29ececfc6b3c38405c6682689522945fa728aec223bb62cce2dc45ad950bc916

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8de842ba53bd042de3772d357b3907f4_JaffaCakes118.html
Size

38KB
MD5

8de842ba53bd042de3772d357b3907f4
SHA1

bf70ca0becf57ef3ea9990b973c9176d77140f01
SHA256

29ececfc6b3c38405c6682689522945fa728aec223bb62cce2dc45ad950bc916
SHA512

48082a889a062de3d53a1af40ef247e1ce75fd1d3c18f373b02b6f6eeca4df163e748806a5aed79cc3a4b4cad18cdd49dcc69ae0788e30650add50bfb9adee0a
SSDEEP

768:e839MBuGiDw2oDtkVDygdDGUkDGESDLQIDrNA7u/DnGcfDfM1DLwCD21QvDdbr2B:e8uuGiDw2oDtkVDygdDGUkDGESDLQIDF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423489227"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BA291E1-20D2-11EF-A296-4A24C526E2E4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28
PID 2268 wrote to memory of 1984	2268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8de842ba53bd042de3772d357b3907f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d47fae46b3e5ff12bc73116623969d05

SHA1
ec3ad4386c182deb3a9013cd2bdf49b028f6a386

SHA256
745f29fbea716bcbbfb297e529baa54e683870119f4a5ca2773be62ac2c9badf

SHA512
dcb4b8d4e858a90d24b5d4d1a6585651dfe822b9b41ee8761736a5391ab5f3572d1f501a18effa31bd7e7f867bfbe5b701ec6c25e3d695bf07ab550de6d1d334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfb9e0d5fb8de1276f2ef20287b465a4

SHA1
d0f8fb0937d2e3144095b913e9c09d720e3777fd

SHA256
e0f149dea632f6f6cb1c112649f30e6debf247c75e5bc582d3d31c7e2116d237

SHA512
b9caeadb4a86d2fa9132e0016963d06eee8a5a9e8c3f1f290ff7d8a9d11374b5524a822c28f14839a079d0c7e606a95635dd9214d73f04b9f81453f01fb4c058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5bff282757abeec804e47281e44ca1f

SHA1
d038b3cb8b8498671b4d777974f372d3be1a70cd

SHA256
0561e45ceee603a115163fdf92f61a194ef1615e4c352fd52def901b8893d2ac

SHA512
05b05101102aa622d293ed1e3084d95aa1514e21920f3c97f8b6034436c2d9e7a6d131d65ba0c95d63ae5eea6ab0c90ef2167fbd30f60841a49365f064b55e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36888b410bb196b4e5551a05fc73936c

SHA1
c4b47277014df3e1af09ea9c73135ad81f387127

SHA256
caff1ad574d1f1f4684a2ce2b512ae06de6f4d9b4f39d05cb115bf33b326d633

SHA512
51299db21310aaf33b65cc32972a408abffbf3bf36d0b0f98523c3d8d2d1a4917ade0328d824a4e12c00a0030329ad2d6b7e148df26bb176b7a9ac29268a52a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed94eea4cd87cb63f4ec6a652e853dd4

SHA1
87abbe9eee72648efcbd5bfd586008d132f6eb24

SHA256
d9521d043cf387a66c936edc723550c260bff6d3e5ac28f305c2c5d46a095e36

SHA512
94f4b0b5073ef1015c9a0fb07ab6fac9dfbac61284539c561d73682877cc6fe77256e510f0e809f1dd7035b69fc596d2fe3e47fe9a2dbdad545d6878ca3aaef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87da33c845fc326c15e8b85a984eee03

SHA1
03cd1e18bdcc53188494de53fdbd75999c61dce9

SHA256
c81fd212e25cf75a70e91e3cecf744858f4d87a137079c7c921dada36c38ac68

SHA512
a66a68ee2116b2c8aec80d24cb70c621581247784fcd83299979b1ee03ec8bc0ab61b79bb8f0ae875fef31c3179cb41e577d66507e61210d33f10dd16c9deade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be3b226490dc8829da341151f4f938b3

SHA1
042aa3fe4128f14d572d3dc6264e32a8e2e982dc

SHA256
a44ccb7ce679a3fdef43eab6920f064ea0df97702bf47e246c96d2c7bcfbe10e

SHA512
d657638e39b9c977bbc271231b6c420c50a943f8e0539fda64f12596031371da52e5ab6f9c6bf05331f6397195b90071afb825fb28a3a1e7cee3998c0201b6a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f58279253422879065e5b1f22dc1d1fe

SHA1
6541d8b3036b2d0d8e5ad674872b4bf71c3d3a5c

SHA256
48472d71f0813b944f43e1ba3af64e44397f3a89a1207cf71da37ddd76855a2d

SHA512
d7a5d069ae903bb58933ef8eb64112c8e50d64902a524910ffb3a17a8e074b09ba6c71582e1fdd0a3bedf561052488e8bd8af7a3c98a0b85fcc7ea98a2e3e766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfc94741de8fc981e30f13d5d64682d6

SHA1
c76a63af7325a3386dbc14fbbf8adec28f5bd654

SHA256
02a81102396664cb7e0daa231ca9b2b9587becb768e47ece05a31f02d20a0040

SHA512
a0962599e27afc5f167f5cbf4292ced898aedac92558bb91ae46160c620d927249fdd62e829a762c700ff2149904e826888d95b0e259ba2f0dfc7d496ca6c9c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b112634ec4cb2374043b0ba0e54b78f0

SHA1
04db990c79b42998c560c5de4feca719db4977dd

SHA256
0063f3feff465dbb322ef74d10f4f0408a0b5b2087602b84693be1d05645c1e7

SHA512
1e4edfdb6b170ef69769194f88f8a345849932e30c4595c1afe47474c1d056ef535c703aa44ad8b1d2e983af48b3323dc711f5c3b7308f091ca84ae81ddea54f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe79761b15931614f7bcf37049efa3cf

SHA1
b55cc886b68d38b0b15e2ebebe655e293b202227

SHA256
b512bb7432b13e4da72b1b17a72768d8498d53d6abf2048bb80963905c070a9e

SHA512
e361156e20017d570cff060ebc701c6c670688da0225c66d6ff8875d938bf8bb933beece80fc3419f35e698e24e539a390f1d95b9042cc56507a404ef9bd3fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
469de718107492e98a0339c762354653

SHA1
b9906fd62a0fb091a020994febc852a4f883cec5

SHA256
eb929a4b46247def12d1da17b83fcdaf4639528cfe3153a4edef77738eca532a

SHA512
fcf55e6d0214c51ecfb789ce3610e1dfc2da0a867dd74e69e693a764b02f9d1dff546c2ec478421fee0498488b35d7964b71f6c039031fbc78d3c408f9f3a77b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit