f61696f69b39861b1571c787707b637d6fec4881777498cd8555ce26da156291

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21309cd792a73685c22db283d4ebc490_JaffaCakes118.html
Size

138KB
MD5

21309cd792a73685c22db283d4ebc490
SHA1

c0b54106c0541ea4aeb828d934f712a3a85a6822
SHA256

f61696f69b39861b1571c787707b637d6fec4881777498cd8555ce26da156291
SHA512

3543b4d2cf2cb683f2dd969de57c60ed1f20e619a11a803149c9f145579e39e6e76560f6121c4b40e7c563e5b98b0168897a0880eda98c817da0d32d7f91a192
SSDEEP

1536:Sn9EeplxPRPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SnHZPyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421264840"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008854c6b2a5bcdad720c5aafb9512ee91676b7e1eaa0a55d9211b52952434d282000000000e8000000002000020000000f3657b67bf19464f44ca74bad1232158cfce8a860deef984a3a16555c052985c20000000b4ffc548ac3985390b6720f16d17bf23ad783509b51a6f4e21147fb64456ea4840000000035512b32fab401a9a3e1c2da10a3769da66bb892c5cf13f2b86e1662b83e57b7c71a02f9a95a6ed4a8e63bfdcb4f5fff9fd4259bc4cb11253423e79573f6e52	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DB22631-0C97-11EF-83FC-5267BFD3BAD1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000612dc07e788bdb911df82746f2df8a075431720c01072f48719eabee24d14a9000000000e8000000002000020000000f7945867bddda5e736c65e62384abe8e14623a18595f5775874c6a8d926312579000000033b0bccf9e64f5e866c86f98f12f6d965bc558279710f9fe4579c2b0450b5acb1e1e0c684986133d2ef3575696af7133cf705e4918cb4c78784d329f66f5baa5d43eecc2e36940d4bc599ca69838b53edbc4bc05de82a3ca4aac2e8fcabc97981d017a3335f62ec245ed516cedf01b04db96c379ac45912f60a7c1e0b79f3c00309f956dd34f5e0339ad4d057c23894740000000473b17dbdc12aeedf638e5db4d9689989c0e63f5d4cb5280a7f676f0bcb2864769fc22f1e1dd226bb3492062c643e0d3101a1529b61031557a99d7082de81b49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90be2a74a4a0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28
PID 3028 wrote to memory of 2216	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21309cd792a73685c22db283d4ebc490_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cda233454ba962d2b38fcc6c96f0f5b0

SHA1
a0ace77a72b7a965e3aac0cae6164c41360a6d9b

SHA256
dbe5fcf010516ec61926e4af9c470d54d241a81eb9c602110d0f37433bd84e6d

SHA512
c8aff75df5b577c77994845e45fc58bfe199e1458ec48ba40ac9e02bc67311bafee9029335bd771ac53298149a14a7ca48426ee3d9c74842a5fd2b4452e5cb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4252751bf5352d9a3ef5d5e3840559f2

SHA1
54524825f65a5f820c438cdac965eacee4c0fe9c

SHA256
d57d710d3b6a901230c36f4d0215ffcf4e1069903ed30c1ce67646d35b020d28

SHA512
71d425efdcc5072b9a7a2c10588e30b3cca0a515b9fa32559b380f91cdd0490cbdf2241ee464d1a5cf68c13bb052291c588528b9495539c9cf44f223e433da7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7ce7aad6d58b81310c347e09f90c9bd

SHA1
440f3e39a4939e6b260b5912472ca62e7b2a3ae3

SHA256
097ddfbfa908dd3e3eadcdb911838f79093a8145fb23730564d433bb72aacfd9

SHA512
8e6d784c3711da58e081b9f9c492131372c10236e31b84fa02b4a0264014f28d1359b27cf6b97dab16b5dd5327cef325cc46e16292a8f2343e23be266e7db769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b7a40750a4cf681b9663bae6c2c4bb

SHA1
8afe778e2efe588e2bd27b899dfca743050e7275

SHA256
fb8f31dde1a9e8f1814a02716076ec54711faf9addca06604443163598dddea7

SHA512
809750377011c84bde48ce9267de325f4980a3f4e6d1b8ea58cd96b83944125f27bbb4c0690ce50aeb8aa4792386291f6895b74d6c4e2b51dbc27c6c4239f21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
860bfd04973c068831a05604c8c7dc07

SHA1
b3f07e4fc716b8eb67f90b396990e3b3e86c76d3

SHA256
ec9b066927e329edeff8653cca47b046ab8dedd280ef854b1f90f6d0ece22eee

SHA512
e3473ee0adff9d5998275d6629426ec12041cbc5dc2546dd92c2de22e6329b78951e0e6a9c679ab54357ae9d2725d6f2a7652d6835bc3309a4bcd18a1ff8b16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa4a6d50d4abce90edce58e6e632a98d

SHA1
362aac0f1160bd0be8d6bc8844c9f9209a95435d

SHA256
c40adf9d3230088abf077b30b0262f1eaaabca1ec5c9f4ac2cc948a230d10b57

SHA512
429dff71b4cf2928f65519003caafe84d5400ed27e0848efad533682aa52499f49c78afa87dedd4a01bdadc1dfc4c0e17e0570e2d4d2f99a683fa74e01bb69e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ffd04c08aace968820497d59daf0e6b

SHA1
b1f68ba3cf6ef4c261f49604356988b03794c959

SHA256
2b65feb2afee1e0660972474abfb26483b90c884c3665de6fe8bcd076357014d

SHA512
8df16952ab1511a62d070d9568eb5c7752f7e8ac9c439e508d1ad36e6fda845fb000d777a9652dd911a79ca8418a4525d91f567139c271b982c57940ff8bcad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fc5de5dc834215ebd10fdf687b14e89

SHA1
69fbc092951a80a7fcc45226f969e7f9c55e3abc

SHA256
d2899535adb5bbc41d4b814dc53f80391e26de9af9ad37ca6fcdc5c65362663b

SHA512
86c14e22393d1ec4a294d1ec5cb75b783ba577d1d2d57f2a63f8c625f1abdb12099f48ecca150127f49636e6b9b3669224c21082d60c790055156b2a51c3a670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19ed72dc4e5349057e0e5b71a0b4ec69

SHA1
e3ca237ddabc27b3d82e4f83e76bea9a0aae7a84

SHA256
987c417a403ff0e2b06e15f85c04f0a1393b1e34457848c3b60f3665554d587e

SHA512
8de3e4a7c27a26a207b96f49c2fb18070ccbdfda6524189d60cf54d6d75699f181fc8c85536b1a11ed0d9f98dfc7054285b9ce494c840e3afb4812810140f3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bbe7fb142beecc20289dd17248aca4

SHA1
e2333bb56bd52c394414efc578c3dbc47df3ca44

SHA256
c07349ea9abb61f8e919693a80924b1457db59e19ee7282662a4fa47a82e890c

SHA512
506bd11ba2df6abcce6afbcdc537b0cffd7dcc1b661a7d359a297de562cca2e01e9b04434b0e864334de899c5be276d535c665d0318d0f05f78b0303c0464556

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18B8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit