2735233a041d0284b1e6350b213ec324b284f06fb998290e18f61fc20a07c0d9

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 21:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f6b354e07ccc5c9bc5191d30238e5e8_JaffaCakes118.html
Size

460KB
MD5

8f6b354e07ccc5c9bc5191d30238e5e8
SHA1

1da92a93a333915b0aa916fb1f4a58885d450c56
SHA256

2735233a041d0284b1e6350b213ec324b284f06fb998290e18f61fc20a07c0d9
SHA512

b4d6fc8cb80022a55b6bd91429120aace0dcbcfca6a284d58f3ebb5fb293857de0eeb8360996a92e0fae96ced3475ab90bcc0af696cabca137f0aea744fc1fe5
SSDEEP

6144:SfsMYod+X3oI+YsTQwsMYod+X3oI+Y3sMYod+X3oI+YLsMYod+X3oI+YQ:45d+X3ux5d+X315d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC15A7F1-2123-11EF-91D8-D6B84878A518} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423524177"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000009393f028bc900f868176086e946602201d4e8cdf64d3ecc7c5491e3b5205ea56000000000e80000000020000200000009d8fde6baff9adb65d82441188856878ecf0f57aa9b3d7b5a7c3fe76c60301eb200000000320dbed0c47171f00ae7c212458e55321d95136e001fec444cb68a828e5c8c1400000009c2e6d866ff6dc2c67c0f622e97836dd6c00a1e5132861002776641369345eb6cb73d5b2e6484fe925a3fabee76bafe5f9a8435845975fb621d2dd1644cc6e75	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000058964a39c5f7389417bdeded791d14710416c20a3ec3d71e1d08d437b3f50f89000000000e8000000002000020000000df9a64fbbd11123152f9c483f9c5a94b02a8f7ae2d273e1fc6dbb8a6c46e86f090000000c13271b013b25f275243b11d0607ac05a7dec55d21bbd9c292919bbff84c3950787cbbb73a4496d89330bae49bcbc325dd44e299de7f5ee40c20ed11be85a2000dfb2a00378ca4b3be57769cb7ae158f7852193a08f380f1074b6d788af4c8bd8858c12f9ff78a9cfbcadaccad9a19f22ffba61e343d38fc8db13cab5ad1dc5320859f06ac257c29af3fe97270032a5540000000cc7150eb0c39359dd1fcc174dca67497a9808cd6a6becafbf04c1944c46d562d1c8b5ee8deb7bb561ba51e1e55571e30fae5f06cc7b0cbc6d1e63bcf5b5afc0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2033cda430b5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2828	1704	iexplore.exe	28
PID 1704 wrote to memory of 2828	1704	iexplore.exe	28
PID 1704 wrote to memory of 2828	1704	iexplore.exe	28
PID 1704 wrote to memory of 2828	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f6b354e07ccc5c9bc5191d30238e5e8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8afe97001c848ccfecc1b9fe512b16c6

SHA1
ebce6cfa155106a371956f436e85944f53f1b365

SHA256
03a6b13b71de5b6da7eee22b257c16348089bac43bc40203b15dd67932687336

SHA512
a2c4318b24a16d51127c7cfb0c68b716bc62bca8f627266e2927ec562516e338576ed60b361d99f5e9e5c1f81a6e3591dbf88edb4bdf15c12317cc44b7658622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9920c64d3430d6138a7bda43a14d291

SHA1
a2913271a79baa4a764724b309e6dbd950ec1604

SHA256
e4978c0d88aecc3305bb65966223c124067db32bc9334f7986fd50951808473f

SHA512
0f432c857dd37f54ba511356b7053cbb3a44cee694e2b4d96bbddd582a9fa832e0e0eb14c8fcf88db0bca5f77ac67d060a97e45772b24085498ad2f540619f21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad8ab907e84192573185e3b15171b656

SHA1
70fdfbccaf884434a37e2765559ccd8ed53bb8e3

SHA256
c423f163940c5d1a0c1067f7dbc755a00553eae5670394d2284c6f6bb62ea20a

SHA512
2e9a1ccc69e2b2ea2b82183a3fad98a9b1c6eba6bfc5974a79d72658e932b1d04db1f3cf9781a625f2e01fa4b38e4bb28e9e061dd371dc3d1b03b82b7c4a1208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2445cdc5f8bba94c9bbbcec88c43b74f

SHA1
a8f4aa0c370f0a54b89a06de04a4312cbe1e101a

SHA256
397d8475899b0d9d684412718abec5fd74ea16efab2712169b1a2b8fac0657a2

SHA512
c882d8fad408fdb534b46ad1c8e00d176ac015208c544f4b60d0e3c2baa9a486779aa4b3454e7de9105c24edcf45e01a73449b094ae118fa283550b274cf3fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e5b644347df8811bfba6f32532430ec

SHA1
4f286544cb5246057e3fe342109bf2dd4cdb8d33

SHA256
3e92a8207bf285d0b56b88fb6568f05ab21787782910feae34317b9dc5515460

SHA512
9ff8d7c793aea5534c1d3fe0e7964d6f79c05417955e684ea4f15ceb31219bed6c55af8cb70b7b1ab3b20cde017266daa37eede148600885a7d3f6a67d0e63a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a19f27de49b05d53662c336775ff3d8

SHA1
9cb9fa5ed85560710a74eb52a579650ef4ed689d

SHA256
32ffd39e181b68a3f06bf7774fe06dda04436cf2b6ad5beb1fe59ec5fd137fd3

SHA512
d6e7d757176aa4a3e62622697993792fbd9ad9f1b86546c30d1ee02b9535e4e1f11e0320400076e00cfb40bb1ccaeddc859d981c2283c518c85aeea1b68a945b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e3c42e49c9a6f89212d479a3b06dfb

SHA1
e8e7d8939057143ed5970a3b004bbd53673d8e67

SHA256
5f1962313325c6ea75b69d241bf5718d0c4f42a1973aa8aa28859c36a261030b

SHA512
7a218c2a1c0f4e656d71b154f55d31870088f38f424249c67d5ebfad8aa8376dcbd7ca0dfefe21efd06c73353448b39b266640fb0786acac89b81cf6621c6039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3e804c2b0e495dffef4b354e80f4a87

SHA1
f001b20e2c0eb57c0303e01de3ecc28b7eca7842

SHA256
5d7cd63f521ebdd4998316d362290c0d128252b73dda3dc700a0744197633381

SHA512
bee486b87b49c6178254ddfe50e534c59894351138f937aa97194ea7cf6cd2cf598f4da81d242c90e9e6555d9f768a2b6f5a5894eade310c7aba8807bf1a61b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a504c7616d75a133dcdddc5fa7fef4b

SHA1
68881190fa0d9865c05d26ec18389eb8b5e3e90c

SHA256
092d4320e0e195cbdda1122ef861f00e0683129195df3de087e9ec32007e30ef

SHA512
695f4dfe14c122c2555deda95ea2c8f6504903580205d61a58cd4966878c9b2053b5b40b7fcd0a0b86b24dc0ec47c09c055bcddeff231a47c0027cfc70f6eaae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adf97de1837566a8884aa80481cd67e1

SHA1
87b2c11745c2586d2dcbcb0655ba541056ced6e9

SHA256
b57589035854bd6cbfbceae479b5ceedc341a03b5795cf2295880dba756ec929

SHA512
9b3342b4ae27b76b1e349dcfd095efc0787bee6529f6ef5892e2b7a5114a1836dea10cb09dd6b3fa2f07837635920d2230f9cebe7ecd7a8ade88e4f56e29f19b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7349afaae83635de9509ad61d32da401

SHA1
74dbad507fa17b646c78963f74e572d0cb2b1d2c

SHA256
552e8dc923e2cf1f9c28ee468b05e84af3b163d65049b514ad758f87dce1fe1a

SHA512
a185af7d698837a92744cb534dd2625c7d69a5bbb595e493c9fc9477d0d123a1052f93bada5b0a3c964f95207fa3d51ce80f9695ce08bf6cf93a05f22007b8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab825d22adf10526a0216a052bb3a66d

SHA1
af4d375a9914ac3cc6ac5bd67af5f991b969f2b2

SHA256
cf259ca94433faa1c11d9e8dc670dedad74e4490f31e01d708bd85f62d83f928

SHA512
2e58507fe8c35a2e2456b54c6aa93d44fb67c6824eaae135227b8b5a70af983264605dd3905469e0b2d1578228d851410e72bad22b71a55f61f8aafebbf28ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ffc23e713b25ac56b7c02872398a30d

SHA1
b164b73ab961682c7f95ab4f795e9f4258b96071

SHA256
99feacb7845e51a446de11fb9209e58726f41f1b5fcdee200e2d7e07d4d14c74

SHA512
bcd658d8cf74ab5f3bdeee023eb6a066b3695d8e7733f279ebfd112ff3b265401569225898d0b72db39e9ebd14e5754f1331a597bf2b7833d0b1c76c150b8afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab473F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4870.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit