfdfa40b1d813126823e13200000000020000000000106600000001000020000000c2dd3d2fce3b91c5ea81c141f9043c8ae5ae8fba90a4a47467231aad1e0fa028000000000e80000000020000200000008540a8768ff0104937567e87a5028254634d8b64f89a78966fff5e39b819fa3190000000ca0eda224058086a9bea281289539249a477c36533db9419c04cd6b48c1de38ace88869d12d5b473929b29cf4d46475e8034208b173eba01f23543cf28767cec4d65baa44fdf7e982c5bbf4f4bbea6d8db31542524b7b5c7c7b052138e28883514b9fa4ca4db9c71333fa7e9128a7daca37e6e1fe0a716ed3b152741e5c4f1dcab71a9afef6ef43baf8d41d7a60e57fd40000000af9f9ea53c59343751dbb8a47c67d2b3d7e2e6c8d1b26fc5221cbec511c9e4e8cf1642b3cd8bdd591e0479555e8f8d0916e17fc275b9a88529889533aada40be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05482644fb4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2592	2024	iexplore.exe	28
PID 2024 wrote to memory of 2592	2024	iexplore.exe	28
PID 2024 wrote to memory of 2592	2024	iexplore.exe	28
PID 2024 wrote to memory of 2592	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b5285ab79fef85cb535ea2c983acedc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3237a137dc0ef41b4057d6dbcbac0128

SHA1
b5fe0784a48260268fb69bacc0515e1292b6673b

SHA256
f57aa785cf520867160379758270c1ba9a80eecea89e752d870a82dd732476cf

SHA512
226e47130d0af07c9e264e8357037976805f06702001a0f6a2ffd506d870eb64d16303c54de51f0586fd9a3d00ffe9542ef97fd6e149fbf20880900e7de1d29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
123494a3bb5bba63b6acdb16acea2c52

SHA1
5b55484cb34297cee68c3f458580d8d96f015e14

SHA256
4e547a5e9540fe05eadd7f6226cce7f24347dec8a4e5dc3db6cc87cfffc67a04

SHA512
45e500d257ef7825537c4a4773be4a859c9586a0aa6960a9684774c1334c4f33d35bd41c5175ebed586d0fa80244816512d12e38503cf04d2f38766d07e49458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13dee4b4f48d200d77fecbf77af831ba

SHA1
5dce17218718613ac1b8598c2ea06b6e4a06adfc

SHA256
6c357c4bdd76ed6b5070c3c99c56d0a7f3eb211839d9552e6a323ac389edebe2

SHA512
c0e443a5394366f6c3b35bde4c8f04322369c381a101621df7381471a9c7a0259848e0d7188b1112c38cc21d11d08fe28ffd6fc28432bdd4f83794dfbd6cbd96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f466f208582d00b0c1db20c02d64c33

SHA1
4c3f0eed834bf37fc8e3ab6f2df9e24a0b06bb5e

SHA256
4722ee9e987a0ac1916246652820a9c7ebacbe2d4f753609c2e2b83cf81ae696

SHA512
ae0e58057054208836ce18cd9df17213db51adb10d71fd75680da5a84ae9dc64b3daeaf8902131ef559129cd19cc3e0fda5d16dab651edc3b96587033e580c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e56c8a6834d33a61273b57d47d6e961c

SHA1
75f2dabe8100d1708607de1de5e0be1adb30544f

SHA256
f21bebbd7d998921e1133bb77f7da855f356077542f50e93f5470c4d8c36dbc9

SHA512
ae3fe555d870f956ea50cc60737232d06ffb183be1cd6218cfdefe83883b2be671a4ec0097385bc3aa98a95e5ec3604268af715c35929ee8f88f90b38201ee24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e186a7c3ec1f0fb83a62d9524e7bc26

SHA1
8bff9693c4848729af6620bf622a558e2c0820e6

SHA256
012cde86a5d223dc2f013a5b383e6b5f017926194ac6f4e651b3cbda188d634a

SHA512
10be466c5ac592d665636ab9d28b0ee2f5150be8f2f0fdcd625b9d7f4a18a4ba577a36243a6e2fa91bbc40e636d10d8e4d0a7614e31ccb61545ac6d8e125849c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ad6058dd3002e0a3b3b0953eb0b78b8

SHA1
d08e49010566b3af568587403de2dff125e6b8e9

SHA256
626464f591ff681735c471c501390e7e5fa8e8c2c0fe856e0066ad1fd5d423e3

SHA512
4bf897eb7957948b709cfe1c3a0d0774a587b0bacd688f2d68f5cf30c3613b3689503d7289a0c72b151f416e536482656f09251b47645026fb6694824140a352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b9193ded9b45412ebcb737a6438757a

SHA1
273cef3d69ed6b17370bae6da1ceef3c74b59ac3

SHA256
87f23101cbb99b75c3e2902744dabdeeed04370e3a5d69f7c9b1360f18dd1f82

SHA512
4ee0731b894cb8bd44000a7983a302966789e081ae7a18cfe59884dcc724ffe5dcf3fccddb2851a73dcff51d167195ce7f06778307dd70e2ff3a3204b28a3ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a0b90611e675374607b6b9d04cb09a

SHA1
2caee486ddcb8416798a72a2cc99fdaa89a63686

SHA256
f97ce609f9f2c08d1b307c00400279a3d9aa90a56b2254f66f5882eccb8dedd7

SHA512
f365c391e86d7318bf57415f000b4a6faa2d549503c52f9388e2cf2f67f25280d034c19eaba849659e959c2b294768a935095c9e049f7399ccf9c4b9de456c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76ac4c60168e958dbd80c2cd107be688

SHA1
c683815da5356fcaff625ade20144be9694dc4b2

SHA256
0f5e3f81b64611d9c3060c02bb438c403b4f3f89cc2c56210a9ceccc286845a7

SHA512
89f484eaf1375ee5e52512dbc63b79f58104671dfec3b2fe9762f82d646cf12981b40d1b93b054cbf4558829af9eb482a802cda7f2faefa380b7949045d86000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b05ccbe99a029d63f0137426d481a5a4

SHA1
8e6c92a362e1e3e3035658163885c881110eb6aa

SHA256
31e2b4c45f312b789d6229b919b5ac9905f46ee67ec3df90f305944f1c349124

SHA512
20178e328c15a813a34303fd9c4dc0031dee714434c90976de43e98bdef77deadb630c52b3e5fc9694de5cef410293c054cdcea91380b1000427350d17778e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
410c05eb90bfb68e6adf4072af044625

SHA1
09f57d41095530c0227d943825853da409c284bc

SHA256
1b35a14e4b6ebd4bdbf63c6cdf96e9b00700d63357ef79c5ad593e8fe8d59efe

SHA512
cc62336b06800ae11ccbfc432ac43eeeea8829e73f050d2448fb394e4aac654fb694bf65b58291fea38939c01886775be0e49b0c8337d238d32ce85c92f9a4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef4bd731862964257ccfe359e7a47278

SHA1
f84edf1789c9da8faa7dca137a543e7232f4083c

SHA256
ddb1bc923882b272be94e08eb07e69f41692f0b7f0d5b29b1b44be8c87fdbb60

SHA512
2a87b3e12ddd9dbec326818629e2494df34e5db18a488dbca4e5ac6da9d260eebcba47248a249b5d3f638da71af079a40be5df41b77fc8d0ad54b5dbf2f1589d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43e9613035da28605e2dc33dd7dea581

SHA1
445df14d5704dcd6f0fbda9df11726c209dc82d0

SHA256
2fb2747d676a2feafbbb87e887672b6a06ea9dbcadaf88ce692acc3148db8c7d

SHA512
202bd57edfd0cd338d19d5b57b78edda0a229ccc6d1c3cd07aa066639ba8765f3286c1a96e166aee84a4785c09f8641701596f4d235ce8ec703dd6ff5eb16ea2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5475140f4e4aa6511f820f81d6af2fd

SHA1
3dd30b83608c5e9f76eff83b06d993f235f04f9f

SHA256
1d9b4f16705af877535124a408bc1b2a9c12281e0c618402ec95cbe9d3849d85

SHA512
aa64f2eb6b8a8cb25b3ff67c33e1490080a7fc0f1ce772a4ae5d2ad863bf0e028d510c7b2315a8a77d20bad0f3640cade91463b43d1e005b57a7d41cb169d8dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EFE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar303E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit