46eec59ea3beb50ab28092fcbbba53ea46f68e95dff62a5cb76e0b87f1172a2a

Analysis

max time kernel
143s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e711a282c273d8c62652d5fe247e904_JaffaCakes118.html
Size

139KB
MD5

8e711a282c273d8c62652d5fe247e904
SHA1

a8f76ba2883784b6c45c343af86b59235000224c
SHA256

46eec59ea3beb50ab28092fcbbba53ea46f68e95dff62a5cb76e0b87f1172a2a
SHA512

2daadf493bc9fd04f471872f344e122d9010cac8e92d5ab36bc62b85db8f5bb3d8899d1611ce5d0e1c7005a6ac2992f43538375136198b17f2dede70c4bef05b
SSDEEP

1536:SW3LbulX1UkPHPlxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SW/8ZyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003675df1025959647a01aad72b169269700000000020000000000106600000001000020000000d4d097cceabbd99d18183361afc3ebbfc9cbd46f49109a51bda895c7b2a730dd000000000e80000000020000200000006b9fc520f42f5e53b791d3b357d18203d5e1d9a866605c93119d780b863d679490000000d46f67ad60ba0c71526fc6dae0ac82a7308212a952f4fb62b6b09278c2973fb5fb7fbd707625bc22b80e8faa0503cd4abfe09b0ba31ccd477713329d21b6bf1d77cb7caf480e154e818d4e36dc2fb3deffffa44f149b994b8cef0fd12f71e3d6010d1e6b6ce9781440a9b1f4598fdc5cdf927ccde77af2d053dac2db31643c053c897d443e89dd707b1eeea32b4a7d54400000004701ecaa8a55e5a4c3ea6ae142519b1a022f913302aa85ab09865596718477c6ce1c72a2c2670ea168db8fd581a2c56f6b34f2fded68c49c67a51f092dcacc5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423501524"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003675df1025959647a01aad72b169269700000000020000000000106600000001000020000000a5616aaefa458625cc2ec0b7e21da4a248ecfe22a28ddafaaba73b9de78d3bd4000000000e80000000020000200000004db07703849a10dcc8c8280d3007b63d55f3179ffb5692892835a668068ed71220000000a34a28611808ea01691148bdd33034c577e52249a9457d96f2234feccf156f8240000000d2834704a9cec891c2e19dbb21876307ed3d8083e100222267e7186ccdf34ca7a29209e59bb74e32ad107dc584a27962571c45e0116727befa85bb075dc65b84	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d1c620fcb4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09B9D931-20EF-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1176	iexplore.exe
1176	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2632	1176	iexplore.exe	28
PID 1176 wrote to memory of 2632	1176	iexplore.exe	28
PID 1176 wrote to memory of 2632	1176	iexplore.exe	28
PID 1176 wrote to memory of 2632	1176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e711a282c273d8c62652d5fe247e904_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b5db6015c49cb5a2edb27638b218bf4

SHA1
d81494c3c5c5789bdc0b9268981e761153b6e2b0

SHA256
dddbae1050c57790c2e89c75e564013676b06aa2a7f3c80c7121ba0f53c8e55c

SHA512
18e02c10a9dabe1fae581fd2d5c4c6126f2ee3ab841cbe12cf8b82f07f2644cf05e60c17809d7178a173ed061b88c9a17d570eb8e7014c76107107491bd8577e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57f5b2e04136fe00efeac34cf0f04bcb

SHA1
7ff8e0b569ed9208d0ad6e523320c365f838660b

SHA256
6243fe67cb6b0e29bbea25225ee4d9258971db8d04cc3e61ad737eda9136e17a

SHA512
f66d7fde3449dba29b5a17df5a0d697e31ee6a2ed5f3d7f64129050ae3d988b5ca7f808a9cc601047be25ada6319ba194a8a42e9dc4b23b9d9bfbe759a781cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5aac76ec9af8e15d17c130025b9172

SHA1
fdd6cf46ca905818496c82c03f786db0eeb1de82

SHA256
1767caedad3869c951c656038f5efa2dfb63a9a4e26d25af9ee8c95525b110fa

SHA512
dff99542c116ec5c8de1774edf642a3dafbb15846383bc921ce5ce3e236f13ac84d43ec2b544f008eee3128376edd83c2a31676bf0db48e74afe202463e9b2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0998623971fb0175ac35f7b9e278984

SHA1
00e8e87f9696248caebbe3cb95cf6c0cc98c07e9

SHA256
e2860b2afd081f3087d665d90390ffef20d588387b1891b1c80d64030348bc05

SHA512
0486b9026c100c8a84d4f7f640f77de873cf21dc501e33df0b3fba9da50b28907e01e2dc119359bb2a8b162f61bb932650b94c03039bb09dd7add17dad7da32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa10ab76c273862145e11336773b02dc

SHA1
23ceb1fa078fa15fad11d22a0f669ad11ab409d4

SHA256
0ad18a194dc0bda0b760a7ad6c2f413586b98cae2e6fedece3227eb5a8117849

SHA512
e5a6a1f6a52fb0e49eb2174ea39881f0bac6a3c6eb9d897d0d552b65c937bc69ae9d9db63ed509f56312d370fe4ce7afc5b1b0474a03465a04f4bfebd825a4c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ca05460c250ff5b15f62ce08326b666

SHA1
9fbfd4ec33c80c96af523f16e020dc34196d7de7

SHA256
0850c601ec9f58e9c474f7aa697b6016f9bc241d6dab514c2c537325f90b8ee3

SHA512
0c2439ed3f5e54baa8c3e8ebe7b2e5c33b14b4b775ec62c1d18b00677c78f70cc93566d830038dbb85a14570609ce929586258c83adbab3ee91b04f4008122ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d52faff17c4d1bd4d37a76f40395e18

SHA1
ed492b82d7963b6fdfa8895310de0b7d509b19d4

SHA256
2e0eb350a7fc1d8ec05ecaef8c2585c78057bd8efb06ee17b6719990fbe4ecd1

SHA512
cbdb132ac2ab52bc9f6a77a5c9df8830d6d63f93119383bd6926bf7fb13a993e43105e4f8f9093761b4201bbf464b5408d06fe2e0449ab8a53ad6f3cd8dfb512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d50f81f011323a3817be5f1938261243

SHA1
161dfada3a4dc9e48562a9f37df1924bd1d36a4e

SHA256
82b571fd541fcd9ad97ea255168c636a08f3257950392a6f5b87684cf367626f

SHA512
e41a4e72dbc63bdb135482f1bbbf376db618a18496c51c3558c5219ede58105e2c1be8d3e12f6ec982b78064153c1fcfcfefff1c92698e5567350665adee4061

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00d001e60b7af891fa5c22237fe390e5

SHA1
1bf49f4e11ae42f27bc5ae36d39f024397367234

SHA256
a1405b923029922af680a93d9f6b51b7f594ebb791a933cdad6829ccd91cc094

SHA512
2af21a9fe6d5a1cebf7575400574824a5d947c901d7a8a9fe2d2189a5b4f2b85c7544586bd7eae1908e51f242bbc28d34320721d06d91ba9b2ab041478bb5095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e1333679af4fd4242159723c7a1e1fa

SHA1
14a1f13305a8afb7658515b8b5712809c9b20a11

SHA256
298550d7ff80170bcdb8213f8f2e03fd7bea83e9c4a6008f574b46bac8f2b20d

SHA512
67436aa1554391a87e799e1f75ab079ca366be5f3dfd4798a8b69969d7816c0487ff6121e5d05f47032e5f4b4239d01d259382b18035b8147e25cf4467217013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bebd882bf81bc9ec487adacc62f5934

SHA1
822d17267bd8780bebd1e8c9f8e43e0e8bd8d657

SHA256
26be2d4fbfe512783c07e95d699f6544e498ceb6fb32dcf06f982de1a40d0ac5

SHA512
8d4787f995ee645d8fe58687f2b0acc7241fcfb2bd641481655de00bc92498de5623f12b65eb1c6e5649d7864e9672caf2cf9ae4001af025e591bcba4d47ead0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1475cc660b7f80289be5ebe58f19bce

SHA1
dac80fdce88dc8c2647214eb5e095a876f4e2a2b

SHA256
803f1273ab88b13bfcca78a3f6a935bdc299010bb781ba19b371ca9a77a0ae40

SHA512
6722b840168891fdfbca1843668db1d46af6ca6e83d49ac1261862e66e9959d26c692b84f04b65eca00900610736e147a0393a0deff7252169a88580aef19234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe4732bf85e8c8a3f382234920ab759

SHA1
6c85174af5f4bb1ce9e7c8797c32cea8ce61d21d

SHA256
b3182494fc8e59ce88525a5295674b163f262ef42c266c1f7bcf22d99ce3bc31

SHA512
5e78e5b3e041cea66535439551d5bc710621ebacb4fa99291de6a5368e68f20517b0f3a87d6ebe73fc2bd7879b4597c8db6c5c25e60a1fad413eb24aacd387bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08f1a91d1a525b64bd1c69d2d94c1cd2

SHA1
e84e00867407decc1034932db1ab724ca3d87749

SHA256
f8a58e3c3aec63663428127ff59c3b788bc706ae6448af13a7042d59660a104e

SHA512
ca6e59885ae1c45cac5a488f441108d53e97eccebfd3af0e582ca3d10b0ad03b19a0f5df99e426396c110b20e6a71eb004e2a03578e270d5a8c7a5831ac64ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA2D6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA962.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit