a6a8d7fe9f0b1aec9680f2592d304104e80a91d6e2689f3dc152ec4847312cd3

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff0f6fdba56e225aece34f53ebe5cab_JaffaCakes118.html
Size

125KB
MD5

8ff0f6fdba56e225aece34f53ebe5cab
SHA1

20bf83f6a57b90b1a145bf699ce650e157982254
SHA256

a6a8d7fe9f0b1aec9680f2592d304104e80a91d6e2689f3dc152ec4847312cd3
SHA512

5b93eb7794149cf8e84064dfef91bd98c719f36ebf107ef65d74b078955090ee879970f3ef589badea7bd5dd8afbd293f97c76a284d4ef00540cc28fca7fdb70
SSDEEP

1536:StlfX+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dH:Sv+yfkMY+BES09JXAnyrZalI+YV+6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506ef22f4cb5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423536014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac19a5362129a74798c3a3d32bae1528000000000200000000001066000000010000200000009abbed7ed446a136c9e331ca084656b782ceeffd9da0735a0b1ad51e100b24c1000000000e80000000020000200000005d2023d448a66b2f1ae7b23dc9e5afc98d21ad49736431ef342bd9496d95951820000000d96b8eed4f1e28fcd30ba43424a8b0f401e8f305480994daaeda8368ed3c426040000000eb1808b75765e432ab8f379ce2bb2b504f6b6023817f94956d104a4f34fcef8b329d29863284ba3705c85e8056b98b4e544b1e6faea4d6fb316a9fe37ac00525	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ac19a5362129a74798c3a3d32bae1528000000000200000000001066000000010000200000004995a68bb91baa7af91125e2e9cd61702a7feb25bc2c857d7bec0e91caf8c2c2000000000e8000000002000020000000c1d5fcb085c97a490d221e795c6dc7ea56b6581407c0a6dc0b6cb27b5954a57f90000000503023c462a7bcecdf08dbd8cc6bdd8dd4c43460d930e60e0ffa9f489c9cfeb3c9e9dcd513e9c5c33ee2a6216733b3221dc2f2a81096caf54a216d2fa6ea08038c97a2565ec0b0f1c9dcea2914a578e548c388f685308ca48e505826b436897d284d0b70128bcb790fd41b7eb4f74e9317237b958d98abed777264047023e350df60f6d9a20ac382d9a625de83942cf940000000cd72f2c082cf2345376b49ed772da70c5aaadc1125cc0826c55d93b966df6ff99b975af84fadafdd2bb96974314e8822cadeeab525e94f63eca284d199fb8d52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59BA90F1-213F-11EF-8303-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28
PID 2224 wrote to memory of 1344	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ff0f6fdba56e225aece34f53ebe5cab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d82686fcadc144e36883eec50433fc81

SHA1
bc6d8badf01f2987ad7445b9e5b8c96a6881c71b

SHA256
6df4e3997be1cebe4d6c4a7d852356bd798bff392186343d7299701781ab3cdb

SHA512
7fbc90e056ff72d2045536314c4c30eb479bfb8e9b88504e678c153adfa948948c238ade5b2db9f3af28cda6d12ed4d171829f44a34c687b6dd7c46d36983374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6168e9e9d58a7e0bbc03d552799d57d9

SHA1
e7f6ac24dbe7a092517be6449fa619d2ac19daf0

SHA256
824a3293576a4c77e138756ae2a9d859c18137ca595f92a89151df3663b2ae42

SHA512
2dd8c4bd08a5892bff1e838f9bff3318935fd8fa4078be4b1d6c3d49c4e9ce2eab84c61e6717ff66de52c6a037470177ea7e6c79d1781513e1783c5b005b25bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecbd7478b795b17ed64c4e0cbd6542e9

SHA1
757343ff4d6d6513ea953929e8570ac3a355eea8

SHA256
2abb0a1b3b9de53ab214cce623487da95b9cf690a70f09e68c24b6fa7d492f80

SHA512
0d165f3f8b8b983a5badd16434730c6c7aeaa5e3767f0daafcc4e1b510f915648014c88c89557eb60f777a98067a497ad34e79053af0bddf6a543b9ff6ec9f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab88856bc847e5ae373d70c8651e0bc

SHA1
3348659c58c33247d1af3403773a1c4e7e70eb02

SHA256
f4391fc3bf89471a7d35e9992fb09351ffcaf38747e1c69baa2c36a0fb48d99c

SHA512
0e42fc3d611c17e55d60387cd5efb509829ae0d61b8af60ea9a6673652fb05a6957b048f51ec9b49b1ad030bfd1be08acf032555df6b374ecd042d1d013a111b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cae9ebc28d98adb1647600865c0c2ac5

SHA1
3e6177375d24c4677abf25e4c73c69433070c337

SHA256
7238a88282b0aad6463e3c0cf349e130b5af6e29881ec2601dfe2d2952ea3878

SHA512
aec4738f6670c50c3d98b25aa1959be56c72a4aa262f8a7ff18bfc05ab1efc8bc21e41474d49e0389cb447c8991154d8b5ca748a5e87f0a25267406743e3e2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3635754dfbde6be05c9abb25a40b4e1

SHA1
67e78cc870cc096b90840a05d8f518e5e847b048

SHA256
7b289a16e6b2837e92649ae591efe2dbafde843c5b3d2a3e699deba0b4b2e2f8

SHA512
4fcab9394d940f73bb4943722c464d90533f06af2199909970c33d4b4ca1e3015b56a41edce7566b8d2b3aba8030f71f28c71eec60d4380d1b2659ad7bb3f5fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f386a95b4d9401d1a4ff0b910f0566de

SHA1
63f0c408858d219e5fe4e3b0d802e6d0ba7cec99

SHA256
261136255ba0285be4b2f5e1a72129586dbce18ed7a22de15f160d52bd2fdd76

SHA512
da8a4316f49187de3b4b521c9f7b12522b548f2474c1f72af773e9314f4cae05475b0dd1b4b1912a44acd2c52a3e67cbed669257813b8ea15450a02b97580eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
095bbf9f7747da9d1c89a870a6ec7bcd

SHA1
05679dc59ee313b5dd124887b1a3b5eba8f3bd03

SHA256
1b06f5cb1e7b05fcbbe8a78eadf6a8487a15723058c682d8c6b755988b5f639c

SHA512
a02fcdf4c3480a7f72b4c8c56f7db289045a714b7bf1e94f3efda33dbb582f7136cc71173eba0387ba61d6c4fc943a6a3bce4258bb56e29bb6bccd6fd88e288f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a87179383c09d34df8d8626085abfca

SHA1
e4b9e122acae60686e201ccdecc7dec9cac85b8a

SHA256
b970f68aabf2c4ae0014d2f22051a1c2ad5e5e37d57bd6fbb4fa438c5ee4efd9

SHA512
2f4cd261d318ae7a556feb17940226d50dd1138a26f27b1363898d095eb64a3dabc8313fa92503035e009c09cff0118cab1647041ddfb375b58e9d020d793e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8087c655597838f1564e7f67ceb8aa11

SHA1
2485b6c5536fff21f5b4d266e09b933f460d87b2

SHA256
d8f5f77fe78b783ad4c7d79189fd8d34ad14102ae1399e728d9f56f32b275c6e

SHA512
f5ffec0e64620699afda530c6d39e892faf595173f0155b83acabfd2652d336b6bf834fd2d83f8e8b59ec1ea1d67e3293ed608b7886936f39ae187ca6dc3beb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30ea2e0da04a475f7585c434b9911d1d

SHA1
926b65c25773a7a7c46481b5fe8fe6e758d8e6d1

SHA256
738205ac7d1c00a21c19211810b8c4e955c7664b1f2585b4cf6d50bfa1a3d11a

SHA512
5264dfaf18f944b35485b45748bfd32da1f5282a8dd1bf6b79104d4fc41ce5d2b2322917a3dec6e6e41420dacadf379bed8edd6e801b95881321f096d2f8c39f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b48b637315550b1e4683c8dc258cd22

SHA1
28858233d5f83a1d6f8eeb8e486795c5625b6abf

SHA256
54bdea36de497adb22418502e58ed62ed964dd6716f7ea7c3d3b13c9de1d0f08

SHA512
b81b68450b904fcb25c67090ffbe207e5c3501ca6f8244ce0b2d9e1f53911af82003bd4abf17a50eaf6f030f3ee4e2c6d6c70c9699105342286868a092f2942e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b234b36244e1e40efcec1c6b3e3e9bc

SHA1
76bf313ca010a0586b66d2746e3e2683ca6fd36a

SHA256
be1367819ee651c87c1f013bfed4e1b17cf00a19aeac9b4a37352c83192a3033

SHA512
91050f26d1ede315d67a63740f687952f6fd67a83bd87fe6a236a7777763af62185e5c398439ebda89b03e068a202406a1597e51de1cdf179d0645076b220c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c1d3f1a4541e6b02a354f831bd870c7

SHA1
86a5570bd7f013a921ec93750772cfa253ddcf08

SHA256
daba073343ca098aecd9c3ba6c9fb9265f88353f13f8c8d1fb092ac2c0505577

SHA512
16aa74acb3f4a6bb3d249ec7243b2ec91bc7a02297a42c6d75f56fad6dc6f05ccde748d38f8df7fcf52d64d6771063f73a760832a5d5a0c23aa13586fbae8f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58C2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit