d73d9f10789114d5deb7ecfdf22a7670f9e6e6e80068d6fe177d63062962ffeb

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92ff80405c7e3792ada780dd8747399f_JaffaCakes118.html
Size

764B
MD5

92ff80405c7e3792ada780dd8747399f
SHA1

3fec00c4c7246e5178a914f530955b4ce1ea2378
SHA256

d73d9f10789114d5deb7ecfdf22a7670f9e6e6e80068d6fe177d63062962ffeb
SHA512

b38c1d1e98751bf43c3dbdaf30c01f4e961afbf6473e3549b2407a71e0b9334c4832ca243b1ca435837ff82b2cba9027d8972bc329be156f54f169bcdeca2859

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c84afcaeac380b4b8e654e6ee0befcf7000000000200000000001066000000010000200000006586b65c84f15d25acc768cba916ba85dde4d232540a1dd471b99373ab6e8648000000000e8000000002000020000000641596837046c8172fb7ca76dca3f782f1d420fed8e2b24f5c3200c03d18b665200000001ba382654442437d3854676801a6a7cbb926f2f8891ebe0c8d855aba7ff770b4400000002551863bd9077a3fda8bf24aa3ee135edfd9f48a4857de6d882bc6cd4d368c718cefdd83241867169cfff98e08441dea89f897cdc075e05a23216a9a0c95a225	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AD60E21-2202-11EF-B33C-C2439ED6A8FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50510b110fb6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c84afcaeac380b4b8e654e6ee0befcf700000000020000000000106600000001000020000000648bef23ff67a51af2af0eba45f1030cd6ea8490678359c13265af32c40bc4be000000000e8000000002000020000000e7beb2fdf722459947305e758d5f714f116cfe42d2dafa10b0e20b6c05507db19000000022bc3edde213b92ea10ad691363471afd66ed096163502b212212290580d3db9f933ea1424e7008758234a6f61afd8dc7d233b98be7fbdfbb5e3c4ea0afe3e33ffb0f1707b96918486ac02d5f2325f58d816fabff0a170e39f4daf649e93c27020fd64ba05e21ca91d3a14fe1b6efb821c0ac038d624be6fe8cae574a9ba22d94818b81150a31993f32012556fb2aab740000000c7c7d6aefd3730e264047b4d542a0618918787af216384e38b7e4ff0c75121e6261f1cc37a3e3f8f35492244e8dd304e588267e530d8e627d4e5d4d64733a1cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423619739"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
384	iexplore.exe
384	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2372	384	iexplore.exe	28
PID 384 wrote to memory of 2372	384	iexplore.exe	28
PID 384 wrote to memory of 2372	384	iexplore.exe	28
PID 384 wrote to memory of 2372	384	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\92ff80405c7e3792ada780dd8747399f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
220759482110242a79504490e624f21b

SHA1
c89f254b5b8d331047b6782a3e7e4c0014e2da04

SHA256
ad163c5ca1aa4fc152c3012bcd425ea09aad4eecf87033c7ac08a070257d1869

SHA512
c84beb2418a6c0f26b40480ecd7bc6f168c5047598888f2ab96d5edfe1660b8950a3fb77fc1b45aa44cbcdf91e2173a9b0a511e36d03cec44253f4d7f2222cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70740a0d471406d0a4c964b41ca152e2

SHA1
26359b77695898f73f8d5617ca0d4061287cda0b

SHA256
28b91e9fdeebe1a031be343ece635b691a6dd6437dc986b74b52ac058323ff53

SHA512
4e45f4c622804934dac9e133d42fc8055092439656ac246df5e54856528204c16b6a4bf2978ad5216719bedf54cad6f3114f50f9328aa1ada1b9bb777f145e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f74d4b9ff96376ac606e58a53e276d0

SHA1
40e74883f4cfc64bec4116206f548fb4bad2438b

SHA256
7071e01bfceb4d1fd213f1722ddd418b31bad118a4fbd09d0a072c51a46afdff

SHA512
9db9b15693dcd07cc80622a5fa6c01ac18fbd8fc5d0a92d31a816b856ed19dc348ac1bcb9ee1acab3b6d7573451520c39f997889bc6cd27ad172aaaadb730c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44ba1ea711587cf0a55eaf9aac8a31eb

SHA1
75999a8db8b75037c25f5a40e5ba15c0ac7b18d4

SHA256
a7b984baa508826c395ff2408cec25c679c9b1a1c1e886b9807d95b081512a49

SHA512
98174a390aa4b516ae6d250ce1f5a29e7c3f5f77a1451931111019959d1c08e11215d920bd885e9a9e8e307e004577513099b7104d69e7315ae7122fc1444338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
027b89bc9a8a541e234d83978ae99873

SHA1
840e60eac5628c4e4e2aa78da504662e94f647c4

SHA256
962e0e831d9497e04f1cb362626f80a7606d795b15b3569da40078626009d203

SHA512
a7a477e5c8791b918024abd14025c52bc515739e3b0062d4f3c0bbb4f414c2f99a81e94da2e0c3f52425713a4c4a11d08860241e64fc2125c7829fcbdd8d3eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a649edc6e07cf9c99874d80a78458714

SHA1
125dc96c33c983cff5fc882839180a8e1311f0e9

SHA256
4f665379d1c7ec6388d02b8deec24a77949e12eca927c812d2c93e52b9fae061

SHA512
9a985553fad7fee3c907a3f3d4089e5959eb72c5caed4bbd4bf56a91e50c6d2fcddd858a74b8dfd2201eae970f52fe5bf3835ea143b9cb3e6a168437e99441ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3819bdc7e3851f873f367d8c32be5508

SHA1
86434921248defaed58364348e71c526f6eeb093

SHA256
fc95cac64dc8328e584b99e9e34e3e96e3e36e6aaa176eb5f9bfe4281c79a075

SHA512
94ef38f7fd5f6c2b0c29af2ed30863fd53d28e371efb8a7bcc9b3830dc4658b2f1c65baf63fd89cf76e5350fd08a748443ff28f2e2a5c781cc62c09c37d6525e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80c0eecdbc46889f0060a308f7c29809

SHA1
ee3cad69519c984bfc2df341c897d2077a71741b

SHA256
dac60dbc2b342554c1d283fac6ed6b90ff8548be35fdb5034930410c60196bb6

SHA512
dff5e111dc1cf99c71ba06b803c3b6fb091dc3d1a589e19cbb350dae5edbbf6f503720447c22adffd1a83d0e23a5ff3a7320e939e2d382b22d007ccfe4406d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
009839abb278c66fa949c939251626b0

SHA1
dac0388efa0e9713ba84168a20971edd8fe8d4ce

SHA256
ce51ee2eca827c9d61001b0eedd5a52a436cc7c887ceb2445c19362cd37ee2c8

SHA512
121a1ae1eba68a144e5ced850077b74fdbbb045c79dd8a224af404a16e4d27d188c9a6f55b2bed37d52f5c2695b0dd92b832ce10a2788beae2d5e16c111b3bfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
576ca608069335a4450e8d94f62e9329

SHA1
3ea1565bec3d04b6d4302917c70638c7157b23b9

SHA256
b8dc888ef36b76f8f36d55569abd05f7c83f6bc4c8c4e9acb6d35c9f81d44f7e

SHA512
90dbf4dae377ded65e84babbef2f4680d7a821011b5d95d1a0e3eb2728fee569f1512047ac72a29850bd72f19588d8a3673d3cc40165ec18e84f5c1c0c80196c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fff127aeacae04c0bb48537a4789f28

SHA1
12c1b42fcebba733fdec8663927f930143c47cd4

SHA256
9a6374441275d3f76752b3d30e28f0b7ea4ef6dbb1521eda6351a05ae3029064

SHA512
9e0c4a4bbfaae96b947fe95daa2859303f8ce2a191b1dba45b73b88cb008220f633c55e79c9fc70b7ce4922973381de5245ac1e2aaacd42db11c0524fcd8cb96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a08214929c1c54b313e1044f16d2886

SHA1
c39d2468119c04bda66d4c935aebc4667005c2ec

SHA256
98431dbad1e6942c7a7212f3acd47d71ed73239ae088970322ec2fc77bac768e

SHA512
ff89f3ffd88d1a340239fdbe0b944a3eaf42e5bcffdf1641a162d80a2ee43f8055a37951c85f60d5bb1920237b59687d158d4e91fbc3e9e816c1add12232586d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c04a4e1b8b3c52223ccc7c59371337a2

SHA1
642a082e08ca4d7dd19b6fa5930076cd93eb0d32

SHA256
0f357207ff4576b43b1ebbb8b073dd182c793895e530bee90dcbd734fc3e04de

SHA512
59c428f138047630603ce72573ffe793f4decca4182f4932ac7911cbaa1b90cda3019d235b0f9f8a2afd5cf711a80f7bd82c23450b4fafa21fbcce863e55aa0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6f00a4a8f4bbb3a0bd337a261326490

SHA1
557b46ef8a8fbd256e88fcc3af4a9899609baae6

SHA256
8f73481150253ee83ae610948cfc044c0a95679f9bb695e32a3ca1803f11622d

SHA512
2239035415c1d07ec0898ec20ed1e5bb4032c41192940c11a79534f22dc4fc9facd13b52d70723f05bcf9dd39738993530766aa9370ad595592fef915d4fdcb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C51.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D32.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit