1deda917e8f9c7301be0297a5837f4d6e8c190581cd308ab1c5c8a5b589f7221

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bab770dc254b2d4a27b49ea479f0157_JaffaCakes118.html
Size

460KB
MD5

8bab770dc254b2d4a27b49ea479f0157
SHA1

998d1d2425c943cfb120bfe0350433a762d5cac0
SHA256

1deda917e8f9c7301be0297a5837f4d6e8c190581cd308ab1c5c8a5b589f7221
SHA512

856d66d31521e5ef9a45994026c9ddacc8b91d0d22e42c909dad4a6abce1389ed5278fe6fe502861ded1eaa142222365581a25c9a9f0e1c6cd6351654be83419
SSDEEP

6144:SxsMYod+X3oI+Y0sMYod+X3oI+Y7sMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3U5d+X3l5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f9fb3e26c7fdd4fb94d9271449cf7e30000000002000000000010660000000100002000000011fe8582f69b2e65d13eb5946a158a78c08d1c110e6df2009886b082fd000f70000000000e8000000002000020000000923a6b57d2cba150da1319500e5aeb873254706f9111bd734c41121ef057b44e2000000084c56892837bee5900de44fc693a86bf01782412e3f2bc84ef89582f2ef9574d40000000559cc74728109465bcffb557808efe4dd3ef2805a6874337bca23460dac6767effcf53222868cd65f361819f88ce80880a572385d8a73ab37667751ef0968c9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000f9fb3e26c7fdd4fb94d9271449cf7e30000000002000000000010660000000100002000000036fd1ee328b6564192b57f0ac71c2d828ae75d32f493eb2b961fafd5ddf512f8000000000e8000000002000020000000c0abf5ac5546b3f6439682c020703be80b6a23b632150c9982ff8d9f873926d99000000097ce33fd55fe2a9b8ec882f3aee86add41f7811026e0ef321dcd374b6594623f6ad59fd89660d09701a491efafa3d28ddb78f6b547f834caef4d929028d67450a985ecff83f07de055b76b8d6b5436de663dc29a62c6e0fd88d3d75e15c866dd30b494b2bc0336a37a1254c3823af22de77be664da65a902b8d0ad7922338e84c2f3c0aebb29771f523780e5fa6f4ac840000000d9f7ef8a64dc791c6c6ec94bb53a873d5e02272f8a463a45ba5bc92b9336a97450cf8e8dbb6375c74bca5099ec03e3175b44ca3c261dc1c29ae613f7c0f88064	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D739E4E1-2054-11EF-A336-7EEA931DE775} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cb1bb061b4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423435292"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2052	2256	iexplore.exe	28
PID 2256 wrote to memory of 2052	2256	iexplore.exe	28
PID 2256 wrote to memory of 2052	2256	iexplore.exe	28
PID 2256 wrote to memory of 2052	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bab770dc254b2d4a27b49ea479f0157_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
902db8db41db4c6c5acadff021b1c7f4

SHA1
2b6ef10b328beae31ce79bb4402d0aa1102c546e

SHA256
9b8a1c560b1a4bad5b1f89ad07797180aa9955348880f6ef94e34d9514f329d5

SHA512
e452eb14baf534320d568dfc41332fb9dfbd5ee3efbff5d182301a9c5694b20cc0eb032f61f6835b84a66ead4f9e444119df1854742936af027cfbb1d90442ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ad647ff48ce20e050fb773b9d0d7763

SHA1
b15efd49573d1e4e4e6e87c994f048b48f92a5f3

SHA256
5a88a8538fe156498582d814f70416e294dc8611874ae4d852bb38d19374fda6

SHA512
a4cf77a8b52fbc58446c53c8ad18b209ba055b43a6694d943c7f47bc594eaf98b9f2415679d05fc72f61817c3edbfc0e60d52d0a207dfb7a577e409a36e7a476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ffb4cba24d806de5b94a542bb4f21b3

SHA1
4f03415010d2231fc74ae5fd38fe4a4fd8706684

SHA256
8ead0fe78e508687839d9f7173345f2dabc887657fd16710c3d215a6d35c012a

SHA512
5ecf6a9b4a2c3a1e818999c87aaf102fab77f749229b5a79b758330d493acfc6c0ae60b05bede22a396a03f92043b5a6d025ef86b47260f3014a137399e216f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf915691a02437019daac43cea3c283

SHA1
d60dc0867bf28cd771f42711eda210d051b51315

SHA256
ff3ff72ab8ff2cc7e56918579347e565f0bbf2d6cdc4c47ae31ec17c57e37feb

SHA512
8f5d790dacf3c111ccf1a92e338d1194793a109854ee535d2b83c8126a9bb59fe12241676ccd9ef5b589849ef2d4228090af30c561e4e21efb3598b8f6c46ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf6e18885149402df3a81b8c446ff651

SHA1
061d79544af89022c6a90b321a78ee66443bb984

SHA256
cf4cd4460fb9db4464a4e50161f8ce2ddee4b2d29b1a70078ba77ee7275ba06b

SHA512
c879793909affe3e7e76c6612fccc56a3eb6805567d3b7727490c82fb0fd98f7d9b11bda181b8be088a40e998dca92c7c71db2fe4224288cab7d4296e9bab311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1af7425013f81e0f1744a1fb45724185

SHA1
638c4bbdfdda59ab4e6e1c2af4241e4b84f901b6

SHA256
d9e0758d5ebfa97574108a3bf841cc612bc49a7031bcfd43947dddebb75b6735

SHA512
db0145c3fb6b7c1cfbdb9d7e4511d1158e2eb4ff7296579bee79d3af64383863310c274ea650c855983091534b17ddad63c562b8a656cd330be8584ac346b29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4560ec5650e70b254f9f273e905b16c

SHA1
9376a5b36db74e0ae3943f36427b96732d45d7ea

SHA256
3991c1ed4388136de976a03ec3436f2a9ba2b3f1b188521ea127d6e9478603c6

SHA512
5a7cef69f912d8209eff4110c434d2cdacf7932f9715943bde816de540ffd31785383b4814e88222b4d5b442ec5e5493c218aa367957faa423b4eaecd0e02994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f8c8c347b716bf6e474d2f321ddb817

SHA1
bcb9e4ebd01340416b4334cefc8ace6b5f1b5c01

SHA256
198a847fea1fca1e475f8b56139029cb0d5bd44ddca40c483b233a30ed02d976

SHA512
eafb94f8d9dac18b3f1a545671a7bfe83259715df1522a08dfb66b0391e4b7b651f0afa6e9428f04892ab6d73a917b738dfa4561e54a5d7603ea1a2451285ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b290f63c0ff2bd708a6328f8e6ad415a

SHA1
69af746bde3eba344340e79d39d735384906ed77

SHA256
3a515c82bc7b3879943472c609f8cf738c137c1c136cfccca84abd948b87f352

SHA512
3f4171179f908a4794c34b9dfb35018b751efa34c06417104f31d9ac93d963929ebb800e8b8beada062ade480c12f90f4d330c42ce036ce0bfc3b24480404d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b691880ce951414ab1bdcf3792c3937

SHA1
f93799091b68a6d3f10003e4533b2d127e6fb4a4

SHA256
7d40c25cb2db097e971f007700609ce0946f3fabc04953dfbe8c75d472cc3a0b

SHA512
2420807fdc04b65f5da8bc306d72263ea6d56c6a55ed40b1db746f8b474b21669927c70e1ee1f038324f10bb5f515c0f90a1dfc414f8c3a155fd20629007f445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3829d496c69ee8f4843a130a08bf455

SHA1
7736bdfb49bb2dc5c9ea5a02a055be287027fa12

SHA256
c8c6b47bff1d901331eb995e28fb0baff6bacb9f0156f9c7a7c7363f9cc2a069

SHA512
1eb18ef8f79d6104de60bcf6ae56d80e4dcdf56db3bb57a83fc1bf031012f4266b218c708616d0b64176c9f70d92c04fc380c34f207757f5fe567fc7c297e131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb0c8bf193fe76af78b026011b752197

SHA1
4caabb6f527fe95ee3cc4a169b08ed5785a2686e

SHA256
0a5812aa0f1c741c4bfa05c08b033f164516283665c7efda2a9e6079f1682a64

SHA512
bb68e8b510508817fd1a631da1819daedec5db32c00065309ed1ab5d9468bf0eee99f9ca560e18b0185e53c9afcaf3e9ec5cd2ea5345a915619672e6fdd2e1aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB001.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF71.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit