0b324ad051d79193265be102f5b2923fe626e7f20edb5f4b2dde127c1182994f

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93cff311d732e0791f898748c2b035bd_JaffaCakes118.html
Size

179KB
MD5

93cff311d732e0791f898748c2b035bd
SHA1

8307cc0b06d42b340dec4e4972a7cd831ea5ebe1
SHA256

0b324ad051d79193265be102f5b2923fe626e7f20edb5f4b2dde127c1182994f
SHA512

5bd4cc461585355ccb1e9d874a9e3ea22f2240d90317287169955a5ebc18f665579bbcbe5d2f4eb402d10efc6f5d6a5d677616ecdd349e0d917a9116a11d128e
SSDEEP

3072:SA8yfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SAhsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2606DE41-2238-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423642870"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083f4d11676f81b458fb4d703bbb22ad0000000000200000000001066000000010000200000000ef1470f0d42271787f103efd3614c6fea0da81d518b9a186fdae28b2faa148a000000000e8000000002000020000000913cbc3845aaaa22fb46b4a45cd73868915a330ef749bddd93c893bb93975a2390000000196b2f8943596dd74fa75c10ac73a8b2269fa3805b9fd2d8c40075e21a6735ebb68ec28515a5e0c4b4345edb59d3cf31586b1ec37fbc7db6c849e349e24c97df3cc672947c059b0dd8ea11407fb2a2ceede126b9c3778f2e5c40ce1b9ab8fb0c32d90fe3ed8ecf58eb29e88bd7118a9d34170cd56bd1447fa6544777aa303f265a918d3f794b0a3f0dba432c4cced1a3400000009d998f5483c08c0ef9469f6fecbb014ae19d82fe72e1b9b088ef1f806e62ea0c9bdae2fe0a0c8378dac5a8d9be76e1bc8d4f5f77e9e95429d7396c9842f23995	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07d98fa44b6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083f4d11676f81b458fb4d703bbb22ad0000000000200000000001066000000010000200000002b998d4a0512f82efed834aac26bc2fbb5f4e3966b5e712e88466fc3a7eb83a9000000000e80000000020000200000005b3be3d0bc0c0018e5b1eda9263a2ce25f6a885470f42c8d0acc48911cbf26ec200000008667059961e8e88acf8b34e56e55151724cd7f3795e73e670e02954d0127a97a40000000281f62662600c097b93002be8e6279df193a77391911b95e78fc3d9e9811c242843c42bcfb332a465c42f71a0c49f70634295e14ad91a8098b85a1e39d0dc7f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3028	2924	iexplore.exe	28
PID 2924 wrote to memory of 3028	2924	iexplore.exe	28
PID 2924 wrote to memory of 3028	2924	iexplore.exe	28
PID 2924 wrote to memory of 3028	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93cff311d732e0791f898748c2b035bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c733cf7fe9c27fd714fb2f438e23d4df

SHA1
427ca3256fc3375ae4807380de2db060e979adc6

SHA256
48cd7da51159df9e500e05133bfd345f83293c9cad6aa07a318f4cc3a060922c

SHA512
0a99785874792145619c3ff5c96499f2d50b17ba8ce00da6e492dd36c51cff171dfc52e8d20a219960fe264cf69f63e7d35c27106a6229ab23a564594379249f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a94d738a60bbcfff1c2572092b4c1f6

SHA1
254b04cfbcf6cafff5f0d32006ffc3c0860ba156

SHA256
cb339a72a1733fc94af1f59294fb2822b2142efa32679c420eaad9babff1ae25

SHA512
61792fbbdbf54248363f4a941dae00d8d0e91279330914bdfed640f24437143e68a3059e975618c19fe9d89a7c3810e8f4809589d1e6a4ec88e5a9b4e31f0511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399f0fd8c9474b4e223c7baab16dc544

SHA1
8dc2a9abbe338f56b05045bfb7344c7a627672a3

SHA256
e396231d0284ba1838c8c1db78c70759bb2a774574add138a1fbd08780bf58e0

SHA512
b4065e0949024a0da9f96cbd99d22d1aa78c46dfefdb0d9c510c827f6bad924ff2b72aaf84563bf1839d73f08633a4576d879f422796a732e3c0e0d29301b6dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f836d850c4033e999faf828a6bda32

SHA1
c6ee7089dccfd683ae5af78256d1866d0e259dff

SHA256
318ef6fb3e40f53a330aabf9ad75694f3a226bca81cd43bf1bda631e84a443de

SHA512
14a8a6d91430cc247896638b1fed0b8f80325a228d33dbf7b33572fce3bdb1ce021cdda2c49aada90459ce284a4d4882d5132cdf98cd865416bb176172a8db69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5043e8dc8bb915e285fa8a6b9c3184ed

SHA1
ca346eccc101880eeeb6c9acd24083e809bd095c

SHA256
98880f55cff6d6a0466e74cb1a1a987166bafdfab74f937b8f5d2e675e34549f

SHA512
b1819a49f641eb9e671b8394fedf09031cd36e2968cc9c6c13358bdb1e3792dc6eb2666b1974e54e8a0670a798056f290b76c8f21fa6b80af5db177d83fa50d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5585ca963782cc012a2c8b88062adf56

SHA1
4bf467ad290424d295b77b4ce7313dbbdd15d48f

SHA256
99b12d4f20da00a7edcbb0b999f11f963efb2afd338e4a3ad67ee0a1f01f548d

SHA512
da9304514723b44704428b5b5047b2884a22abfa7d7bfde66d1b28518ea1d43ace16347fc9b81186147b365a12d97d2aac5cbdee707ed73e45d60373b2256e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
046351b7dbf4c0bcf47c2206b0d8d184

SHA1
5326c3038c3d1300fe3aca5e9a0fd081e514ae15

SHA256
4f0ff1917dd1f48fccb73af62ffc77ed2e9c57eda140ae1da60cb36a96c96e01

SHA512
1f25bce8aa1361f181db46c566e2b44dd38702bf9e6b0d1a033d7d7e9a82b53b699c4bffc99feee1b4a1f1e82e9732095bf3e0091367f2c2ee6ad6e73c8fa395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b79978cf8b26c2305c3947a85e890a

SHA1
f7b5add95b6bad44a437b7e28cbaeaee962724a6

SHA256
31a3a1f362331a6f7d14195f12790f3ae347d6b2cbccf189eff120216bc12041

SHA512
8ed87bf448baee469ba7f3aa9ff760e4e44897ac827af8061d530423483ac81be89ab87fec04e171a384bc7eff3e9de25799e672aef71f05903c87c4d2c24f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
379cc9897f02fd329d3245184d7573f7

SHA1
9e0fadc5a91d68514a1d86579a4d5297e52cc40a

SHA256
a002fec296ee2aae8f9c482f06b43aba9bfb7e5cb8f8f4afae93bc486cd3b036

SHA512
f3c73099054ea10ec7e38c3efd02b5b97628bba94282dde1ffdd44b5db04a56972b3063573f06d1255cec2155448b2c82e635fcb706e2906f2ceff20c54ad961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d192845badb987410fb5184994ff662

SHA1
d08f58e3be922066016e9353a0e9809ec6073790

SHA256
7bfaa0e4fc798293ce266cc939a643012cf588ab52013bbc94e6c2cb965e32dc

SHA512
8e171071a1176b2f612bcfc01274ab02d1955c22ec3c8ce6d9f790ec284af8fa245ee0d47a15f86a76ae0ecbb9093617816961d924a8aa845bdbb87426d70c07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
363f8745d509513fe8a220f8e91819fb

SHA1
424e8032094f45e09d04097db084596332dffe8a

SHA256
aecf2ea6ddbe289edf85477a35033e8129bcf7bc1de866cabb5698dc7de65212

SHA512
3d8ffc001b396901798cefd2bcec1e0994d57deac0206653874076acf7f90047c35835d0925a85f8e57111f223da2f8a988e47b3891b228655f504818cec2eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B9D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit