607376b1023f71fff53bba13df7c1d3e21d73744ff4f5c8625bc59d177d83a8c

Analysis

max time kernel
140s
max time network
133s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

271cc8a5a5e4317ac600dd5e9660ff87_JaffaCakes118.html
Size

97KB
MD5

271cc8a5a5e4317ac600dd5e9660ff87
SHA1

984ce8d194dbcb2a581b09b25d9a230278b32199
SHA256

607376b1023f71fff53bba13df7c1d3e21d73744ff4f5c8625bc59d177d83a8c
SHA512

f8630f693ac3436b35505aebc224ca499b6394a06add86db5a802c47a13ec0aa4cdb701d82cce3bba79d3940c560b930c0dcdf67172a262feb1586937249f7d5
SSDEEP

1536:K7+A/YjICs1JSUw+JWpFSh/4k3Aar+MfBI/IeHt4GUOAUI37eHZYcdc4eC4J8mD0:c+A/Yo1vccc9lMIKYXI3s

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A994F761-0D8E-11EF-99B2-4A4123AE786E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4069187f9ba1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ff6558fd1209e3025ff4f4c5298fce353f3be17c0d246e85fc637d8318b3fd19000000000e80000000020000200000009a3845e7459c9e675bb2805d0ed02a6ac867434bed7e4b0f557f3df10d8a628590000000128ac09935a010da5d232082749d84a2154f2ad9f4a06de1165fe2ee3faf429deb575a859795dfafbcff7ef16b15cc0ddd41ed38259578022d1da830fa4c94133678cdbeff9b9e4b619510150b1550d52f1fcbca7b69a45021a41c150f95fabd8338c31cb43d092ce81fb0abb5cc6c8c22b389b19d46c0d4ca8077e5b5fe42abda16679e3b3f7fa961f7e6a6a7fddf3f400000005916f65fbaef54d1a9b696bfbd2b78c7ea3c6afda766620b31b3a90808e93302eae032b330d4724d8fc8ec5ead2e34612928244166c4deae1d9aa29d21dd5d33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421371059"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000016512d4a22abb2326f99abc3984221f04375536714ae2927fefcfa11b2e4da66000000000e800000000200002000000063e8249b777974c20e12fae1714654d5600606d33000b09f795fbc924c9873202000000021d0e32d8a3551de38f0ee3f05aa64a051d7cfce2ac1465226ac2bc0a091861740000000e0e08d593ba6f6e30993aa9c91c17a1b65b31d38af9dbf8983afed3d27dbea4f195a8d242ea46fcb1d643f86e887261a25e1524c7849cdf6d30019890980d4d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2156	2416	iexplore.exe	28
PID 2416 wrote to memory of 2156	2416	iexplore.exe	28
PID 2416 wrote to memory of 2156	2416	iexplore.exe	28
PID 2416 wrote to memory of 2156	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\271cc8a5a5e4317ac600dd5e9660ff87_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c01a1c2b35a98f50775e6c6809522b79

SHA1
9c0819210de238dcdccea24d897d1fdfef45efe6

SHA256
25eacb1d2676b60d38ddf96fd01309192ecee8c795dba29194faecea74a1c256

SHA512
8eaedb033dfbf793353d541edd9ae2203f2918fc8a3f9f7858285a0ac430c2322bcc8413754d63298a951825460dfd499e3600ced4dfc428c271a0b8f272f904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8da9d7881db3b5c779e23d9ab8eddc94

SHA1
2e118307609118793497bb2abb8919647dc2d69b

SHA256
8187b838352b5b7efba297993cc6480fa22e93bfe1f2b9664a1569b562da594f

SHA512
a50d95b954752b26608a14aa35cbf2f78a978eb22aa2067f43c56e7f8872fef82f94240c099831bd6be201d388c50ca4d7c2e947c3c67320110865ffe77e1576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceb6085be7f6469cec3554dce230b091

SHA1
644d80ce8cbfa0f7ba402ccbfee75b051a3a2c8a

SHA256
8a79c5078fa070a23d42a57255ae6b12cb0a0f06442d7b7394bb42b304adbefc

SHA512
0588cbbb2253c36bd136d40db304063418fbece02c7c9031c4cbac00f15be8cfedf46d1ad2820c471d686b91573dfe33e6871171d23aec719f64eb79082d3da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8512b7b4508cb6d757c090912792f6ac

SHA1
b88972166efecd13bb2baa20c00050aaa5c3cb08

SHA256
5096831be045493ed2f4f275052ec057e27657de0ad4266ad1d099b761d61f6a

SHA512
e4b30d48f2c4fbcca6aea4f687b353cbc35a173c509f5765952a6bfe1c93d8ce139a75d9e38cc5840c3bb3b44f5040e2a2636263569c5d6b7d11c86230fee10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
797210cf887bd08e299a2df0e996e9e5

SHA1
ddb4dcaa2ca5bd6afb12047bb2244c9be657e996

SHA256
3830a7c830cbf1a88d9b68f3c159c91232f9ac3e4f0ea955f6365c428576cd02

SHA512
cfc1772dd13ee9124a14a54be86c4d6735e46004ae95b35f251ce5dcf76bb51bc1f97908da007052d1632ed90764508b1a3941fe5969329a6601cc6f13760b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14feaf7384267a7787d6452e021e765f

SHA1
bcf342c5f9778e03e408325e7abf4a7380e93c50

SHA256
48860a3bdf98fea3e2f7f89bf96642fb69242b7e8ab02c122780209d29b7f9fb

SHA512
b031afe0049ab9452c0f7d145b3817085a286a40a5ec09a047a8c17d5a469a45eac6dc0072c05dfdb5a3a1b1c656a97b3fef36ef193e1c59f4afce2a7237c0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf4895a398caa8ad059e01b9429cd76b

SHA1
6f0da3a627be3dfb501bc70bc8b8c10d86d40e17

SHA256
8135c212b0b779088b2386a5d2b5c90908681a96ce3fb44806f6bbc4c56edae8

SHA512
9193f53af960ea41e008c4b1a3bffdfd70260ee4c0619ad89033711ba95891d9638bf1c096366d20476de80d25112984fb55892d0d6f016aee266b829ebca5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6a3bace73fe1e406bbbf62d51bf4c3

SHA1
e219ae4f08d07f7d56d4183dbdf57e24d4f54ec2

SHA256
296925e1b7916865795264f9d50af07c1a2b6d11044a97a3dc556c8c019897c3

SHA512
96c40b3e269cd840b66d161455c0b91e26024ec1360871742dfc69feb0d27e8c343c3d584429e695041039bebba686faf78993ce12119ea703165823e43e95bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea43992733daf7f2fc50bbdcee4ecb94

SHA1
bdd04883d1163fd7e4ef6f5ef8a825d8197073f4

SHA256
17f4845490f324251cd37a0639fe4a94b7833bb4de43506397ce39ea59ddfdae

SHA512
3a1613d568932dd1a99f02c1240cac51437533c97656c38861d181f395767419d5211b82b91d493f364c84fab26d855e25c58a77186dab765302458570955c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42be7f9b6382cfc73cb9e37c087f202c

SHA1
73cee091c96ffd22edbf344ddba94be0f55235c0

SHA256
3206508143b91d86d488eea30d3f162825e0d04a007d1508678b548d49484d0b

SHA512
5fb1706c0308c881c6eaaa36c12096eee9a5874b42b7b62489dea530dd86f3b0262172242d94372dfc6f3d631087ed9ab911541084f4ef7a85f820e98445dc5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
463eb524323f460ccc32260f171f2629

SHA1
8026b27ce517ee720f3c668b3f43dc5391a800a5

SHA256
1e15e9d26a684ec4d30db3fee4c4a7c7a410259f9e6cb9b854f59ec04ed27980

SHA512
41aa62964ec19fa2e554cd5dae37ce24d94b01dbf650c480c4ed312805424e51455d88f4b822b29e70b2b3f37dc486b21564fa65cf657b6a5fa5d8b2d3784810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8f3823558c7172826627c4494920648

SHA1
38bfda5f63fd23689696c8c1692096bbbb6c9c11

SHA256
7b5ff7fe901068f75ca90ae0fda8a74c03360c3c9cf348501382c5a3aecffddf

SHA512
3776d15f353292385f2cf6cf8b21c063a45310b2e4e222c67e1915e8ee6d1957808bda838660a3229b1dc0558386d2529578c2e89615250caa36ed9e2dfa2960

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab201E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar362F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit