760a683f369d2940dcc883f22d9cae1e0497b466d48e7932e41bd5fba04137e4

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff22d459ec71ffee79c8934e7e336f86_JaffaCakes118.html
Size

43KB
MD5

ff22d459ec71ffee79c8934e7e336f86
SHA1

a6578e1ffcc677bd2a66069e47eb8df0da6cc9c6
SHA256

760a683f369d2940dcc883f22d9cae1e0497b466d48e7932e41bd5fba04137e4
SHA512

7aeadd587d7f0f305a16f479b5dfb7d31a62a9e78f9897d82fe2e226b1c1102ea7c366afb5a77573928bea2b357b9b584b8f0241c825cf6c28fad8be3b8f433b
SSDEEP

768:vSKleBp5Zy+7BGu5VE5j8cCsxSRyimsaacPMoOC8y8gqNYj:v6BcurEx8cLeXvNNYj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f3eba93810678340bada9a8b508797d2fd9d2d4ce493e09fa2e0f0162710d12d000000000e8000000002000020000000143b62520d374dbc2d84786c350554090fc769a65649b1b5de7829965f0b6d9420000000298a0b5a38c59440b9c34f66db3c5081f0e1181bdbd2a1c40d0898435f71c964400000000bb4bdc67a990d8c9471ce71f3be5eff8764b1cae0f0d6061c370e053b2ae499cf4e2cb6566f6944a81885b53207ece2af2ff5bd210fce58d950d55eabf99aa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007672c87327b4eb2bd4587e8cdd359ba379ad5924e45fe5fe2f64df48a914fc8d000000000e8000000002000020000000bfa2a333f52c45d4afbacb2a630349e5682f224cef6f4341173ec9a4e76b68c9900000009cccf3de4045f958e00f15a5a8a037bf80111df6b6bb15929396d57cd12da57bd603d5bf88da99f71320f5f2540f04aba4acb694d846ca755f19e75b7cca5d82c3c9e1385047751bca0a9222e8f04e23575be0796afe608cd1c956d48f5ced3faa9df24227fa01f79d22e03a49b5bcc487b8b71c07f16f3688788156d4ee866c8b0169db3412182cac0d622988dd45e540000000488adab57cdb82188c72d789286982955f5360ea8b55aad1e943e897660b68ea124c16a7b71e4cbd4329176e1f0cea0697d9892e48f01926f0c66d4383adb316	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA2A57D1-FFCE-11EE-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a133b2db93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419859323"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2532	3064	iexplore.exe	28
PID 3064 wrote to memory of 2532	3064	iexplore.exe	28
PID 3064 wrote to memory of 2532	3064	iexplore.exe	28
PID 3064 wrote to memory of 2532	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff22d459ec71ffee79c8934e7e336f86_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff58616d7699ad333286d4ea27d01f0

SHA1
daf4b5a8a7619cfae8bc98ada2b82795ff002cb0

SHA256
6c9b023caf19fcf99b5cf8c68a12baf365fbba99e339117c20509c9f7dd34d02

SHA512
74414fd32773af34befdf1fb2f07d5fc9674a42549d0b3a7e75174b7fac3b54b5d8b9f92f5be454cf7adbaed0869661459cb1090c75eb07836d965ff81240efa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddf73ff952752fd833989d256a44362f

SHA1
2bfcd8b4280e03a8507e3664a612f707bd1a20ab

SHA256
43de21cff12aaae8a1345273356d64930bb1c5d38df516419501a885ff2b80a3

SHA512
aa20e8f10662fe2efbf152b50a04b9b27f67596d219cde9cc8f2f3f47295253c5f458bbff97fa8a57dfa1e17a1c8a7bb644679152a36ff39273b039e8a5f8f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5ec3018fb2bf900e3d259de9c1fa281

SHA1
e7154a37d9f3ec6ca3b9c55217932e1f84b48ca3

SHA256
0f9d08691a1f6001ad19ec99353d0ff172311f851a67a811389cc156140e2329

SHA512
77ca724c0f353bfdef3b020f2802a7551e30cfe2fa434d895ef42e7c62d8398197c9f379ff7cae2a56854f44808f9ed28d44ea0d826d40b9bf373cb1a99a2228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60ce22078d54700d85e3a45b6fe4e22e

SHA1
e27c019f8e96507d0766c5b87733b79e30135923

SHA256
a8ef73e3fd7df664786443c18fb1ae905cc1b85b63606edd67f3063fdceddded

SHA512
4359abe9282e7fb887ee11acc6c48788015a6d1248288d5693b55eca3b08f0da46ca3a9e62c936b36aa32e965d066ec9c1a69fbe4653f2a7b49af721619f135b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9fd569276a9e34599817d7c093ff87

SHA1
e4ce02127c18154717913613460a398f5e31ec8d

SHA256
7238508a2dc6198f6ab24a552c0724d0312bc9ebbe53291aadc66e96554e9ff5

SHA512
2d876ad158560c145a879d1bae8105a65b475a79a870ba7db67163ca1b214aaf657de6214f0ee71b41359464f63d3a151e95b678a8ceb04d519f69fbb818bda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ddbb27834d93451ee6314aa71d99714

SHA1
3d2509556067145212b8beed62ed5672c71e8b25

SHA256
4b452987b9ac7b301eeb7eda928467d588e0c0955f6c69f4a66881e64a2174f6

SHA512
fb801532cdcbcd33c5ff66367724b65530f934a8addaae09217e9cec064fe191567c048142fe75277f29cb35ce39f5aef13201b0f13b877d87fc9d37ac1ec21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
812d0dae1cbc576d26f4b05a5707a26d

SHA1
095be543dee57c77e4c6000f16079f5608808389

SHA256
4d8843e97dc795bf6ce3c4b17325f203f0a136d7d6037aa2c523cdaaa7dd12c2

SHA512
f5c164a9471e7b6e1559cafe158c6f4998c83d188ee003bce66cd47877708d5f194010f568ca282da7db961bce6003722d8f258528f5f09ea349a2ffd7bff5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75373e0e12dab11cd83079c35d811fcc

SHA1
42d64cd129410e3d5b7099ebb56caab77b919e12

SHA256
3c5bfb71cb284f66c10969763e37634ffaf449385b2e8259ac54529492691f3a

SHA512
c3dd6377a0b5ac3973808b616afff0a1505c301a09761cfaa4986a3c7af5a671a1c450bc15a60341d3d715e3b1dc796330e11d9a73634c19f747e7d62dfb15c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26e79b323767c590512e91a2d04c5230

SHA1
196eabc756973da28777f91af8ca1284680b71f9

SHA256
9dc4f4f2095b2e9be8701160490d06d17e5eda165f581a070477b9cdf4abeeee

SHA512
5f73f0b466831190f91843ed1f383b04366e9174e25115cf0d92e0a0645f31e46f2eb52cdf839b1a264584f45b636486dbc0d901b68b519504f97441cfe3a783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3e6aa6f54e221f9ff31d54fb4f25813

SHA1
40347b60d65eae981a4a31a7b52d6226e4642cc3

SHA256
3e5abc552c616575a3e827532100912308f8e20cd57948f470c12f2a719e4a4e

SHA512
cca018276f32ed7eeb27b4612e69a5fd5581584fe7070c0110c5138e9ba577c8a69533ddc37b25c91f02ecd60739191594f613b1abd52cbd79c4db2419ee80fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c90c6bb8fdb7d9d90a723ee3ee56468

SHA1
9f8d0b8131b2d4cd6a58c86d07e0ab623f36d384

SHA256
82bcff0114da1d2037129fea7b6b0cbcbf69658300646a6f0961091ea973d88e

SHA512
c8bccb7ddc471624d1a76d1321cedc3cabcac99e9d9a91592c63590604952460c45b681ab9e78d1789e693da49e3a2f75d3798687ee5e747359c953b30f4bf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab366D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37FC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit