3078822dcba3bdf8609e4d4cea3bedd55c71e82f89bb2cdd1aa7a09c85640490

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe047445684b4c004bb78845d38b6ad9_JaffaCakes118.html
Size

12KB
MD5

fe047445684b4c004bb78845d38b6ad9
SHA1

260d1683d1893683dd2db12f42aa2a3924b16eb4
SHA256

3078822dcba3bdf8609e4d4cea3bedd55c71e82f89bb2cdd1aa7a09c85640490
SHA512

215a8ccd376cfa29756116faf151d9a5e76c4000ee8320236606af953dd03e2cfd15c591141cce4421a9b5525d5f5314f38aaeae4bb2493b59e574c6ca1642b0
SSDEEP

384:1z9/gTwkmWanALK4hsUcd202h5XQL+IuT:N9/ADXQL+IQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000050433a1cf6fc43ce700f6a7aaf758b3f92b93ace9d9d6a47bafe92fa80e70b1c000000000e8000000002000020000000564e87a19184ed8afe12531021a23b5eba527e5ab92e11a17487dbb50311d2fe9000000011d24aec457bfb4cb28232ca2de9999586e59ea16eebdc341040eae6b05de8bd76bc77ecba59e7792f88ef04b9b4348f25933e4e37ca3ef244be3f5fe932f7fdfe2ab889f6bd2594506f4d412fa20e6e94991fcea653a6a2b62432ae8cde419ddf0789cf7791adf5ad8f63508eb2507c55cab9976d2f7b943618f18e112032c3a9ff3c100daf47a3d2a530e39628cd4c40000000acc07ff9ed956cf789a2e975ab495b67daa3ec8bd86e5cfa33008f49ae751567e2b64266577f7309b640e297dccffd8124c683c3ab3d225d49824f9700f87f81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000c4a43c8e61f1013caeccf3eb6847154fc95658fefd1ddcbe3f432e7928ce9f9a000000000e8000000002000020000000869da73d7dc7d31b388a303a87a0be694b56cfc8a6d4c4b5cb194f297b86401d20000000b62e5ea074ef9f84eeb723187c542f518422b8bb2dc13cd9aa44f34e278b85614000000070e35758abec551f3b083e25d3c9a4b6fb73172babd6863b18a901ffc80c7073689797f8b79a0587f6626d50274886302fdb008985222da8bcc95c140d2a1198	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306efd388493da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419821741"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6274D0F1-FF77-11EE-A1A5-568B85A61596} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28
PID 2356 wrote to memory of 2108	2356	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe047445684b4c004bb78845d38b6ad9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39795bf99295ff56ed0f4cf2f5111883

SHA1
ef7bf9b401a623a366367ccd38900e06ef9d88f0

SHA256
ed6538ebf36a9a57d7593fff01e163f04554f1fa5220b5b0db9cb0f4514de628

SHA512
d1e541f1404a22447ebc1eebf6a0d7a474f4e1b593a56e44b6351ec175395727a52acdea16c2069d0452f08ea31c40035f5b7de7e79a49f21eea22f37e22975e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fcfbb51f476d2162edccf6d3de2ff48

SHA1
3c9739bfad523a0007e5682af320f877b258bccd

SHA256
c0294a563186e0b622c0d760c178bb72e14309517606e56fd1d4a1b42d7f3eda

SHA512
b6fd2159016de770330a075129da74c180e3d760c7fd55fc48c6b3a9fced72d49fd76dee3e9d4eb1df7d9d0e648bd26a9bddc37ac472ed17be369aa2d91540a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18b9b8318b939bac7f8131fe6d9027b

SHA1
909671f4d2db1cd2abb05aeba30b16c9e79eaafd

SHA256
527d66a29bd85163ab1222defb31c457b2769ae1c512989ce0ed1841b47a0d5b

SHA512
26dbbd186c585d1ef7b2953d9e290e5246bc0507949a7f47b805eb168eebbcc671f0ec8a1b16fe05e89dc32493c81e0fbec54f2557cf5d5f75377340996e68c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9a07bd64c9b48d64385aa28d927b09d

SHA1
4142fe1932f55817502215134249a6d8c294dece

SHA256
4d6c63a544b6705ad1ea70397457aec9466784544ddda618937cc5950571d358

SHA512
566f07f4ae81a95e79786ce18b8272fe35e2644cabe6806bcd2514155df3a75d9d85b8fbe95aaf751306a2c4eada33c1a1254c38b7d40f1caed489c20bd13a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27341bf19701962740e6dac6e748121d

SHA1
f34c3ba798a377dfc2ee66c94fcf222aa6963c4d

SHA256
fd36d7970646197b4caed6b969da71864289600abe02a64cfbfe0e13113069e9

SHA512
961dae605ee979e891dfdc76ab660374ccd992994e843925c8953fa9b3e25881697a3828cb425d9eaef6613ad590668d17ea109c123ff4854af02a7f58f59e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6418f7f5e9f0cd118a4edb1b422c51b5

SHA1
5ecdea5ffdbd379ed9f394f755de1372c54e0120

SHA256
5504bc6294560a46a450df19c6d8319c8ce2d97c04f43d22a12bea7a0b924fa2

SHA512
288a7f0037fc8c66c47607c31f55406a9c7536f820fda897521030451c4d7711afeffc8be62843c1d26c3b79be6d4666984d63c3e83adf87771b571ae347bc02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd2d7d072ad8e753e51c2598a159377

SHA1
e3a90ea0106f34e36400e1e1ed314b867281ab1c

SHA256
79bc3c2d4dbca22216624deb11104bf51cd324b647911bb54f2a257705779c21

SHA512
6cea127a29f20ca65e801c1715caf6630c3434371ccb00c53907257308608ccb8c27bee8df53a3aa83a93c60eb61b3080c757c03a73bbab1ecd8618a4bfa6053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df11c026eb5ffbf2cd3e54d2b0255292

SHA1
9208d46f769cb8dd982bd68a42cd6e5d29201be8

SHA256
b520d444dc9ba5467b0719733c3c6292d85b748b7ea7f1b48579c8de9333243d

SHA512
23207955284183daee4f7ce4a3801d5e095edccddcb6f296cd6dafa599155a232f80ea9ded4c8ddee881f97c010c36a7334f6bc22cfd49116d3a0d269e6c2ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1827a4cc0a03eeeceacfceb965a13a6

SHA1
835a6511c50b779171af285628ebd6bb174e4248

SHA256
1db32c58f1f48f005d5f30d1bda7532d3b9975199b450d692835561ee9cd100e

SHA512
513449d7677defdc2bf40209cc4251c303f4af762bbceb7f80116eba9ead8f2e3574c14d17b4cecbfca8fd9b6fd26e841884ea22f8d3a70e4fd1befb3fad12ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a07212e8485712254869778c450f5907

SHA1
f30509f6beaadd80de232d8f449776213155f149

SHA256
589baf61e4cd3a4557c7fbaf78214b753123622ea54eb54e8570c1ef5f121036

SHA512
db8af01a8bd8e906816e81feab10fba82a5adce80e6761391eee84dafab3351f0359e7bcaab9268a29d0aa2dd17b50330df6805bd6d43cd154b8bfdaa975e47b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd14d7a73d9ec434b07fcfd205ae0c9f

SHA1
4c285a6feed0e36203975f2f94077602dcedc283

SHA256
e492546f21cdf9d94edfc88db413bdd92ae341e911e708d65ae9a64461bad854

SHA512
5e78997ce8fda3fb5f9a7feafce6b605fb9e6557a064a8db9adda755c96d98f8fb8a0b3da4a576d9ea6ac971cece49502b9ae5239e74b1f469a61451eca43a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D80.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E33.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit