dcad35f5e0d0f6e43aa986da53dd9a8884f7ee4e39c5c860b13fc519c6eac1d3

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9648318e1d536647499cd897cfdd9c2e_JaffaCakes118.html
Size

2KB
MD5

9648318e1d536647499cd897cfdd9c2e
SHA1

9e0b8da800e6c3a3355e74359818a2e252f72961
SHA256

dcad35f5e0d0f6e43aa986da53dd9a8884f7ee4e39c5c860b13fc519c6eac1d3
SHA512

aa8047345ba9cd18ae521e6f93f0f429cf508483cccea75cba99788c1ea06a7e9be8e77ba5833f3e1bd8e8d6e9460d153c53ab1354e2babe7e91eab4f9c6b7ae

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E9EA911-22B7-11EF-8706-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b9eff9355cc7441a417889612f1474200000000020000000000106600000001000020000000feee34c9c36e8645bf9b2c12d943ab56324fbf397ff97299cc5ba4ec8805a4fe000000000e8000000002000020000000e915a8e96e140dec5bd78c315edd0996e0351fed574890be4a487b0c5ca0479520000000c1263dc3683d541cb4954bd584e88439080ca1a91299798c25ba7b2361c308b64000000022a95d88b8b9bb33b9924c083912c5e825ee7a063c66013c866a93e902e874ec51cc3786a2de4edff14e751207c933c6f01f33a0d592998b0e2e5fde5387dadd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b9eff9355cc7441a417889612f1474200000000020000000000106600000001000020000000fb6a28da1254f895b3c13613f6447f0436d8939cdfc0e92c9b96738f3d4e00d3000000000e800000000200002000000090b10d847d7f5033e828ff713c6a09998a9192c6efade3cb41547787fe464db790000000b8dc1f2694c423bcea9577e49df2065b22f1c35dad5d6fd6ba6ee57ceed9d9305d03e3d96e04b38d8736502528be340ef64d641645488dcca76968f4dcaf7aa08555e52554df929a08104615466bbf803dfde063fc776174d53e0f9f682f1cf5e13cca35c6c139d44582448931bd282c4bced0a327d274c7f59a5d4cfbc99ff662f883765f4671f3a811884410855c4d400000001fd201a2613b8a009e5df3075674519af0208cf312f6bc435109a7efea5eefb4146c46191a16d6e9d1e105065af351eac6a94cb934ea4824122d2b9b5ae964d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423697538"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b059bf43c4b6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1152	iexplore.exe
1152	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28
PID 1152 wrote to memory of 2252	1152	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9648318e1d536647499cd897cfdd9c2e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
538a1b4f8d39cacdaad85c51662b2d6f

SHA1
2685a2cb1158e7a1e727302f036bac1e1adaceca

SHA256
3c2315df63e879269021672180642083225fd0df590d228f06df8bdea12233bd

SHA512
36e708dec4e4e526544485f20be016edb44a584653742b7d51e3cb172143b1ea1bd9862e40569e3e5aef86ed44bbc291d3b0fd2c6c229591ef6808a878169c55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f305920bb6cb3a111c7a6735d45cb8cc

SHA1
9fc95e3a99ea8f830ced30baba5fc64b3580fb5b

SHA256
be263b36985d287829744b19be1b4c06757ae9c1bfe58ac392ccd0d52b201b60

SHA512
8b0b111ab8518babe2239c0874076ebc6164686722a8e6b955ce430c9aca9422963e3fdff19f45bbacf97f5a559a52b9cc7455bf50e7a29475ec839b83dbab8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fcb9cefa2a11cda45f5b59e03f1b43b

SHA1
cc9dfa00156246ff89b24a7b2c64402a64f6d54f

SHA256
b15cf0033bcc589b7e06f66ab936e008e3a1205ecdca7dd18a241f61335b4026

SHA512
24ac97a298a727ad00aea92bdae5ac36ebee17f46e904f6af818e26a23a7158c03bcdf4ef70c21dc02d89923d448b1f8dd6f44a82e863358a8d0598010617c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58cd6a281e3b6fd648ba09419131d510

SHA1
00f841b8982306a438a9a31997bd7f348823435d

SHA256
36020eaed15d08c316adf552806421414b18cc382bb77522ea6ecc76d70c31c4

SHA512
a9f17c5ddbb1a7d0e1556bd54bed509964022bc591e56d5132e94f38776ea6f18e4b2aa9301148c75e61675065f83f53164b91814594b25c0a92be0191ca3257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b90a5c6a7b10458d348b7be848d36351

SHA1
40f073e62b59e6405ab401020b435bcc5b4074d3

SHA256
7538d7bc178f544a530b782ea75d9acb4fd141bea304e19a34f3d006bedcd947

SHA512
abb6e4d9f1698667e99623e062fb2895f8bc1807ea25b9696714a1121b8530521c70949db37fcd89d13154cc14449ed2d4d01a37235139de25c43b50dbec174a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8638a5197709467dc6c9828bde5b8086

SHA1
cc0b1aa8f6be1ed6eaec6cba42aa0f53760f1172

SHA256
d29f1a37b5f39178517f26e05aca515bf6aa977e1507ee22fbc0020bcbe5b204

SHA512
5a1993c60eac975b881dd50c839bd26d40e59c365888bd80a81f947b566c311368e5ae89493a45721e68a75777c0301184c76ad57c7d0f661c11d0fdf2723409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24730941fc5c7fdd490a5b043fc92e90

SHA1
b82c7b445603d6d44116b5c4a7bff1f586885c1d

SHA256
8bb8b9c1129cd0a36f2fb8b8b884a0021372b8dd0683edbdf510ec1fa89f56e3

SHA512
ab2d8c0ef9a5f2cbd63c6a6f3b1e3e9552e7bc1139344cabe9d7d84a69d7655d1173f1fdc291cc3aade1353ea193d96fc179dd3f960239d2557452c851bd389c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7ea8fd2b0a56f173ea92d6d254fb0f2

SHA1
14c6713f742328943acc0df428ab7d32b62d79a7

SHA256
fc8f926a486e50c398d556396127846f8a21dfb6d5fd139870ae93fb08e634e8

SHA512
e32b30b1320df1ac555525ba62d8b94d45c0439d383e47dd5d33bdd4aee365963911544ee043a2a7d6bbc82023d08e664613e088b5daa629f4d0b61c81bb856f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7ce0e7f50115709b8bb2358225819bd

SHA1
c7a0c8493f615205c890daa46ce0f802b90eef1a

SHA256
99398c7ee4e987bca9cba80c3d8847c1c1a20911e9fc9b61698563af9a6ba4ad

SHA512
762bc8c1a81c969dab177aa3c2c3f9702a6b5c7ba530e10e3f23acc5668beb8c4ee74d399798a8723b7b15dd7a0983013757dbe96694712384fb53c3210196f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53f51ca3de33c6dde3b3e684fd798b1e

SHA1
32f7bf0b3e215937ae4fc22ea514335fe0656b8d

SHA256
903fec352f58df3a1b77da1a5c9c1838473504939f42036c697a0a7bf5699af9

SHA512
1569bbdd0d9fbdac6a42389e5fa776d521179a51511b23f1e29cd078946af6e934778be9ee2d432f648307308e6cfaf3f3aa9b3b419d354fa8bd685ac5432d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8507c2070dbc418d3946af5d3bb9dd8f

SHA1
00a955adc5d5b952cfdc0266a6d18c08249b598a

SHA256
f65ce499d1d00bd90bb35b3e4323cd2e419fd6c4e913cce9d48bafd51d8bd8a3

SHA512
b0b43a1506cc5bd8bb6d6ff89cbb30b260ef3ee66783d11be02f3bfca2705a6450937db7a5642fcce3c0c7c5a12948d11e2100038c41a25150f5eb34ec18b90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adfd116d3b174e11306978c4bff20b68

SHA1
439a0999c4261e90bb9c9779d18cebd252aa03ac

SHA256
857c9aece9787e54732074e28e876b28bb05ab829e2d22fcde2f913d789bc072

SHA512
4813f370776e2dc692156a5f65fcb52fad0309fd9375c7d84d01542e0bcfbe25cabfb84eb445be88d771aaad6c917032536390709200d24a62121e5ddda0e3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab936A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9567.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit