38bb5b2717346dc306b86b7585cc63b79986e466cd6c9c309229e563aa96cc0c

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21dd8964ac602657732409b527570a2d_JaffaCakes118.html
Size

40KB
MD5

21dd8964ac602657732409b527570a2d
SHA1

a521298dff60fd2912f2fa10f1f8571df668a24f
SHA256

38bb5b2717346dc306b86b7585cc63b79986e466cd6c9c309229e563aa96cc0c
SHA512

13159c09a32634f22c6fae5865045e4137feecc6f8063d0494306c72bbee2d0a4c9d038366056332a41a83ece0f44fe6f25ae1293c81d7b8841cf52d931a69de
SSDEEP

192:uWnb5b5nFCrnQjxn5Q/xnQiesNnFnQOkEntjLnQTbnBnQDXCjA1wEkbqw74aGmZD:fQ/pmuHnoD62VP3AhQgIOgH94vl2rOi1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009e680a53f059ca356e88e98e4a8cc1af114ba3636a5e5d50f55d268ab2f263f1000000000e8000000002000020000000bfc3153933f90c5dce7fab17d057524af3abd6258d3b71e58528297fffc2dbbf9000000007d08ae34b9d9752243b0d67396b8e86d14911904cbc0a30dfc258cf033db284f8ab47ecb2a098d02e61abecbcc58ca8543a1795c09bacfa8945a70447ad6c935596765949b860bfc63723e211cc93e3e6213478ea8249ad19be63cbbf6d602ccc8f7d729fe93811d98d47938f0ec982ab68ea16752b46c6a4cccd77b690b26b3a370c3f28f01d2ee7dafc2753545e5540000000c6ff9ca821106ca124f57ee1626634172059d8716e94a1df5ac5b417c5ae5a1d3ca40fedae64c63b95b026fe1183886707165b574fbd29dbe0ef702e279e77b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421280533"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E76EC261-0CBB-11EF-B012-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000437e4345a2627b3e1b48db1303ad65a02beb9b58177a8a262a0f812c9c546f2d000000000e8000000002000020000000e3d5478c817053a32afd6862c8a2f212bab6b74743c9b62c6f4048fff93411c5200000002cfe868519cf8b949957459c1b5d32c272fd29ca86c043ed7ab7e1f432683a3540000000a66db8b5783323813dd5ac52eed743d9aa263964bd3612e5154f9ab1c781178baaede2f6e0715fc57f5b37c053e3a1adbd5043c52c436cf82e49875d7e41aa9c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40441fbcc8a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2716	1288	iexplore.exe	28
PID 1288 wrote to memory of 2716	1288	iexplore.exe	28
PID 1288 wrote to memory of 2716	1288	iexplore.exe	28
PID 1288 wrote to memory of 2716	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21dd8964ac602657732409b527570a2d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25557e132a35215f32705b2f6ebf9931

SHA1
0b128462624786164d4a238fca1f58d47247cb2d

SHA256
4022515b96e79277ffae49536ac78870f62448b0b8b97bfd0e6f3518d204e621

SHA512
a92a2ac7526afcfaa2de6c11583983eec430b402c897755b5cd2899756dee7b022054a53ac600d7af134d1be77e15e6342e914fa9faa542289a12064e2e4205f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcb2de81bb9c8c85d35f49643cc7ee80

SHA1
f96811206b118caa9cccbfd09972a65b84f216b2

SHA256
50c65c2b8f6b4518c92ba38792a49b5548cd8e12443f2c75c430a0f2649d2885

SHA512
d9f3a43f95cdfb7b827a464a4ef5e56ffade9757ebf226b2e5ea6eef6842d8490fe82f62ec82f2b075862971126bf7c57c8d308292d79a4b55ec2a894ecd1254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2d9ca7d7876aa0e79491155b7bed97d

SHA1
79654badc5d4a2a99a775a9bab4b63642579e538

SHA256
ebbdaae138c76832c1eeb487fc90d0785f77b9a287c993971af77c67b745d4c9

SHA512
d9c7d46938204203c78ca21510a2322e6bcf60ae16b5e8d0a88f2245cf38ef2317811099441b75bb31fe0a79de8a8220505b5d649a00df01e27a1d7b7dbd7911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94b901a9f40ad6593ef4ca45dcd9c23f

SHA1
61d8c3fa93b8761c1be185d6a541ff20b70ee8f5

SHA256
7d729035b9fbe54dc1d07bd9966764087335ea73e2e67c68f6c46a270802f0ea

SHA512
b90c657d3803cd9a11a3876fa1f68067b6cdc36b14f59fb4995ebeaa125a7cb45de8625c226d13be29e02b172b1c536e565678032342c74450722b36228b0b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d19eccdf093c7ac6f9e65c53416c916

SHA1
628d2871db39e4de9a2911bb190074a8bc4801fe

SHA256
7f9c8d4eeaa4dcf3725502f718423765cbcaaacf04cc636c78c39a69cad2870e

SHA512
ed15a98b10a1be20a460c8bc0f0b6ce2e91986c1ed0d859362a07133f9c15ee4349c273ed77cfdfbbb3b8a0e60e58b1ede9011a15e4dd4b90bcc55d4842a7c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
985255e43877f2237ba36126f13ca55b

SHA1
b4f3e32dde4bc2808ac7e3b5993ea230c640bb95

SHA256
20f576c441cb3083bca1a61c90b825f3b2fce29d531efc7a4191f0817fd6225e

SHA512
2d3536025f18df612b3d54593b1c40586479c81b557811681644e06fb885910d22ae2f8d7bec17bb17691606ea0250b2c6705fd561a612ae821f5a8b09127694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3041d2cf87ba1b94dab8a87532412bf9

SHA1
bc3ca9be226634c53b8df8cb02d690a4a2773186

SHA256
a0632a655392567de45c100393fc3ce6141578705a032a132172607ac10097b4

SHA512
be07b5ab9729e5db75d057c998397bb5b422393e161ea663cf6cc5f299e79dcadd7dd6ee59924493d77850f421f7267be4cad0f1ed43505bd2f4da1a53f346fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb18185eb38c71cf027e697211bfcfe8

SHA1
fbfada74d77938f372005a2c260366a150a6463a

SHA256
383ad40093d1442a55b81a4c5562bb0d2c4587cccfdf1690ce9d9d836a674930

SHA512
02d13a513c986568de2aecba1b6d5a00d900901ce330cf718dd7e5110d6bc3d1d6cdaf2bd1a2b798661465db0f9ed0d808c21a4464700323c0bdc3de2e065401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aafe8fe87a96c5b55af0a8844f585fa2

SHA1
67911a68f4da4b50043a4fc487f2ac6bb600027c

SHA256
cce66dfb68744349547b98734729a4f9a4e0e770121199f8d17814e27a8417f7

SHA512
8d8a9404f80f8139b1d4df1520315211a852b476835104fba8fe6d28e28b8232eb944ddd04b288d6e25153b53dbe9cca96ece8247a77f0f2f6fa540c4c14e0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77003ee180ccee37c14cb5b573d79a1f

SHA1
5fbb8ab6fea6eab03e02c9540a6f352c5238adbb

SHA256
7f03fb3a3312424c95cf188bff657c6e00d1765a1ca4592cf4bf2baaf3df6ad6

SHA512
d9fe49adc24c545c48240788cdce4416db28d26da388b5a5d820db3f20fb79bdc5f080bc1d0a974a0747f800c411be15439580efe03e4a84869caf8150260511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8abc12564f5913406a59fa1db3f14f79

SHA1
6bc0922307fe922d2ac65939560ec19866c1d44c

SHA256
6b37ac9673b16ef2cf8e81cb0daffc5b3b04635f6b9e8bbfcbe01902c709fb8e

SHA512
a1ccc4d1c66629f07f7cd197c5569ecd4d253a8162b7a121a6b1924d0e6143eb3e7b10ce3199cfaef2fb4c56cb61faa7a0c4b9ee1a01a2e8a633aef0b52b639f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637f8c65172ae0bde04021d0ee0283aa

SHA1
81c94d8749d6a8ff7278389d3c797d05526cc312

SHA256
5f1c25ad8e5ceb1a1be55a7db19ad9e9c1851101f67064b26c81569157b36f1a

SHA512
38fe080162739320b6e90ae34139c0b82061bb7caadf1e1ee4c337c5f4f64fbef46515160c4281fc52d7d3ef5ba849331e8e47edbacf2a00ab102dc375cbe749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d70afacee13459d1800f75732bc6189

SHA1
ebde29a1f58ae0d71d16b3347a919099b567c941

SHA256
e0a39299e4bfb6c724452960fe3b8960b79040a8d2a8e67e2ae9e0b814255e94

SHA512
acdfe564dfb206d7dcaa03f00da93fd526699565117deaf29b1f471897af1dda2b3ebad5e39c7bd53de3af1352667a761aaeae93b8dc5972c1a312daaa7bf4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2907.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A17.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit