b188fac1eb85b972c449da2654fdb9caed35cf7f7a769f5f7ec9f5f132bd776e

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bbc667962780cced68046e825ae0d47_JaffaCakes118.html
Size

258KB
MD5

8bbc667962780cced68046e825ae0d47
SHA1

7b409aa36a8ddf6181eebfa42546eacc59fb2107
SHA256

b188fac1eb85b972c449da2654fdb9caed35cf7f7a769f5f7ec9f5f132bd776e
SHA512

1f54db995131df4af5ff48cb5df5ec8fa1ed5ca4494f4e4286e58346f8dcc33f818bf6f50a844ae94601fe7a94e9efafa56ee0b5cf8477541cd53ed66e4e7a99
SSDEEP

1536:0A1D5ULShGNBVlgbslv0ZO+7QEgS1B0FSfY7ST+0bwICqaMtebeUvjJ2:n1D5ULShGNBVmA4EjEYabChMtyeUv12

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8003473a65b4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000228f9400022951fd9740c3a08d0c91501c72ec3e9df6f78b6accfcf591a73d85000000000e8000000002000020000000f5e0d4a34a7217e082fc4e70fe38c1313268a5a054b96351fa96a60659bff70e90000000fbaf930a9d576210c3ccba735048ea8bda82ddaa294651a374702a786b9d4cef1cca50d1877d2a2fe380f9c87bff3a256669db7e29833bc470355fd0ea4fef4cdd954ccc21f9b1068b6538f482acbc0392c57ed13d0d8878e53540f176c76ed9cd7f77f2ec7b64cb01fa03e5dd64c88d8524edb5727365fed55b2d1372d3f5a7b4ab87ebdee5ece03f5389244bc6259d40000000dd3aec4f4f0c132b379166a5f086146d2d6de102a6274de43a9143d25eaf4ea294bb10c474f9f4c20d9218e64fe4dfed73908599e4be5b96c8939a18ca3a8530	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c1aea8686df88af3d85c39c3af127a4b3303fd7edee6b4f763d5dd982a78dcd7000000000e8000000002000020000000ffeb714be3c6a45eb5934a46d9b28aff25669f2ce5e220b580dba1acf0008cc9200000006d4666de7141969d387e8aea39794f90b5874355e5df05fce1012e51c5e8116740000000e892c19bf4d47b84e3e298b8a7e2c263e0a3e25923b1d1334d55aa81b3d055a2186b3bfdc3be2a39bcd019a58e1dd748e409b4a39e02b737af4187b43d2933ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423436818"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65705431-2058-11EF-BADF-D62CE60191A1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1576	iexplore.exe
1576	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1196	1576	iexplore.exe	28
PID 1576 wrote to memory of 1196	1576	iexplore.exe	28
PID 1576 wrote to memory of 1196	1576	iexplore.exe	28
PID 1576 wrote to memory of 1196	1576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bbc667962780cced68046e825ae0d47_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f73c3df35a64e265314e4530497a74f4

SHA1
fe2400edfaa9957b1270797623431b1a857cde73

SHA256
c79d59f7650169bc01bf20b14e238a88bb81d5ced8a3a37d23beb3530b06d671

SHA512
1b9fc4930a5458f47b425fc8df248414a40099f3b9bd27bd066c56a00735e18cdf46606138c499a14d89ace0282784876655115c78e6e5f64ec1701f469dd39e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaa2cf565e499c300f3b5b3f72884925

SHA1
0718b78420c10bd50772b27804cd43ddad2c341e

SHA256
c9fd137894eea00313e4b16851d742eba4d8db0df74564109c1031c40d73bedd

SHA512
a0298c7c58d521bc494f4ca569244e1b20aa765b7f5ebbb6612dcda9d2c17596316aae1de3eb24e5a6b9b4b9c7e676b176a3d1626efa2ecceec34fb5871f68c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d0d443cbed0562f981be7cba74a6c16

SHA1
aeb6dc1ac802a0646b5a98d65957b085072a9594

SHA256
3631abe868c08d57f01d017cfcdb7bf3c67f8a234f0ddf17fbdd84073986d761

SHA512
ab56468894daf817e5089bc0918a9d9af30d57bf41748f49be061df99279f1be170e36c3af113cad943f60f94749526f82853d07f07e3fae96c48cdf6cc0b8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73078f7082e64e2613a7d19cb75f11e2

SHA1
8e04c5391d494360b9f32c7acfabe41ec2bfde5b

SHA256
8d1f5e2301aa690481c371714313054241be2a7698cc83309dd400024a5d993b

SHA512
9d76e4548ef636042558b58d6f6a7d23413f3e6adbd5aaa8dd572c124fe06c4fed1d5793bb1aea4d5c001462f1ce6f54c8cf8c7b295ebad9d1dcde0e57851be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cd5268523be3541dd61f89ad59fc8fc

SHA1
be4697b4a0e350ffaa8224f79f5970ff092cfedb

SHA256
1f51029c0b36706c005480f977eca45c65cd6d661c0f91c06312943ecb95115b

SHA512
3bf546febb3fd7009cf8a525b6bba50d9373bc9e568c31047968e9fabad7e1fbeddac1e3265d3f06b9e9daf9f2807cac9bdbda28402143fe69cfeedb8ae2818a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bbd75f36e0a1b65cb6705cdd903f8dd

SHA1
e25fa27e12c39c3b90c7da784271cb6127a0b797

SHA256
a8c45b7e7fd654c995bd8b3ee7e5c53045fa45fb5e6b6bb8ba8bb8fa15ebb467

SHA512
6fd82ca0ad1f74ce9a3e83e34de781fe4fe22773a9b89a2cfc814b5bde3d00d4a6e49c6038ba28c76840eaa6be0f2d8c16b7fecf79a940dbcc25930843bcc59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b065009d47cd7c00b31a944c63b90e

SHA1
6947474a6d8fc8aba6798ffb260c2976b663ff5f

SHA256
4ae1be652cebf93823fc0dc717409bd8473f1a1fdb1a0bf610a8aa705640da34

SHA512
83d401597f1bfe4ed9c8aca46d8558c8ab87005b480caae453e10263c1a28d7163f609648758c34ba1124534d89adf7f15a58db0fe4fe96b8dc44c30b737bfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd9cb7abeadafaca1d0c532f1af60e7

SHA1
e0210fe99cd61fca2baf99e8a08f4c18d5e8804e

SHA256
1560886c61533242aa9fafe8d12a78932d1b26dd478e4a5cdb8d5ee5593e8e8f

SHA512
97783c5fbb44ff37857ffaea7f5d71ed073ac683a82bf846c920d5419e2328134b99e39968fb545f82f7babba369af33cf2d34d8de6c21984d59e74c781fc14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc110b24b55155f9c929fda31f11a3c7

SHA1
0c114bf195b96f4a3626b5413b27c32df2615f5d

SHA256
146465bcd1a0262576d53e5fa4f83cecf6bf62bbc2c5aa6ab96cfb4c45cdb367

SHA512
90dd4d6720fcc9d33a7a42e38892acdbc0789839e901a1ba4419fb58ef14b65d40d8f3180ea0f4051187c5fe3c059a5797d9a35dc2ee41d766a2c9f77f9b1feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2fb31e23c4eb734702f1f34ea31370e

SHA1
929e88d246255e94049adbe756c58a079c4b47ed

SHA256
c5a45abfcb72ef626d00ae0ee77047c77d2986c7c8d20223c8e8086a7be95b71

SHA512
8d68a5ff41004c0f0168ae0a8f247d68d35c019ceeb1aaba520d6c8eb6e2a6ed74e1d64a127917f53410ba58f64165fb82fc88724c3cf3f787a474ac5f1af44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d384d7e25bbb8cdfd394c6de27e56b7c

SHA1
8459c3f536069cc1b81ef3fed704b29e5153fdcc

SHA256
1de3331687ab61cf079b66e5ec014f90681c04314275f96d6ae9509b0edfbde9

SHA512
649cf0023bb059f55c46975e5dbc5ac684e3b6dfd7a4cf481e8090c0e3339b6fb69fb25e9a03e5aaf9cde2dd718bf84af0385ee1d38aab104c6da52782a736d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
491284d181587106d00f8100e16f9f04

SHA1
521030c50320bb7adf3a42f4d050c02ed8232ab6

SHA256
88c5527cdfe9f984907f1700518a705b299341228cde83db49d9ff05f428418e

SHA512
483d4f9bda1a32964bacb22cb110ddadf19cd6623a649c9736a6117c23c7f99d345bb3620d4f0acc6fe78f2190271ee6baf7aac407e94ed002f808e2155c01b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d144f622fa56335791c57044f23d097

SHA1
d6b07536d2ed1befc555168886172b1a5fb1aead

SHA256
5bf9219c5e26cd2926ac48ab7b6d0f1c662c521bb214761726825670b284013e

SHA512
b35ba266062e3c1e51a3105eb9c8734506bd1754e97355124d7dd67bb1c46ff2527a6fc7f9e6cd8dee1b7aefb66aa2bb8bf870d37fedceaee2dd1b480172208c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb9a4c6a8b2947f0c0792ad00bacfe2

SHA1
0a07284bba5c7af19fbb372c7ad4ae846cf6a793

SHA256
9187cbdc00de39666bfa473ae8cde64bdc1b370870321ce24a82d77eb8c2a3f8

SHA512
bc7e069fc1796dcf0a499c46f0e9624143c9be04d18764647836cace19be77f3b70ec48521fc2b65879b18cfa5bf50c9d8604e41ffd1941bf2c3a4909afb4453

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47F9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4899.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48AE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit