be726bb5a6abe16eaa378f1f8d55d9d2e0aa5ffe15609bdb48668ed0a63ea0b5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff915bced86fc7d8fd7e419514707d13_JaffaCakes118.html
Size

117KB
MD5

ff915bced86fc7d8fd7e419514707d13
SHA1

548b41cb06984738674bf9bc7e34b7d85394d06a
SHA256

be726bb5a6abe16eaa378f1f8d55d9d2e0aa5ffe15609bdb48668ed0a63ea0b5
SHA512

6850e242b2296dc121b7a6ed1e5407b9f8a38bfd12185eb5c79736c36ce0db3c5cd9f8e6b00cd622ce5c9fa2b8ca89f873e1f2fe3ad601b8ac17ed65f123104c
SSDEEP

1536:7+oRsyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:7ayfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419874326"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000561582dcb6b146e6ee2d6d310363c694c9d3b035e0079bd962db202ad18999d5000000000e8000000002000020000000de0e9ea1132875d3de3437905e28c77d291d68b292f5f2bef0e517b36764e406200000007e38d250b7f2c899e4892c089182770e69e1a7fe7bf11cb28a9d0b4f59d659c8400000009794dcb38f89f1f0108fd15263c6e7f0f36099c7ff8d4cf9d36cf28ab964af64d9a846c6f0efeca9353ce93530a880ade4e7743fb8cd466cd6c10d96f3a984c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000516998db8385a7876b65b832239c7871809adbbb2f205937e97079b677aaea77000000000e8000000002000020000000c5615bd84418b570baeb8c8537554e133ee92d77422e537d82f24c4135d839d190000000950dc9b2a6f4858c183478d7461cf153a260aa3b0888c150b06b636c9da81c14abc4e42083db1322c123f67d48ee6c4e0c9ecc91bb5c71caa1ae51138fd398b13df785179c5e96918b41c744b04ef99da02f86c084348484f1b471bfb8c1d7d52063d9096c5e65dbfced2e7d9ebc4c33ea7915f00533dbcf03e160022985472d0b6fbc649e2304e2cdfd3c86ce870a5f400000004b4df560071be9a1c162c21f50cee6435bf2f994f73a1ad65d8e173ecdb2ce0d1c5f818dc4a6b2ca66c63ad325b58249b965df748b90b510f336c86000267df4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D05AAA21-FFF1-11EE-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02b2fd7fe93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28
PID 2008 wrote to memory of 1200	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff915bced86fc7d8fd7e419514707d13_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3f80ca03961ee604d185b7dcaecc41e

SHA1
283fbeecff145e27de25555da6452ef341d7e122

SHA256
feec586d06d6d735715c6c37d7e1b7a5d032ff9b35fa12c3c0c5dfac4e919c54

SHA512
c21573395e99c08a524d35b52116c065dc8cdc242a4145d2c4317e95a084b6f73516d1d2252f48774eacea691c4d11ce2b246b58ba75a9b25c1b2ef8e1bda108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1cdf8372c061eae0a54cd0b8f62a93e

SHA1
191b7b229d33296ddca273f184ec2e4f114144fc

SHA256
822dba5bc996138ce38e826628ce22e4a49d37414e348d28f120730b684a8531

SHA512
8aa6ab8be58ae88b625c58d829929932edb84e25a5acd53bd29fba632e073832fe0d24ffe91f41e00c6ee9850332a925003188c572d70d67f4603789aefe6946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21788df7b53778a4d81f78ecdd63992c

SHA1
40b393d7265768ac2b9c0c02b7cf0f72fe5508b8

SHA256
c21f66b78ef8394d4203e8e534bec1e7b5c3b769fcd5e1f32f222057ff18cd1a

SHA512
97284044d52910bc5143a47ff1d51cd15dc920ddd2acfc9c7b4f7e1f44cc692341395a6adde9aa21162c87eb9d56c952aaecb93fbbee5ddccd063bd4a069febe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d8384663fc2d91d6557adf5eab1f64c

SHA1
999a2b24efdfab802aa9e4043e5823341d3c4dc5

SHA256
5dc32cf5c55b35f7075cabb990f5414aeccc186d1af3bf2dc23d1194b2011bcc

SHA512
00ecd53e45fc3b29d6a9d4a22e529c9b3a5599b76856242cabf9ae06c13454861401349caa673473cbc97ca49afa230ad4a0de6f5a13aa9359f4001527d4c03c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
590cb6f519e463d731eb9b99f83e9a98

SHA1
976d4419563725fa1346f082ffafe6405bbabf67

SHA256
1c1cee034d10ce66abd6655657e65902db9e4148821c2f7c9177d37139d9a152

SHA512
0d9ab4691e063dfd7635ee1ec439685b1d089c6208345be51852c3aebe8a08765eeff85f40417538e185d72c462b487ea5513bdc321c8f60cae8f115d8d222e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfe5c0143aad3091aafee7d71f3c6df2

SHA1
f993abbf7f9eee8b57bd473f09ffbbb75cb74b8c

SHA256
00b44aa0877035835aee948e07d537fe68ba51c18730bed255e5cc186b68e766

SHA512
ce5ec03976820c2a45f25bb29c30af98c7f1fd3b4c2c9a8af11a9f17904167c18cd858b31830e8b0a2d23f85f47c10c1d844e1003022ce6dff4e30ff26f3e55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d58fd6cb2f813d7678ec577430b216

SHA1
1f59ff30d26aaf9cd81e142b0d95902f182a09d3

SHA256
3684941f6f32caf7bf7182edafb6d92b175bfdf501b8d91d7d1845da22c5747f

SHA512
7d046b4111983c128c31b0e2a179cf21531dfc7665a3d183e25dfc8da4c070c43c3d2066675edfa536a39c01eb803e6bcc9e4cb110976bdc8f2da600b5ac55dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8ce35b7fded284630fed7ef2139c425

SHA1
bd346843fc92356a9107387f6fe33977d69cf9e9

SHA256
30693c11d59f6eb528d101fb1492f5af832e2d0cf153392a45a6f7ac118f5296

SHA512
56046619d84253ee59694b17df60dd148eba8325855819f782f26044a092f4cfa7012eee3704731607c27196aef3c702fcd0861933fcfe244926de2bd864da7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5955aaafe557d908339eaa5cbfee7baf

SHA1
5c45ab81cedadbf286aa3e96f14fbfe5b9dbdc2d

SHA256
23ab1c0c9777934c9d9dc93c3b801cdd5e4b09ae8cb01cc85608d7545c89765f

SHA512
b30b3f3aa4cf2e35d76da311ba05f44ae7a97e9d10effc5a627765a79b865d13759bbe2c344bd8ff621dbf7b824db325b70e30a958a934e4b6b406369928bce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ec634eb096509583a07e7bc6a52be36

SHA1
66bc88c9161a65ddb963273a7be564f3caa98a26

SHA256
25788edc46f2c678ba2c42313c4864137c1a8076692f23f6d24f5fd032b2a967

SHA512
1dbd3b8dca3efc3911a03ee2fb599a67228873ebb9f6a5592605d2b347ef324e73de459fb6a491966c5519bbf5d7cccbae0aacc87b2868604d25e963c3cedfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2da7338edfd8dd6876e896687c95a97e

SHA1
8b06db148f1c0adf2e7f0cd55dbca17b4612cfe3

SHA256
c73b31305d3f00d4685d64d7fe0ba6a8b3312f8c2f92655cda2f3dafadc12ee2

SHA512
2d9851b4aad77ce39bc032e7761233f505c91278262227946e90c8d4a48f52cb5ddb8206d0e19dbdba61af44d16774045e5cf1e060574e7c8de96468e7ccbf08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab314F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3359.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit