c4fefad8265dd1edbc14cdba387ce590ea435cb4a7c5eaba71b92941d4acdb6d

Analysis

max time kernel
146s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21b0c2345c4bc7fbf9ee719d74137320_JaffaCakes118.html
Size

6KB
MD5

21b0c2345c4bc7fbf9ee719d74137320
SHA1

0325dcf331f6becfb6a58e74e9ac4d9aa192df9c
SHA256

c4fefad8265dd1edbc14cdba387ce590ea435cb4a7c5eaba71b92941d4acdb6d
SHA512

8ddd27708427c491cdd90eec930fd38d82a69ffd41590329e7923520f627ad1c7ed03e23e50467b852db767610f81d93563fa64d30f6050d25e22932c5c44a52
SSDEEP

192:Is9PQbNPa2uNUh5hJALVWlF2jI5aT/W3K:B9Pd2u8rKU+nO3K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421277202"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000086806d86673b71c75ebc5fd1cb5a5b02af1bbb6a2d8a6b75eb9d6cdc61aea31f000000000e800000000200002000000007f280c4a30a4ef9726403239c9ed583483c122cc01b4e14f830c85c06c6257320000000b1a1a1a2a4bf19e4e97dd57a94fbf68d85aba69068d194b80f445952da7991ee40000000e28261a80aa6f0f6aff435f32621f37e466494eeb0e28f29e5c7906eddbd7bc032736809344ffd16dfd3d7595a0ee4018053588044608fe43bf8a6021f3bdfba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707953f3c0a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1ED84FD1-0CB4-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000de1ced12539af2cb124266d8a735fd62e99db2f7f184d8981cce679aa8f6d00d000000000e80000000020000200000008d5214a46f4b7f6bb7b746f007e5c3352e8ae11c3b277d5480c0162aaf781d0290000000190b7a7553f215fb8303238327eb33a26e14c803d1a332af77e8e29bc1e16449dff131224b2e3e2350d75ffdfbf20eab14e9a99089b61a70d679796269c58406b090c28828929a4be7794ba67ef62e65ea4d9999272379144e602f22cbdca8b6e902dc9acc4cd711e78c15cbd32d9079493c8fc2cf73305de3a19631a2dd41fdcbeab8282a869105eceedcbc741e7fd2400000000ea08728e0a47d1075121864c641a9360b1a240542348ae70a4fea83211e16392cd2288e88d04528dccf4febba949afd1f3446a9c9084ceb24bcdc67c6871e24	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2216	2776	iexplore.exe	28
PID 2776 wrote to memory of 2216	2776	iexplore.exe	28
PID 2776 wrote to memory of 2216	2776	iexplore.exe	28
PID 2776 wrote to memory of 2216	2776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21b0c2345c4bc7fbf9ee719d74137320_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25ed3dc34c34c52faafde0c8d6123123

SHA1
410b69029d2155e1695a0a5e9fd4e1100725cbaa

SHA256
40bd4c721e8098d62a7e4b797f448e1b93ed350bddafc57f9cb6713a26f4b023

SHA512
2c65651363619750001ac1ea60843ea44bcefc869f15ac1c9f33b5604bff8a3b7ea4371412477617a38a3d3fbf8d8ad173a9b85ee1ab9df02ac6a6cb7551066b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c1c9a3719bc3e947ab7dfd546dd579

SHA1
0a537f9d9cd9608972b427d1c57d05bdcb9eafb1

SHA256
b72bf4e50341edb1790e8e16dbdf1f37343eab5316be32552d5ce1968a9e331c

SHA512
c86efb0653c12346e31924108f2e83fce04941b5feccc280429ef633e920c39fdee66e981248cf69057e1fdc082746878a0c62c90e2ac6e2cb2360e4c7aa3f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a85a5ebe4948148cc9eb2a745523767b

SHA1
393b4c86836d2b54635cf78856b485671bb00559

SHA256
11ca5fe0d6daa69ff5e9781e2a36d5c88e2bd81967559345d3d3e507445bad82

SHA512
b181600ac97c2347486237c5b2ee2ce0a3de0776ab313915e5e697818333a679395fda3803c8b36e2a4d341468e845ba36b6f9338f499e91c6869b6052cfbf56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13141dc3b4a3bd0405664b0c7c1c817a

SHA1
1aa041f77aa83c9d3811cfce953bac6d419e1b0f

SHA256
ba1ebfefe4df3311ed7e0534d25ba67010609fe685aa5cd39560e0e6b02700f7

SHA512
61498a810a99014ba3016d23f1bee876ce8a72f1b750c5005897c37cef418317a64d392bcfe5d2c2cfd9c5d5429e51e697ba22b3d3df58c95308caccb7abb380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10c0f6d4a55d20df97f332e7360c63f

SHA1
1d978a88ffd17545b0cd39231d86ba36db592ca3

SHA256
a40b46e326edfb505784f29ff78bc9f09ed62d1ce9b810751d4c37eacd074bf8

SHA512
ae856278568a30c2ccb91b0face23565680a4d84f1b12bf06be3820663995edfb58abfabcc7cf4f15f933c1e42b70271806660dbe8effc52fd73a4a1882ccf8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfdda7449436cbf3bb721f3c9bb7afc7

SHA1
c7888e22231f6ca408693e4e2bb8789580538e2d

SHA256
22dad90e0ac4286d5460ec77534bcefffca5f7ac3cf60b56e2c5f62da9379ac6

SHA512
d068785914ab67a584c577cb2e22104b69b966d92f51a712ce6404b81fb270bf56f2109c4916936b9b9b43d973f5e522537241b4d703ef34ab9be9253f3817e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e56f10137e1a3da33873f27924f0e267

SHA1
b18b83977e83527a3dabec665b29bcf6444d9319

SHA256
b6d2c8633a875020f793b3bc9970c1606a284e564350baad32d9c5c1011df6b2

SHA512
15dcaf2e8994cbb3149e35ac527357e9197a07e29f802ddb585a7875a14230664566a7e0dac89bd65705313143aaca0b4186a09b3072c85ea6903ebd4e5475cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a7dccbfd419d323b2f2a844e9514ffd

SHA1
3a5c0eefb75d57bd610986752edf8ee4f04d7904

SHA256
ffd6d6b9971a0128bee21b5d6013d4ff45fb3b81c5bf5587fd09cb9c84fc02e2

SHA512
16ee4efddf52617b11be82893a49ba56a06213a5a174caa7244d33dc5649eefa8ddd44fceb98c57bf8c7ddde7e90211e0ed09921b4908013e75ff1e501c5362a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faf8e9c40d2e21eab82de55e270fcca9

SHA1
1eacd53eafd6d9964102edc30bab94b91ed496ca

SHA256
cb2fa9c09cf8b3f3959a757de92691dd8b712d4b909f1d7f976f9546080f0c5d

SHA512
9bacc7d90e91c9101a4a0c62a7cd802c2e03b24fd71c586970a6aa6e83aad23ddc8f265786709d2f64b8646bdfae026a318c2cfc4a30449a1f1e1da0eb41b030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51370bbf61541b8b73fca90cea177b54

SHA1
ff3159deef21dadef1895dd5fde8918acf9938c7

SHA256
66ce9d862466bd51ba6e8d33ae8ff4532a71ae998be8b4af46bb2dc4e484295e

SHA512
f183b519e3d2405057a758583cf2ac61c7e2cd3dd7584e6322624c5cbd501df46037bc738f978ae68e46576a50cc3551e49ee85db0f720d5fd1e3c37fff5678f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5414d5ab0308d0257ac17c1c1086b866

SHA1
eb5df0cec846d96613e975ddee5b693d918c601c

SHA256
52684a1edc9a08f9c4f130bd73ac76e90a0cded772b7e3ed568776753e0f0306

SHA512
2df82b29b09baae4e1618d3f3ae957494612d6b9acc881a2a098059d68c9a71cbbe746bd610109fc5008830430dbc0b53e238c50ba4a8db64de54d3d48df0fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1710f360866fd7d85dd2c29361ae3add

SHA1
5018f5e7215b10fc25074962719051fd08218c36

SHA256
872b05f6da269f804dcc231be2c0d2d410267ca2d3bda94b0c357c4d2959ac1f

SHA512
05a84229dca646d8e6c5c2836926e2731fc4bbedd3176c048dc336a3057293250e28a23971c7afdd58e4e0724966222514dfa25c5ae064430b74fedb1cfc5033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c702dbb0b98bc1d43b0cb35804ad449c

SHA1
4e63c6159183b3e9030d5e67f0aa8ed18d162bc6

SHA256
bf8040865242fdac02f4eee1725eb7ddd97364e52b8623226287d5b4f51b4d40

SHA512
9d6cd173c9cb31a00501255786a48c4e9c4cb1618def681c980114279a5fa5f0426dcf039585fe953bb7ec77b0c7e6b2c548945e317e7e54e81454938e56b0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9da6b9f36499565f6110bfd8f6fa0a2

SHA1
3d3e161932e691374f471f1cd50aa7e8ec154681

SHA256
d18dc832f6eb94d5519dbb59029353a953097201b1a308c4ac2c97f2dbee11d6

SHA512
d52dc6f4160333f4e7fbdcc93f4b3640038250de171111fd31d738117f44756954bdd6da0badc8f8d45bd575f63faa2ec88f6750a23d996d47041f5c73bfec1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3065.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3148.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit