16bfdc927a17d5b23fb45c3a328e85dcff430cd17fed18e7fe9ff6a39cd70263

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc406a44bfd1231c1737da5569c21945_JaffaCakes118.html
Size

38KB
MD5

fc406a44bfd1231c1737da5569c21945
SHA1

063281ee6e0dbab75e064a689d0627467d3bc0b1
SHA256

16bfdc927a17d5b23fb45c3a328e85dcff430cd17fed18e7fe9ff6a39cd70263
SHA512

eb1f3769c8100fbf65c3e81a882d3fffedea480c8452f6e1e1600e518cc122a6c26ea001c9443e3edf10ae7d43c689ea9ded85d08686e666f7f47ebfecdc0f42
SSDEEP

768:tcOJnzgPXni+eeeRuUdg3lF1HVpM5rlTS:yUF+eeeRZg3lFOrS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{821731D1-FEE8-11EE-8857-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042721b3d190b8842914f6970a695723a00000000020000000000106600000001000020000000611455bbb2b842a853b584ad7291ec8e30090d783e423682c465c38ec401c6c1000000000e80000000020000200000003c335ac6ae50ace70bc8a87216ba8dd2d53c4672bf4c0229063abf7d39a6adb19000000038ffd5cfc5e654c5f2b9058b6da6e5eeb7bae990a735c9ff0307e3a495c1df889c1484bf9d528eefe4c67da631d0beb4ed6c839333161527a408d6cc9cabf0bf25ba0b5e12c8a27b77a25f1d7e2e02263fcf924f7766416c8d3ab0b3535a8521eca3576559b2001010e28d01fdb9fc37836bc1e831b2bfeae3733b6045ac1ed329ce609aaf5a9ceeeed1073fb3f8332e400000008f27dc4450fe771ae5fdb64ee1bf2cbff99d71ed8525c66f9b00fb1aae93494bf48756dcec1fa2f1f339fe4566986a3020972f0f583a6e528c7e06c21c89273e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419760377"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042721b3d190b8842914f6970a695723a0000000002000000000010660000000100002000000069da93b4d4c06967e9cd09ef95d14285b6eff512e410ea7b2160c9acf7fa6c87000000000e80000000020000200000001fda1d0dec455c7752b9d8e2d03733e8ff89eba8cd90e444f8b2427380f5053c20000000d2d8e2b6d3d1c0de125d8f6c0a8ed5968917a05ab1bbdd1252ec7cb0538e251540000000daff0be8aee668412c6bbba53be3105b099dd17f85f0de7efa60e7117283771014b61e62b63f286a2f19380353441645ada76ef6a898b589630da4a91b2448d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902a985cf592da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2824	2896	iexplore.exe	28
PID 2896 wrote to memory of 2824	2896	iexplore.exe	28
PID 2896 wrote to memory of 2824	2896	iexplore.exe	28
PID 2896 wrote to memory of 2824	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc406a44bfd1231c1737da5569c21945_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b1003709abba5f4ae26e51d0ca3b3a24

SHA1
565196110964726cb7f2f58ce05fd416c99fc3cb

SHA256
5cf4b703fec5018fb5b53d03c3be705c602dfc7723ba1929cb6d25187022784b

SHA512
bc2aee4063b102f316c18937ae56f5e9c2b79d3986ba859ab3e257603c63451ec4d61a882473d7d9647bb7897a62e39fb9bb06c01afa2ffa14157eee04e8203e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79528131dff457371875aa9236222f06

SHA1
527d8b638891acf4fa1e55650687e7c7629bdfaf

SHA256
001ba1a9d78b3717cb30169e27dfc4f39e44a4759664b20914aa57340e39bc3a

SHA512
c446ed338cd889846400b7f7a320a6900d4bc9217419637a3217db14ec5f95951073c35192a9c973d2215005fd6079101bce967a2eff2828991c75e09941ae5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
571a0501597eed687a1213275f86d120

SHA1
ef67440580676fd2fba99168309ab01efc5d9e8f

SHA256
2a3534b11897fb00c600bbb751f5a214161f89d2c57e58d807dc98228af0003b

SHA512
b1f8276312439c633224de57e119ed33160b842091cf9efac8aec004bc0ff28ab2b164a4f4d6f296bbe23ea11b8f214e47927b40970a65ef4c378e0a128b38d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f8f4e1746a682c7470b5ea1b0312603

SHA1
b961a7d69c5a5ba1dac339f967f7a2a411ca66ff

SHA256
fd42036e534fdfcfd853696f61e5e813303fa7a69dd5ee32b29e16a2910afda7

SHA512
e2c92b58da588dade2a8d313ed58b32cfc246174ca599e7ecd1569f8f935c1688e5f80bffe1d7a23bf643bc60c2f342acbb84fc79f80d57032bb434eb90f3a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7728502d9014ee1ad6e72d21bf33ca0

SHA1
45eb66adb2425e0199eef8b525b3e8f114a114a4

SHA256
54c5b1ba7dd55a994d3c8f2b520e960765800cd7bd269ac4370b157b508fed67

SHA512
c5c151e9812fa59d577978654b4a538c0767d75cd61968e4f21a799f6f4f6118de87b21eb051c1629fdfe8a31c5183c22e40be74815d0beb54b843eb21f28a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d54d218b3ae218de2fb3bdaf6c27a1f

SHA1
538d3f85e4cfb1dc9d2afe84174a73b59accddde

SHA256
555b76958b2f1eb92da83d4071aa8b9ea015e7fa21eb95181a5ba8292423b1ab

SHA512
ab9212037d00960bd8d8c3315424d4d329196a97d2be53ab7679c5edc6f625b80c6160ff0ce7fa02a9ec8a422ca6384f4d0372b41cdd4ed1b4b5aea9ca0a8e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
696a8a6499845489f536f7dafa4e6480

SHA1
27a424048757e9370e5b4be57ea597ea455b059e

SHA256
4d50ebefcf3ea9bb2a3fdfd901c4f26375494e4368c17441e1262204ad263094

SHA512
ceeeaa39a36a706167c22e48af713662ad1a3bf45cfb855251bf7cd5253178027621508c5fc48a905946c14c1691e4a469c8371034a3a5ca92eb6c7fbb2d54ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287869edac3d22b36f8b025095d86ecb

SHA1
bacc5d6cd891936d80be005988d753299c0b1691

SHA256
0b8818a0d66ba7e05967ef2fbeed8fb8157ddf51dc1d16aa94b6fbe12f3b555a

SHA512
44a73e92104065775676adccdbd3ce74337870fec04c448b2cbf7561b0dbb81583428babb47bd3279fb0a53cbc9af3b689a74e86e1683e8094e1ae3b18075b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
77c13869fe209bc352fe149abd3ff8f4

SHA1
954fc2ed78be73b5bba519d50fe452af9dddd7e6

SHA256
f1cee15d4ecffd12156f47c3618ca566fbf2e0913d3f89bf1e70ba819c822f8b

SHA512
19753fb5ceeb534d1484f11da1e62df07412994a086f2cfbc7f5fa8ab95e27e106634847358b51d0ff61565e143ef13f2e6ae3799001e2d3eddf07e25201785e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FCC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit