d2a030b5919ef71cb0afbe0d9c76a18a99004c9a8d280498002c2b911e81aacb

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

250c57b4d43aec0578df50f65c21e934_JaffaCakes118.html
Size

461KB
MD5

250c57b4d43aec0578df50f65c21e934
SHA1

a7114f4e95a0ca1ec92698d339ad535bfde1eb2e
SHA256

d2a030b5919ef71cb0afbe0d9c76a18a99004c9a8d280498002c2b911e81aacb
SHA512

1bc7725a3173e08a405a79fe0422bebbaa9cb975ab2b35d0b6931f553f9e814842ff0eeb2b1b0808ddbdf3cf6b05e59e1b666676786a7b5c14127b928cde8136
SSDEEP

6144:SOsMYod+X3oI+YReqZQzsMYod+X3oI+Y1sMYod+X3oI+YLsMYod+X3oI+YQ:r5d+X3S5d+X3n5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000589750a04be11d638f0f999992e82b38b393fbf05559b63feb349d50a30bcdc4000000000e8000000002000020000000061b9e106a4b63645c292813e347f4f416f00e29d554338545fadbe2bbeb7bc590000000f7a0604ac3967769cfe3887973c04febf5c7c7b689a75be07510f0d13ed1d4cc2bffe3eb5d23f29d4a024992d9fff8cd03f13b18059125adae587d84793701c2ecf14a712f26692b18411f54a91c717d5b31173a2dfabe9d3253a4f2d40a58fb5b738bd3a23f32ab60247acd41468f5a498d54603789365bb658567c440982eaa7d21cc90d875f88c0a26ed96c350f7840000000b0c617cbe46c663668cf60bc526f69ac4fd98b10073b438e4422ebb0d6932a41422a39cb70c832a5fe933c35a9994625d934ef8093061aa34be745e9c67d8582	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421336701"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEC06301-0D3E-11EF-8547-E6D98B7EB028} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cc6d874ba1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e74ff68c78264502bdfc3ec2bc6d8b3cdc9a3cc971ce983daa5565a93fa9fb9b000000000e8000000002000020000000cf02dd731e5fda0d76d921635d2e6c02b79a7f35167567b311dbe852b670ea5a2000000020ccbb6b2628b6ba4f4183c360f8ee0747a6a7c99a3181d8b905f233842c42dd40000000c8c4dff89dad5f446f13aab28e7a055d3b4fedfb454fc1086fea6dbf96ef2961ee4baf09aa89d09f601855f7957da2492da0b75a47b50fb0aba6c87a631a8540	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2504	2172	iexplore.exe	28
PID 2172 wrote to memory of 2504	2172	iexplore.exe	28
PID 2172 wrote to memory of 2504	2172	iexplore.exe	28
PID 2172 wrote to memory of 2504	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\250c57b4d43aec0578df50f65c21e934_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eedf4cf07369e1de65aea27370d201da

SHA1
1dce29b8f694350fc44ad19cab258b09f85fc0ae

SHA256
d2ea65afd55cf36766335155ce1d36fd88b551cbb237e668eafc84a1e129ba09

SHA512
0489b85b8176c2ce01b58ed1c5b2319e51e8e878c3640cf9e43596806765b619c4e4bddd2ecbf95361d82792322a1957f72ac3c336deea16e9fd7571e549b899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dbb999ed5724c897ab7697da68354a7

SHA1
d9fdc37a70a75e5a60d5267557a967c6bd9f873a

SHA256
0fef06b659432402bd63060a265c633c117ac1cc0844e9a0d28738fca69ed1f9

SHA512
96e1d1aaaf7068cd1cf3b85f7565cb519bc02acaaea59e8152f618fcfccd157e3c14c2f37e4f1f00395ef50208dd2e951db969da1d98ff5e228570c1ad6f4d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e1ada7381a7d7fd4bd625a3c980eda2

SHA1
6530d34481a2a746eab7ed7837ecf489bf8e286f

SHA256
ba53a3d4ba508a741ca04c67b1accb9ade9267c7734bb6f5028a588b6a09f1ac

SHA512
6f505ed6c375430bf89081ff8bf967cb777a000878b2804fef756bd6f9111f3ee7b12501996d7299993852aa0ec0a396628b56cefee3a3699695ad35e99ac6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6dbce6de3f87f3259294e713d32616c

SHA1
0cb9ae96c05440f05f598c16c64dfe4066620110

SHA256
d47961d09bdfa0e1b663a9b48e9c00f24e6559193f2efacea6f3000185fecc84

SHA512
2cd17574ffcebd06cf9dd4e368d85aeb055ae48a09857acebe56b8a0b649284ce89cd28631165df85e97901d05d22aa85307801d6c87e7ce3957b144d80d0400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f711fa9a4544143ce040cc22124c0342

SHA1
3234e248df4a8ae8efc6641636ef86f8db767f57

SHA256
b90235ceb01fbf5aa367c357bbf93084ac03612e0b6ff213785bfb47f93e0bb9

SHA512
53f89ad04d03c06fcc1734797d62de505c6754e61e2d72cacee59a02c26144a542d56fbe6f9adfd6010bc0c254a0c090ace4c5e6362bd0b37fd1cccd7fb9ed75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
340726843f1efcf4f0d6ba2b96ef4504

SHA1
742e6ae45ed7038e1d1b7c0b32a7fecd05eebc8b

SHA256
86f84c70f894612712172386e7c9fbc905ee2f0270ac6b0c11dd5310b7d7419a

SHA512
c25591d8b3f0a306ba1bc1ed9a248cfd09788804eb3180e3af6934bbabe1c30574dd9bfd9fdee5e8d82564aa94a0c68bfc32adbe263c1d94c1393ac594620a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee5e8769c1c07ef2897a04872e4af068

SHA1
e13d1be8399a125b1cbed4476e64a87436e0ab35

SHA256
d2c26d04292c5b22381761e1e9199e6c0262a0b9494a57b00de2cb355de37526

SHA512
8ab98a1cbafbc96a6ccc9c315ce89c61fffe016848e3ef5536b3c98f4e94a2a0e5e421978d9ebea3c28ef318abc03783f09d82b65abf9979babe1f3540b3dcd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1fade3454b9a59cd254ab2682207c1c

SHA1
2cb59e2b14571e36ba56aedde2b55ce13c047e0b

SHA256
c827cb7dd11864fd07c2e830ba750269d3f8e5aca1d49e68faf6060ac48e10dd

SHA512
26812b07ae512a70714406066f19c2ef4efa7fbbbb94bbbebe573609c1f15a9b03ddf4e967335669122e6f307bf708a6a2560bd6a0cbc7ff3d464d0c5af1a7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10e9e26bbaaedf650bb270af190ce42f

SHA1
cd3e9c703d0eb22c253a34acb7959d8a1de7668b

SHA256
a6231cd9531335e6429c228b6709f2dea902e713c179cf1d1f4b6b73d58de085

SHA512
82bc77b64d7ee4c66f9a5f7b2c8cebbdb45671ed35fb9d1aa7eea688818f104b55ab99e11f8acf021f02407100dcb76c7bdd4f5f95a93bf5206396fb4c3ed1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
513fe33d23e855f161e5f143da4ccf79

SHA1
b60e48af52b47d9cb3b9e66824524529d56bcb45

SHA256
f5e189b2fb9dc4108eb78c8f62990ee09509193e5b9a7fcae5cd4341eb801fb4

SHA512
76b3927a4f2ef760d71444182b230182b36d67d9c9bcb9839ea34d224401b329fa51441fed52c0d0203d9ba266ad876b4d0a96866e7591b2cf546024b7e8cbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c93c82d866e6e7dc1ef1bf8b4a342de1

SHA1
c9e26ad9a67a8cd3a187361bfa68cf356e2aeffe

SHA256
30376b1b587a0c068a23ae9f3b94683f97049a99fe376375ef4f10f96b85d543

SHA512
4035fbc7757dcb102732b76449a97e439b08f5c62361d8f87226e54fb7aa50bc45b6a6cb27cacaa6f9cb224d770ed6151e95c0db730345176937461f9142a90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8e5331c68e5e7fac2f043ab4771b980

SHA1
9bbd0e4e423a3ac7131bf839adff8e842ef560bf

SHA256
0e4d818ceed487c52be8c83dce49335aed48595c6ea5b71b85b86bc674bbd27d

SHA512
0bfc0288d7b50d9223632089bab007b2e69d45c3a2e74e3832d7d48ac7fae7e42729fa3e8df6bd88fe95e598be9ca8ae923ac174959fe70dcf3a71332152af60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7882755834c10ef82f7b68e563015fa

SHA1
8a12dad87b0581d88347907f2c5c4c577802af9f

SHA256
290c81c24f2891da16c68f99b334654bf98ee73f0ac07f68b76f9942238e9103

SHA512
977a6f9d125b8bba74429942918a7766f8de94b40f78fff73d92bf8c159aa008d238226bbd610f96a92729c94ad2e0dac065d7a2f382ab9accd18b8a2b9100de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50D1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5210.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit