2f93351ab13b5eb07d3a3cc0b88658d5fc851b5552ce7db57031e1afd1403819

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b94fa78a232926e77ce402283ccdcdb_JaffaCakes118.html
Size

460KB
MD5

8b94fa78a232926e77ce402283ccdcdb
SHA1

805b87be3802f5bf451b6b7ed7d9d4be97647414
SHA256

2f93351ab13b5eb07d3a3cc0b88658d5fc851b5552ce7db57031e1afd1403819
SHA512

2610e774c6970c862de4265809893875121fb8b4908d2ed7125e16ae8d1cab141c81b4bffe0f8ac01a19448e74a4d082058acd46e26cfb68ba5728bd1fd113e1
SSDEEP

6144:SMsMYod+X3oI+YX6YQEsMYod+X3oI+YpsMYod+X3oI+YLsMYod+X3oI+YQ:F5d+X3n5d+X3L5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423433483"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30363b7a5db4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000044b5c4a5665b7c439413510ecf6767f100000000020000000000106600000001000020000000d0d5e89f01c1a7dffe15e28fac8f0906b61bf5c7a1b289b0a34699bc037b602f000000000e80000000020000200000008752eb1fbcb2acf8aaf9b33e46a5b7e7797b8c1e087e94923ec032fb80c3ff7590000000711e8dd3faad3fdb93a2c347bee3a9bfabec5c397bc2d5b956ffb696452fe37dcd1dd5b7a6f500b905f83944869f720080b447399ebd1951177122c39b7a7a6d102cf56efdce7997fb2465fa05d4b14c98736f6507c071557c6b79935ca529c97da5523c7b48edbc86173ddb35f6e7c822a687e5b166a0a24d0fc933e313d911e3b2418657f9ef975f6c35654c8ceb2f400000007eb178db6767d5af6e45f20f5165c78c6fbc6d8232777ce6fa0d3ba49ce4c96e5f4ad152238cded09056d2568f59e05f3c44d2185c56f1201613e80096e57609	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000044b5c4a5665b7c439413510ecf6767f1000000000200000000001066000000010000200000003a11d8ef854d70f2f388973d7b4d1e1b6b04d2a26635850594ff79a1977d823c000000000e80000000020000200000001164c2d247e9253e0c31b65707e98297c764db1d9fed56a5529f8bb98667dcdc200000008f1673e2cc77fd1c4a46ae19bcff07aeb35ff08e0f628802b160006c2fa868f64000000090575378a4b559ee4f75d748d81d11f72df0483b9731899b1bf0e8dcbb1faa5abb2ab9ae550640e4f3ea2dd3547d1f8256bb219c9b10494ea4c7df3152ea6945	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1B6E831-2050-11EF-A2CF-6EE901CCE9B5} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2692	2316	iexplore.exe	28
PID 2316 wrote to memory of 2692	2316	iexplore.exe	28
PID 2316 wrote to memory of 2692	2316	iexplore.exe	28
PID 2316 wrote to memory of 2692	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b94fa78a232926e77ce402283ccdcdb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b22f8d0e28b1165f6bf68742b09ac75

SHA1
9b51cabd3674da6b620af82b8afdf101be7670bd

SHA256
993bd70f03c53add9b6959cd0611bdb59a9e477131d059cfc2fb03d2cfcb17f8

SHA512
82f2c6341424d4008b9a25b788aa72356c25bbe141eb8ad5c75cbbcfea390c23c5e15ebd88c42286f5ea41219c0592db454c8b19ba16fc917a8a99b34224f66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9a508125d41e18b4c12fbdd3e80ae12

SHA1
3d376825a5876c8f639b484a4a44c8247ac7c1c3

SHA256
72c1f6de109dd06d21bb489b23bfffaaff1f425b2307c75c99ac5a09f13cce46

SHA512
b0b981506db8285285bd9faaf68bf64129ae68a377d9b822615834b03ea49bce72df18701501d71ed5016a6e4828779b16d1bb0366b27edb5ec093ef8dcb8ba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b0f3d0398d5e13edaa663a0c85a6fea

SHA1
1e34980462e08c2b1e15369c04e0b51645d36af3

SHA256
4a207067473744daa9c82d1b74e97918ce20a1d31ec1572b4c5b8df781f5d442

SHA512
55f182d13e914bfbc30a32de784486c824d49a0966fb761738818ed335511755375073de8df6603c94bb097175a37c09abaecb1bb80dfac4f96a5d5046d81638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3e0c183957ccd2dc4c92d0ba8bad2ae

SHA1
e248b0d507f0de7978c58ea1e90db87f6374d157

SHA256
2774a515fd85c5f157747a613dbe8c3b42773210f3267ba2d35ecbeb3604de2a

SHA512
8f9f4358e0c2c01ab3ca7f90aae8f6afa14fe25a69173fd04e5f3ea67cf54b6d06b827e798fb41fa67e13f140c9a2e89ea4cec13ee92e2a87a7e3818afcb2164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f4c4478b65f7da27a856e1f1a8e218b

SHA1
870e48ac456ec01ed705363a5a66fe8d36b1769c

SHA256
945ca3c392d486326456632267a6d986c20196907b8da0c36bce3c006cce4792

SHA512
929400d89e9f7104d361fee49d4407059ee6577e8396cc4c135671d45674bbdc6e95ba81de9ae4d3fea93b661619b7d3d92a45811aa5c51351cdf13c9d6d4eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b9b01b9e569a4a2690899268d0d41aa

SHA1
384f0b8c729e6b6cbeb7d04e65156a0a34ce6ae2

SHA256
22f58c2be7c89d5f6500e1131dc9994a01addaa28d3bb805d53379c7124938fa

SHA512
1b31ff302d800684f646e9ea281544549ab367949ed022a2ecdd2db133cd8df47b4bbed00bf820f113853ce246d2bc9a3f60050c0bacd3017f167b8fe752fd39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14884c318878c47f7410daa0b15d0723

SHA1
d754485fe445b496ebec87c7d1fc8e4b0dbc907e

SHA256
ef8ddd9414c74e21029d56c7c83861363937c66567d393c6c3f37a5728a7fc66

SHA512
cbada9bf4d499127ab9f494cb1d131eb6d1988da8ae9af95be82f6c59efd7bee6dd31b4426126d4e8010160894a1c72f8d29bcb49ff1ed6043c3bbe68c5d9649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae56cc3be4424405f1a4413ddc4409d0

SHA1
9b2c2a536d7ca78e9b346cfe44658bcdc8103207

SHA256
c1d160610e10a40b6bc458cd7116b4b9f8cab5d87347dc5b1e58552986e07e9d

SHA512
0949a725d3dd4efc81652f23df7cb67fcddcc22fb873c2ab1dc587b3c3fda2dc3010bed611285d3e251aab4cdf3d3d65966a0d9d5e7c82b88ce1cad417b217e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f726325448a88bc8ce6aa421e9a7bd9f

SHA1
58dbf78c9e4d2e42a5520e83fe08011a7b3ed4b8

SHA256
c15c58d3560dae0167a5c10fb8170d48b4abaa9336b10c4e72f404a1932ba658

SHA512
05a9384af3d8e8052ad6c60ec8c92b382afabb79f3f1879c63573874046e4e1473d487cd022e629ca574ff70ba6319e40bb9718d48f4b4523075a85e75013a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab80feeedac9c928cd03c3161bebbedf

SHA1
65c1cbc786e236e95c5f2eb0e2c9380b4a00d4d1

SHA256
522dbe230dfa2ca4714096ffe6547c75ff624cd5e2e774ec537e9ff02c48546e

SHA512
ccb60baedcaaf4e1381d5e27e09d7f8d6b799f201528cb54e3401c1a38c206d8d459c0f3ee69ea22fabfb87836c2434490eea10821b62473b5f7df2238edf64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6440a312df6af80253beb159f01da5fc

SHA1
d35da7c2b09c966cbcd2137636f9bbf77b603076

SHA256
f84839faa1e04f6e4111ca738452c1ebfb9751b5cf614ed3623abae152629186

SHA512
04f313410cff255a2a6129c70e9f2ecf88f90f8703e7f6eb98091ab7e894aa7e5bc9c48fa10c70cbe16e7a2f04b869bd706252a02b0f571eb7da116968e56743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
595269bdc7160e99387f65c3b438d78f

SHA1
b10856de405606b0c89353d8243d44ec2819e36f

SHA256
8e6c0b97c4104b4f45a92e1826780472519e29e3166f2019522f8f8d38843671

SHA512
3cd2d395caa2e9df70487a2388256707e4bf29b9764c002ae0f472a1c58fc116657a5025025d2ab4553a7367cf2fbd7bf87498c0ced2a02f0f0b2eb0530d14fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c6a0690a7ef758b111474ba61714e1

SHA1
5006e2a0bc1ca3cfd62de50c704f7271c0315e70

SHA256
eaa9e9669db87b5ac93aa5743b3aba4191a9ba03e92fe93dc546c7dcf258acc7

SHA512
e4ce209594c324695eb758af4015ce9428f315eadbee6eda09a97ac8232ab0425280e1cf7214e05c4de05102405edba39b388c2ddcf9c78433de6081e907a531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b8ce0221dc96bb12f2b748ae3abd3a

SHA1
370bc93892000eda50d5dbdb2726f28ebd25e71a

SHA256
fbdcea911a641e15a0b4e0b0e5ef8926d3416fe91acd47ba3c7f91589bc565b2

SHA512
c2926614b70701635f8e6ec330a3ac796bf3a6f9ef546bbd0ca819ee46b26d48f196083f1aa32a0e1f9a4e19c028cd1ae3a89bca3be267cd3e6d16f413283755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8fc499f96a9ad333b5640b0eeb3481

SHA1
48cc74232bb136e3c6bdb643b2abc15929cd5a27

SHA256
12bb5e6084e1fee6a458859f13de1a29683ef31271de3e33d92feacb0867866b

SHA512
1cf130675996c2ac1e72087f2c99e2c0c29d628a352f54f227e7f6cbf8e44c8098026cd60ef520ef0a31a277c80bff141f3deec99b33e51605ffc40856287c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab429F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4535.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit