ca5efb754fe90164feba15765347701ba246b160279c7801d0d533c9859a3e0f

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21bbbeac4a3584247581a4d1160f6589_JaffaCakes118.html
Size

47KB
MD5

21bbbeac4a3584247581a4d1160f6589
SHA1

a721012f97a9c6d4becd0b3d66f7e9a67a7e5469
SHA256

ca5efb754fe90164feba15765347701ba246b160279c7801d0d533c9859a3e0f
SHA512

bd330f058cee2b6bbfbc2002c534adc553ef5c3a1437b372fd3a097950dbef982c1b8ad976de5a495637a5152220f73eb25fd69d8403615e9f70d2f1e1cabc82
SSDEEP

768:gQnI1xxBor2v3702KrxPoAaUVM5l2p62QFyVL0z0z0C0R0H0u0n0v02o3:ga2vr0rPo2VMqp6PFyVL0z0z0C0R0H0x

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBB9E2A1-0CB5-11EF-805C-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421277990"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2094a6d3c2a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000006de6d065003908401039777fae4b15dfd4c6a84561ae7e22de660908dffab619000000000e80000000020000200000005975faf52cea14a65d7e29af7c51469633833ea3a9234b8a93df306a8e9f1fe690000000083215a0c8c6d1b52cd2c36627271252ca7b8f2132d2dfa64065a7a40e3da013e18c81cb3cee9ec2364218930794dc165da61da33df539d0f59c54429f216683463489c72f0a5cf655e547159bfa30089f7f0fe29d22f4cd5afe10ca5e72fe9d3123def3fb4d5e8e98ef30fc4720f6b5beb5ad43d78626c302dfbef6f115e2445decbe72e4ed0fdc8b0d85e58d4634ee40000000ecdb690d16863ccb5bf05349fc68c176d1daa20ce1699cb24d91b1bf6a80358ade8b3beb1a1a6f4be1b4ef182ac56ed8bcce561ece20861ebc5f3045a293efba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f1f07f15001db7a904cda5414c5d7c2799efd2a37fb044b585760793d554d65f000000000e8000000002000020000000085862f1ecbe72920ce1d466e4c141ba688e9fa2db6e2c3162ec1ea702afaa7620000000b66f102411d3b3a16d654cc9d9902b0d1fce9add478624f735c5cfd5f65aa01c400000001f757b82485f35f261a0f524e3f263a2c96a42de1afec848f5580b896eb4b397447cfaf966403c86f9da6cbf84ea0d9ae1d04204c44305338590ae03d3d180c4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3000	2280	iexplore.exe	28
PID 2280 wrote to memory of 3000	2280	iexplore.exe	28
PID 2280 wrote to memory of 3000	2280	iexplore.exe	28
PID 2280 wrote to memory of 3000	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21bbbeac4a3584247581a4d1160f6589_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4ed17a0950c4c65d824039e40efc4566

SHA1
b0dfeb3a101ccd98ddd9ace3003d3ce9810ca0b2

SHA256
da64a98af8c77f4765f8788d0c1bec4703640d216113fe56dd2923358a4cdbb9

SHA512
82c4190f41632e0ca3b38811a49f7c9553318216880cdb0d3269e6032d1a14561dd370b9ba7f22b7fd0e85e9cf31fafc4db052531613d08d4cc5549f2f7e18b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c91965403bce86b950ce337c8f2bf9

SHA1
7412bf2e065c60c58bf4c4d4da9c59069e80ef81

SHA256
3138a52a1b886d3a296d87c8e5b467ac5e7c9e01cf460034cb4497f331be1294

SHA512
bcf34366894f7679d65ec63effcc13edc5e8e9c618663231b7b7682b8f841761b335b725670d87776567b77ff3f48e53aca59bea28146e3b7ff98bce59fe3e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b14b676332e1f4b8e4bf1c27c136fc

SHA1
34b989c79a56abeeec2f5ecf35d03bd5530556ab

SHA256
32d4c78483188fec06e89cfccf28bee61ebd58c5947275dd72066097f9461234

SHA512
18c497872244d6c5cf7d75bd35b2ef4386ff84d7009faae823553b814102b0897a83ea62b3d7e76db5e1b2d3682e479910df9c35ca7a39c698fe11d92a60a10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93cca7a9865f4925b08b37cd46db8e66

SHA1
d0a705e6869c846d2c70a128e4f0d150a2090529

SHA256
749d18063b02e91c0482ae16c40c2572ee63864d14db036161e444219aaff7d5

SHA512
c11c607ad6deb06d4648f15ed76019b74a2a133b38fa7ae20baf57d40371be8fde95dc95a420ee2526a6d7e00eada98424c8b121bb0eb254a0874b0abf709c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d02afbde5c4630edb7731219df57391

SHA1
41522272d73a136df9e8066b9ecadf4c9ec83248

SHA256
794cec868b7ab8ac2c6601813e4d29a3a09fcdeefde75e8e07c6445dd0c1ca40

SHA512
6bbed01bb5ec6e50d7ca9a5b8573aa5113c0c3da5e17fb78ebd363bd90732c6de02a532907eb6dd136dfa6ed7639f5c8da8f85fc63882783505f9444a2325ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8225192d17607e39eb9d4dc702ae1d25

SHA1
07191c042dc452b34789384196034a383c559066

SHA256
da39a0449e761b567ebe8503fd50e04ab3f0a14cea759b344ea26e9b368f4b4a

SHA512
50ab15952abedcf983e5385a6f7e5373085a24f4cfbd4727221be79c8b0fd0e21368f2a4fab2510aa1a173a39d84ed568ac6195d9f4490829db2ed04134b9881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b676990be5e09e5222dc45e1626ad1a6

SHA1
f9c00463bc8598a5523232caa019a3d91bb562e2

SHA256
ca8efa9d4ee0704d117b5dcb43b779e255103591f07c091ab9f6e4826b7fabeb

SHA512
62e198aeb5b7b33c8ee70185b0eda6d42549cf9ad8deb6648d3e0cdc78f12f91863ac63024aed34455cb4a500eef617c81a31517df9db947e464f01578054cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50aaa8746491c891bd97de6b64f14230

SHA1
de777b6e01f0500a9c0e0c190dbc3f58a853a412

SHA256
429e784d6700b3245f420fc4ad85cdbfd2f5eaad1ba62370e5de1683c266ed53

SHA512
83da1eeab51bb114059353a2d55e68cbc7d37670a6048c510527220fc8db256e304ff849302acd616ce05b507f93af82a4ca2e56fa5467d40bca250af37a87d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c4580349699dca703893861579f5c84

SHA1
512a17aeb7c59843755245377b7845ccfd806625

SHA256
17b135629a6ee1bd26661e84b792e941816b6d3fe1cc5c20cd40285ae363b577

SHA512
4ec886ab958362e7c136e8334f6deae1e693454a699239626de563fd7468c429017d19fadccac616174253d1e677662fa180b6507444b6563402e7a84e89b7c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a6172c216abaea6bd48612d60daf33b

SHA1
e235ff475d21eeddfd08780b241dbce70cd3c564

SHA256
b5b896747d19f80ac6dba8d678818f55edac9df0ea46ee2be3ed0b414b0736db

SHA512
221d5411e1f38d2b05031aed4999abdd599e19f3a8cfe71a2a13d8531fb9e5612dfc1369ff88d289b4589a3800b2b113b670fe2e134140fcffa2b31d64dadb7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d78cbe1832d7e8b0cf79699002757d47

SHA1
0327c58ce90609af8d6e7f72d86b9a7fa0db8fdd

SHA256
5b02d7a011f50b63f760978565c0d1ebf6437f2886702574749080d43b7fe9c2

SHA512
d8b2817475fddd79d7871c6e6ed1190a41fd9776cdb4fdd5959227fa47653791c978280d675291da2ce38e703d418466bf0ebfd452516ae6996899ed0e320990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f5447e3a72ee0d151a906ee044de0a15

SHA1
9b304cf82365fb5af932a652080c564a7f64940f

SHA256
8e38802d17f5855f5b29ab024d1ded9aa6516a68b2c9777af632520c3024bf4c

SHA512
c670ee190889097164fa51d26f65fe42bedaeea54b6e9072d046de2c89236fd8b52514f176243b9be6729b3b28379ef7002c47c1a429d8c1672e847b4304ac83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A08.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B28.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit