59190f9a143f268c7a57006287bfcfe20d4dcdf462aa7ac44d2fe0b3db6b456d

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffd500398dba911285544a6df48a51ec_JaffaCakes118.html
Size

23KB
MD5

ffd500398dba911285544a6df48a51ec
SHA1

27fb9d6fd9dc77facdd698d45a7d1284b0f5bfe5
SHA256

59190f9a143f268c7a57006287bfcfe20d4dcdf462aa7ac44d2fe0b3db6b456d
SHA512

ff52c2d462e40e5fe89013f02db74ddae43cebca950cce1bdc7ad4d1286d0825972f39906696d4cb07181a2d7c7ee06723898adadd32dabf21118a2b1e1547b6
SSDEEP

384:GnA4ywZf6p5qReztvukeKXXTu0wOzhLtXNKL24UTpNyOcn8tvG5nTDuU5esT8a:O1Pf4tWkekPZVzKc7wV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000381f0d39f992f9f825a57dfd2ad23fadd1da565d7fc0b621c2af8848c6b9a9c6000000000e80000000020000200000009b37608f286c521e1b2d54258ee77adbabe125fbed790d207986713ff3e1380690000000fadeaf4ea6090811ac0d11987bf8f0ae1410115c8ed8b281bd19f7a391f3a7f62a13498a56c6241447edee9620fd8c37704ab407f0175c3f263a7d6eff0ac366151ab42e57f7e1f04cb164746404cafa78fd45fca522ed970106677a8f5d93343e870d6300a8139b62422dc8d3195cef8c35cd0bd01e9af0362428a99e0bafffb3b31b2236bef3b3b751dd8b490b35d24000000068210d1bc983922081ec64041a81edd35748e082b4580872e8f073f96032fde7364c5ede9fec3622332b942a10348276091cc52b649b91103e7fa2a4838cb3a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9662D91-0007-11EF-A30C-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419883786"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308418ae1494da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000005ad2afc09f7192217de8a13de1d5b37dde824c75793f20524d1be995c1ba0fb3000000000e80000000020000200000003d01d9cbe798281618433e98236a683ba6392bf2c08bdcbb5b3869459a4995bd20000000555f37d745080a2258b0010c2bb9ac3410344717b15309ee70b885b7cbe6ab7f40000000948dc2d8c9b01a35f9098df424a2f83e15095e001a70342dbe5abca894f7a6c290a6e3b64a5c1af378d03f726ba9972af5d98ef86eaf34c0c241a8bb4a069b17	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2548	2168	iexplore.exe	28
PID 2168 wrote to memory of 2548	2168	iexplore.exe	28
PID 2168 wrote to memory of 2548	2168	iexplore.exe	28
PID 2168 wrote to memory of 2548	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ffd500398dba911285544a6df48a51ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97dd7a55c83221e4f1802733c6a2248e

SHA1
9bb12691a362cca0bb72a0f75fdad0ba13584499

SHA256
f3845fc8f21ef26ce28a742b8846b7b29fbe3f88a822c5f7a01821f4e527a32d

SHA512
3b8f67f387df85d65e9698441293e8d4d6fda1d4b0f627a5c02dbae7a9d06f8bb44475d9c38d5b1c5a57c0659b1b4025bdbdaabc2ed8e7828eb44ba633b27b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3282483a44143698da0109f4315b257

SHA1
2e63fc870958935499f4f82d60d174bb92388625

SHA256
68e68d65e9e754cd0acb24b0ec602fc584414fe93d8e4d561a9ab1977ef67456

SHA512
eb2a681024eba664806d3be0d159a1a416cb70e94698a9aa1f5b95feca4ffa83f61859a420d0e2befb9467ef5ea38012103ae9f2ff14479827179b8562b0f1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9b4f6fd91e1acca4624babf8d7654b4

SHA1
ca9dcde48b32588a5d212feaa42ede619f7c42a4

SHA256
b69a2be92d6722772a73ceec48b803b59c2133e3e0fda76102f8a83f845aa120

SHA512
12f2962d4dce65c31a5ab047a8427c0f9886d23c84bd08f690662f6045112f17dec37d083f5e20faa97af55b1c0b4b7a42c1d84ecc367257b72d52aadc66a973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e61fe36295d6f26674ea0b0fff470c

SHA1
6dcc0530a4733a72e6d8fe6350f7c527ebbd1944

SHA256
ee6df14e3ae08d43440d2a736e094a42e1062b8576249668fc6f27f07474bf6f

SHA512
7370f39001b68c07eb2d3473e7c85674af38fabb8049f48f193de681ef398cccc7ab76cebbfb53791b39af82debd7eedb6489916c72953e65906653350cc086d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3789fe980239f5f8f2106e0e56adeaa

SHA1
524a952e4b8ba6d503cd91ccd1db01c2f515ad9c

SHA256
7512338a3ef91a3697f7b01d4ce72839c515e75188b13f4c9f8d4f7d97f4c8ba

SHA512
4e9f99536e339aa8b77c17d5c4deae85b82e45359ca904bbd462e9baeb1aad05e3ee586ce57436311a2302a0237914889a104a6199122825a518959da1f67bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d42f48a223a368b8f8e6cd35f62e4ea

SHA1
1b4dd29030a50ac9cfd5c96f2d20e58f19fb1d5e

SHA256
736dd67013e343b46b6a31abe0381c2216e5b7d67a40243a18ed9cfd4eb3bb46

SHA512
00344eb297a8929ce5c0384dafda25002358e35a2a94596aa0b8871ce3429cbc2d9c531787d6b0922877decd4e87e4d0f965b782e8345f577d37e6d4df738173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7132e8371dcf80e4c1f7589c3524a4f

SHA1
f6ed7a253e13e2ccc7d604f9ace4df14e195f1bc

SHA256
69b16f9ec15fc03ef80edc780ac99e2838ce57fc838d33145ecd8b8e21ae446b

SHA512
53aeafedd0191c91d37e0e88a80347b8a6a13db045eb9710ae55730ef089b3fe07c4fa9cdb9a84197129a13268a328f7d8446a07a4ba4aa8167fe62a85281b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e01f2f8038a7d35d3478c3c2c9bf775e

SHA1
903b9d1436487b60da3fb593eb91c0696a6b9ac9

SHA256
0856691053586faca7fba094f434a0e530c819446478587b0661b988779bfe35

SHA512
bc0f14122f59f0d07c686586a938b272d3789b3c516af784cbe141b3f71ddfe5af4fc77a7dba0c07075ff9165c0b62486eced20f7e7d4d31ca35d474d6ea3c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AD7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit