acf1046dd5426999c4f5e6bfdfcc1a9b4ea649847775954e0626de591dbab759

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8caf334ea4380c7e9d09688266523f12_JaffaCakes118.html
Size

45KB
MD5

8caf334ea4380c7e9d09688266523f12
SHA1

253e4835bade6227008ff35def7f20f27a689431
SHA256

acf1046dd5426999c4f5e6bfdfcc1a9b4ea649847775954e0626de591dbab759
SHA512

a03543d5a57c4f0d1c1a09701f10dc37be0a0f7c2fe31b355f791e90d4685bf7b1f4388d2b1c3c8373783aa5fcf406897d9affdc201c64308aa1cafc02bea790
SSDEEP

768:kGKM+BvLIACkCQCuCPCSCaChCNCf3xmSxFcBqBS3cwQOMvx6JaE/00z/QEAJmb3J:kGKM+BvZLxd2DNuK43xmSxFcBqBGcwh/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a069eaf598b4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecd7412c9c7fda4db9cfd923fc7ece1900000000020000000000106600000001000020000000ddcdc2fb87b37833ca215c9014b3466eca13984c9ed3c3e40cd7e012a2c38fac000000000e8000000002000020000000f2a81fd6980fc55bcf55068295adccd850acb048521751c585cf80f00c565cd42000000004e95f2c26380ae4c394b49729fc8572ae2ba35ef0c106e578fd95f726484183400000005fddf84d56ddc68620b414321d0530e1c706e264c461aea8cd8e72fd5311f9fdafaa7f470d10916b46d312540a4b65c095d1d9c3e0fc002dc867381ed8db8790	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423459035"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FCE0381-208C-11EF-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecd7412c9c7fda4db9cfd923fc7ece190000000002000000000010660000000100002000000003e34bb0bf295fd23b01deaf12ceb9fe256dcd8f05b57ffd7897787b0a0d79c2000000000e80000000020000200000001caded611831d3ce5ab1732f0dafdf6ed040ff40d39c75c039296260d50d1c5090000000324f9dcdb17a038e07587eb08a2967a53dfe109e5a65419a3858647b17d7dc71a7d631102c8f7376ff6c0ea4323897a37276586435eae5fc312f26cddedc14aa96cf8d44cb8d6c3461e615a6f55cc8f69e894cff6d7deb2ad3fbcf7d5a9efb2f202b37577555eba3be61aad4a9ecc85526222b2cbab219a28084c9688a50649edd6bbd8f6604d6579f9fd9a567e547c8400000007b8b3d9c59cd4e25d3acbf1c538a24ce664a876202d8b66f659d170031f21fe734063c1ffaa8def104bc4c64e6a925f8cc9f3207fc41a801ff4b56588185095f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8caf334ea4380c7e9d09688266523f12_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c364bc2ea0f1c0a36a6c7143b5f081c3

SHA1
193f51bcdeafd533ea7110da88fe3e7974e3ecfe

SHA256
fb8525d524b200901fefc8f474f672f74e5dc1c0e9f116afcd771618104e4b2d

SHA512
dd90cce136d73e12a16eb16199c48c50b0a4a573198537e1fb925e150bd87825e75e85c24c76e932a17e276d278eb6dfc2fd08de68235fa30473505c10a23a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbece74ab01ecf3834a3eaaf93646c6e

SHA1
c145ef22c64cae327b80489a187aad493c5771c8

SHA256
af274106df42fa31b173d92ae265dc3177e21dc296857a8433af5e09c310cf54

SHA512
e23f811e9ad8a0a00feae19c57ff29c52a83b056fe5407dedc3461ad3575400acdc4fe84c110341ffd08cfebd4fe333b8e03cf44f45fccbbbabb5c2595ff08e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9120e6a9f5a709e77bd4ec0c2f8235c

SHA1
c2df476261a8809b79b1715b74e46ce11c532a36

SHA256
5193aae0a5d772cf2c6c69648c9e2f900ef4e72f04f85e12f2bd558d77b206c7

SHA512
bcdea39098a453f8471ba5839437b05452a510d048f4ed2dcdbf6dfb6978458e22782432f56e96517f68697e2d0fb459c14f25b5eb2ffde428ac45e6256cd80b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13776942fcbb116555a2cd12842320eb

SHA1
f12123447815baa06833821bdfc41126f6ffa58b

SHA256
96d4d485394c5a8f2836d5be514e2b3943419e05fbc05b9b6374250775c312ba

SHA512
cca548af7f97d349556818199b1187e7d11a49488d3d29bce9564bdc59d4a087295c86018a30cfefcd849716757aa3f4b66babcf5d9fc4c89c67143150c68f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c56f380b71bbb121058ee2abee5686cf

SHA1
6287ca4e2263f8e46897c49e99b089943b1fd114

SHA256
35059e5b1000091f96db9ad614b9a8fea82b76a4715881b51ac9b811cc86ef52

SHA512
6b501e35b2265bbec36b599a59a264fad0338162ea89aa8bebe36748c1aa8390086b7629d86f6ca669d08d6854ba5db8e87e88da5bc6caca5c7acf01488b9b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df3843e8f2500a6bcede9e7fa1eb079

SHA1
54dd0eaa62af61e1fa8bc4a2225c981368015e69

SHA256
6bc4e6873b49f1fa9a1e4ab891fe42745023628b8d2434399c0d615c888689fc

SHA512
97fdeb426d5680522b9b56203a9f9756e74b055e836f03e5d9b3b7f142a20b955f97c6d5daef150955d106d99f953facb706ad4022b5a8be95974f2d9e6fd521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f19e532b168176ddc3627627a84dfa

SHA1
385d0e836efb975640699fca24e405914ac1ddb0

SHA256
d4c103d0f775d691970bcee26df9a83f0f062999dcebcd02405c3a4a63bc55c0

SHA512
f96ceac99786dec15e62abe1e64b549ec5c3b1b60542d54a94825fe01615a31619983dcdd6f12dba6db2768ab9d04ef94c994ea661a746c1090a3d3f2c5784a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f7ab514a100db34129d3c5d5f0c69b

SHA1
addeba6ddcea8179ac32d0c5cb8902edbb16d376

SHA256
97d6c200c500323c3e6e99a512f33bb2e34377491f83fa884f34af37219d9acc

SHA512
f0c3ce20480bba6dfaed454c4bb47463711220d4fa8f900f18a66528dfc89274e3d68918d5dbdfd727d2930aef81a031be1f618fbd0311f7060de63e4af41450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a24e08c83fe977bed803ee922069c64f

SHA1
76cde76f5a64d32da94ef7152527f586d5568e37

SHA256
54785bd90037fd53432200ad4caa7d918e1b7b772d8e9c8bdfb80ea2a44929db

SHA512
ecaa2505f5e955fa7d97db333e72410ce28131760ee4fe4e80ab63c05a242985de5219b8a741db33ea90427c273044a46ce70507ab196a886a50c9896d4af87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb9470e0e83948f8b675f130994f05a4

SHA1
fd452585d39bd6481c7a9ca5a01ca8b74a4e67fd

SHA256
23a98c50fe4f3fc4c3b99ff508d40f8009cd9383536a5fb414376d96b2401afa

SHA512
4974a4b64c2a89f4fba0e3dd74c2f935e873369d654871af9d7ae3bcb7c134c2ca4fa39817332d9d5a83be5a3bbb55ac4b0e840a3b2c8e4ac8cf0264647fb133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbb089327e580ef654f90cfc4c0d9a11

SHA1
a0f7eac833cef4bd19eff11b67317bb383aabe82

SHA256
3f0033a889a3f08634bb4f2a095ba555e5ec7bc917a521f1489e869a870b31d9

SHA512
d2df078eedb8455f11cda531bdfaf546ae5e5c3300d8486133058482fc0422205d2df9da08a2b20c9b54269f2ce3937d7379298672690bd8b447713dffe3cfeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a93432f224254c8e71dbcd65a8d9fe7

SHA1
c0406d2d621f1c036617f3f1ac09f6322aad3a35

SHA256
329fc8c32c686480652816114165592d71d4e64b3bdea5e2e71d443490fde435

SHA512
71209b0c2c41c962eb8a86591b5b57fbc12c69ff746a0ae3c44a5a97238ee9b568866baf4248028df7751d29b2f7aca0eecefc56d1f1ff166884c36e073ff14e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bd3693d3baea748e26857732b71fadcf

SHA1
24311a63cee6e429a74f38a48b71b60e84ba4c45

SHA256
dd354cf0aa0017173fb2af0db940e458abe685cb123817a4eb5434a67ea799b6

SHA512
93ccb14cf85072bf72a0edc87950a0ac10bb90da8e6a5c542dd71d40fae429a4747a17c78edd29826e566e1567b37ad283f35c51130a3940e0eb23a03bf6855a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38AE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38B1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A2D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit