b96913a583c50e6b102da984b4def546413db119374885b864d57a4c0fbda90d

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

212eecbd9735ca53b989ad926cd368d1_JaffaCakes118.html
Size

151KB
MD5

212eecbd9735ca53b989ad926cd368d1
SHA1

fd6596b67ca43338aa5584f1bed5b1ab11c24e1f
SHA256

b96913a583c50e6b102da984b4def546413db119374885b864d57a4c0fbda90d
SHA512

8d62afe3ed4ce1aa01c72f76b6df23dba9e9459cc2a0273cc6c201169149b5c46bbb8c81d7fdb45f8d36ada9be4aa9ffbff6dc479eb4475033a9e7f8eb4cbcd0
SSDEEP

3072:StfDzzPdEyfkMY+BES09JXAnyrZalI+YQ:St7zzPdJsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421264677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07ff60da4a0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b06bddf7f71b9debdb4ee9998329b9b767dcd2676badb3434909ba37dfccd034000000000e80000000020000200000002ecc6b6c84093e5cb14a2370cce9d2b30d71a8e8d23551f1d7c032ad4e7ff09e9000000054d1fd30c1a9e2b8fdc6a082ac7e30c76daca25fc31ef6c81c03cdc613819d0030614a7eb9ecc2b89eb58fc4a5aa3f0ab3ee85a568d3fa5dba08e7d05ed961dbd7a2fee1766392300c3365e3fff3bcdbf5d42f31f779fa6391aef9f0b18d6b187b631ad16da274b94b0bbc3aa1877d34ba6ceb3c813eb49872caa980b129e3c549b4637d9daf3987ea68879978a5d936400000000c9a129f3ff1847c0f943060103b00a71ff4592efa391978c5b8d4336273a09d6c62f049be524efa899639b88dedab56c9bed31dd6bf547efd044bdb24969a72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA336291-0C96-11EF-AE77-52E4DF8A7807} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000da9931795cc3ec668da66924fa296a3024bcbb35d10e049cc8b5e2d121aefc61000000000e80000000020000200000004e0f42a1726376c7c65af79f6fd2e13f67ed088d96f28c4ecef364221c03538120000000f0df85dd39708a7ebbd0c645699919076e88acc8d53df5801b228a8ccb69f6234000000003d7699b82c27a28bd718f228340a84420108c6fc042990157a5d1b23a97f431a5156b730a3229450c4ca4c3185c82be40a50767e50f7bfb31ca97c0dd7b3954	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1528	2900	iexplore.exe	28
PID 2900 wrote to memory of 1528	2900	iexplore.exe	28
PID 2900 wrote to memory of 1528	2900	iexplore.exe	28
PID 2900 wrote to memory of 1528	2900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\212eecbd9735ca53b989ad926cd368d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c6283d226725cc0c804f199da88aff5

SHA1
815c8d870ff7144f81a0a0b6d7b60e20963db8dc

SHA256
a17bd928a3691f27eb2a0af342e53f29ba453de0ae5ae651ffc3e552ab85b125

SHA512
490fb86f7eb64ca4532c7f94bf968c5d18cf522630bdc0832b966d9259aab1f08f5427a74e38cacd2dff686b44ace922244c31972e1d01443d424ef73d3d827f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5401af88d52ea1bdfacc5ec11998b4a5

SHA1
914d35584b14762e9af8d1da6892a7dae7b0e63e

SHA256
82ac3ce1fc45cb47114b908c84c1cff433413aeac8a97314dbb3a9650371f507

SHA512
10781b0301d55f4fb412e3a26de3f98534a00d0c1c6cef2f25544d8638d1ad4dad88039f0310a52e1af4deb921fbd9b6be4999e55d1b14acc643a2a56ce7203c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ceb2ec526e1c4554242a66bdb48004

SHA1
625fe8d5f8e48f20c523a2add759a30b96f476c9

SHA256
fea296b7eba16b9c877b1ed7303de8ea2730b53126e4162e299479e65b3deab4

SHA512
d4176d7ad9c4c0f8187c784630132f3e672a37b81b1d71c0ccc4c86eeff283552a89670336ff520e5754008e9c395ac0ce9778a48e3703173f887f353d93a93e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb75760633098b6afb4122363817d035

SHA1
6397c1d0e924ae13a30fdc6e1bd0c0dd1cece002

SHA256
8f5de1d4e8032d65ec11a95abbfabe6ca43c29e9e832bd2a2374389c9e0d7f87

SHA512
879cd494221f4d14dd9ba2f5eb53a774a41d862ebe82ca8a20008eb05e44f9c30755aff050f19b98a1e315ae910032376c1a7f7bde1e2aa872b5d573a42a8d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844446282b9a5e06f887186939c055f2

SHA1
96335f8c41bb11dea6b52876e1221c30f4a887e9

SHA256
75f54054d429e501a676ffb011d90f78f16af7a9482c24049d4b26312c2fddaf

SHA512
993f64fe7fea3f4a07945a43c51be9592fba45469b8982725eb2a432281d37814bcc782ff69adc5d04e4ccee80ca286986f42d3931f14f3db7d4d867bcc48129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8726cd97bd20b5a4acca51f3787bf48b

SHA1
0803b3bda46fbc49986e5d957c750d7afcaaf77f

SHA256
44634dd7e81e9dfbcea2868da7cf3da92f6214053af0b80143742cfeaa56c502

SHA512
174d07559373ab924df6ed67780c41aa8d98c8687ccc35213276d7305e92cf680b38acdcb562b20ca2702f5ad5af657a69a91dc0c8be23123c61495beadd31bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4386193b644b5814109e7987099e76ba

SHA1
05e94ea33fe85e5d907f039888565e86031cbfa4

SHA256
7e1deca97a1701a86f7f1449d7905b678052150c20023163beaff03846509006

SHA512
d2198f4ddae172a04746ca8c21f888e42d8955440657f967cb4f5201272264900efa0c87c41d5de25c26ed0409a4a711ab4d481378518e563a4b0743f6c30ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d97a03fc952223a1dcf0162724c925f

SHA1
83743bb42eff7b865f5bd133d88380a38eaca659

SHA256
df4d2844f0a9b70b673734aea3a4455401dde25e8569d51a6f0c91e411a7e426

SHA512
683cf6eb37aa430acb5e02eb17f3f330159d338e6520b91cd3a8970091c6325d5c5d6a9c1b64d204ab118d317d781eb5eb45f5fdac0bc508e7174c5499a127e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c8816df24ea69b40d24e7706e6b514

SHA1
7d07958759640080f5fa1dd5e13d794ea00eb2b0

SHA256
8e59beb5fd660a0f583c9510c30cd38c365bfd8787af4581ae57d2279247aeab

SHA512
4f8e281f0b4e3ec6c0c906f43925c47ced78db2d396a449114b8441497433635c2898071af5012d9cf044c6ce557dcdc2449810c26ff5557e470b0bbf839a87d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ac791b12eb6d0d2083bc25dca3dcd8

SHA1
c4a042d9d434593ae6dd7054637a34cc15630dfa

SHA256
7f7b4ec2d16eed70347185cd9909b41cf45318d18479a6fcbfa60f2d43e1784d

SHA512
d216d80c42c43ba39800f10dfec9b06244a8f3f173815c9f2bda3697ce1c73b3bf67f044da41a01d117716e0d288c4a37d09c8341546425bb0d840588d5bde96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F36.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F49.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit