214216231a4db6fedfa79bfc6bc74e513aaf70d459819f861fa9d044402cba8a

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9918f9017f05de83212287c0a9e5a7de_JaffaCakes118.html
Size

6KB
MD5

9918f9017f05de83212287c0a9e5a7de
SHA1

def2e98bccb96225b121949304f8f44fc04d9d8d
SHA256

214216231a4db6fedfa79bfc6bc74e513aaf70d459819f861fa9d044402cba8a
SHA512

779c7af2f968d6b8399e1c5ec7b0c05ab71217d92e3955e4ebc1374defac0383c4262dc6fea3c489d8bb751f6f685d86ba4e035eec3c745c6706a2191e3ba7f2
SSDEEP

96:5hM3sHfOy1QWb2zAsFppcwiMREGnMWhWJVUmXL:5hM32JAJ7pcwivGnMWoz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05d369f83b7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423779725"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b844407477627382110c70f71cfeec8daddb76b646e0269fe4cdf629592dfd0f000000000e800000000200002000000097eb131a03a491fad282ea39e8ec6d7b0faf52721997f29d7641f9486c3c2ada20000000b1b22d854dda84962bd21302403b8526417921bca739e662a4fce13f0793b984400000006f1d5d477d1012999bcf3d9cc3d3cb32fec83384fe2cca15b87cff1292908f5640dcedbbe00caf7750b94b3d7d5f653a19d518f2bc81df5c677cc802d81bc9a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a54181b7bb1db3d89b387ffb2ed75074a739c3f101bc572bb14dbda8c11b3f0d000000000e8000000002000020000000261f98cac9c1f09672cc9174c026c40a3e58131f41b5cdd048e160fbe1b3229b90000000fb947a0fd94ff3f0e176b65fc42b93da99bcb5b0f8abb8de6487a98ae4e796d88cbf0c4a0d0e4f4373ee5f47be1e4b96166c724cae17e146fd1894656ca4c8e29e94c8eab27b5591471757d820f0c069d5ad954e41b14cb8517fa021ced6051b2e0acf16cea644de6b10896264730f93405390d0d6715f97d41bc2b1aa7f699acb4b1f1cbac4a5d89052a98d8e330d7b400000009dba329cc24c69cae973df9ea8c6f2e0e516abadd0196e20d1a10524ba0221f90e2649ce1b195c36693629f88eba4dde36b8f4d1a0773f21c9d77335459fae7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAA5DF21-2376-11EF-B6D8-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2496	2108	iexplore.exe	28
PID 2108 wrote to memory of 2496	2108	iexplore.exe	28
PID 2108 wrote to memory of 2496	2108	iexplore.exe	28
PID 2108 wrote to memory of 2496	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9918f9017f05de83212287c0a9e5a7de_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb89e9c8552c850667ac8d4bfc83677f

SHA1
cd2f50ff34d50d33f77c7b16e572e82b05aac89c

SHA256
5980cf3bf668cb5fe7fcc8bc4869392b8557c33da864be112cde3e33408afea3

SHA512
17c53c4100cfd3cfd8692b60db352a134e2928281ca369b10cd61b1f394300f434a9d034bc68f3baed153ec92c8773d031272ece3d557812d9d20f0b13eb5521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c01ee2f40a09f599658ed7bdba83bc3b

SHA1
e8831638b993eea5f02cd680010323b12a11e79f

SHA256
766b324efc690d32fcc41df8ed9d41a31f51fa6b81aabbf7f2a5c66633daf0bd

SHA512
bc44bb947a8e88deb6a6699e9a2ef8e02f73f1acb3e7a98383cd9f13ae94dd50f75304bb45dadc7e422d607e6a7c95da53913f3381d5b045e7cd9a93170a7eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7262c8be6a711a4495c16850f4d0bb81

SHA1
63ad27d51711a2b0dd19fee5bd51080b9a0ab6e8

SHA256
2e8e79eb534610bf678092e14b67629242171f5e412ccd41dd1e3a86bd091472

SHA512
05adda990e31c14789e5b240898a91c1355d8281934a6f817ea3e863a55c78e0aacc84ce140920c09ec10c403ce9bd1f2a249efbb55e060a051a826046b3d0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c1be1cccdd8e6ec86ff74ee3fe8a60

SHA1
de2417bc10fbb54af267927d6da706084cb5929d

SHA256
2b1ede91e9b8e1a1b2551d33cbabc6d77b00b90c2ac2347b42074a1c188b509b

SHA512
b422e2b2edee266b6fd09c3f2dba9eff55af3b4aec4cb73b34c9da232ad9df1bb639e716b0911d8857101e1dc36886ca98583a2f2cd297f23c93af653046a643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bbb8b5cb9f3210af96a777ad906f99f

SHA1
b5c68c156142e6aad2f423a182465cdb90323ad5

SHA256
ae841d30072b2d80737a5178ba47cad72732ef102ee016d0a42dc599a172a32f

SHA512
6ae282c1ca0bf0b0aae8a2055ea4c9f39af3de01b4db29bff18908ee0d2dd6bb5edc92aa9eacefe1405bb27697e59dc43016090e4e01cd27e2f05a6b16dbf5c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7791953be412e63e6dd7abf9d1f83597

SHA1
711aa5719731ed041a470f1b1c774cff1ec501ec

SHA256
5baea2d9d9b190d97feaeeb03bab24c856b83006461880fc71dbc048e84836df

SHA512
c78434f5b7074108f288213332feb3c26bfecf035f607f8991ad42993c1cdbd4a4aa785db8acc58bdd8d581df3ecfa8d6d783bdc1e5864693c879bb59c663f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
792dee6c40f9d3ddaa0e51803eca43b6

SHA1
028fb947569a7207ad0796246b08a29c576539e5

SHA256
d0ff4deae96d76255fae72561c3ab3590712b730520d6f9c8e412e45c2dcd6ec

SHA512
4cd27066abbca1c09042fee3c5756e7748ce4bce527b570be6464ea403638b394c3fced467e5d33a02b58c00b60bf7a373c5ca14c48921243c620e47dc1690a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fb7c8999e2184c9db5dd4f734e513cd

SHA1
eeb04603b3e1bbe10ec53a3787a8775db70c7741

SHA256
d4caff9386254048ea3b9aac839e9470b59d7bcf246409018c4dfe11934688f2

SHA512
4dae8580dfe588c4c2007e3d3b541a376abfe6ff4444710362845e1f33c5c269bea27f4c52e4aee7c357b3e1bbd0d5834e6a3e37da4aec6b1635411f21718d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50b0b009b494255d55025f68776c41b5

SHA1
4b20d4da1d78e5dc5ea06ed52c67b0999c6f1d7e

SHA256
97c693d574295388dc1d17b315c83cab44dc05cceb7474160cf49545bad6b358

SHA512
2b607fce9f7bcd92412c8487f229224222dd93e04a274717d2259408cdecd2736c7a3b9c33d5bf38984ebb868d6a824dbfbc3b0266974d6712213a2a3a0bc5ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e704ebddcbe25f6b5c6399f03ff52f67

SHA1
55ee0647a5d9806984444f5a5386bf0b6210b48a

SHA256
43d6a760566facf128ea9ab8926dd67e999b54cc515165692e9792536da90dd5

SHA512
b795d36b9039784dddc6e5cb9fa6ef3366655b1c5c8049d9a9d007e86f02e0b78634516e43369aa5f898349464b8f4697369d28045f641bafdb33195c3acfaec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f1b2ef8930d6f023676c4b79cc17379

SHA1
6d9e01f5510cdabc97c6b93d71b43cc59ef25e48

SHA256
821eed2179f6fcb0940ef642340035c4c7d29069772ada0a61e200854aafa008

SHA512
46fdaa65dc72c8f6568c335118f8816d4108aa70e6d0e6f0abf67380f03b390aa6040a2742ad3527106965d2b48fd304d9680eabb7ee0e99c207d87516b42bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a565b7917cea542830be4196c9fa59

SHA1
5c04ad60857f91001cf3adebeb77545cce6da311

SHA256
2aaaed1d2de8875f244bdee657fb3101e2eedddfe0da8751b468aaaea4ae7c2c

SHA512
ac4bef03d72d909fff58dbbf5d23ac014d331c2c72f8c29747456e8813096a5ba2cb7a1268238a00993925776d42aa8d3ea19af36a1e540507c845ec594f96d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d97c37383201a509dacf6ea9257b374

SHA1
9962b8f34744a0f7db3c0434b62e512dae4714d6

SHA256
5084145b24dfb28b832352122fd407720c320e25a38d28385275d7fb5f50a737

SHA512
239c88e164a620b34f1cd23555d335fc2df1f8906eb868381f712fd78e62a2fb0fb2d7997a6e9bb0ca4caf10570732634e84605954ee9a2b16421822c36e7a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73e3b1199556c44eb31df44c95288f3a

SHA1
474e4e3a7d5b09600b598834486994c98da956b9

SHA256
9cf1841adc6fab896b917fe19f1402941236969765c5174375755e735b616f82

SHA512
a3e264d563ea18097407b4ffc2bedaaae1ed2ccd7c33ec0aa3f07cf7a5c5c2ab829ce5a4d61ff828f8011bb166f94ae4be2320d0f96386df11a8062b42259453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5173886242c348596b1f8d900071d863

SHA1
744ae57e62c62c62883cf018e8244198a48b5f75

SHA256
c3276bf0be7430c6b523de2f641c1f2ebd99d2ddb045d75a077143618be497c3

SHA512
726f4caf888a77bd7c9a0e41d868e74d860373b2d028db7e3e1586d7794858475dd5f7f86006da8314b61a97dcc8652ede4b88c5ad7ff6ba564e4a200ff20af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e6707af0e7f00f9ff195b84fc08f637

SHA1
c745db1dd9f58c24ff92fe8a28c49a30c1095f22

SHA256
d3235a930bfe75a2923338b5a2a4a73c4fe629d4c184b968316081535e52e157

SHA512
861e62f328814f50c6d0f85e138dc133bfa908bfe12c8ef7d69a0e6b38b6a87941d3bb93c49f389c3119547de73c290f8419b5da0625f000e6dd9fed5701c3a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab319D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3271.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit