bd194fb6b539936d54d123e856b52731c05f513ca4f2f1a2dd55c23edbc7db09

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99736f268be0c98142a82ed78bb999f0_JaffaCakes118.html
Size

23KB
MD5

99736f268be0c98142a82ed78bb999f0
SHA1

23455aa4ed4a29125686584af6ad55ed1549105a
SHA256

bd194fb6b539936d54d123e856b52731c05f513ca4f2f1a2dd55c23edbc7db09
SHA512

3af4c1b6ecd6685c61142d4b33d4d9a50332aac16c9016bd6b882a74ad9e3d91f2b433ff69fbe92bb24653874b2f22aaa29ba7edba29efa6f3713c6d01fb53ca
SSDEEP

192:uWDMb5nQunQjxn5Q/bnQieCNnRnQOkEnt5dnQTbnZnQ4CnQtIwMBiqnYnQ7tnSYv:BQ/9UO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DA954C1-238E-11EF-AC1E-72D103486AAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423789717"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2228	1676	iexplore.exe	28
PID 1676 wrote to memory of 2228	1676	iexplore.exe	28
PID 1676 wrote to memory of 2228	1676	iexplore.exe	28
PID 1676 wrote to memory of 2228	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99736f268be0c98142a82ed78bb999f0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
98c48b91bb25011643398730816e63c3

SHA1
7387ff948cd003352480d6230c87a183fae9d137

SHA256
13a25d4c02e1060d552e2054a59d7cc2c8bacf42995e6bb6dfab6b9499789315

SHA512
cb52495285d9509157183602ef1f50790a2faffd21fb0508623e1fa2c3c674678c2caefbf2e95412863fe374f3db828fee0fd85e6432010aa024a7f08b329386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29c1c1b8830dd9f830bf4c5478e3c948

SHA1
0d7ced9e415fc126532daefc61f01d179a3c27bb

SHA256
8e5e200b1f2d936498170bf3ab2326bb4f31708315933674927f874738ec8653

SHA512
8e075c4954f50af763267c9da94deced4c17735398cf5d8a2895f2f50dbff622d7bf2da88f5207a3fc37f46fd8db16f7312c52a4017e0189c56c25c853ba4438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4feadfed2722fa4f8929a50877c48c63

SHA1
c7e584c8b15145cc0920c321940ba6d7d1debb22

SHA256
668c341ed85f7fec3baed11a1a639db11f688d53d94a2cb4d56ea749b7f31e79

SHA512
e21451a4af44de34156786356c7e86aadfd7c35b2b021f6c8dd9a578d48c0986e7e42171cb5558d994633136f56a873890c4558dead8770f6560e68215cca4eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
691dd08a844917b7651a34453a0c874e

SHA1
996e42c1db579b3214ad9ba737dfe7354123c47a

SHA256
ac6304a9b8aa5cf48f5877fd702998f79eba0a5b4a2c741155186e80fc2d29d0

SHA512
d79740e001a7e8ecc8b9107338213a8be3be982928aeaae575658f675a6af8c740bf961dc4e5fc6b27cdb54b5791302d0e79011d6cf6def599305f552545b5a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22edb927f40083192b9e048dd0cac338

SHA1
c0bc661fab087158c290895b376a8c9d43d68fa4

SHA256
1206da60c86a510cc200d279e82aea9defdb5049722d057f4315fd54752483ca

SHA512
d3091ff1ba226173fc021b9627d305d433aa2865e0baa1758fe80276f75257f5d568ef2331c8ddc4a17f88501533501e4070fc4276e86c8e6a6440a84ee34e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3bd78db7b65042faac73219f0edf3fc

SHA1
f0ae49d2927fa8ba789a8cdecdef2b4dd31cc4d3

SHA256
37a50b9e8fd4c7842026560b116843fe738284b7c38a087af612f3991ed85041

SHA512
b536bb986297752775fc7857137761cc40274d8aad79d45b95b12d9bf5fa0ad41f36e9bb029599f1fd1699694e05dfb2ec1324ca56a123266c418946d088ba60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b51ef9f040ee2fbc0cddb03a90cda70f

SHA1
f8f577b6eec1eb52d61c678b30e0ce2e7e01b311

SHA256
e10effd57036b49110a2a352d69f305a10ec277d269b912836a63dbf0551a3d5

SHA512
97198dbed8193860ee0d288a30b2fd2e8b1e48b483b9cb7b67c7a2bf8099a056d4de125a92790cdfa0ee6ec91102f5f5dfc2c2b3fb9ec3744e2be1b299a84ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ec7d8b81c9a3614212e1b18c208fe7d

SHA1
59420fc43b8a314d79050fb3075d7f3d314b8e6d

SHA256
632664ca18e525505a96922133b7395613cb23dd73f246cd62b7bf1f37f3e27a

SHA512
63b292e476028bbe8b37dd1597795b13715ff68fda7a9c8b084ca0b105900d53256157c07e87508d65a878b0f996236467f647288c63bea2a49b23a50320aef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0b43e0ff760d80c7ad518d885cc6612

SHA1
4c8cd4880ad85c6a606a5c77e0cded26e5537b86

SHA256
08aed593bc775ccc8ceb1169afd8d5084e023e51afb9ce226d72a3c3f41c3fce

SHA512
bb7a5491ad67ceb3103411621c27957f0b1918b4efd3f006c01f4be7d970fc821b4bdbae0553b7311e169f5dd84b8e75e67d19d8c078a12cf951f55cf64dd2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bef863e39ff84b819fce7e5a5b28216

SHA1
c28b4a8e57f5a4f750198c28fb83eab65492efee

SHA256
3c7c48b4dd7b3b25c4b2eb80e7e4948203dee066cd53f9a5ee948fb2d917ca50

SHA512
25b23b0d6ea22bef727ad3db6ba8813fda10235b309d3ce4a871855d8f7b1f478ffcc47e8e4c74e259fdfdab926323b6c169828b04811cdffd422f66d63c831e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1965096728800175642bc88cd1a589f6

SHA1
c677a439928d5e43c2649497d32b6eb4ff23010a

SHA256
3d9203f599a05e1b6cccc0aa17dfa88f15c0ab94bdf5d1f62752d440dc8f2998

SHA512
73f74266c09bdc7fa7581aa9e62aa893adb8094864d42b2cfdab393838a1ca7200da4b8eb92826a22b0bc8e85d3cef738ddf7abea381609b4e030040ea005fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9d3ef63adccd8720fd68c6e088d3bec9

SHA1
0cf3f6232bec69096ba188056c4c331519bf84ed

SHA256
22e96816411a473417542fdbd9202da37ffb6025cb2ddc87fb2081d7f45f6b92

SHA512
df0bee0dece3086746b8bb3d95ef94ff7eefde5dd9a0b6447387a4807524999e0c10dd386b72767e6fd1b7840854f5aa92d46eebb84f9dded3f15850b179ffa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD77.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit