cbbf3a347470f7ac89fe0fa634ebadf148b085185cbd92c1434034e548000144

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d996b091b84588e7465ea45934ad45f_JaffaCakes118.html
Size

8KB
MD5

0d996b091b84588e7465ea45934ad45f
SHA1

9dc1715af9afc9058e42a20b69875c3070857146
SHA256

cbbf3a347470f7ac89fe0fa634ebadf148b085185cbd92c1434034e548000144
SHA512

94c1427574b4e1c9d84e52e59f5f8c8550635bc94791d9ff1bc31b524a48ae6565c450df09152a477b2cb28f9c71497125cb2ea6e4f186ea3b3a00dd54be146f
SSDEEP

192:A4PqaJlaMB8Yq1SLLCvTJgoTEp9ngbLF1J:A4S4lzXq1M2aoTEp9ngbL/J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402e4bd34f9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = e804000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000014e0813eb931a0e2389898d17d585ca838aa272c025bf51569310a98273c78fa000000000e8000000002000020000000a96e025a20aa4c98aa5bd356e94115d0a9ddd7fcd96efe92c73e113b63111a9d200000002fb771b7ff9f1febea9730399517f9c2379ae97f8dd343e2d420e336cfe4e48d400000008974a2692efe0ae1718d6f7d6d1aa3dc18af9aba6154483463c1bf7e15e790834f59ea68b22ba3c5b8a1a2dd3df8a84d89120f80d086752980ed4350801d1917	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000825bf0118662b5bd1442edfdfa86689aad0d3ee6d0a16898ab0aadf25657cd0b000000000e8000000002000020000000028191b5f8eafc2cb34ecabdc4d3a3e32f560f73aa08eed1d267be47a5e46428900000002de9f6bac6b93d00c281c11c5b56026fd9b05ecd383cbec7818146fb9dc537390a1c3e9d50d658ab548d23c5e3751360646306c81a32c2229789e2b3be473074bd120dc8e2e105f64d0fc4f8d2c5715bdc9464e8f32e0c52d1f1cb135ef863e556bb7a50f2e7f4dfb7722921727483f388ae51b892d30f264365e6b262e6691e1ddc060262d48e579541f75b598ae16a40000000c17b8a3322776e3834eeb8251044dc8b4fce4161cfd4c8134948767a1b43c0bda4eb923b1301d170eed6191f89bb121b0df44ec246a58298f5ce16e6ea961faa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE4B0D91-0842-11EF-8698-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1216	2804	iexplore.exe	28
PID 2804 wrote to memory of 1216	2804	iexplore.exe	28
PID 2804 wrote to memory of 1216	2804	iexplore.exe	28
PID 2804 wrote to memory of 1216	2804	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d996b091b84588e7465ea45934ad45f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c69166977fc8d814aa8c429c024117c3

SHA1
0925fb3068d5b19610f5ee355c9196045c15804c

SHA256
2c4576972e18202dec2e5ffc5c638524382d57c04f3ec79a7390918d1f281a7e

SHA512
9e5b23abc18678ea40e9dd94fabe67429c53178bcae516f92282c6cbabc3d4c414545333c0e654419ceb36d7f9b08e5342acee327367b828352a768092bab6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
24ec7c25122dc16396c242f8cdda1434

SHA1
1a767160141ba19529585b8fb1ff1d32069cce56

SHA256
d46606f4772e025f855e12a95cc679619c99c66773e0b699f92bf3b3c3bfae1f

SHA512
4d367d123335c121b14eabdf46789937f175c7c796ec1c97363e006095f9b4c5063b68fb4d2c0143780fdbd28e2343fff8c8aee74a46dc1cfecf99ce9f741962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f2e92fa284b4d07a0f2d36cb035391cc

SHA1
e3707943bc17761a1e321203337c92c6296b3d00

SHA256
9836e8eb9fc6befd83e3ff30e3a77e3ced439b6fc494d6a0f0af90001a54d79e

SHA512
fbfdd76397f7e29ad704bec04ae2a57f62b00503768e54811dd7bdcdd39be32edc4ee4d46088048437fae940c9728d988d9de37eb5377647e3a536a62a6c6aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3dd296bc4682912a0ab0865d1672798d

SHA1
95b18d99a036194e0f9997bdcfdd3f93e384be48

SHA256
535dbe53bbb0f7cbae054cae31aa51877dffe20fe06df9b6f2ead7ae4b620062

SHA512
d3850b5f26c2e530684b31615997f6aabb98d503bfb3eb0cc2ad828b51f115f192cfb0a60c77b3fbe5d875257fe75db2dcc363ca79dba564e2aa192d6e0e5d99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cd2e2db72290f9dfe90b1e3f39da7524

SHA1
1cff4a9bbbab7b3d79f13dbd11b18323def48a33

SHA256
58cf3940f25fb158e4f6f7ffef26cdd71eca1951367d603d1ad7af9792599e4a

SHA512
f914db79aa9bfb9033701598ea17860717df916e117e645f065f9182fab3870a947b651e07cefb9aac00aaf86fc492164dd83913910bd9bf85070c7ab29cdf63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f1345a405ce56ce57d1589e3ba27376d

SHA1
0ca43ef5020fd1479666c5b08152fbdbe57424ae

SHA256
f48c29843368c1585c10853186a3e955bad9255a6b04c9757d7f320716f6394d

SHA512
2f28956821ddbcda3bb94366f5abf973ef7597d673abe002827e6b8adddbb2c555d56006d749edcb9c0a186249cb501adb8988da5c7bf8b2d1b16f83a92ac252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3932a57b4cc2a8a2abe210d1ba6955fe

SHA1
9256f74cbe4b156bc2d981af3900db0ead6bed38

SHA256
4ab353ade3d1d5c1a53ab8de92b13b508217606b8af3c1d700f2086f2211f998

SHA512
445ae6dbdf831692c68c765da30a3db5693ddbe7054f5143fffb656e4051f5a755981a2c4c2b6eeeba373454f425ad193e0e16c872d28715fb1957712f3e2f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a4765abb93aae8ac29a0c6ac839171c9

SHA1
cf9c3c69f67ca99f06b8f0e3ab874b5610ff0a31

SHA256
b5fe2f5adc3582740de3cbadbf255a10a49e2311f52c1645171ebfc5c282dfcf

SHA512
f717f03a0183ac97c5159bd595eb7035fa28625aeef9e932b82d14d024df09b4e4f03363a105e667e44f3bf7d659d1d5f3a67655b67289942ef140bd37b90bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F28.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9058.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit