cdcf8dd36d76897dd6cd895663e3987396ebf5b34cda0991d8926ab7d7b77937

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00133fc826517d21547b93a2eef29f05_JaffaCakes118.html
Size

20KB
MD5

00133fc826517d21547b93a2eef29f05
SHA1

2c32e15905b0f3bb89ed4b525c191a7b2753785e
SHA256

cdcf8dd36d76897dd6cd895663e3987396ebf5b34cda0991d8926ab7d7b77937
SHA512

15eed8e2d666521d6e82d1ab566fb740d578298f099446952418b489e40cfb55755aadb40e8d81d92614c6b25d1ea4397d240150fd84420f4451e2cf5b8393ea
SSDEEP

384:HedDnWUy2Zfb50/eDVMZF78c5IdmeTof8NUX0R6PjRCb3mlWEuu:+dty2t502D2ZF78c5IdmeTofFM3mlWEF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4298301-0347-11EF-8442-DE62917EBCA6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0037977d5497da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000002045962e9282c2ad8147a03eff9d0b81c834efba5d66d36cddb3277c70952232000000000e80000000020000200000002cf42660b2097cd308fab871afeaf1299bc46fc301b8f8c64bb0d2a992a980a690000000f5568ca9f59f2f3b22433ed69d56be2a7dcc9d92ad9fc579cdf2576408a01ca562e2bced04440087bc4546dd396be8858b22d45eface858bc8bacab5f2d851a42dff1a23223d03bcf35b92cdaa0016843494fb352ddc63dd2e1b30062cd9ec9e598a5df6514c8dc0377b81f4fc52b6c22fc1f36022893cfb6aac7f5cec5e8e2aceec2b8bce98c20ff0fd93aed6fba2f7400000008fef2d28bd61ff13ab1056aa0a981948e68d1fd7d1dfa38272a599d925e695add980090e55b37eb36f6a871e98883ca09ef4939a2c08a117c9e4f19c3b53f9a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000522b6958ed0838ebb847fdcdb9294f932d9c59acf3acab882c9c62a421286380000000000e8000000002000020000000a155a50e011b133aa7a135f1394f8bd028dc01fe676e1ec463f7b8df7a7843b720000000147e9d347f8222d9e7252f583f3ce76822cd29a30980c04a3c77ef861ffcf3524000000028cdd0cd7cf6e52eb261af94e10b9f6bb222025d941a75ea032212805be8db3210016278619de2adb7ebb50b97783719997009c4bdccb87dadc56aa3a987860d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420241041"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2880	2752	iexplore.exe	28
PID 2752 wrote to memory of 2880	2752	iexplore.exe	28
PID 2752 wrote to memory of 2880	2752	iexplore.exe	28
PID 2752 wrote to memory of 2880	2752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00133fc826517d21547b93a2eef29f05_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9059c2aadf4d9bd664892ea37c7b35ef

SHA1
e30860638a8befeb4b0919bd71fb8ffeb03d683a

SHA256
d7dc1d7f029a2d2b30e406e01d903d30c8ba5a5ec901e1460b474b39611d6eab

SHA512
1a3ff55941d5d9b079d674e454ca0d6ac955b22bf78a9b2ae632f2e387ab3e0f9f199d9e16d81236d91bb5a5085605fd901b56afc01207b5ee0383aa2113456a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29bd03b344dfbe65973b8472c50a0ee

SHA1
b5cbd75a64518e33f3220e92ead9ca304fd68a10

SHA256
98d78c4137f251ca1fc8ebde5084ce98c28456e21ec798d9922b402ee9b7f61e

SHA512
2f4418c1e6b6d5ae24d6e33185fc8e9e8acac68d9d7b06c9ed7db3d839a3c3aa286e50bb4f505931c21b5398ad81c1adc0089d3abfa6b744b9e19deadca8e961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d53001a7ed8792b26b57603cc61e0b0

SHA1
2027570fb2315346206bd6d29ad60cc6378fdb50

SHA256
2062046fdca255f7b73777fd7167e6268bff77d5632b161b4777923e210e1f2d

SHA512
c007a58d759115addf3afd630c5045ad65dc5ff338da6b69b19339c1140d660b62fda6cc63e1612fbac29cb5b8a66d605611b16c3506ebe06617bd1ec8f919e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbda228206e8da279898100880a06567

SHA1
b8ac097a94b7d1776ab06aaf8c9fbb888d3f6ff7

SHA256
42c3eba5add9c5a44e6bd3531e32a6f0050155ebb4e850d46655caf9aedd8809

SHA512
feab08a845332080bd22a58e1554978c0965b0315913a688d0041d8ebec459612849cf9b25dd884be6d7644450ac2374068327ccff0f10de5c6b0f45ea3ed4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
904cd844d9b8feabf2b2f7ec67068454

SHA1
c7cd7bdb8682c20fb84db8c24bda9f6ac5f8b290

SHA256
07865103feefe7f2def2e8f8607fccecd93261ae04b564a6a1bb61f1dfc8043c

SHA512
b87e68423bc9261e295227f5906fc315d200508c5b619e7ab2cb7ed18bcf91be24f9bbdc4aaeb192f9f49fc072a758a472c6ecda895a91dc017b5403791a4feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f4495961ee6b92a180d694c14653740

SHA1
ceaf385faf27ba82e962d8a78724d73586b86d19

SHA256
5c25d5ded40a7c0c922a8c3275cf6dfe52cb413d204fb6a43297969d53ba9c27

SHA512
12027e0b984bd74adb7da1deea662bfe2d568cb97193e598d4f851e569f715fcb0a736d9b0f5d00bce77397ffa9e90cb3ace85ae6bf47ad346f9c3858d3c3579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0946f363b984f98e62640c7e7dc0ae1d

SHA1
ebb4dbb5b407a958620713ad4978f926a2a3d543

SHA256
80733a45e747ab18b50f49d6e921f2e8b3612a5f1839d48f11e18a4a7d19f33d

SHA512
cf523f7dec4f01f6ee223ebbe31f7a4ab1642aa51857c9be0ab95ccfc346e1eb463e856d04053f92f3b8ef311b04dad58b17b42937ea1c8f19defc5ea1fbfc54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9245c043cd5362d9da2cfab3b16b078

SHA1
9a67647994db9913190e9f56f8b1c079fdd5282e

SHA256
0d4342581bceee754ae253e6576224e368933627f8d9d039cfbfc7687c380a23

SHA512
a3ddacf13fcd995de886b0d5bc009b581af2dcdadb6102f8b33c5b6e80ea65eaff49205dfa95192576328868dfc66aee36007a7f0518a9efacdca4f5a0eff385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f53955aec555caa71022d36cf1f23d0

SHA1
c82af4dbcc3db6f98bb123dfadc7ef8388d505a9

SHA256
9d9a9923ecf9b2fef4b6c6f41385fa485af0f05028591f624e5fcad85d5f3c88

SHA512
d75c94e4076d4632a92f03b148025850083d24b49599a0e3bb5fde14492eefcb7b89b1e925c5e955a123b233e3cce3b5132df5bed7558f7ec1e42c36a6561aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4239749b836a53ae9da5211b8e82de36

SHA1
9f5c3eb84b3650ea5d50287e4ff765b4eaf727df

SHA256
8fc99a5dce288d8d466d933ad9e50fd66b9947d8acb8422936c7dfce222a03e2

SHA512
5bdb30e91c4e290acd89b42d608b3171e20be68d2c0a0ed0ba28d08c86d629efee29e48b6b728e82086c789ee1fcf62873badd26b959958323eae4abe3ac11f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f20a262b54ad4aa75ce65d530b4ce2

SHA1
c03d7d1ff0fdd7389d37baa52430b28f803d00cd

SHA256
ed325659676d48046bbf4573e5a1f6d5f5617c2824f2c10ad5327b7d66f48bcd

SHA512
4b34828dadfbfcf4907fde15ed3cf84a4513c0ee5fb4b7d54b6f6d704cad0cfe87dcdcc62e397c727ab5927e708184a846c2c3074406fd68906af9821f43b067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df6f0da6281c13bc998ca505f7fb2c5

SHA1
bc52e1ec8e981cdb0da86dcceea63714333a23ff

SHA256
4a8a5e2344fec4d065630db0c5352a6216d143d79d28fe38c855233553c9ea49

SHA512
0c927c8a6ace0afac118ce72f235497a5718dfe70b78290ad40a73aeb197e7a48c4a0ca8207fc2e860f4d94c3a3484ab1658d09560632161bf6cf918df711a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6165.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6320.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit