895e757af44191debca20e9c242604eff0d9ec45152bbb57e523bac438aa3d61

Analysis

max time kernel
140s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c594c47e4fbee721fe4b93c689f15cf_JaffaCakes118.html
Size

139KB
MD5

8c594c47e4fbee721fe4b93c689f15cf
SHA1

b24f3354d7abccf149f753d31fdd4b08e7ce8f3f
SHA256

895e757af44191debca20e9c242604eff0d9ec45152bbb57e523bac438aa3d61
SHA512

979b88b75bdb945ca8c560d258acc1f6865f7e2e9fbc65378eba033e6743df43e9f26618c082e7b33441c830d7430f2e7fae013574cc8d37308ba481bc12cfb1
SSDEEP

1536:SNHUqUo1zlm9WqeyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SNr49WqeyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E77A6FE1-2078-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423450780"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908382fd85b4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bc0dd6257f5e243b114f6ebe3800de50000000002000000000010660000000100002000000043d1e181b0bce22b2720851c7c4aee0507ffb9b17bd0a996c328cd0e7ca78f70000000000e800000000200002000000055fe410ff01b66dd39ec1fc0f9e9cd7ff87e5a9825b78e5640cd759047865b8120000000811f915145e497d9c8bb959e58bfc817e18c7e5ece2714544edd897e84aefaf4400000001a3b8d4774d96f8e6fdb44ec8b14e61f2c404809480a2898a6ff9a96b7703369d96428cecc6a7bda79e4d766c1ceef622348ef3b4863fa65f9449798fc3e23d0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bc0dd6257f5e243b114f6ebe3800de500000000020000000000106600000001000020000000f2f956628abdbe57785b7f1d75e025a77e32a5222b9a7b9554684dfa88356c01000000000e80000000020000200000007aea9c3a84a33fc032e15a08a32e3851d60c4a6b6fba06b74d6f4e54e536cbee9000000074bee3452970e5bbcedeccaea8ba505d41044cd04f71b7007addb9b7fd4db72bff993b5148ba7cd3c3ae3c98e3a0bd2424bdb5514e14501b6b8c80fb06d94bf56d365711876e31364312928ac8cb5fa6e40ac202824958474cbf565dfda49c4922361063de15b563662995c6bc4f176e4e3c5d6ccb9507b2ffa611a301be63a9ec607b217ce6dad1272f94cd94a5d25b40000000b2a124087929027cfb341638c8374e35627cf93f765984a1e750ad1ac65949b492e962aba623df415189c2e7d19f4768d57e8851a54779f5111c202e9b26b30c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1880	iexplore.exe
1880	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2888	1880	iexplore.exe	28
PID 1880 wrote to memory of 2888	1880	iexplore.exe	28
PID 1880 wrote to memory of 2888	1880	iexplore.exe	28
PID 1880 wrote to memory of 2888	1880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c594c47e4fbee721fe4b93c689f15cf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e047f0ac2c67d5459fda89224d514c2d

SHA1
ec521f2f889e9ba0bbb86a1446dd357f0c38a1b3

SHA256
25fc1427a437a7f10619dfa6d3102b8d7cff9b537b8a26e924f39d2eb36eb66a

SHA512
eceabb70ba8bef75e8e05d18d6cdbb542c498fb9ca8afa944b797bcd48586bf368f52a5a5c1e411b41a29249414d97fd77c08cbb1c8d9c3dc9bb3e7aedbe1050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ed2752176a30c05a0cbcab5056f9f14

SHA1
64bec7c0a2bcaa2f0393e2b86d446f67bf42b219

SHA256
aeaf32e43cb3fe85581c12aab42ebb07e0233780a8e3c3bf2877aa4d35da9807

SHA512
e6517e048861176bd4d83ef2db3ed0a2ad728841504fe60eae1c45aad55af64ba423652e6e13ebca1b3a3137b2442b752a66ee468b45a201ff2ec52fc1b18116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ff2ceb3bd9556ddc6921a6e63d78bed

SHA1
5ee017cb9bf50fb948bac34559f807117008feba

SHA256
90dab6d54878ab9dd37ccd81a78569270f4b01fa34b735ed6fe08d221eede0c7

SHA512
7feb093fb0a806be0366bb43284276ab60a7230ddfdf4c3a5cadab61480ca2db9223bfe018a52952d30765c86f74a5b3cdd64efc56809ff0ab9f67ac94e58732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1034a93732dc6cfcef600b28b74d5a8

SHA1
6130c3cde621ad827664788c39cbfef2d3912df2

SHA256
a39a75b74e761ae60669e9ab3f2f3ab4d829d9aa25b4a1d3e687d5fdf1a21669

SHA512
5ccdbb7d6e2e6e97cc84d31eaeb5661f96c0178e8777f78c782a103cfc4879aef86a88f072a6ba9fab6e6d0dacb56502ce1eef54162a221b872d6ef35ec9dfe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fafa4657be5b8a023813e3736a6174c

SHA1
45415d64a9cd55379fdb10d95af64fa07c7a0b26

SHA256
330a543a574c52be280c73436c6caa31c37167d68f3cca6821a0a5ac02a75082

SHA512
17529edca2da5951c8652dcfcac901f105c341d18cd83cd6a07abb6c480195ceb76f0a9b6985a85c5c023dc20945f4251b2f8240358e95cb68ab5e92045309c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20ba95ea61afd9812bfc1ea37cd36b00

SHA1
ff989e7bd636909e10aa0d3d4a24cd08558396c2

SHA256
a51cc7008904ace1691456129b683d7ee80794e16e003604343aef82aa82d974

SHA512
907ba27e0bae434ef3a3cb4fe35211122f49d12e4a89a9bba6040851e4ca3eb886d1eb13467b3823b09773210bbb05b39dc0794b95ff36d41b97cbfb31ce531b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a1815b3cea36be0d2e581410ef5c033

SHA1
e0f4840c8b8ee5949aeb5c37cab8752b274b7139

SHA256
f4bdbd0ef699803299752c419e00507a1090ffaf69fb57e894256aa0aabf0c17

SHA512
5fb78cb12d07864fab69f5c1a6b1f586189e8c85e18f9c2189546a2a83edc9d95461371618854926af1ce400fd3d3e7ada6d66c755f06dbb63808820aaccb8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11ff6d96856da2327b31d7643314dd43

SHA1
bfc1d96463fc4cb94a469c911869a04e2387d542

SHA256
8e683916541856046fcb9ddc009f75c5076f71df3a815d8950f6372b7c49378c

SHA512
5f5433de8669aa1c29b0faf54f710faabf5c2968bc504eaacd64f57446d51bf86840eb43eca23a8a32e3993f96257b5581d2c0400ba66ab2314011e1f51394f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccbba0e6716ee1eef4569c550f984964

SHA1
0ca9ce08301a2d52a06de5b372b39c9294d2b3cc

SHA256
3b22570fb79c5874047b3535b2132d444872ffa5d14ac1d8437fce2a614d4871

SHA512
69138b598ec8730b536aad3a54b5d36cbb3a4ab5be3d9fa87297f3f8fbbeade061b8c08d74c7c71b242ff1201b4e92a0dd6f3044019a36ff08471447b8d47bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd29b626c2afc18afb5924262981c157

SHA1
ed1d27656b484c2d6b42cb3efe1ebcc564b5402d

SHA256
c6d56db2a1f1eed7a65b3f34d408f42ec5feca2f6a714d6cae2b060c4a4c083b

SHA512
ba9e0d58627aa2efeab6a0428b9a753ecacbd752674ec000d467ab94bfac9def884e757b42d56d009bd24a620a9916a696f60c4c78f557bd1ae08a19a9569656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79fd71bc02b5664528d476624e91dce

SHA1
ce471191c4efdda0657ff69e1a55e1ccaa098ea0

SHA256
d114e806067df9e80ea43b2da526408f7a8c7239161a5827c74f210d97ae9895

SHA512
b2e951d9f2e17a88c38c435d051bf042d214bc9e6f67a84f7217468a921185dcf94a21d88412d0cef5560a0a444e636a01bf3123ceab6810432af6b164a3a48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2276.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit