3406769b24e12412e2a7d993cbc3b0e6f15ffeb1810a3074dfa51de803863bd7

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21822dc7321c5251f11e8ec882d229bc_JaffaCakes118.html
Size

68KB
MD5

21822dc7321c5251f11e8ec882d229bc
SHA1

0d01d666e261feb96405dbd7cc7882850af76ef0
SHA256

3406769b24e12412e2a7d993cbc3b0e6f15ffeb1810a3074dfa51de803863bd7
SHA512

8dd648977616b70888c5c963a5414ecac04fa0c0ae4c3b984a3763cd82b2dab267e44a4ed3561ccd15d6847a4aa79d3a09b02a30c63b0dc013a5a42218082a2f
SSDEEP

768:Ji5gcMiR3sI2PDDnX0g64wqcZkrrszoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:J/0BKrIMTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68222881-0CAC-11EF-9387-E25BC60B6402} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000006a73bec31a7c635110dd9bb2d3f9241642b3f0f52c3172817c2a40c86e9013e000000000e800000000200002000000035971a4777d438f62ad1b06d18497fb6929fc6cf7904e8186d81facebc2f850b2000000072848c5e558e4873cf7968bfa225c3f771cc484ab01cb1731e614d8804c0e16240000000855985814386702d938d701cad685046bc760e8a70913e783dfa6002f790282286366edc0f6ba397354845956d1e172d1db6b98e36acf7dafe594389ece7a50b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405be73cb9a0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e0fb463393ecf7bcafd955996633c0e259f2c98ca0fa47da6b7f427c71242308000000000e80000000020000200000008056cacf43ca5e73c6981af5f8482b7c4fd4200885350d49cb4e78b4185c685090000000fd678b8089373e0fdd6e29e23c146badb9cefe358a5a39fc84bb4814745006921f1750618543dd97e57bcdb5b7b1d50161257f1fcba67e813735d5925ad19eed80e8c53e8d9efbae568371e1bb2ca55a4ed56188dd26683304c427b9f692b9b274fa98ed205fbcb21ff37452f4f56b09ec39f967b32936e5e8d5857b8a964e6152583af7ebc6888d3ef021dac0248328400000005744ef8301c9cb5b15eabd1c0fec450097a5c19550d64d1d958917996e1e41a058f55ac8db098b40cd0a261757389c98f2758939c35620ef2c99fc55e6cb9a0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421273877"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2560	2696	iexplore.exe	28
PID 2696 wrote to memory of 2560	2696	iexplore.exe	28
PID 2696 wrote to memory of 2560	2696	iexplore.exe	28
PID 2696 wrote to memory of 2560	2696	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21822dc7321c5251f11e8ec882d229bc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59816eef9fb3891bca70727a27e455dc

SHA1
e004428696388fcfc781a0f98e4b2706603d731a

SHA256
612dc3dc0189f7394e0e9dca92171691dea4121cdf5d139c209c90c9290b8f09

SHA512
36085bb065f11de73795f578f2c8656dfdb473749572a9e668d9f9bd404e2c334f6fbe824a44f71df85ff9211b745d6acf5d32cab1ca05e5c2abea5c13dd56fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff19bed18b8df75940399ad96810ac4a

SHA1
575f9d24e90ce211d1206ec174da418c182cfc8d

SHA256
5c5efc310539ac15bf597a63a487acf4fc2f66a893a9571e9a579df58317c640

SHA512
93f5bdd732e5d49057a36892b71fb9f643804e3ea23952f227e57486ba76fc48b0f33a6ef46ce8333b9d3291eeff7e77ab8f6e0e85ac5362c5685359204b230f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e88ce1ccdbe9e1d81f5a45748590accc

SHA1
95c307ebb288131d54baa848e57ccfb6d68acc13

SHA256
c45dc726dab9faf5e1c615fd40b0b062d2b020d3f8c75ca5876e679b76b1b077

SHA512
25eebf654ce7c21a2a1c49befafca8a957c20f381fd2d929d19a57986582cfd50a14d900299c26b1ca4d31b96012e5e76b7fa9e05866d5650a536f716d7baf23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2433743fc0cf299bb1bb87eab22c21b

SHA1
0c120508217071825e5b1eb2f86f0c765e856fb6

SHA256
5e8516ae611a9c650965b8d76a23587f55647a0ffdbb993819af825bff70bb60

SHA512
4613675feb75339b4acad7099c2b6e66387cabafa972aa8c3e48b69810a0a3e92b133ad19909c22cfeb00716c93a8fcb1f0aa6103182038c731358714333d113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
111516297bc51cc1b7d76fb6dac7ca70

SHA1
37fce383293c430ac4620bc708cca4d5239703b4

SHA256
b1955714fa135b4a40494c2c7183591b45b393f0b51bfb17fe64dcc5e1b0eec3

SHA512
35ee389b7c0dfde753f5c409db7fb06f9d9f2c90916711290bf6d2ba6a420eb7455938fcf8877b944ee99a8d1cbafabd09372659d086b3ff631d3cf9b17cd438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85596022656f7e35913949b548d1930f

SHA1
8d85acd5a40a938e6148b5c4adbc05b154333910

SHA256
ab5c1af95e258f465d1c0cde3313a029f6eeb47bc197261bfa91bcea2adec4fd

SHA512
708cc91e75cb115675e99ed377219997b4bc9e25d1c5cf2d734bc5e31c07dc373390bd035a14967f9d83c659e1f43425837fed3d6b5d02860a4a7eccf8f38368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4385d0ec7f47d73933e5b31cef1abab0

SHA1
c365495c622e295b441cde79eee0b0e8642d8e78

SHA256
5a6d417e01ad3370a367193b9138de68d6855c8b408fe68690bc0927803ada71

SHA512
310fd7352375ce00d3670af36dec61dfe1280bbd74b184408d23a7d6f11db07b28bbb4c2248cc32a14d61339a94ea9706b3919b218c5d5b2bca86af831c9d970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84c4a2f5ebd9f357bf20e8f902aa1a22

SHA1
c9db2be0434e942ef1e90edf160944f0de93a8e1

SHA256
09f1af49aa6f5c3fb0e7e686e13ad3677053feec82322c4857bfec91b2169ac8

SHA512
613bc6fdaf3c1a193b64cafa8447495ba74ede2212fc6630e9865377836b015ce5d2fe82dc480fbc2d0379415b3fd99bdb2617f582acae31a225b2ae69521c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdc545e81dd64b0f68cebc1fb5974914

SHA1
44d381bfbb7d8da65612501fe57f39b5381ca70e

SHA256
28f201f9c47fd462b52b3948a61885e2fde53686d26081f629e677a4cc5e7569

SHA512
82c5713192e28b09a8b7d9ce35d3d95470f119931164f3d0334caad1e50ba31ff4559509d315987e26ac8e450a4360cfa51a0397a69456de8cdb06a011b61cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7579b4673ed09de5152f39f0c19ef079

SHA1
7003dc563cc9f603021961dfc33ca6fdf0290840

SHA256
eb092f9b6dba5ed61477b37ef38c0bebf82265fd3e8f16bb6ff69338dc54fbd2

SHA512
e9f128b8d0ef290dc576cb7b1e0aed63b0e951ebee6103b80a06b301c4d70c9cff6ea5aa5128a02d7c63c974152f6bd536c3b313750c1bbc004d86b8fdfd6ebf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404e6dba01de565a417cd88b408a4b8c

SHA1
5cd0c4d4f7d5fc024d5fa703761edf53bce62ff1

SHA256
75e650938aa73eecdbb09324151428eac946cfbc298ae5f3322a317c5a3985a8

SHA512
90ba2b35ac4b845b9989778a936c0d8e1ffd4bdd1e8252821908a2a59d101df0bcb2ffe8a6bb0338d61da692da6a970f5f37c2b62e846b8653815f6f0565704a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe086e08488059ed968da54892e6481

SHA1
6c354af674aecac60a764058f79be15e90f91adb

SHA256
69d6fafdd637d401c836945a89659c8437a426cdec8b55656e3e504d6cd3d1b0

SHA512
d8b095f9ad8babfa7518d493d7a605962821484485e7d7ab150a279f3fed26a30bb3ef6675c567c55147869463b500638df8ab9a0d768b423b4ca2b85e11ad2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
156d170fe6d5f0cd4a03b94bc7797d2e

SHA1
7c5c909d9c677250cf337bff2f946e16b04c7c82

SHA256
9c490354ad9945a7bc0cf50a07927eb121dc5714c4945a1644cad61a08e00ba1

SHA512
eb04b0b324ca3c108cc2c7233c177ad733c083eb2529e8d56d3a419d206a1a6d4cd778abb527fc6f67b5fb95431e0dec122bbe89c435c5c44fa9c1c33f942cac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a12b8a959c0dcbf20757d7464680182

SHA1
6ed7ece9d6d23804aa9a90ca20faeacc5ce1055c

SHA256
84e413138208b86e2823675a2dd752ef0f7ec70044d9dfa259f1863320932185

SHA512
a83dfed773f534ed98aee5a77aeb686328b6ae876bb6e73a205e0d440cac6119bab9196e3aa59f97c4f7da2d5843f1f22d62e75463147f7bac7d6552c3af324b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dfdc914dc9c5d8064da8c93dfbde9b6

SHA1
a331858e8b3905576a2b9299accf7581c53c8a0f

SHA256
9dd373bf035c2411b40f8cb8a3eb8d55f517adbd2451f6cb3dad33fe455ed97e

SHA512
6d202abbbe99af7fa378a01b925a9c01ea1508aa591536427cc8dddde44863fe29c1d5c3613098ae4228198f49b39f33492f6d154d01e9dcb43cecb962db3ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64737cfb05b3eae9cf68ff568fc681ff

SHA1
5469d64a305f2320ee141c79c071fb86a7e794b9

SHA256
405fd3122649ff6b3d1f22fef95add1be307532a11606f7778497ef92f3a6641

SHA512
3bb9dd0dfbbeefa592cc59f013db5070a93ac9f6ac0664451d14bac79dd69ea32ba851fc67435481df90097a2e481da81222720a6b0355a5eedc69bca42af8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A94.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit