d090f689d78a647d0977828283425b1feb55aac8e27d42a5d5815f5ce8a115f7

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

979329970435cf23ab42947309f3d7e3_JaffaCakes118.html
Size

6KB
MD5

979329970435cf23ab42947309f3d7e3
SHA1

9105c953c4905276980d8ce1e5890de7b0833a58
SHA256

d090f689d78a647d0977828283425b1feb55aac8e27d42a5d5815f5ce8a115f7
SHA512

a526a530e97cc67f784f2f270c92abcdbbb2c771e72ac46c00b42ce7ffe572e674517e14c3097a01e5d39a1512f770d1cc1d06299162a113986e3f9fe59852a4
SSDEEP

192:IhUPTNPa2EfcwjbhlhJALVWlF2jI5T/W3K:EUPY2E7vrKU+qO3K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423736721"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8FB4631-2312-11EF-A6D5-5A791E92BC44} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c879b8cccf97334cb6b534613488214000000000020000000000106600000001000020000000496c5d93df9ff17c435166bf5baee8c480830ab0cdabc14524c0b83455adf423000000000e80000000020000200000006f4c09d249c383b3a0cd64cdb376f9c8fca8c5b696cc4daac71c90058b6de5aa90000000c93218b8ff650fc5a4a3be835cbba5ebfd5eb402838e7ce1e4db2b50e4382072dfdc61c539d7409f571ab6679239b9c3553c8a86dee7b6294472f8fa2e5fd7df347c341e46273b06566d796d6f0e8c21bb50f7bcc8bc1e32758637562a0637b77a5785c23bebe44eda52c263dafb9cc15975383dc7188bc48fb291ca3eeed67af6ececcc044e74f232e1554c25c5ea88400000004574b9b7481cb1f954cf64890109ab23c511a6bc2ff359e05aa327096236787717d862b805457bc04e485d662dc947d615bd4d6b2d0638e53497cd27f60d75f1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c879b8cccf97334cb6b5346134882140000000000200000000001066000000010000200000003599c820404362d90205c9eddfb6e4a25df70e3ec3e8567e518f785a09c9ad4f000000000e8000000002000020000000c8e4672b7532d4e417ddc2a340b27e835828d0b450f7dc81055d4aa39cd7b1a62000000081b004a44a3ac26d5b4bc1cf9d27fe9aa5ec85306d974b4817c2acb6b27e05e94000000076cc0de21f59e7bdf41d57a0c1f9e0883e144fec8020674fe0d5ea5425c8f2539f44e1062feba167c523cc9a0996fe17fc1225d2790773e347fa574d82baade8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0447f7e1fb7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2820	2076	iexplore.exe	28
PID 2076 wrote to memory of 2820	2076	iexplore.exe	28
PID 2076 wrote to memory of 2820	2076	iexplore.exe	28
PID 2076 wrote to memory of 2820	2076	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\979329970435cf23ab42947309f3d7e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b30c629ec6afb4d59d38dfc145468d

SHA1
0232ca190bdca79ab2531d5cf4f127578cf12510

SHA256
a6adb222a3e71e63786bffb0fd82a6769188c49863e807f8192ecdddeeb585fb

SHA512
16bb1f988213b112c5cd89da9aba28cbaac8d10cee2eece7ec7692ac41aff04e51f587aa8f8966357c53689110889f069da4110eada7cb6fd9c90cda060238b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30570992b30d90a31ca4c6b7e49d007c

SHA1
f1b2e99724984bd812f0aafae15651d59405d30f

SHA256
395592d82d70649749308e550f59300445d43a31faac99bb3a6e305d696eaed3

SHA512
61d8e34d3a1465de13e1337ebfee60f9517386717f69151f97d6576e4ef75ca8ae6793a323d8291736de8a26fed7aad2afee632bb621046dacbcf4be31a48032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f917ea443a28b38241104003e7819356

SHA1
614faaccce675b973028d6d71f16892b1f87ab4b

SHA256
ec1a359972726cbba28241a506a89d11ad170a024d32bd3f9b548b5d69344269

SHA512
f70919e8859990970ca3cd559011c5e24770c2c7aa68e4926f335ae9cf08538420e2eb669c02e13b35f2e4e956804143cc23d621115d47e65687d72e53dbae73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb36acadf266c3539a851b029118c03a

SHA1
44181a7038426d223238fcc5bc4b00237b228db3

SHA256
893a829da72292bd2f95c524b83992c3e4e82c8dccc51cf28f39890941467eab

SHA512
808a674a07f52b509636ab7be39aea257397ce38683590fc568a4ed9c8821402ad28ab337d9ea6743953f4d7f002c612c71468a7b7eaba047f8731a92f919444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d519628968ceb0b5c7129dc248461164

SHA1
1d5794efb801400a3ded40a178fde9a280a21e2a

SHA256
fb953d7838f23387245fb1036e96a1c3e0f43513594f6c99e365d19485fc9241

SHA512
1aac2b434b8660925ad7076103e716d67ded1c752f0452fa0fe11d474e186b2957f96ac3fd49bfc088e68d5775871d38cfbb85ebf5578e618826464fcac76a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6bf29f3d89e9ac9d5f1e504e15e36c7

SHA1
336897a3536b9d8dfefe2c77b487efe8a431725d

SHA256
b61e618e3b48de717a7964ec458ac65b552a1491ea8b99400c66a319ee6ffbd1

SHA512
058f83b2b85a7b3ccc805f5d46ce0b13714cad923456289b9a83bd3596fe1603957d3169fb330c3b57f1d2f90c6da4d488c07361143ebb968171ab4556a77995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaf68ae7a0a129e1f9b65b9642446180

SHA1
27272911d082fb8366dcec260f839044bfed68ce

SHA256
f5f1a80c473ed7deeec6c18d6f9424c7b0fe1e002b5f3ed3c32fa6edd324c29f

SHA512
43bf1d582651068a5c20cd9d3051f4858ec6ef0f7b44f90bad14a05bdeb4874f3a4bf365211770494e6b9ce9e962153478aae5f7ae83ac9e27fb8bfa09c8d0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91e2060b1578260055ca5a8ee75d7717

SHA1
aab2e963c398b2006aedf4e947101dc370782f58

SHA256
872db29db29f19e8d96b2b03e071e17e7a7305e6a83482a10f63521bde67c731

SHA512
471cd6651f2d5f2004f619dba223175405db3a9a8cfab0ebf84ccd2c4d3cf26c42d96756e32ac419dd605ca4ae981ed9b84d671b280a56b0bbe67e4ae18438e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
063489827fc8970063479a441fbc41ab

SHA1
0312e3fe66e816df4dd4a1b462153bc508dedf0d

SHA256
00dc59a0e72494ee3adca20c2f03f0ca25240150d64037152144c69ea618f075

SHA512
776d8e099e2d9d2d3a2bc7df3ac8250877c75eed1cfd4806ba97150dd0ebee559e20df6e36987b23ebc43a35b921ce20f7c07989b0e3ec8fdad782e1f66c7427

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ae6761edcf24d9d01c0c2d12ad4344

SHA1
1f6899b2bbcd3841e0b67a9220aac1d4255f8fde

SHA256
7cf92ead2586057f93d94c6c8bdabb71dc335ee7f606aff35bce33eccaf7d0b9

SHA512
749ca7c0e0eca608ddc99a16c503ae865030df37e51294d7474990c3297bab88c97c983a4dea2b5e7855184f5f2d67ee856f9129c06ae7daaa10732803544ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d317de72debe5d0d69de705d201ab35

SHA1
ada65daedc5db79295d4ea79c645e3d2055361b4

SHA256
03225849df5525b6d8f1854a820f377a16d76f036a0b3a71f857ddec94773586

SHA512
881364c86efadb48b2a1d17aad21c7804b84c64f064841ec2f1906237a3c7308c4678acbfa6672dd1083ebb2b910af453b9afd1bdefb59947db15ff651810dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24c0d4d1362b116bd4c4d56977e9c831

SHA1
48b5ac33d0e94071d81999c25acc6893ed1d549e

SHA256
1eaaf64fb226a8e46246b57772530d75194a1a51228489b12501bd07090d6d00

SHA512
8d17aaf49eedbbaaeb2a6649d3a52d03c0570aa92bc3d8b59edebd1d8325a8c8c8f15ffe9fe02c7fdb41f53b8045ef6c0e21273b3d4627ca0cdaf716f0f8515d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dc1739574429465dcaac3e86d5c04c7

SHA1
7eea23e02cc0ea9d1b010e9760143b16286970ac

SHA256
03d686c20f5afd0bde075e0dffd1d445bf957d7b023bc43bed19499cab571b2d

SHA512
2cd5ca19925584f11c6f66c3e0000d90e52286226d3accf6bd8bebd3d028ab0831388d90bb2146904aee51518d26e89746e042cc56605af6ab5f28d77d90c121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2370dab81b46bd4c7a94ff4537a0aad6

SHA1
568168a886b87c89db93578c6ddb3effc8f5018f

SHA256
6d64d4b2671c3d8260b812745112b9a2f6517058df01747bb860138ac512aea6

SHA512
f7394fb3d94f00e27c61f49a43b83bb8427f17a5c89bf0ec0475235dd945276542aa3ae99de3e7071a135642f1461e0f9f1e8ad2564c1aefb0acc0e3b91ff861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dafb4fa601eb74b538bcee5a846b197

SHA1
bdc3dbb84d737468f7ba6d15e7dcd356d39b7d8f

SHA256
8f2b9b4e765d1809b66accffe59874ee7e39626aea371fc1937fba0f2b348baf

SHA512
8aab6c29e401098323bf2e34475937e833e4f2b53bc92229bfb504f2fedea0ea376684719ae66bd3b6c755a68e36dcec27b496525f359c46e34e84821a51e6ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1075c35d34be01ae6752076cd73bc51b

SHA1
24687199551450c20c585de0cb8305413176cda7

SHA256
a6bfdbf653f0756394898ef93f14958e3be84608a472e4991b52414acef2c72f

SHA512
d13b8737c9237e48d8847413395b81b8f14a0b841c529ebf2c88b4ad0238418fee747a68fdf78f9170511f57610ba10793099da116af72a5e180546981a46d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD173.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD261.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2D3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit