47827f9ed8001deda1f76e76bfe952315745e1642eeb5ba9f2e955132ed7ccad

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13d2ceddf227c4f942831a833dae42b5_JaffaCakes118.html
Size

15KB
MD5

13d2ceddf227c4f942831a833dae42b5
SHA1

b904ead1f551a2e6bea1652d8f686c8f92b46178
SHA256

47827f9ed8001deda1f76e76bfe952315745e1642eeb5ba9f2e955132ed7ccad
SHA512

bb8735256a5fb76aa73a5d0b8631de2bcb4d6decd9007a8dc78d98272384e1bff2a745b8eeb618077746a7c896c81f5334576d70ec11b71a751738b2de2dbaaa
SSDEEP

192:9SEk6Pqv5euu2mOEoGHpVCymRrt8nVxnM6MjOzY4FiWuJHlfIbw/S7:9SEk0A5euu2gnVxMRj8ZmJHdIbwg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005df4dcf9b538b6b3d6a4bdcb56d9f0c87ed86817fa7330f94a8dfb64d16ca7c3000000000e80000000020000200000000d362f0a4da811efb1738724764ae38f101ded6c7b75ff16d62eaaa489814cff90000000a7b26423fbe198b5de411d191ef47c1fc946720c6f4632f4d1b674dd29b51254c79fd3d9a6c8b049860466a13359f91c1079b883821e13db49ea218f2f31e9c398f8ffc160028a0a70d96ee3eaae6176984250bf526f06178d24a4ba231cb7776ba0896afddb97c870119bb2ef22bd1c4132f3c19439f0f306c60e32475843b6415df8257e6e38b2e045f6dcd03435d140000000e77038926ac33abe690d8bf91d1f148ba9334dc5da11ed33a66d02d7e21d6dead69e4b179bf7a30752a27ed17a54c7bf9598ea8a0fe8b8ca76190b73561fbaeb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421006954"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC443D81-0A3E-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004fff863c3f3d02d1cb1dab76345cc5175dad482bb88ef82ac049245c3b909e1f000000000e8000000002000020000000709307e25445d366d8dc668b80f590bb92986565f767621c8751c4712380cad3200000002fe4b68dc10e96e44df6ea6caf33daebc22f2b34182bde10b50cfdd4c671fc3540000000fd3d26abd1756590573aac74c49f352009536303aa9408529933c0a2327f41e90fbe1da036739a8a2b02a3d4510abb223f5870cee431d4cc57aae5eeab25f470	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200dc8c14b9eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
856	iexplore.exe
856	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2352	856	iexplore.exe	28
PID 856 wrote to memory of 2352	856	iexplore.exe	28
PID 856 wrote to memory of 2352	856	iexplore.exe	28
PID 856 wrote to memory of 2352	856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13d2ceddf227c4f942831a833dae42b5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3ee34fc198b4edf4472a1cac9d97607

SHA1
984bf0556d0900bc00de84005a3da8232df6e212

SHA256
6091e2e7b2b128684bdf16af7dcaeb48a7b6635cd22954381ce69c7c2d580f19

SHA512
ddaaa06503f080248e1db1984e3691e27fb6128c5b36ee232b6a035442aa1cfbb7b67bcc41f2080b441d611178792cf1f9cf5eaeb3cce7a08132cfcb16d6f66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d60d0818296338b42e0e96f7020ab47

SHA1
09ab777006039a523b01f55fd4a42e49f3f9dde8

SHA256
7d951bd25adde1f0f44998e28cc505f0d08236f75e4b399589a84e41dfa998b2

SHA512
b03cd2fb61892c0a4a8a3f5af056ed5c422729d59ae4da45302b127dd570b05cc809629c1cdbb9e1e0d11d277b50c0f203863ed0986f82de755bd22c2489fd56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2799a459f0c57621bbbc1afc863fbd

SHA1
c216bb5d3fd1a4202fb1ba44711d30471bcdc482

SHA256
bf7e369647fd632371f324cda06efdeab5982b10081246797aaf199b62687add

SHA512
3ba6b24ca113e22f8485f73cfb19d49b87a26384a65398298ae907895f490ea59e74a19d24984c1c81c601455b8f73263bc42ff6cef2b926319dd7639668279f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
837002443b9a9dfea12197f8c9ada0a6

SHA1
b4a342dfb6ec83b49e8d9a70ff22e0bb887d9384

SHA256
6d49de5c444a354301b413a6d82febc4a640d540e8079e2946471a9aeaece0bf

SHA512
aaa4def073a62e866731fcd6cd1788a23abbc5b9715446e1227090a73e2e5ffa67b71c6ddd1196d50661c65d4cebcaab4b136fb7bf76eb7aebcf20d3b5f1d70f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88edf5b8c8f1e67fcdefa770a2797a43

SHA1
e8e0ac2200ad3e925a532cd8cfb6b393dff50f5d

SHA256
546e3965ac7fe052c255326c8c72a46d34d7d5e54146727ea104e562b74c11f1

SHA512
7626447f4ea34c2da17537646f7ebfc69d92c1401bf17aaefe2d9678c50a9d0bcfa3699819f746c9a7513d4c5bfee2f931b9e8c35e0023a5e0110e7dc7a0766f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac9c3f7643896bcd2431a04069bca5d

SHA1
993bd3234da29e54c08fea80ed2c3a8a255b533a

SHA256
289248ebf1f5c9cf59f5129d0874b2876de40dc1c9c60fa7e8152fe24ca8a792

SHA512
c8f0cb8e640c173593d8db3d444f0dafe0175b24fd161aa87fb890ec2f966104d8c0792cc8ddf498e7d30062ee00581ec86f7b3500b63934025609b1b85b2c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a018fbb6fa8eb8775cd162237e29aea8

SHA1
2b5761d53962b967ba6935bcf56671beead8b749

SHA256
49b4357eac8f86fecd87edbe213e522370aea3bc51903ed2e18cf1f4a377847c

SHA512
9f9dae82e65d8c7fe385127f65605a68a7a8162c63bcfe8172d815a30c00230462d602a12311f17abd2fc3cb3c79a260d5043eeaf282ec1fdb1d359ec66c7b95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6856bb39f094b2e69bcf531354b1d0e

SHA1
6f4720048843c5ae4c5cd900756fef9bf5b2c6e9

SHA256
b7744ff249157e804131283b4e6d945154c093ce34c1636320091e7d915ed9cd

SHA512
ca86ffca65f17be8d081d0aa15e0898752eeee8781ab32dc20e4e9215bf1ac3415814a5d4ebf1f4993c7feceb395b73e3e378cb35c2f8323c5ecda98e3b1b034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce30c2929ee2a5a10c86cc1eac7ab2a9

SHA1
2bf7c405c20549656248cdfce757b8c0d9006bed

SHA256
a00c1656b9276bb3e446d1404ff7432c469e6a8afb97533c8f70832bc9b24ba9

SHA512
3da62c2ff70cfb22a8fe8e91a77bed2e7d6e87b87c9ccdc9d02b94f395269f323ffa39d8073297558868c61cbe786a4571c691d7a44a7432452bb5ba6180548f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c17d4063324b8fe15774943b418e27f

SHA1
31cb52c0c0e51d8801b53fce40e1f461be2e0ab6

SHA256
b5af448e8b09de385ed06bc5f28fe704677fd8e5fdd8973cb608bec81bcc1815

SHA512
dc82d1c43f8275d2924b1e84a0733c1d9619d38bac37a1b856e66c9aac16f57f749255c593b0610691bf42a3752dfc2cfb045026bca3a9f8106f2b8c8aa22f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
523dda71a5505a30d97ef9c341536b2c

SHA1
4f358dbcc5412a58dd08666eba89a75865a32edb

SHA256
396ec5832f1fd9222e706a1ca282c2b5e45625e254fae2adbec7056a2be0bc53

SHA512
f544baddc0ad9fb03b8c1fb01b16ebb2fa80193f2888aa19895520af21e8b4ce6a352cc11ce489bc15a657c6944bfdcd17d996e887f361b25aa189b21b8ca5cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ae9a5c5da7b8f79e5d879e540952b0

SHA1
bafef536712f9218fdace7920c5b45db6387fee3

SHA256
77923330c9ccf864ce03e426504958ffbf5cb1ba1518cb08f399335a28cc695e

SHA512
39a58ad932c8d31b25769a6d7a28c129edea5bc8aad8278165316cca69b8698123d529cb7fdb6f221563d2b3d370957cbc1ee0f08434b341c17427b7ea715e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f779c1ee26eb29d1705eb792546c7f6

SHA1
9f3cfb92a475956b5e9c6cc220446c086a6076ae

SHA256
7874703f27c04934700196b62db1b36455b965b7ed4ced6ce026901f53b69d1b

SHA512
b3229bb1fa69449fe7a14249ed593a5b64b5197ca9d2c38f3633ac084e9d23cac21922b4d9f4d60126a39adafa828f97876c9ab9fef4f66754297e8c6c71af48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8E4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA915.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit