0ea2bafbd2992a45baf0c09faebb498641a7e9e0f5e3a00d5e2651b093ab06a0

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

218d0d19b90041f871f132297fecf85f_JaffaCakes118.html
Size

70KB
MD5

218d0d19b90041f871f132297fecf85f
SHA1

98b4070c3296d151650e480f624b88bf42b7f2be
SHA256

0ea2bafbd2992a45baf0c09faebb498641a7e9e0f5e3a00d5e2651b093ab06a0
SHA512

2d5139baf2b0ec16a6a21b59d41c394226710d45ecfd6ec957cff0e7f7cbe857ad7e4441e76c8207b111d1d8cb35550fcc4b656ec10eaac0bb78b3f2cb6d391c
SSDEEP

768:JikgcMWR3sI2PDDnd0g61tIoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8s/k:JQITTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E0893F1-0CAE-11EF-9A4D-7A846B3196C4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401b3933bba0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000004ab3562d280e494c15a0caf291fb8f2b12c567b1d793bf3bd20bb622bb76846c000000000e80000000020000200000007f9eeac0a49abf921d93d66a780dea3efec85d25175a3beb493cbd0bb93f499790000000f1094bc9dc247cfe6c43ec639d14e350316762b1d82b9b64c256864827e5e110cf89ac2cecbc6c426d9851bc0dd45cb0a52b58e22d7ba8cda2e2666314bd7a858cffd2753ccad0639ff65cd6d5cf506f5e4746bfbc65873992ea9fe61bfee5b883bf710a87d649e5e0f2fde78d1db9ee7e611726cbd7182e4768db2e03dd1d6804da8a523d4ce7bdac2553ed9c3ac979400000008034e1a8a8f00901eb319054a37d93a82e99ee24d1b4bfb2d5038a5e2c6b00eda7948ad4cb57aa0166b7517a092b79adab148df6f84e545603f8374f3ab4c027	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421274719"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000001c71891b5c54c95ae5767878dada0141e9b08f91eaed1a08b8f726b8f019fd8000000000e800000000200002000000061236b91e27f79903219d41b6253ed1b081434934db81db9c624b46dbf654d1920000000460e3a08bd9545c0b5d3e7ce39d6ba69c39f6bed941346c658dfc53917d48860400000004fb390a8547bc76fb2d56f52192575d6dd8e747553d3043a645e0fa584f4b79d8608ba59935146bc45cb17a484cdd4982af1c18710d178e00c304643b87a5e65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\218d0d19b90041f871f132297fecf85f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d1fc44de356c84a89251c14de7485ea

SHA1
f57e7c7c31456284356c21147158b5e0a0a264a9

SHA256
953c5a1d9e36191d9ff87aea8b2ab86c91c895e2575a924939a481dba4ec1bf9

SHA512
754a35a4ae755103e26a89fdc2c062da9d4f6cd896f9aee0ac9f8ae28986f047de8b5bac1b7310cdfe567752cc5677caeeb5faa2e77c53e8cd8a0af1231221db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb3be52a4be415745b39cec5f6795904

SHA1
10a8210010ddbb9f449bd257884f3b7ce9883961

SHA256
b521c9b0504d5809e70630b218a0b9dbd1ac63ac2d8abe8ae8cefe41e0725454

SHA512
44433249a8e82174454a94d8d64975d37aad30959792de7b9bdc208e38efa0211de4ab967fe5aa0c06b7300a7aade2c430b87b9f799c50486d747ea38078cf30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8336c44b11c95941a9dcf6c18fe4941a

SHA1
35c9b8ed8e800f19fcef1db9810a0bf8e9dab45a

SHA256
d7229d4f782d60e828eed37d48a04cd102642f89caee360977d8c39f28184a5c

SHA512
6c94df90bff7f0ef411a34192cbe08a1eb37d0b293c79f25f5220a60ff8d6391d6fbbc76418b79c57e65e1a01b9b9ad75abe64116edb31a0c73a2b1f98f65eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
272476fee874c1dce4e1d07cb845fd7a

SHA1
1e3e76e550e0118b2a6cf4c5c2fae69972997a20

SHA256
c81b0e12eaec254a748c4ae1e9ba4098352f2a3fd085b34b1b9144419b3ead9a

SHA512
6aabf0810b62c022ca05294eb142881a43f371976b0e5aa38043eaea31d746ca212f97cba3cd4eef342c1c9f1177abdba78963c475757c4d85c0b6a9fb084b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a36bb06603f9463176158df9ee4d656

SHA1
c74403bdbb106ae9f27558892affcc218294de93

SHA256
e86d76816c5823b33a8333b925d54674249ffaa40f4389245cf60e8125e302ad

SHA512
4426c6f372460b6c08fc2e83928765399bbe191cb3aed504596437e9faabfb0ceeb300530798be998d78847e31411e6be970812aa1f20a3babedd6ab67bd2785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e1114dfdba3e788e31aecacc2b4175

SHA1
c7981bfd3558e38cdb8c621f916a4a9a7cf32cfa

SHA256
ebb9c5c7a0c95ce72c73873f0220ab2c460b133a24bf154af0de347f575f5373

SHA512
30c45c817df558e3b361d009fb4ccf48b50fe6f65707efff86a2b780a5ad73e631a41bd17d08a7d29b140794680802e3b2a6ef538d9adfb93df02314e13bff09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0990ca5fab228d8801f200d9da237d84

SHA1
1e9699c03ea4c6336d0ccfafdbb74d01327fb5d1

SHA256
4176290dc7fe21186c5e749df6f9613616eb146630598828b98c7b3521305664

SHA512
f3cf81cd47120c6dab33531ba180efc5023e495d8724f1b982cda1408754c02fd3d4b8ef8a610e13f864a3c9671559cbe5550c48223fb79b420b02cbe2a25ff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df4bcf21e2252b65d92809780010ec65

SHA1
bb38b43e6dd69a9e81a7ed2bd632b403d4c09107

SHA256
2e7ebd432053838558be5ec8839f8bad091a8d6d146868bfcf9806d4a62b3c85

SHA512
19de6a577133969173ff6ba457bdf2e97a49d33cc6c9f8a9aba45af8ba34743ec9bfd8b2bf6812a4886c1c0e44d808880a9bd6a5bb99366f0e5e57643f3c1dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e4347ca5329fd8a362dcd6b1268a18

SHA1
afd0f42abcf8d6093e4173e052628fd81d48fd2a

SHA256
0208a5f530788af96eabbf01645baa0753d216417a8e6c211b25a1a28485ca82

SHA512
4f39626a6a388998753b5b03d8513c54a0428655ef84ed8ce7fe97be2a452ae6db1c04026dc34105f0ec57d2fe8a622fab970a42520b8da94ded78053b2e2e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a886b5fabf739f3913a2e033669e986

SHA1
7168c9834da95da181eda0b0e4ea92493c60b393

SHA256
26c3700f94777ea9700a28c8572e6b754f01725321e4d7c2fcc5840fdfe75011

SHA512
b2fdc2f4cbf4bc0ee45eea84414a27acdca176166135d49321422e01a31987abcd15193fc5e81244c482d58e2a1950ee9974c82e16827f427b7fb446b480cf78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef7a845b11dcd37648c3d95e950e2450

SHA1
5f4735a5a52c56817d740c380ca89adbc809772c

SHA256
da4c9f19dfcdbcca6d2c46ae8df14aff6e3ae81686fc53e7ce3b25833ca05192

SHA512
e29380df11694ca1d3fda8d2d9ea0ca0efe4bebdbdc72b0774c83a3573deb4614a127160fa1933d8e3883a5e9478ca735958395148a34ba985e5cbc98c92fa49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5decfb889b859bfeb6a7458b092b45b

SHA1
bbf7d44aea1d379f3afd7661734659a7069d6523

SHA256
1aa94623bebdc0054b334d2588cd9bd6ef755f9efa531d183517306f9e0c2c59

SHA512
0211c97a9b4d6b077c97546352492d49c978a09faf91c42bfd8970c446081a5660951bcfca9d35646e5a8e501085bbad869b943615cffccbb0acd78f7b25926b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5039e13a7f2dcf160b9d5caf4509856c

SHA1
0310ad6a97739074811d92329ec4b3953719b5d7

SHA256
265f62d8e23f9810a75048b6ba6ad7ea0a20557b14b4890ede7d0b40a2ecd791

SHA512
2069a17460f22f0aeab5a544107cc623dc4aa994e3981ef3fbe08993b107671411129d8ad6a2b554d1e254417845b1c010e0532041e73aa27773829a2150aa34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47f185327c63804093dc06629aeb5f9a

SHA1
3ab75bf0c02be69953ecb16cd6378e0da9b45895

SHA256
7d93ee1b2edb1488b48eb1d40980eb95132ff43a0c32f0b03b08caad2160347a

SHA512
ecbb2f687d13d5ce1849d1a4cfe46b5b05b9075fa5e37871daf0cbaf3c87fafd110425b73048cf1993c060a1f1c191d33e33cebb85691b23a92da8b18d2b31ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
636e791298d23b00e3f3475d22420265

SHA1
f6cf6dca299bd0ecf6af94ff3eef5e73d07fba27

SHA256
b24d8fab77d7f48f5be8499db31c739520f564030632e3e71ae1b1c32084980d

SHA512
5211071d0855e62405db11662e02e18356b5852bafc4910924b085dda9deeae1b3b6a0122a378c65f12c3d127d2a0e49164f2ea04a3bf1d3c2f5b370905e7699

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1883.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19C2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit