54b570b54f712869d13721a43218841192e428e4177f0f7a3771e22416ae2e33

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d4957a79f7157c0897b60c424c336b3_JaffaCakes118.html
Size

123KB
MD5

8d4957a79f7157c0897b60c424c336b3
SHA1

c6d97bfc1f57ea96bc3783993a8613ea2f8594c1
SHA256

54b570b54f712869d13721a43218841192e428e4177f0f7a3771e22416ae2e33
SHA512

d5ceea331e04429779dd38e5a06790327887da38c5e5adbf44b00b9abf8f6444d1a8d00df43cf571658108492a525357be8591f8dbce9b3c5fe652039c600dc3
SSDEEP

1536:S2Vd+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:S6+yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00625a13bdb4da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\weibo.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001000063022ccc294555d32bf4158533704c336009ba17e33577963cdb4e0ed5c000000000e80000000020000200000004209ce91216171c62e51a907a7313c86bed20d9c0ce15cbdcde22e4f7d50d0cf20000000bec2bddfefc8c85b8e5616d5d1fc8675b2ca18320b41357b13564040b96c265a400000000555c880fbefaaa603a6d0737cb43224614ff0a09d35af174d3351c0f36eb0ceff5259ef72dbf9daa79c12094c7c50257ab8aa36c91cafb074656326efb135d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\weibo.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C82C231-20B0-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000eddb61ca9d7d73a13edb58e28f8b1cdccd08d6317bfa586dd108a95ffd3f1e53000000000e8000000002000020000000b6f25e269341bdbf9711ab283f0e48f068688d1106aa5eea99dca205acc20d7f90000000187d848865ac89a66bf551be31c0926177f02287487f20b5336066d5028afb78907549fc64a88d96ccf2fcffa82d5972c1e63501daabebb74f0669bbd0754205e09f6da88b627f08e4802c2748af93562e90a8506815e04b12b1fee5f4abc633cb9f7e4062e4ebcad03c9d7b1903c97852a28592bcda731c19b019a7f5c861007c33bba8c64c85fa74f688772ad1994e40000000cd043550570bee92d7e78e0a19132256d405f29577539bd48814c6356e31a05bb549a8d71edf926c43efb31ae311b9671d2bcbf20ddf36e5112d11d7d6d070f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423474544"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d4957a79f7157c0897b60c424c336b3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
966c6c26baf3130d01dd6669c2266189

SHA1
68b1b699fdd4b19bc3e0099e6436923756d2a228

SHA256
369453dc1f1b59b1a8bf9f226c7948260646719e66727cba55d8151527b17af7

SHA512
e5fade133aa20b696253bf44c96f40d9f50938b5316e6f60cf95514551b801a77bba0e35d23a530b5bb039e0862518134d7af4c3d7dfa7a9806e367a2edeb023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52772cd75f7e4e22a1c1bd9d3530a77b

SHA1
9854c75cbdf1297bc89bee2edcc3738c95f9ddae

SHA256
cb916a7f5f9ab6cd8d5bd92c22de3b33a42fa76b974e075c81dfbfdad22775e0

SHA512
fd2d1e87961c3e7223807aac12e06dacbd6e54b7889ce1ab36ad725e284c1d8237ef06935e4fbb91b6aa5e5fa36086479b78d8324fcfb17f6bf57583a69a8cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e745f3a7e1d5fee023601391c9bc25f3

SHA1
c1a462d35afcddb7c9696e0eba1a2a58b57d3a57

SHA256
8ede2f7464ea2fd64fb1b8a23946be1742680604fb8a94200501d1cead36e764

SHA512
292500bdaf03e2d6d3c348049326994a50b233d54bbf1c7eb99869a583e86c0c4dfc8169020a59b695df5b454b22ed502ed527cd5b66ed3a3ce8de5482b21a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a942e34870b5b21584175245e1ba1493

SHA1
69bb6dd501fb2015938ccc14f00f18f34abcd4be

SHA256
7a449758da8b059b523cc7bdbe81d647015664b60b4d1b25b1a8aedb8bc646fd

SHA512
22ff4f8f3614c4492946141980c24b8ff82897a1937005de554d92c6de914fc8cb09323eacf3c5b1cf0d2ee7993b42aae600dd38c723e8a3891ad9d9c4710e22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ab50d960d4db88a1fd3c235301c3f5

SHA1
ffb0c248723253d9dcf3c54a107118a5a23dfcb3

SHA256
501830b143e7e003ac5fe1440d22cd0b4c8f762264df778a610a5a0de8204572

SHA512
7b36b5ade7285021ec1844fbe40da735cc770285960121fe83b666790a363e3dc8aae4d98cd1908eeda303eb4b3962fde96997d07c632bb5e48351a5b96ecfd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9694279e4c305933336c5b9ec3080e9

SHA1
6e5dc3c0ea225dbe2841d5f8f425ebe7a330ece0

SHA256
da1fc99b1013082e98af00b751bbc5b83fdb71b2d8bb088176243875041a0537

SHA512
208d6633fc95c161b9ad375ceea1c0b546748230eeea74f816e552f3aa8468e3e5717e1b255f7b1212581a8ca780014841f0801f1c5bd51b0bbdfea450efb565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72113a522b54f25f766c4c790ababad5

SHA1
d347fd2764c4826415a17632c7a226393c955d32

SHA256
9df0bbabb4f245c4b337d348fe31c919c510982877a45b58f7f21bbb5d5c5fb9

SHA512
3a0c4565f74482a5e5b11ce68c7421f6d2b8bc3e44192fbc2ec3951fc7f7ee7820f39c62382f434415cc2cf58c02fa94fe9fe5b2341215629f05be7c88c13138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb6a37574f50e8020f0f19af2bbff09a

SHA1
0b5b251bc23cb6ab3e1690d082c362d321afd89a

SHA256
5c454f2dde68038b331a08645110ab97b1538a79feb715bffb9c285e4b0aea91

SHA512
fe5524ff205a51febc3d16c18adcb688513d8764d59319ad4cb562d1a48d2eb8c0d868ce04eef654c653247eb8d0710e9f0d503ce5deb9136c2f7b2fc68f5b5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bc27602532c563061f16c3735f27e99

SHA1
65e68cb31c531bc7c61abfbce4912c2a26853fec

SHA256
eef4945e70898db18bdb8415972a3c73b0b46f902f7f3e83de9492d07006fd49

SHA512
3143452af02aebd130f6242d7973d238edf83271e42aba3ecf14802f7615c48d1e266cfca53e7ff6b49cc15cf24dde6d2ec4e1fc6bbbc352e63607cdee0e7c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30a7d0a65ba76af1a94751c5a0f2e451

SHA1
13eea37c7b02e45f764a8de9b9e33cfe7a011fd1

SHA256
23a78ec72fad193eded72b6db43848122888c2e0f8079efd1d23cbd213b156ef

SHA512
12ba9aa6ee2a23223cc905ed4aec96d29acdf78dddfc25f733c8d9c442201152d872984b8c30c557534733992001d7a9f4feb75e95fe678abcb10cec0f14e1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b60cc2eb25139c464136a87efd54ec7d

SHA1
4df830d371d08403fa195fd3606936e16a984527

SHA256
2da356fd094fe4795befcb519900a65224a53c8f6672c6212d390b4d49aca802

SHA512
28f0857c06c5f34c9974b07bea49fdde1fb549bedf4f4a3c109394d1d699ea6841a63dcbbaf2bf8b09f4375b44fe45aaae98d805972f22df00acd1cdb3a2a12e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62150e2552d0e7191a595f6041e5dbda

SHA1
026dba74485d1e3348249b124f4ba5f548783a9c

SHA256
4ee3274b32fe3cc759b1fbeb545e509ea29e7463ba4ee8d149dfef60719abada

SHA512
cc5c3233105e0f472582699dcd8a04b278ad90c4df94622ad7fd283b607c80debc63cdb600c7f5286469435ee5117c10bcff25f0facefc48d69bc8ba02c62b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1a93388d76a6fb0c4d5805c0c66fc72

SHA1
3bb1e524a01201a4a7f47bf048a4afde07e8b561

SHA256
9b2c55f722f055d94aa5855cf1b0cc58907c38ff7a4a37bf3611af0795ec24f8

SHA512
3a2e893cbe2048a29efd12e4f12808ef3c3ce54e0ae5c81ad494d9187c6e7f68554510e5d7dc1d911a86928e2095f904638a40bae2290af64e54fb962314587b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F3C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F3F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FF0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit