818f91a385e2847782069b57b0e9b5e5a01b456e5fba56a9117e17df6ed3ff65

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffd4bd85c406541d00020e50a5edbb6c_JaffaCakes118.html
Size

28KB
MD5

ffd4bd85c406541d00020e50a5edbb6c
SHA1

e13250f753bd07a14a321bdc6313e044c87927ac
SHA256

818f91a385e2847782069b57b0e9b5e5a01b456e5fba56a9117e17df6ed3ff65
SHA512

1313c23ec4785af3f3416cd2c6e12202fbbaa2ec089c13ed6f1f0d76f6bfbd71527242962a26b362f06c0f53adff76ead858daf64fc83067190104254d558bca
SSDEEP

384:CIlKhrRGycCH1wOKy6U17lqB1LyoY26Kpuyjp1TGPWI:CIlERGycCH1pKy6U1s1tYLKnN1TGPx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bd2a9a1494da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000794ee284cf0e2217c5241cce0797d46abf64ca00ec6a8fe4d239e46ae18e3e1000000000e8000000002000020000000401a0c5d7bcbb1d7b5e5d7e4e65e0b74ec9fcd08f15998c1c25e3521e649f8b5900000008d48a111a83e4618bb20b6189ad7bb42aa2902c230bb7d744022bc00212c0bf158c3980b31da93f0383e466143e21ee5a1e0e7dd68df70402dda7edf639aba407edb8a6a86a428c82f3bfdd11932ff934f7a0c91db07b892489bc9390b62f5450b55c1f07ea76d3d771628ddce9c8333298d72b5f643b1757920ac43a5e50d10ac84407e0bd9629de9f6f483f947362d400000005a46111766d074c97aa038c73313d49b585447c40b44d91098378694c571cb003d96530e99b1110c4b46e7d5405a8a9e6e099f79a0f99670407eb4a9d61cf8e7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419883749"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2B0EA41-0007-11EF-AAE3-FED1941498E6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000079eabfc4caba220b198ce6bc4d504327318a6fcb2d4db66ba5ef7d0f6fa6a7bb000000000e8000000002000020000000fb14f8501709905120d9a37e38a24f2a62db84d835359348fd008839aa02dd04200000008268fbfea39dedaef0ea15f0bcbb07d4eccf5daa6a6a71114ff49bdcc2e6ff97400000009b18ef549a8913f90aa21b89f1bff1580e01eb7c6c5e209a55346e6a977fe45bc9e56a3879be15348cfa07f5663840230e7cc5450bee5484afece1a1dc6fcb0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2024	2108	iexplore.exe	28
PID 2108 wrote to memory of 2024	2108	iexplore.exe	28
PID 2108 wrote to memory of 2024	2108	iexplore.exe	28
PID 2108 wrote to memory of 2024	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ffd4bd85c406541d00020e50a5edbb6c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c74295cdf67efc78b1b3df38dd4acd79

SHA1
f2130f2776526177c88a0bbcf1fa5ef03c34c25e

SHA256
1175943ac041ca3d045eebcccf4c25b3d7f4fbfa009726773392e1cfb47fb3c9

SHA512
fb424b0efd6c0d96fa22adeb9c800594d11e51ce88ece887ef414015d5bdd221a4026146a0b6a59e6bd43dd0ce0d77afe67bfb1a977211e922c67c62c5cc24f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce62eb8a448237996034e424643c9fbc

SHA1
04ee51e99b58255046ce8dc251723c36787a66ca

SHA256
e2952aba3a92e7b6334ccc7d479ea5cf91c4d7e870d18c9d8724185faf0bc884

SHA512
f9c82c12294c01e7d7513a18322a14349681dcd742884e73802e9e67b687945112e6862c161e7c009c12a8a30fb4504706198a1dee40829bfac1c0efd5d0a4f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50b02533983dc68efef1ddb005a3644b

SHA1
384847c3701b20d071f658c7ce6f1b4df65c9df9

SHA256
6dd1daf63be513b0c61fa9b2fd0b4fc20c64210b3b77e758818601d12ea8322b

SHA512
661ad193fef6919d962dc2db03b306f994a5afc7c567b47f74bed6ed9421348d7000117c25c4635f63367644e2ad53b6861e547ae3da9ab1e7d0b0ac4f85e55f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fedabc17e6f731163e095ca82c4a1cb

SHA1
50705f64027782402cdbb013a97101e36496f435

SHA256
ea7dfe0b7424af79e926b144928e5c2583d20e07416502b3c96e5774e317c138

SHA512
098b6a6786d88103e2d744fa3425d28aaa32b1f59a1d99cd1958315f0429ab874266465c3b73a427493c1e0ef74871f03b81abbe72d4c43e87692dd0ffc8b864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204f25856cd279801f0343d5fea84cd4

SHA1
f3b0ccba89f2d571b0de52ca21ffe54afbaacee8

SHA256
23bd7b07825aaaa58ed07e33128324ddef4d8c40b6388c857a1e45b7d5508eba

SHA512
6ba4a744c803e6c6491631eb540068901ef75430ef5d5e6d153a3f54d6688e851a5b9c5d50962f63a6a515244d3ef92160f061a61bb661410fe978792fd2c56b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85e37ec84573f7737ad87b8364edbc13

SHA1
fbe20330e9727ed7fb2ee84a812512f778ec6b39

SHA256
2084d59cfadc92f77549a7e6eef949c10416e7c8daf115e662b2b61c84885eae

SHA512
9c12aa7818497588f8ac32cdf5fbe367ecba74f1d2b54797d1c2067e3742409b30895bff77495dbc875cb52cdc3d51fc9199e471d9697f52987c9cfcb9789392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75ecf02cc4379ef35414161383edf713

SHA1
42c8f537560363ecc9bb3aeb0ebd928729658b95

SHA256
519b35d8362c5e2823dd7283b71a21d6fc5c66f49f56fb33b2cd644630d72177

SHA512
09034e168b81c61775fe68df03ebb0af4714853ef05127aa48ab875eeabf3b4f3f929a4247cd0f75355a2b11a015e420bb8df981c891ea45630825d458daafaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a64b625b0313bc84bffdfaf9cb9281f2

SHA1
e0bdbbb85aa43a9f5ff0b0d97aec45eabd80b12e

SHA256
80bbf17cf732061aa84dd36cdebfcc2a8139dd8ae52e1e61c5bcc2ee03341ef0

SHA512
bd05cd0c906b310f6a3f28cb9a3c03e36484fc1dd67fc9e8e801c9e1ff0a7798a93ac721a4eff90abda3e1a2ea6773741a04c6a95047f2998bfc34f444a1a70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acd4f2e9b61c4e8888d0409f5a7eb81f

SHA1
f97886bda28803acf914756a0b4f7553c7158a9e

SHA256
82e95dcbfdb750c7af8ecb09ef8fc163a6718fe9d537ef40f47efdef0f7c704d

SHA512
6e039f5f080a988a4adeedf380a159c819d56ca92c6de1b9c8035fcaa2b5d8859ad2ff5d90f71e97d38a3e9b6cec16bade3e18ce4204934782a86c7fa6c2377c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4398.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4841.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit