87bf2c002c8553b4b6eaa5b991202d1bac27a146bac59cd844a73637b16561c1

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff225df3fedb473240a43876ddbeee03_JaffaCakes118.html
Size

12KB
MD5

ff225df3fedb473240a43876ddbeee03
SHA1

b2704b4edcfebd6bca51e0802177dd8ddcc9f6e4
SHA256

87bf2c002c8553b4b6eaa5b991202d1bac27a146bac59cd844a73637b16561c1
SHA512

c660b6b3414bb3d123434999f55bb0d2e46996244f4444f88931eb8b7cb04583d4fa69ce555f1c09fad8fbfdbf1c0155d544fde43e8c07d3358b54d2d3cf1313
SSDEEP

384:xy1R1QREDBeVliOwYvU2ee7Io48kX3RsY35qCPRrMO77OM0TCtxYLuZ4mXYHbw9v:xy1R1DeVUOdcz+Io4fV77OLw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0142492db93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000063b5306fede22c4ded16f79cb309f4e6537fef0c62971ee5cdd3f5525cf650e3000000000e80000000020000200000003481475a635b8a04e80321a725450ca0af9ebe0fb38b93868b8e186723ebefd720000000b0f999543c32e9a092ee523a5f21ae8dbdaa3ad18ce27c0db190e4ff039d2e7e400000005150e31e15d0575fae2f943e18744e1d0d49acc1937784132d568dfa9e053e0a003544e3e1dc36472833016e8cd6b335510042cea902756a15214e31bd648b90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419859260"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD875971-FFCE-11EE-9AB8-560090747152} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000470d1238d299c6f1690b9085556ce710892fce8a83f4dd256b2f883fa05140fa000000000e800000000200002000000074265e48ac5842eb503a72c1038399780300df0845aae348312ce8ccf07ab73290000000bb35184892528917da1c861139057d5f5974e7937a7a5424920593cbbcd28afc4e25f5d59abdf2c594e79f93706a992caadd3be466931134a1eea34da5cd70c270885ead6b358b66516e921aa1bf94a0f310f5a790daec58e87bb2220b5bdfc6bb724fb5e535515b24293ba646391d8be9b4899d588f5aeb8752eb94b81f5673f7cfbe204ba0fd3e77c9b8c0c53f30b4400000003cf1a5584b5965d7608fbebc98a9e7ffef16d2bc2e93ea4f6a64f94e0400ff5160b93b0f9f184c5c2d0778bf67abc26a0ff13724c445c8fbc93121523a2b56c5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2824	iexplore.exe
2824	iexplore.exe
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE
1996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1996	2824	iexplore.exe	28
PID 2824 wrote to memory of 1996	2824	iexplore.exe	28
PID 2824 wrote to memory of 1996	2824	iexplore.exe	28
PID 2824 wrote to memory of 1996	2824	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff225df3fedb473240a43876ddbeee03_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e9d960ac53434dc7b5d3fddb58b0d99

SHA1
a3f53da6f8c621b5687c0426db6c96f125673384

SHA256
db0401af476fa34dd1390e00db96738125cec835e9d2c71ffe312d6e80fa04e6

SHA512
1a09ac902a2659635f0cfd645f42d34cf6c9dc1d97d46a82f5dca30a9452147a313a7e922f4d2d5585afe4e164d65b91ca8f9a15bb9fd1a51d0df56587c932d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c3824aa7197c70b659e3c065e82e26d

SHA1
fbdbe0183a4d686fecf442a978445e3473c4e10a

SHA256
ca31a5af36c19240cfc1d27fbae0abd8d8002cbbbf33828d808286f14da9efed

SHA512
157dbbf35793db932bf4f39f03306673cb63ac7429d544422801578dc5f0c0c8a8d9a84b1a801d731fe59c4d859d91b14fdc3373d0af513783cc330bbd62bbcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94b009bb2f4b06d207c8dd600386733e

SHA1
3033950c94683e84c6d6aa104d35a6f6cf69f3f5

SHA256
350429bea9b40da479584672c8b94d35083c8a0713dfb76028c98fb303153092

SHA512
418db9d3fd20323211ef6ac5856f85b759a10eab071e36754ad32e35d4bb6f725fe1d54955457e2f902dacda8d5a72f3f13be381a3212a7dd94fd807cbf792a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81a655f02854c4aa9049a89d8ab70b4

SHA1
0157dcb7c6ce8cfe5c0553fbf0b0d4885838f1e3

SHA256
be6c56fe41120c45b46b515256f646385c4e6a4a15e37d0b6f65b09bddcbf24d

SHA512
54b6b63f221a165fbff03a77e38ce57fe0934a73cd6e2a1bf7a0b0a4c2240d70c91ecc98cbe48c5d76338fb696f5a5922311a81e5b54f27d6238998d9dd43405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a139276dce6a18d46e8a5ee48351c838

SHA1
f2e4df31ebb11135ec29d9ab079c5aceb4784991

SHA256
f7510463796496ab7b541d560a26096847781012257f15608e45daa15a3a6813

SHA512
9c4d5ed5df79f4764a5d782d82f2ada5fa6652fdf7d67ac8b821e341674a0eb9986cf130ad6318fa904440ef7d9496477400f4033008fdc9bbaf1b2fb1ea8194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b19589684320871e11f42e4a28f1ad

SHA1
4edeea4841c70d3a476fe4d262d7e079d8ce3e65

SHA256
215c20198fff56d1042891c6792458548cd1241b3b98d05994131aa11ea2932a

SHA512
7855e6945cb433519619659706d1396ce9d3948cfd6570010d640e59df64d83769e55f2752ec9339aa258735b093ad34f51ab18b2b7a8bcc595a1386700142c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ff2130572531ef8c9b6717889032fcc

SHA1
418c58377cf263c56786116e7b93c3bfa143add3

SHA256
4628fce2062cbfd58c6421c61c1a90c3b08cf3f5acde56c7e1586f9ad9595cae

SHA512
62fb53e02e78497a4b48f601643aac243db645956ae60dfbebbbaaba5536b5ec83a4b83b83bd2259a4f5faae1f693507d4666e70a1bfa5c61b36804fb6038343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41dcfeee563484fd8761bf2949b6ef0c

SHA1
96e74a94f02abd6f767c1dfdcf5fe0aaa74bf4ef

SHA256
f4f062c2d0c02b60c83c586327f6cddfe02a8e0c54d43bf6893c03d357ce119c

SHA512
0eb5a6999e02a88b8fe2f78bc133865e9bffe89a59a79a7dd72c102b2975a8d30077e0239553c505eede2652549c8d09236ed181db1a3d52e4fe3a85eda848f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1102d894b25e49812d5a87e5e3be1a7

SHA1
b1978ffee1ca0945014bd4b26eaee83950ff51a9

SHA256
fb0c9732e07674056a6c2aac610d47c1baa5a86c5f3d917bf5c1122ded2ade52

SHA512
5271d8e022291a8bb5d37a4c97488f970f86ff70b2dfa2f816aca9c1184c2cda5cfae79fef80f2a240a43281a6f8208de202fdc8e75b6ef42063ed9a5351e3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e853139ad560cd56bb481ed55254885

SHA1
3ddbbc3e329fbcff5841f0aa68398e5b52989390

SHA256
50e27928c866a7bca82839a817f651c0a0a8bca8b04f9d2508a81c937df1cba3

SHA512
d0444ec313a30547fd5ab258e776a94d168b65c6b1574bc82c9fb802eccfcb122a1021eaa51efc772f4223f72c3b8b15b3d4ad8097fa36beb9e1ea1bb6fbad7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b917e25365192be5f225a8327e15e57d

SHA1
b573b3397d2ea26eb9be88d465928f2be4dac8dd

SHA256
4685eb14340bf51dd4f864286bfa2e7dfc7a407ee60a710c351e9876f437b7e3

SHA512
2a082228d6277970748ab70b4ee651185bad12e391340e95c0b7c80402cc1a068cf02f81e762f9ec0c618e432bae9e9157642c2c8ecfaef73f2e29db1b29160d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55d779b1391a0843a3a33401bffd8c0a

SHA1
090020f5f97ac7f77770b656d60ce205172719ae

SHA256
fea51ea7b0cc91831f82292e259bb4b718625efdf6cf733b4a759ba30e7f95cb

SHA512
29b48b470f7a33b314598d4a83244ec423dabceb5f9c54b72087bbe85fb845d82679a692eb531825882a244a4f574cf85d5f7e7288e07eaf679b9a3e13e49ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a763593bb633399917cef3c10e2ccfe4

SHA1
33107c9b1d9a1134f817b56dd433479b010c07f7

SHA256
62da13609b5ed5bcdaae74d8e9d8fe9a6cf4a4de2d1fafe29d61af9da4eecdb7

SHA512
633d44c99f47273d3ec411f1018a670e4470c56190662d78fcfe4b8e352793770404adfd577fa57d8698db52450763c564e92ab86faf1cebcde88ca309fed570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c97d5b38e89b96f2d3449621326d3428

SHA1
3c3f378884154378abda12b2f47ba86484072f23

SHA256
5e1613bcce685076f3ff4be0458039490cbbbaa4d33602a4a5b491c59e136e7c

SHA512
5e3e17cd4e1e04aeecbce4e9cc8f80acc697f249538a025086b7d14f5f3782c7ecd8c69d79b8feb261724c5c0b84103bb3c77c8b13df50ee154051b59d9e2e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab343B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar353E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit