21cb5343831df3a8d9d644048ba5987ceb230680046c9bf321306f04e7737582

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1823203edc677d04f4b94a4d8a9f2cec_JaffaCakes118.html
Size

50KB
MD5

1823203edc677d04f4b94a4d8a9f2cec
SHA1

665007c4d4376699b60d25573b1edf2894f100ba
SHA256

21cb5343831df3a8d9d644048ba5987ceb230680046c9bf321306f04e7737582
SHA512

45958ce56b53ff2bb12a5e090053a19ab6b5c0bd36a9a2e34b5985373f6eb311516a940fd1e2e0e6678ef0c317ff5d283be0af149e9ff6f98d9c66123f977521
SSDEEP

768:NZFYHMjxjwxFYgJgR5521tBpInZ+kyMVKilG:9YsjxjwYgJ85528nZ+gVKi4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421081718"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d15d4bf1504501e946ef1b2555211dc82a3e1f11f4f4a34c94bc596d7dae1ef1000000000e8000000002000020000000d69708ada90dd62d84ac62aefb47ede7dc76623be6f1f5c11d9ca623c5d116e0200000005b370ec8f8e139ae08a4365daf8759ca31c6d8959d54e6eb6abe8b077b1fb51b4000000097bb487c40a0ba2e264756d26de1809d93c1ba5249e1c0de6458973b339052dfe153f5c87ac64f8ff3744243beb4c2b9b1368435abcb37d4153466a45fa21537	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007b0961641ffcd712cc9023e3583a33e6a2e10094064b0282bc88a92b9ed81a6e000000000e80000000020000200000009eb6ad29612c7e168b06780c7f290428561777a00673f34dd8b5462030f5b3bd90000000353182189e72ae0ecf777a92a551dd838eae5a52c286d434c3828ea5b6dad9e1686587a4e13064723d9175eee3a66a99e172ee4552f049d56dcccc60c08f230f2cfbd350b27ddfe3867a3b43c85e90fff07551b7bae8f33a2c8cdc3255ea02aca6d3566a8639819d5dbce3b9825279b66a4f4e6ef9c1237441093fe6edf399af235e79e73cd80330b4c118d491bfab694000000079940d70448f23861d2434f121e286b0c258cf6d2d38f25cd5121e6b095d5cba0d1de4e612502cc120f983a39c6769ed1604f7f54e4c0bf3936c7c943284f7b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{010C58C1-0AED-11EF-815A-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e999d5f99eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2228	2012	iexplore.exe	28
PID 2012 wrote to memory of 2228	2012	iexplore.exe	28
PID 2012 wrote to memory of 2228	2012	iexplore.exe	28
PID 2012 wrote to memory of 2228	2012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1823203edc677d04f4b94a4d8a9f2cec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbbe9d74f440b74281e174d5cf446fa4

SHA1
7ae05a3554d758786fe56a03716ce5332394c638

SHA256
19b737e0189533aa59aa0c7de3e3a49e44cecd38db9c31f87bb658a19aae163a

SHA512
807983d695b696e59fc72066ff7868ea7e6f35ff0d069f00316b444fc5a6f06595aeb9a8c3ef087b8dae4ea1a6006309a2b37a64f92367bff80c12981cf95c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c71fa7183f162e1e6b9388ce69ec76cc

SHA1
7b4c53ff02372c609c28dbea9d8b91ce4ca852cf

SHA256
86e6de1cd75d3ccd13f698cd8f199f7ac8f41bf1271c96351eee509d6c8a4259

SHA512
07644e21c148a69c8f840ffd0ccd294cf23e868e33da6df1203f0b0c54e80a3b58e78275bacf1f8b574180a51ec4394d20c4e4d74c9cec1df984af45d2a70068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bc38d5e02f5fb524e0e6976ef77d962

SHA1
1b221fe9816e601706353d7faf0bc5d15e7aa970

SHA256
e5f595555656fe8daf57768bc0a8e3224376df3992e401a00fc3852056a7f4c2

SHA512
d28374f739d9fc286767ca3ee6d52847776ddb180546a22c6de3649136723941a1fee8c3bfbbd5fa0960d10f08de5febbd2c9ed207eaea0afda204ba81b3a8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed642b5f0abf880462e4ca77587d9b83

SHA1
51c4c817fd04e1d9a4a6a1d4d5ed6cbe458406c7

SHA256
3a15efe091582b531c5f7d5ce3b3ca401560c2c5a36bbf2ed09b8be7a03fa688

SHA512
17d7a8edafa2564896f4b9640d573c0dd17fc8e78f8f9bb87827d841bf8fb0ec3ed55777b41f7de876f6047553e77e506a500d629ea23d8888899102da64725d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ceb2f42d392e307effdac5b978a9214

SHA1
3b3550c318524e32d25ca545efe3e2f3420629b1

SHA256
9fdd5a07c1de7118a9e1c2927ed67cbb9b946d2b2b354e2ef027f44f4d78d967

SHA512
79d2f946491a87baae1018345b157e92fa9ecba7c2152b78a3b2dfb029b1371159104e80be708fc9b6e21752e5e2b1edd54ae3402fe5a6d815a7ee28d342e876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
744ae813097d802cd7edf8f5cb6ba3e2

SHA1
71c09d63e07dc050cefb6e92fb7d0da9b7aa7377

SHA256
4a026c312b033beeefca8f019c53f8e202ff885b6e68b493d77b737a0dd197fe

SHA512
02b8a851c500be065c730f70f32830e91820fc7181e552ccee9f6d205ff2dd29b4af13045bd67b355de60170496974f8665ee588e8fc378446ee58d0ccb836f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3bca607214053ebb1183a00535b63f7

SHA1
c8d77fffe0c638bf592801cc7805a4ca75fc8970

SHA256
04557350b47cd801db58dce8cd7bb2c7c00aaa985523833ee207635f6e60a60e

SHA512
1582c96262dd1869f738508a206619d90a3ddd4de022410fe445cb263e65501e885843ca6e1baf16748ddd6c9143042e01d7b5f223b6acf839d470b5e8605001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0893481351808d0235e796dae417da89

SHA1
43f4ef50f9824c9b99ae3846c66a2521a71d8b6c

SHA256
1f269b29d4ab8312522c20757161926ea1133e6b7fdf5021c621facc69973e54

SHA512
4d6b4ebf7c6e586f993986655e2b4a32ad7db84d2b05245c06c7e282f7e813fb3cd321a2a305d85a39f133e6610973daa4da71e8325e5e6fb3f1e78dbf5c00d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3aecfd93bc19bfba1d098e70e727a2

SHA1
f20a07dbe5997e20c5039a2dbed60b561568b12c

SHA256
2671f30eaf0f909fee0e29c9377178fb3bc47aa29d496d318aeaf1ee18a80b60

SHA512
a4f8f104415ad456570257b411a7df5b1bf75f6598e4c6e9757c18c46376f8c0f6b8abfb18d44a04e051c7c3e0fe5599c6eae94b5a92cc7a772129b2d310b28d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9eb0c0dd0388ad192c37fb3f1fbc0b

SHA1
016921fab7166c8f98b5616a0dc08541851f2b26

SHA256
5f46f02bc3cd8926e2b4163b1eda605455cebc62f4d63f9c83bed5854001c450

SHA512
ee3b399028497127538314e1a08202bcfbd8fefb7073336d4a0d8faf5000e15e1ab3a065355b8ddca61b940457c3e032330c8dea7c9ee3923f294c46f4a681d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd0ea01220bd7f08096cbe1f0817618a

SHA1
9e59787be5db9044a754b8006e79866a6e4c0b65

SHA256
ab4130fd29ee3b23c562b8abda13c4b3a843d1150a4177bc6e10ec5870631f5e

SHA512
b8e0e5185e51ff028e50945ae2b31b5e050680c5cd5f0b14b5bd4f5fd80cc0e66fb94937675edf68da34415831402d9ae1437c4184d105cca6f42ba16b14e094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ed19beb30d3ce6934f7a9bce55e4fc

SHA1
3bd37db09b4157d7dd0da78a937c0675028df7f9

SHA256
29c9a895cd7732c25b55e1c682867ed85593be43a47d9f6e28b37ee8cbeabe45

SHA512
172812b2005673fa1f58ed299af3d3f5e32b343e33e463cf9873692789b2ede109a2e7916b61d6dc27d6b6383f61d1b396e660786ede9933c3fd2e4391dd200c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db9c4e4aeff8a666f13700c98a849e0a

SHA1
f08341e8b1bfdc3ba5a3566fab5ea3bfbb35fcbc

SHA256
5894556fbd769fca16c1aa3a2ffdbc16e388c01d2af32c05322b775ad7267127

SHA512
cbde7ab8f9fed1b602cd065b378a8e1a571367dbbfb20a83b98f121dfc14f82a0f1cf0a2414098f7bed0d3d00416877e4e37eed9cf864518bac08604b5faa8bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4053.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit