5829dacc8dd9d8b453900823c71e38893f4a21495fc53ba65a62b15b224adc64

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e97ef097f6f6c89cdcf5f24914b7cef_JaffaCakes118.html
Size

138KB
MD5

8e97ef097f6f6c89cdcf5f24914b7cef
SHA1

ca299f7785519ed5c670d4c39bbe2c8b25cac441
SHA256

5829dacc8dd9d8b453900823c71e38893f4a21495fc53ba65a62b15b224adc64
SHA512

89e88e3507494cc2eb142e0c58f5d962821fe35a733d4316e8815952b60f7f350d5e51cdace9e34c9df291032c522ad04bdf3fa2959317c17a93b091737a55e6
SSDEEP

3072:SadkEhDNQqIRRUeA5IT+wyfkMY+BES09JXAnyrZalI+YQ:SapsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004a0452a3dc95e34e89b834650545a772000000000200000000001066000000010000200000005e570c04d8d406e8054c3067fcbbb1a673798d60e91e7bbb02d0f98b87e5ce3a000000000e8000000002000020000000a4e8bad0c87dda4788e5ee89a0da8b8d76d72daa9e0aa2ff4ee458fb44eef7532000000014f1592e2d544ec26613783fcf8b0f384ae67c39a27ffa9a02c1befe2195566f400000000f0ce8b9d412079b67312687798be191b232ba232cea71a73d961c23917d04c6978efe70c1a4c9193a4979296750fde0f0f8f77519c5b69f482e3e09d4a31f00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04416BF1-20F7-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423504946"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208fa3f403b5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004a0452a3dc95e34e89b834650545a77200000000020000000000106600000001000020000000d0d1f9f6ad235a3eb25a0850d7337ee3a7d98c055b59e070e8d3fdb02061f969000000000e80000000020000200000007905302af05e0cfa662c20908b9a039122cd0510768272fb11339b3def05a82190000000dc45534f5019cd9e40eb56c43a5f7e55f6689d33800b75eb346ce7a25098d975dc37724b7dfb839b92efe81d3b9d979f9398d608952d8b721d8b2078b217d082ba92365e695adb7baa1de51c04d4acc47a673e5a31879623ee138f496bbefa7f4ab0ff85572c36ca07ab8079f81fe5acbc71f3cde407c159e48e437a4a26f8af420db9924ff953f5184c1522ffa8a9564000000074421a433a53644913929a76ea5f7a0feae1c403dc6cd7794f8e81a8ece1b9df6e8a45fbee49ea9ae6df037aee37d8c02722694b259aa2c077c11a165d1e71b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1556	iexplore.exe
1556	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2300	1556	iexplore.exe	28
PID 1556 wrote to memory of 2300	1556	iexplore.exe	28
PID 1556 wrote to memory of 2300	1556	iexplore.exe	28
PID 1556 wrote to memory of 2300	1556	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e97ef097f6f6c89cdcf5f24914b7cef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d715634cd530700afbcc617f4cf6db

SHA1
be43ce0fec601edeafeb7333e7f5b1e3252418be

SHA256
7bf97cf444b7ec6623dedd8937207a0e78ce18524af60f904a5b417f761aefd8

SHA512
cd584681f8d3056565d1d73d5ba52d5943f75d0512b4dedcc4559b9aff95011128ae41b7cf9da99f2a75e75dcbafbe7aff80ca41f851009c5021035e534bf3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
460efb98d80d7f9cc53d3e7ea4cbc3f0

SHA1
8be2b3f124d601f4a2c0db23828c6d919db8fed1

SHA256
dbceb379e7f9bd649a9caec0f99c50c9e9a7f065fa82a50f32f0aeab0e06e9d9

SHA512
6feac4cc200c91d01c7aced2f088a4c8bf46fee1c8db7dcff28b88cbda4d1e19f21a60ed7d350da6632e2dd85d37c06c394ed7fca0833432e727ad8e432858e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b638062296257f9a2d04786c3008edcd

SHA1
10b8bbeae12c3e55e9dea7030a2be38189855dc2

SHA256
d799254c05bb4b5007d9f84a5f80c35a9db5a239194c2441be475bbdcaaaa20a

SHA512
35d091144c4ff8a0f5d4991983cb2544990066f8d0eff03656a165db63b8c026912092f0427344f57f40b34323a99c0709114411eff479869b45e4f6692bc633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23cad60de84aba7eb5e0eb43df580b60

SHA1
0a403918f0722814605cd6b64eb2c1a2dd3a292d

SHA256
2e144e31d961693ebb57c5fafb67e490cf1c42715687a22e54197e3788718d92

SHA512
3843ac3cfd2564f68bb84a6c6ba595bab1eeca507b0c16cb24642e2fbb8da875bae7eb0f5ba39f98ffae766bfd2f6759cfeb9307c49591a1920c1ac7d0cd36cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5779cb869091936ab5c00087bd1a13a5

SHA1
6e22b506780e55bd66e3bddb9908e703889a4c6b

SHA256
77f04322d92fb59dc5f7b2aa33f9cf192f7709bec40bdeb554e34c5fcc1cbed7

SHA512
5139239960a6d65219becc4961bd96d296c33a97fe3ba070acf15eaf034fa4ac25da366a871db1d97286c999cbe009baa7729daffd66bfaadfb915c9a6e4fa7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa5a71edb2a38eccebdb20710073cd3e

SHA1
69fd55d1b3aeda9ef506651bc1d4799977a4e73c

SHA256
f6c5657634c45b05307f8b1ffbbdad48ad49a60b5cbb86cf6063913d3e8a2f33

SHA512
afcb91641bd4a4abfe809d08c57b359632da742cc5092313b4ba446deeead975b3a4e60db226f1c6ed50b47ca110fd28a6e0d40ecbbb6ca9e9aeb9635883ea5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d02b5fc4efb7e1956e691546fe0ba03a

SHA1
b4d2f90391d5a6b1940703c299bc19c99cfe4110

SHA256
d07917f597b56c5b833f2175587bf23b2f69d5b2ac536da5d0819fb8d09a0a5f

SHA512
b06afe5dbb97ecf0a0f0ed87b10f204401ba8cc37f86297756b90a88ee2409d324712df8bfee1d1214b732e902d78a7abef4fcaba8569873cad3b41403d7300b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebbfd06c4fcb26744c9c6513a89cd3f5

SHA1
b3534b7aafd1e6e7aea37df1570107b6eddddfb4

SHA256
8d03704f91cbeb7fb5c79c4257a1748b75ece51f54ce27a9f18a2600c887d666

SHA512
8ff4a5201f2d63a3a3834247a378360df4b2c356f7143573f3c614f6a7074d6107a0711e4e8c827290ff5cd9748b39d4cf483fc4905248e9c59b9d2807c8158f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b47034bb2d146b5c8f0c22d6aba957a

SHA1
1908ad393193d5b3f9a19a3dbe0cb906d71ea961

SHA256
21d860a7f7d71e227c9dd4693d5bf4af52d2ee6be5b33c4170a0e76dbdfde331

SHA512
8f0956e9c7434ea6fd12974beceb2198394051a89a96e975afddd0e0d58aba46347be27ea3a099e07a83611a7ed708b8a87d72bee954a3130e44eae5fb0871cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb20aa031e170f007c5755e3b91da70

SHA1
2eea526920eacc6b5db458c59db915da05eaf629

SHA256
4872c0a5cf1dea148ea116974a30666d78c83c53e956c99c0ad09d24334cfc39

SHA512
00777036720928e581b20fee52f431804a83fc7a1dec105bfe2d41621fad7663f509f9e2de85751c56a805554bff9da7459411b4e14ca938f9c07f98bf9a53f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2af75c2a3e5321f63f3f12c803b2e600

SHA1
121eb5c513bd0e7879b2772ee81732d0483be6cc

SHA256
ce6d9b2d834da1ad74f5cdf72004dcbe3ddad114a600044e2b120c9b7cbd8fa5

SHA512
135484381a67ea031603d356dab717f271eb85973fe24b5058108edfdd8270cfff8663e1ad7d03da7f23f41350d79bd05bf80e3c430ba2aa932ee33abbb541ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10cd6e48a477370da74ba66d5b3e98a8

SHA1
1561ceed9e65ce3c47af888973590f2309982c5d

SHA256
0fc9d4899d8e0ba391ec53f792e6b12fbbfdbc932748d83be44b4021fd3f0c34

SHA512
6a69cdc5b4d30c7ab9177da0a8e55b98b76d350662f775bc4b490855de3f4563b8d0da90b272cc4945ba8a89fa4b007fbb15cd76f33716c36de3d60d5bc32232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4104fc81c5a3915765c72da8fc59efa8

SHA1
f3ebb92705e939ab782f580a9a1c40416405f877

SHA256
030caf39b5d40ba91f4df5b27e864b97745884314c1ae6975a7009a8a7594571

SHA512
5f74e4b0e73a31bd9bc9e3373b6a234f13f528ba021d2a658d2604368dabc996a1c5cd7ce7592bb849720afff21838ca083d07c4792966ed2988604bc041ce42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bef1516368717024077531c372567b3

SHA1
70f7e8aec3b317b2501ad0ba47d5771619f7c1b0

SHA256
1f71fc6f3a6691b0f11394051a17864eacb9fcaaa14d6e35c6721786da907302

SHA512
d1feda5805c8b832d764b3121827fe30c6b154f5612abbf2a6f819f966b7fa51d06a51e3bf2d3531256913b546a116925852c223ff8cc0007bff076db082ffec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1da74c6ca35dbf4f31f4af7cb742d903

SHA1
fbccd8019a510b6096e78aa8dccbab8756c87429

SHA256
c88533b1a58b2e23d0deceb22fb359b40eba949c39585efcf476ef7b588de452

SHA512
37d7690de72bfed0a877ace98d83d88f93ad012f127bd8f98df0b3b50231a62bb5b8006cb562369d3a26800d58d6fdee0e6247cabc696e367f425cc7f4779f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab766A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar78C3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit