4b0f754f26754bf70d9dee1c13d79fb1afd09b346e88edf9907e2f857d7a5c6b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

218fbf86e2d327948520d869aab520a0_JaffaCakes118.html
Size

23KB
MD5

218fbf86e2d327948520d869aab520a0
SHA1

aacb0631a1b54ce0924e5cc1168c3af7330876e6
SHA256

4b0f754f26754bf70d9dee1c13d79fb1afd09b346e88edf9907e2f857d7a5c6b
SHA512

f5f1c96c0ecf0a35b9b6031330eacb1a9133f627827cfd6687e5dd73ec50008d7a8a705ffb26a146ca42760911079bb50f05466b548e73baa7d6faf8dd21630c
SSDEEP

192:uWPAb5nlWnQjxn5Q/EnQienNnHnQOkEntM6nQTbnhnQFCnQtHwMBHqnYnQ7tnMYD:QQ/5BE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002e308c69351ca8ba904f607565cf528aa5c0565829b680da2d3bb7114370ff85000000000e80000000020000200000004d4e7f25c75a4e74393ff6a87942eefe1637502963b93f0e067a6db6ad63712c20000000fc9b1c681fefe0615af7fd40ddcaead6c7f5d0e3f58bfc5525e84f883f28cbc640000000064c2b6c066e956b497d2be17c1dad9b766e387e5c3beb444f6ca66577fe52e07d9dc931d40ce628db9892420e6d378f99d3b97dd98bf0ac5b06dbfed1d3eee6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000121419e19b2ae8bfb130912ba353a920ef3e30aedeb83127936c08077316c698000000000e8000000002000020000000909a5665c34facf0eda5444c5a49c44ea73deea4c409f18531f591d5e8e2d8e690000000e4b3a7c50833574ef78d9aab007e386bfcc796be7d575a4f5bbc5aa53ec4fe58ef95482348ece1f8999878f96552073d7ada6f3784cbbcb88dd273d79defca1decb39f194eb6635cfb9f6ff6772c8b6b8006710ad744af8953ccbca182d859b468dd8e3e15370fb9d95b47a09b7f52f8aed8cd30030bea99a09b18836d186271cbc2fa7b0e659ce468ac582e1acca6de400000004469813da27a821fd77c24bfe069a5d60981a09927c079e1bdec19a70a738cbf8b3c1e03f76d33438ad81e98e037b74cfd6fc646256f0465e8184a15dc5dfcee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b16c9fbba0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA82EEE1-0CAE-11EF-8804-E25BC60B6402} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421274901"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2564	2856	iexplore.exe	28
PID 2856 wrote to memory of 2564	2856	iexplore.exe	28
PID 2856 wrote to memory of 2564	2856	iexplore.exe	28
PID 2856 wrote to memory of 2564	2856	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\218fbf86e2d327948520d869aab520a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eb91e043e41dc16218b28f763e750fd

SHA1
20cc4394351550d6749fe477cec2ffb36e11c446

SHA256
630c2a821523c4035ca7e1c0abe946f95c085e2d2108ae229e1bdc01669ff09b

SHA512
147898338ffb31ff33b6da35a13ac4667204448c4a02b6222be0480dbdd6b3b7c023d55992f52946712c4eaae3516e5a4ed48d26d6dfe3e688e75cbc04f99c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe02af6b6a4a4b07f78a94245d874aaa

SHA1
42569d6ce424dfdbb0fc3fa6d71fa861ab81a546

SHA256
7f137bd82a5c878a8b55e9c0d3ed155451ac56d2d1f47e0322ad959fa5cefea4

SHA512
a6300b11713570e7523eb01e91aaed5a098628a02f8c513359239bf5ba8126eaebb17faf02f3197440684e06510e24a0fe0517eb4234b6e02b88cc1b7939aa55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1437af09bd2a92ec3150058addb5216b

SHA1
8a3207f4cba586ed10e437367e201ff7550846db

SHA256
e827be4f42c6e155fe955c99ef3f3b3098f63c0f5fb938cde66b710a3548cb65

SHA512
373fe37ac2d46f3861a393f01e04d848c6555e16f7e25c75fe5f90886944906125e951c71c13b715f90ba436fceb0461ea2ff698653e38f10951349728e1712f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e86682fa964da22412d475e196ce3e0b

SHA1
a4ea4da1fe4cec6f4b9c7e9e229ff6e49dd34b32

SHA256
ae4ce6706056b6462fda23879ac271a5a2fcf4ed3bc7e7af1f1970f58d6f0bd3

SHA512
ba3c88f51dbe01478daeb519a4522aaf07c14a70281898507a70de53a2c1e0275580ca3a8da671e115e0eb23c984990cc7b1cf79e32d8f83fe215262b95e0e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53f9445e2da9ab7596f8a07e1ac6f598

SHA1
7662e30c4eb5c2f0b06a5a403962d166f9625ffd

SHA256
eae8f8061c6dc354d842285a980a10baf637a32d59b6fc74768885838f439ce0

SHA512
bbd24ec4a09a1843e6f202fe6ca750d8a43b3087adcff730133fed3a481ff4d0f5e26590a9ed406a510334171c505face063b532fca6029c8c9765dfb1419b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aab8295e6dac2712e27ad5e186e443c

SHA1
434e2bca6fed329e355691d1fc56ec0e6f19be89

SHA256
9fed69f08511997c56a5fa84493f26b4177bd5af680c4354fc719ab4250e70d6

SHA512
e6f1644853b1503b7ea9000710cac3a9848d84f235967201df07e75144faf90419082c40c2657f0f82a53715c9234337655444fc459f4bcc2a17d990d3f3762a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b27345cc6eba40d77872d465e35070dd

SHA1
947be5c4bbc02d556811df60247f097f74349db8

SHA256
e31c31bca15b5447480251316d1e6f01e70c064645b23576aa1d987587c8e1e5

SHA512
d15dfaaa34c28a24d28fd6838634ece5d36de118eab1a6d39ebec28f84ea52f2b9a014260c8cf4c29fb90083a4abe1b98317a8bd23b08fa5bdb7ae7f7e40ee4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb988b50d28b81ef6623e61d5a88560d

SHA1
8978e8c1ce2372c33e0b1bb43f24dc245a6c4519

SHA256
2f8e4e72afe62a26580d7d2421604ae7cc77d5fc55d79b6d83de8bff079aa6ef

SHA512
e09f7a4eb943635a81269d8d2b305a1ee73b2fb0ded09872f0c6dfb8d45673a9ebc3e9f0369aad53161390d2efdb45dde6209990f6ddea1ad87a483f9ec34d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec7f9d4cc378053ca38deecb3fd7b754

SHA1
8c29bc4cef8611a12c4afe709f1fffb6dab40cfe

SHA256
91db79d849faa4d85b65106e35279083775352eab88774ac15e078c0fac9df1d

SHA512
295ce6f044f3160900725bf9c2ede392bcdf1cbacc93f5613b8562e72ef0fdd7fda18e3b864a90458a9c93e31cfd1fa2295f23d4744441cadaaa53c2f91f7062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3220.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit