e9cd08d827859ffcb972c947994a72d040953c653abef1535c30e4d2f49bf838

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dc27934282b57f89354905ba8a19e54_JaffaCakes118.html
Size

3KB
MD5

8dc27934282b57f89354905ba8a19e54
SHA1

63fe0d0375157f903a1787f57de61d6edd39fb8a
SHA256

e9cd08d827859ffcb972c947994a72d040953c653abef1535c30e4d2f49bf838
SHA512

bb515c69fcace4383c0b2b462c18cc49eb610c0673898ac7643343e64fe29310ef977e70fdf54f88f7c34372d43820c989c38d695e472a197f4f69ec278c584c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c557ead7b4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008066f809cd8a0741b65a1b55a7add1990000000002000000000010660000000100002000000045805d67b08afb3fd8c55acf9718530a28ecf10fac499d0ba97b0dfeddd205a1000000000e800000000200002000000076305b0bbeb336d76e4b292c59325eb804f0a8a49c71724d1e2c73c094b2f35490000000db95d26d1482d7d37157e17e56a13c3cdc3088bb7eb759755fe2868f4d87b41e43e3062df9235294f781179f3871972ea6cf4c089c1a16e26ca2e3cc71cca6d7f004d3155a28e0f033e403d529251f4363497e5ab8125dbdf724124a6ce32ab0db557736484edb33e6f26fac8d54faed6bdb9aaf862243636f3a916b99ebeb8e8cc213e82e96321238a39facf08efa524000000031520409cf64662c000ad095bd3ea85b06e1e13d1f5c4efa3874485b05ad7a813b2200ea7bebd541829f59a4630761568d7b09a4195be9c171081b3cd8112b49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{156DEBF1-20CB-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008066f809cd8a0741b65a1b55a7add199000000000200000000001066000000010000200000008f1de44559668cb429c90b88ffb61100b22d3609ce91cda46898f0f666bedd0d000000000e8000000002000020000000e8502c7f590f3383c13b0356cb6b81843f83e51b0f3bdec44e2add61df570daa20000000ad57428c226c21a197678187e57f1883a9e082aa0983c8866d491fe75310b94e400000009b626fb9db6c111c142cb19ecdc2ff7cae4bce96718a367ce082e92536c031eb7e38c5845bb6154392c75625bb106038392f872f59aaf3e87f4d149754ddcf7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423486077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8dc27934282b57f89354905ba8a19e54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d5ad218251c041ff10e539e014212e

SHA1
602655648cfb3ff436ac2a34b0ff7e5a367e5082

SHA256
a2c04b4768925e780444be0ae70cbd6cf8000d485f21e85909f312420871706e

SHA512
c63af447c2866f1ed891b63304ec840464f9675df4c9eb0c0d1abcff35611534a5e376ba515edc820270fa5f965b501133cb55b91284be6d8a75d16bb8b8aa61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c95ff37834383e47865b30ac914607

SHA1
b82382eaef20d3b0ce75e8118efe296174e73ed8

SHA256
911c1576cffa64d06c4c160741ed86ce837f4c20200393eefba7c988fe0e3c84

SHA512
ccafc35e2dc2bafc9e86f820cce2317bdc7d905b40877d8be0cf98ffa59926107ad5e6d2e5e23f71dc93e139964df0f1b3500619cda2a2a51b0e6b9bc19fb0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6227237de61f770804685f9e4ca54a3

SHA1
7116cba675ecac7428dbdd5dfb288accadcff29e

SHA256
465543486ba75f4fb779c74617fcf0e16e1135b8e138f5c67edca340431ccbbd

SHA512
9994895b3b8946b5e872a877b769be27dca2f0158a18e648119b8ef3b8a736d1d74109d246de19405ad364889416ba081ca3a5016953a8e12e5ce34a3f9761d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
951ce9bc9b13a3a1187bd19d3edab631

SHA1
f8ab3e19d2593b055a5cdf93cece1344cbe266be

SHA256
87fb68861516d9a3dc5d43d8ae73fec8e1f2b8327047b81143886498d8c3500c

SHA512
7f76f111fa3b4fb1a8557c4659a112148487c025a160622fc411c09c0f9ae785eb7fe4d744f22ab10b90ad962b3e59a84a81a2ad534168b77d952fb92e8dd18a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2107265e59d6dd0f253a4fc0b5e716f6

SHA1
04eedda0ce2587cde958147f9b159070d64b3d7b

SHA256
c2a8b69675a9bc8fd3c94f33f66ce4acd7ed5a31b18e1dd32613567cfe7494dd

SHA512
7733a4a50e28c612d4cf91616e85d7dfcecb42560a9c9359e48ab6e8c1d336c4f8c53e805f9a8f6dc5862ed4577b5ceb5b38960d6bfae90fde32169b5d09760c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e4ea318596871e760dbc44934a4ebc8

SHA1
7c8e864c42fb5ef577df582185b352b7f1c8e096

SHA256
2764e25d22b071afdd3ea03b1dee1f2282f5477c4c6004e1a0ac3061748ad61d

SHA512
adaa700fc0022b1692959f01c01bc426f1bf83228b956e8a6391f38af4bde3ecb646b8659d8b6ca9c46f6d4377cf867073d330ba614d92b5c682de7c0bd206e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c598eab02319f224904e4fc94180a392

SHA1
7232a72b10fb611017d6cb0bab01de05ba804f97

SHA256
bc471a550a4041228d03994868c4e0c2975fca3afd0062f24e273f8a2dc0b599

SHA512
6b8f407b90cc0f4a8d827e340d5a87d2b801d65a09265f6605309915d19afbaf15e9d71baaa413f0d31d968f6c4bc72f3ee65b52fa7a1a886120d56d59c174a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aba82e26c23dbcb6134874f03fc1c23c

SHA1
ee2093c39153a1e35a029d609bd0314f67fa1bf0

SHA256
3ce6da3fa3b27ac4c1e1668cd2c9f878f357f42fd3be840a54861f801b1d9406

SHA512
a8a0b6b8ce9614bd7e0fa82296d2b3755c678a0bcc163651fbfc2120c45e4c0fd616a3251307f91303bd327a63320ac837d1bb80e04b75571e4e5db4a0cf7ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ce946e44774ad69f65706dae991b506

SHA1
58d872242ec107ffcb9f3497fe7a172b23882c68

SHA256
255f64fcf0b724809a196ab6ea0e5f6d01c6597b8fdcebdde6a5d0821ebe80cb

SHA512
f9f43b0f167e044dda96adbb727205e4adfe5377e46335b270429674b015ec0ec53d4111f2472005c7895c3ba5a7d24206e829de475e890c3eacd62197500c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96727f04970da4325c70768419ec51ab

SHA1
1ab566548af2006b8fadd0ff2e5dbb51979b43e0

SHA256
18a670172e6a80847264f39b4c76e67a4530e69691e14eafdffe93b843c9875c

SHA512
3304f6171dbde45c6bcaf14dccd6a6da0376dfe0f620da404a157de903aa723c2f8f742e2d9ec4d610c5195d9843417793fee295afac7a32254f9ff418f07f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d57379aa0d91bfd61fcb3ddea963dd9

SHA1
4b1dd90456cfe0b49b5bbb439991df993c4158eb

SHA256
46bbc0a6eaf0ddcdb58ed9159ea1e176a5d42c569a458a067b1ae1098ea04ee8

SHA512
70fc605355ba9461e4531822a74a408d076f373fc51fd42000d40b04191ffaedb84bd25c40ec3f74abbc873a41a7cf405009c437d007a4d0356868bfb17509dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a63e848b15abd20afda67cfd877588b

SHA1
ed3e4523346f332031c698ee224afdbae4abb279

SHA256
63a2dd3ad3e1169ea6cd77b2db70890bf297680909068fc7947f0f567c9ebeb1

SHA512
b91de6d88f158fa38e113feadf6f60c411750df94079e87a53674c72114c4b8c62bf0e57ce222794bc3f4692ddb52364d6f79e5b8ad5483ab48ce1d0491c9f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
627d3d32f3421d997e54cbd706abe06c

SHA1
b0e9b0a1beae1bc09924fb09b5d44b3f465eb9f6

SHA256
3a4169cf744a6a7fd3076694c2837be3928c10a0b8cb464dbb0394b9e23be975

SHA512
8554c909a42833262d13aff9d605ad8570786c2079373e5ab0e03346777bc885d4038fe70744fa11fd0f94915cbb47b97a96704c3d2ed9e8eb862bd62b6bfd94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9a070dcccca43ec79fcc7de99e6716a

SHA1
e261e775b1fae7b2f191a3076e9c1f10dc1b2191

SHA256
5664bd5b5e14d8caff0aeabb6de5b8db27defd63724c8602dbff702e42abe1e4

SHA512
d768c630fb29e94537ea579548dcf80a9c1df7ac09f580ad255a37c2e528043725c824c02702dfe74a1e2bbd0c5ac1a5c3e30b6ae335a82ad60496cef1634b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a56edd050fd903104640598a8a3c1c4

SHA1
9ea9ece8c2aa9ebf14c89d632113c63337593482

SHA256
e864bfa95882a8d8eb23704b650e91e439ddc283416ca3757008168165e12245

SHA512
556a91eb4e61a7346cabab05e05e00a05adf3856d1d9194e2ec89ee578039e7e5ea6f744772afc3afb9d9e9d368a66efd4ae314b581e00045f1acd6b19cb9b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0ff0e8300c8cbcaf9bc6a9196bfd3b

SHA1
05494fe95c9f5148ea43c0ae467d5a1efcd6dbc9

SHA256
76f523c17ed4dfd32f5be89718fd532653a84b1ab9f3164e01c1054653ab7eb6

SHA512
acf505a69a18f0dd892eb7d3ac16913706b39044996fd0041d8614933f2871bf25212aa782f2821958533599797c65d0b358ff377537fb05c62a6de9377299a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA10A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit