4ad0c422999d3485d0b67152a28e5dce9c3df68a88a463fa4181092cd165f177

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08abcc24bb63985f42b44022fbdf1017_JaffaCakes118.html
Size

23KB
MD5

08abcc24bb63985f42b44022fbdf1017
SHA1

8861455e3f2a7633738ccddf8b38c34b4cfb69fe
SHA256

4ad0c422999d3485d0b67152a28e5dce9c3df68a88a463fa4181092cd165f177
SHA512

ea9b6afc39bb3ced5891b5c30c5a367c3a27442429ab804cda2939c7758df1a49fc0c3535d9ae9a4b1909a1819bb9108b4224e7965a11b458abf9f5bb2d23a33
SSDEEP

192:uwDUb5na+nQjxn5Q/1nQieQNnanQOkEntvbnQTbnxnQnGLnLnQteqMBwqnYnQ7t2:XQ/GGra1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ddc6a79a9ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004f23320cf46370948337d90371ffb2183b65cf4b21ac0eae1faa05f24f6e8816000000000e8000000002000020000000531eae912ee43dd38f1109377aa4d7cbc0623520e95e5bd33dae8299b5ad57ba200000007b0659a40ff2c72ba483f9359ee9a8fdb795ef5022cef313870d1dc861c1999740000000e34331adc92415c9aaa83aa14138ff8c87cb11760e7db5c5adacd0618ccf9e14057b6b9e7815d4eefaa1c073ad62b81e8aa546be34e7d7c94b2e047110a1c432	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000573adc1ddcf266252fcb02eb898bed4a13879138833457e43dc04c07e168a6d6000000000e8000000002000020000000a1cc2508a87efc4c891949fe3a5aa11c2712b9d4088f4ea1d58f51e2e71bdbf6900000007d457531bade3c4539637f89cf66d45ac22bbcab7fc7552039ea13cede49277908452998947f24aeed1b1ddb9b451ad609c2b983811ea5acf018f18590256ed33efc9ce9aae204dfa00b804557f806dffd8f0b9f87792e6f35909b042b4050fe4626dd2206e57b665e614ef59ca279c79f3a849fb598db379e05abc7386869d47a338126b6903ee892abc7c238971bff400000006307d1f8c35bb3dd27b562df62dd4d4ba8614f3449be0dbac74f6db143883f5462a1c858afc069e71ccf56264f1e2017e474957838587023e644c9db133cb14e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420601035"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D31A4BB1-068D-11EF-9F9F-D600F8F2BB08} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28
PID 1648 wrote to memory of 2632	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08abcc24bb63985f42b44022fbdf1017_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26a64366c04783530349babf32845103

SHA1
0308d12b7af80182746b15c5d3e11ede8391a827

SHA256
a727d8e1f1c91659de12571b47043151b202ec682d365043820ee276242cdaa6

SHA512
ccd3cd502a5083e508644fe477d06840959dcb5838a6fac40ef999dca84b6a767fe643daa7ef2e938146f5f2e4dbf01aa9973d9819acd7b15ca7d755d4d94421

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2cd44eeaee1dc0e9f506b8c31516663

SHA1
28b7cf77f499d4411861328a61ccaf40ffdf677d

SHA256
87d60cb7be8ce2c3f2a9fb7faa75f517c313136a2659c81247112dbec0b3a682

SHA512
8270f2d29f39268d82a96d4ed6d44aa8ddd899729dc6d0f9584cb6a7ab33552bbdcc2389c84652ab0872f145007237da098c579c420c938ec93f2f2f7232fa05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf02ae06326f7dae5084d3e4f6c77a12

SHA1
d12be8f8768f3686f5b2d491f439cf6a096249ae

SHA256
0d7644cb02214c78fe45efa0be3802d9f48a6ae631b371de3bad5621219194e9

SHA512
0bab6e9217cd607a946987964d89e39b8e0d8ed402db83470ccc3b835c5845fc7b092a95ef29c2c1cfa166be3fcf48987dd0a0d0b7aa3e783108d3d275a2a6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8664140959387c41dbe1fd0f4c7c9ca

SHA1
72af15a5a552388df63b2d5f41ac246f15b86900

SHA256
12a08e7fef6bc37b8f0c1d8ecde20f9f717cc32d619a17753c20e8894de88f5f

SHA512
38c129670b16e13cfaecb5c9fb2239a13542c51ea0881d9a0228749ac41e3da42f6648b3a727701719d91972ed8205622a03fb96e12379636982243c3c350b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8036ea6856f9698d21b223bceec72ea

SHA1
d17eda9ce42ad5be18b76638fc6064dce9ee269d

SHA256
02d8d0390d4c112d343b5ada9ffec527823a7091db4f3d72868ccfad4ace2854

SHA512
12a434ca9392ee388010497375ffadc13dc6b1d3c9a0ffb8c26e5693a5a7b42cb2665535c9606f4fcc4fa1355109384268373a9aaae87f9d8e53733f79ceb9ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1720de4134bc36a616f1cd3e58a75e82

SHA1
e7b68904cd1ac30ed2a8c33ee6a4eb3bffa1aad1

SHA256
04518066f75cf8b12eaec85fa2c8bab39474e6f3abd0dfd97effbed8f9f54506

SHA512
4cfff2a279a7aa90b833bef55c7014c9b08242f7c7868ff01a625790bb98d39ef12cc710486317731f49b076e840cfc8e3cc5a0a68896e0dfce6438099fb5a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5c7b76a83727289d693297a648b5a9b

SHA1
829ed0c87b3a19eff7404dbf27fdcaac399710bc

SHA256
ed7a4ab869c3c23d3db62ee775a7310ada99806f90e53e4f996697f80496da41

SHA512
adbab5d011351709d85bdc371bcd792510453a5e28d9f0edd71da01edf736c4002e971ae4367808143ae72ab152d05237ea6162e94a9cf41368b71b3e19359ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883abda5fb49d2f826e99da46cfee927

SHA1
b180114d9c44d78b4e2146e8b532d439a093435a

SHA256
284173b470d61faa957287c51c07be29489806e5015c7953d1c103d9d71767b3

SHA512
35f56a322056d346fe83fd51c6907a0e5cface3a89200ef71291c47be00e18df906873fcddb74260d6942c76497ff937bff65ece6be7b29b4c8c88f9c84d954a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c985a15058b9a1d58173d14c653050e2

SHA1
f5445e8e7c550c73a14650fff90e6d09f5a69cf6

SHA256
c5fdf3c6f2f70434a3276f5a18ab30f1f5c0bbbe630fea870463e323329d23f9

SHA512
b591708395335d440d0717925e2a73d64f074b18007fc092f5e61e7dce5b1fb34c926440a18855e6f75233f70be10b4d67ed3d4427f5e8202f627c3a6812f67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ad510cd027a61e916aaa3063323c937

SHA1
8e1526b52d671c9b72217abbb1283f280a6adaed

SHA256
b3dc75c6eadc8b6537f4ad5fc058642f0b9df51d7765c2b9bbe8fc94ac8a6315

SHA512
85899efa9e4fbd58a7f2e71fa6201ab2bab65ff45441b3f72af68db121e176990a98874b4cbecff03bba6c6465b7f1f733bbc63c7f113372ecd5f8d9f8410a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C50.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CB2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit