e3fdc239e49d4f26259e8ed9af2e9d599ac9087e8a8708c2eaeadd02723dabe8

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cc04e6a82d9f15de16d7123b1ecf224_JaffaCakes118.html
Size

41KB
MD5

8cc04e6a82d9f15de16d7123b1ecf224
SHA1

c845ed2f3b4050ebcbbef1b42f3a06a20bbf8626
SHA256

e3fdc239e49d4f26259e8ed9af2e9d599ac9087e8a8708c2eaeadd02723dabe8
SHA512

bb38f39d6a14e6d8c89f506ec67c3217489457c2a76b1de52a586a12f4d75bccbcb158d7b1eeb5321da7850c56779b9ff9c6516e9702d9bf0ca1aa346670703f
SSDEEP

768:kQPyTb1t/4Vf02t0gsRQOiuRicSzIDpHOj7EpYn+xYyxzR02Ab2wtPKYv:kQPyTb1t/4Vf0ZHOj7EpYn+OyxzR02AH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423460911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D625B01-2090-11EF-9387-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2204	2036	iexplore.exe	28
PID 2036 wrote to memory of 2204	2036	iexplore.exe	28
PID 2036 wrote to memory of 2204	2036	iexplore.exe	28
PID 2036 wrote to memory of 2204	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cc04e6a82d9f15de16d7123b1ecf224_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
795c117e9a6c1f7ab8cf4f9584f5e17f

SHA1
04b0d781d510211d0bba0b55857f847639c7e992

SHA256
914d3715d4567e2942387a86cd8cec59265e1dcd960bcb033bc3756af134a5a3

SHA512
d6f14359da6030d80d06beac5ed08787066cdc0aeeb7f290df2129592aa0f86d04a165567d171b1ec6b9b25b678f231c6560ac5a9f1bc550fce6947a48bde623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20836d6b32e6fbf370c3c1c6340e1f37

SHA1
ab264d2771fd5236b669e54a8cb40f5a891fbff2

SHA256
89d380f210d899f868ee1b997590b60eda8d90a7510b5697791bb6f1329893ed

SHA512
e2c87c47feb7b0663b42086733c64aab8c08e4e62c83b12a7d8ede9a2024ccae943a039689be1487158aec25f5a571356e4ad57493d1cba9d0555d24c1e7b053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b38d72012191e768eda0707bf6dcd9dd

SHA1
497f521ddd25407f67f289b229790fe2dea195fd

SHA256
6ed631043fde763ce8c0b9343869decb21e03b756ddfea906144b91791f1ec5a

SHA512
b9fab9720069eb203b891b6a1beb2530b006b60829df264510f1a565d56a55179527fd4359dbd096439ddf5d8c79bf2a55a71f865a0bf8b48188a7a8d7b4065f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f5f5b7fd3c1cfc995a79683a840635a

SHA1
83af188d3f93d8fbb827841acc40aa9d77a19c69

SHA256
2893b788c45d03c1dac73aa7f670e5ada636e0c0cecfdbcf692e3d0a29e56cba

SHA512
0099b4725b1c226f028ac82482c3bd88e62a7bc3cb1a389256916ec151febad343b1f04657b5f2c66cc7d9c8c17b30eecff808a207f60669fd0f0d8a482a4401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3f52d685e2deb2792f81a4ac72bdb75

SHA1
bdea06d2079b91344db586e58f5bbefe2423dcb4

SHA256
1cc9d32bd8732b5d00c18fbdd0b118b6d1d48ff6950bb0682032c4d64231b4a0

SHA512
8b8da2fb6d6a066822dbc6c16ba8a73bf248e07f6e8645c822e5a8bd5780e2fa06ae304b1fae87166387b2fb2f4d4e2bfaac856de7397712ce31124e524a3e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaed073edfc827559c92e9385bf047bc

SHA1
b23c4301ee5a88609fefa19f305575a91feaa76a

SHA256
f4e91b67a1b10728927e79edd334e4794480d636b38ce86dd8332b286b612116

SHA512
0a8c1972889371335f9e254591494236d130bc2b5b9ca0472d5b8e37cc34cf8b68e4d614f101c24343f0371c766900cfb06d0f3a03130ea004c51659282e1319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f91f20676f41f54c61b653fa8f1fd98

SHA1
f21b5720030c58204bd94591c97d6b6538bb4105

SHA256
fe376133f16ce628131c6d86fe109587a1e404d2a1b3df3aa26304c8a819f203

SHA512
83259ec0ce4ecf9da2094036cc3c6145cd46536fdc3ebd26386c9795ea90252ad7f4cfd6b25fb9ff68f556a6130644cae7fff93975112543170066a3f6a4865b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3547654342312d297836ca1dc8025a7

SHA1
9427920b4b9b87654804fc36612b4d6fa38be9fa

SHA256
f4a5e9759616eed8561f6b04b04e6e7cfb656e3c39d53285605fbf0e96ee939f

SHA512
5ed75709d1d0cbca4fd91832d68bfe79c97e75c8fafc45be2a8f0469fc036cc204ab19ec2cb771095aaec3a11da93649b8a6867071d4eabb3e15cb76a2e9f8e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e38da65b9ef2303cc061c3aee3642fac

SHA1
53943a99fdcf14df36b06150944f58a6e4f57284

SHA256
ee11f6651c30dc01fb597d432375b964cf8e8fe991a0420ff58256b36983f505

SHA512
93c42a383bad481add655898f9b107f762051e0e35b0b31b9b7dc3252df83a1d555096ef2a8a9e8507d4c7c1b9540004fe8f1b50adac367b07d2fd54943e62e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d86cb09ec563e411aeea732164e77a05

SHA1
3a479e1c5101f8977da04caafd71e2f0acdd4b0d

SHA256
cf0fb3337c6bf8f402a72e0a3f050ebd5b1817f7a6f7936f42a47719ad539062

SHA512
f3aca701a23029e189a7b18568e01c87f8fd077c61b01ce906a4b1702c70e8487d89350de33b95a52f0328eabb658dfad3cd53a81b79f3ca5556e28ed139e4d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7374caacc6881ce98d5863800521411

SHA1
b242aecd7894f6ddd2772cfcc986bf550f1af0d9

SHA256
d902144c907121e471772e7a10e18f4fdd4bf4c18373ee039ff42c3ab6e557fa

SHA512
a01f0fb9f477abea15cf6e91527c5ab8104f3b39cce3c1472d597027d31706cabe5903cea2fe514ea164b22a28e57ff6528ce856d6962734436d3b5142bec45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f3c60d16ddbeb31e4dc210c32d8c353

SHA1
bba9aa46c06bac32b9c3c7b78a30ad0f5a32942b

SHA256
31d47ce8f5a9419022d3e8e0696ac1f8e834a916f2872f50911fbca8f0dcdcb2

SHA512
9b2baa49a7089e86c2a9d652577da4a51164d316a0799d70254b9d851c03c9fdddc5332f1c302298cc2dd81bec05ad290bf0c6b10e927c2c55d27c9f41a9e91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37067d82c35eec27ba4cb8cf15e79157

SHA1
1fc6c1254c58e72e4787545363d463c4b78f9817

SHA256
78e6b0d30ceea5a934adacb15fc0b3d99c28d595f0982a54a7f84b8cfcc31cb4

SHA512
ef1be94faf3e1b42f0b561755756f33b5194b681a92994cc3db7d22e3a328b40358bd39ee3bffc9c2a99e2765502e7d01c1b39d4e3039c77341d95f5ac9a8ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
230886b812085bbf2477a0c38bad32cd

SHA1
91183dfac10da948775747c690925d0d0062e506

SHA256
29b2dc45cc8afa1155ca4aba53612f3a37a5446647aada05511861fe07efd567

SHA512
3a54339ab905901d3067456a1e6c3c1adc27a202451a305fcf4ff11541f42f19bbfcd952cc8762a51b8fcec1f3b99f2eabf9b3f0a8f0ceb8f5e66f5069a7200a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd6635b2d191f86048c707e8e6b0102

SHA1
b88d5d49cc120c2da2eff4ef12565f9d4b436f36

SHA256
293e06a4071f408f7a2ddbbb7e48a946c5a6337fde85687293bd1960d9cdcdf5

SHA512
6f3643383dd6d619acec3c365fab0c65dc56c974956123ebb32648639d4f743ee9a31d903db5b26ff18dd9b863af6da7cd98e2ada9cb30e18737f044762f3927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c811db3aa1a150d2fede015a37353dc

SHA1
50d9400f4d3adc288f2aeb4b4ab0f15f78f8537d

SHA256
c82d2f0aab7e7a215938d69e06aa11be2cb552dbcd4d8ced37229e654258effd

SHA512
9098a4126daff182f2467b13239114c2975abb762266060712f72c4d1ffa5df2b503d98efb4f955437643f1c6cce57dc45604d9cbf694b97cf50b085804c0293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e928eb8f36d3aea1d24503bd591329

SHA1
3e1ea4a971e368ec974fecccb6403147a42c66ae

SHA256
5311caf7515a08e479e3b1e8e1aa1c17a64ead422e29408c769965a3101251df

SHA512
a66a60e2faebd78c53459e5c7eb118c976412dc57b2de74b2c5392087180b75c338273cc35b02fa7cfb50e684665f40ae639be2f748b1631dbdfa65aa3a03e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55abb9d264d1167ab16a07087a0a4d66

SHA1
e1262453193bfaa39ab8140a1973c498db87ba3f

SHA256
f7223120fe7f70466151037bdbc32a6304fff8e4d489be8f6e8c56c31dbdc1a2

SHA512
a74315ebeb2ab7fa90598e09c44703f54ce28b860812273aa775e6973f342cb79c13b7af44a7607ea93dad5e938bb1d31f6411b260d761ae1e5ee489fbde790f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ddc5bd336786bb5a335799b363593eb

SHA1
898a843188811f541d2eb5413be8e090ec783e56

SHA256
1e99e3292beab73a0a2192528f76732d1c87bccdb01b4b98d76f4c2c25dd78e0

SHA512
972d45ec93dbc83b28153d7a2228ea1fb80cf56cb54a3a7c6a4a8104ac2a5c13cb5e59361565f3ff9daebfd6d9206a790bd78d7a30627dda0a2b65d3b1d142cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12F8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar130D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit