113f2824c03204e879856c668e47d72871ab17849ed5b8a4db5012ef5c2688d0

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

940809b6731970a6becca6cbe95fd423_JaffaCakes118.html
Size

461KB
MD5

940809b6731970a6becca6cbe95fd423
SHA1

7c63d929b0d0328ae0b399ef92768a3385831835
SHA256

113f2824c03204e879856c668e47d72871ab17849ed5b8a4db5012ef5c2688d0
SHA512

c75446b6fb5582f2f65e7eb1e3c509fbe067d0cc2d2ff5d78773780afbe910ed68999cc19672f78939807887f4f4330bdacfbf99321d15a0c4ca34a20ff54ec3
SSDEEP

6144:STsMYod+X3oI+YtJQlQRsMYod+X3oI+YNsMYod+X3oI+YLsMYod+X3oI+YQ:w5d+X3Xt5d+X3L5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5965E01-2245-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e439237c28d35b92444abab8799669be9d331aa0af8b5a7ab835e04313c769a8000000000e800000000200002000000074fad075fba7ac349c65f42140757cc20ff6877f5dd0c7f64ef21c72f706c11a200000008f69f9d2f0c168f62242421844370c31c5228db7b8ddffc1161ea7ff296b366b400000001916971cc04111703b824cd2fbe2e17fc7ef90b518d021c321fe237c5a82e72469cc357b80bcb772d43d9d4add93b7c2551869c5469bb5f99a81332d48b7558a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423648748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a32bae52b6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000bd16ffec702daf99c0a498231ce2b9b64f0a510b110e451ab8a548f4e7f6038d000000000e8000000002000020000000de980080bbfbc38849d2016453c553454dd3dfceeefd148c1e1239fc04c1f008900000008e9a83b60d2a10d4e263f407ab1daa55ce15ec2fc626e8680d69125857511fa95df11804b6619e8680e94fe40e96cfbaf3d74ba872f8276100b2a12eae05597d7840abe95b06cf8ce67b0d636f77d2d8eff8ca2eca18e22e34acb6a5d8a2145285246ec10506a3787fbb0aba1f050593fe4388d5d6d6ad7dccbecaf7494a43d67778299dec66bebdb7ac4baea1ff351e400000000b49411252b62980beef8962373bf7eb62ac060c19039eb475d6ffcd0d52bee0b401b1b7b70f1568a261400baeec55d3ee71dd48b7d8f3d81529da9e9b4533ec	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2160	1992	iexplore.exe	28
PID 1992 wrote to memory of 2160	1992	iexplore.exe	28
PID 1992 wrote to memory of 2160	1992	iexplore.exe	28
PID 1992 wrote to memory of 2160	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\940809b6731970a6becca6cbe95fd423_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5562e67d73f08452c58737958b1f489

SHA1
aaedbfab5aefe2a598417bd89680ac01924421b5

SHA256
8cad90f1f2eedf60ad23f788907059dee6f9351a13d90d27c7471b9b8134b405

SHA512
571d04e4ec5231182006e3964c4a17b2381b7f3cf5960b887381202e5230f2532cc809b7d1cdaeec25009329e7dddaa1dbe9b50e1a3e093e448c3d5e70083602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f4a81159a51edbbf5618bb4ea3bd855

SHA1
2162fbc8c67d8d91f265886c762e3186c58ae55e

SHA256
db620c0aec69b892b54b52bc86b952170c92abb5b5bb21e218cbdb8036ef927a

SHA512
3ac437c4281bcdbc3870b34461925b50f9c2e3cc72a551b28ffb5b821afdaefb9f19b3fd2eed633d7a4bc36c5bb8755499a96da92aa0164cec867b3283490358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9e91106c6e47a70f3dcb1b9bb9794457

SHA1
b990d94fc524f553e5f7e18c68fb0c3fcf9d1133

SHA256
3dee661126790af5d876014936fd3333820f1d206511fee587d142229e0afc33

SHA512
c5b412a60cf58b70258428a478007ad686c0e9ca7cf725075332de5bbe8a6d31307e4fdf00ea245ade12cfe8f1430804cb60e7905d40bcca7312775d62ab83d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f153121508be92af88c27d3e4e4146bc

SHA1
5ea84b9001a23c7b0bbcc9931ba1c52c2bdb37dd

SHA256
9edd0d457b618a3790ba4aa79cc6e0ec870946c541f128fb719a42862798296d

SHA512
2d5f940cc8763543b447560ada71f9939692b44d82684f9bee14cb4a9e2af101380efaefd805669c959d6f963855d181ca844c55795acd00325e609abe898211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
72b125d05f14aee7712ee27f09106ae2

SHA1
8885066807c0ba633f70fe656337189e1fda47d6

SHA256
926d0b96917df24626ed2a60a5293333988ccc9b7e835e85b258722d2bb1b8ee

SHA512
2dc4188a0eeee318ba0f354c25ed3d0ad4a2b985f73f244c18bf0a0e6db4f2b37497e1bac3d0078daeb39f3fc7066b500b13e0ae74922831a5c51e2e39fc5986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
280cdbbb6949a06640434d04fc901441

SHA1
81803107eb8c4099c8b03f6c14a90c3ffb31c93f

SHA256
5cff8eb7388c2447ca94dc5a3b3b2dfb12020de702a5999fb12158c07a41978b

SHA512
ee7b273a19f123712d95b411490299797ab28c93c8ee91c5a4baaac9576f42b080665988b5c3250a224f498e5a553bf1c1391646e53cd4e2d7426a87389971f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
007eac0875877314fc356f92255f009a

SHA1
a3f9883fee936fc2451a11055f44e62f58fef9d4

SHA256
22e5bd223dc3570df4052a163199054e931f01ef1680072548f45564039d9b3b

SHA512
7c01f1f395b75e3aea2340abbb5ba7ff3689f5c7338cb4e5b65fb3e0b438797b41ff391e89071e97a71172e8c1ee10e584dec32eb7b990fefb0521214c4999ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e309679d19efd66327ea2a230c5ebb9e

SHA1
486f23446d45464448d89bac48eab92e24b68241

SHA256
288b4d84ce7282bc961163fbeabf5ca4e844fc23770f854660dd81c28cad2892

SHA512
569ea2770004a87a096a0fd38378b99cec875955aec2571da2206bd436a78ff6bb1a7d00f8d450b92b08353872a1632080ab7d8ce2625f20e51e3bb579794c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2542e4eb771bdf1c43f6b6bf200633d2

SHA1
d9976c14d9b48a271d9fdcad273439c553c0226f

SHA256
2c4df3e065cf3c73a8ac6b0e82bcdbfc7da9c4a0c034d2d6a53c2c9e53b12b3c

SHA512
6e0c22ced7d7832e856e0ef83761e7759605594b3c283dbbe0cb22cc34fe3b5a8ece74f3092873b6f59ac49f2434fce7897d9d0568a3d287cb6de84927e8a459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
104cac09dfeaae6bfd6a2c2270cc8d40

SHA1
619844f4995e8ce3319e6311a98e2d7cdc9d66a7

SHA256
0319b92c1c6dde64dd1697512eb61daa7cc9e2b9ad057f579bf9cb780a6f1e46

SHA512
63184b528484bb060a9d6655c37f5413dab80ff87713c9b8bad7cbdb38066200da8b7ef4761891120320fee19792d0027be415d1b1697c155bc24e88d31be09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9e654e60510cc116073c365b778be883

SHA1
f435d240ea3ef1900b0682302d3325b185486b5d

SHA256
394bd4025438e11849a88aeeb057e418c3e528299df06c418c7c432922b43960

SHA512
065fae0561ade90aad2e222283a7f7a9d9cb83838c1c67f08d9cfc19f01ae4f4c6f33e834b1845095b06fc580231bfbb5949c9da0203812d0c5254337e30ee2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc54b3295953b6d5aed1f1640fa88207

SHA1
e91ee0a9adfb21b9b5ef1aac424248602167fa8f

SHA256
31e86016ca5dd16566ac3cc79dce790b5ebc4eb8cd6b9cbaa7a392e84385fc97

SHA512
6c77dfd993548fbbf9a609ee7363f768c4ff0da559a7cebf68aa00ecd1cf89642079bdebd409f3802e1258b0c6545723d74d07853e21f0581e6d580706484bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5a4d1121b192f41f398172f9a21890c3

SHA1
76011cbf8fffcf8f05d36890739d5c27caea7af7

SHA256
9e41f9d5028378452af8b7c506cf75d91c559fc396b47a20157b7b19077f56fc

SHA512
76a813096906ef1b158298803f5fa976cdc2018465f41c0a085a94a4762424aad56aad8db816486a4b542743dd54eef0d0ed10800b0064700e41a6b53915491a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b666bbf729d6a952bc6690a386a70a94

SHA1
fbbc6e16b9d461fce14af4135fc505e31433eb4a

SHA256
d60d161fc19cea1ceed2d767f56ba7cca8260cbdf0601e3f60116eef7a28c57f

SHA512
22c20dbb17583d45db73f6840ba0a33a7961c99ec96ce84e1ac26e942489830f0f24fab5126dce1c1faa6220e784241e9a19a5fcfc12a059dea975871845cdcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
303b6956a6a8393a177dba3b1e6f7d9b

SHA1
44309acd40d372a57bc87ca5169483a2947d1e6c

SHA256
c61b658825e551c833d6aec73bb2a9456a3167b78ba4c1fe3066b8439bb1252d

SHA512
b80957f4cf5069327a22cc19b357ed8ad724cbcd88142f20e52890635134def4b21f72819be648633b6ef2cea1782df2774a1d82b651ed38c3906ddec31944c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8d9e8490bad7551d5e14f21ab20f5588

SHA1
558e7e1c0f79d473dec36f5c8c73875c11a84010

SHA256
21013d720ac78607d2a50b8dc06e3d6712b360e26779d6360824c1b42c898679

SHA512
7f7629b854aced1784106f17bbdca8887bdfa250e40c4a491e573e255b41a88db827bd4da1386bc534717ac435aa4622cb8971c8a3ed332c15af3dab2fe9a9d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A4C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AC0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit