9e52561402c236f4bf554c6cd452b1a68d198644312f598d21b1ea07d36e031c

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2591d1d776b534c7142137121b087616_JaffaCakes118.html
Size

73KB
MD5

2591d1d776b534c7142137121b087616
SHA1

854869d8d91c10846fc1ecff22dd27cfa9f33065
SHA256

9e52561402c236f4bf554c6cd452b1a68d198644312f598d21b1ea07d36e031c
SHA512

f080b6112a68ab709c71ae41ace84f54145b84d73ca89331374c8046f2f1ed2262d0e2a61d3e18fc0a2740c324c7dfb0d642c3bd12cfd3b52d1d0704628c5a4f
SSDEEP

768:JiigcMiR3sI2PDDnX0g6sl6+O+SpoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JuY+TzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421345094"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e05a32b60640dcace31e4b6919b49314afd708b6e1b3b0bdbf2c0a21096e78e0000000000e800000000200002000000085e5bb86bc3a782b6be2ad59342a22796204c2a3984acd437254aab72ea0449190000000fe93d7209f211f552eda072970eff4e7fb2a08999098c47385b0f79a713f96f703463c15f94500f0cd558d4342769825d7335f5a8866d5d3d520fc401e40ddfba52d813bfc2b9a469405107512fc6b37e44dc54634b103f370a215a7a3c72b4990c0556d0c6cbcbe2c37aa69e5cc00aaa3d6836af68e0c373a029978937cd93e9fa610966d76ecac3b5dc8a713195894400000006afdf77638f02ac629abe6d753fc0c5824852b351bd3192e8a7e5a732157096576ffa60e5f89d9e5a18fab402ceaca62c0738f490ea8ddb9ab37aa21eed3e79a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8091300e5fa1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000be9bb447ba03dad8c51fe02784f3b5c387e430ef737a19a5ade12dc74ecdd386000000000e8000000002000020000000cf4d22a2b3e1c9a472a5f679b4e96e720ba474a717c97008f99b609f5c26ebd320000000321afec56179f4e5846b308d05cde12419552eb478957281ed88ebca7ba8eeda40000000e5233d3951236a434f5ad1e8a0745aab9244e854f8a4e9004c4af8895234a068cdf6d194a262b02b8e4a29f4f219384aec2654970afd97ee7fd4446429cdce92	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{395EDBA1-0D52-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28
PID 2860 wrote to memory of 2484	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2591d1d776b534c7142137121b087616_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3fb5011bb7c930c613f51e974acb126

SHA1
43ff7871291cd5030a95c42edb325cca360c4053

SHA256
caf1c3a78c6acc1b17bd878992a5984d50a3ec8506051ee640445730373c2a37

SHA512
b338650411e6e6db9c9f7c461cdd58a461d5768b9ec0561ab0a7a1f79cfada3433f7005c5a95fbf2c5b036d01005cf01709e88efcf1695e938bfc683add3cb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c4077cc96e8f614524f25b1d489490

SHA1
9b27f528dc87192007ce48441919260cf636c601

SHA256
a3a9d405333d540b2360cb3d296a86083e1a735caaa96b34b03f5a19c7dc3e0e

SHA512
c1d5143b9e9a0538aecb0d0a2b42f646fdc06f3994d7e704f061183aa461c52655f059fcc858cdb3a96ef5d3dc956851a784bd89e1e1b90d13b2dae4f00655b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62b48fc4e7453e79d98a31c2d6213e1a

SHA1
0b0eb61c03df047078c0b91c9fe5f64f25c87368

SHA256
ac0ec296c9a3a91f6ba9dcd1893972a6d211fef50b773cb75b7c1b45346747b6

SHA512
7f92eb79d92af58b817a552dcb86b283f8ead2e92c1bafd97d4d4162444b9a7234a55cf2ff6ed8ca93b0981d88203c92f54e6ca8d4fcc9aad822ef812085ff28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec9a79606633f83b56240a813920688d

SHA1
28ce9cda6e5a18a08408451ca11d6a43034b2b24

SHA256
cd1fe4f621492e21a93f4d7cd5980124e0140a75bd7f29df22c9b6a40f95949e

SHA512
0990575fb584603bf6369a2225949075461ed234c958ae99d5a2c8a183da54adb20e5149cd1239317dda5f012528efbd22a0cb76518285a7431a9868b27d4c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d43a25221cec5df600768a08681b7de

SHA1
f72aae84ec2b4fe7ef6bddd2a0080c8bae362cd2

SHA256
7bf46540c181edfe3831dfc6d46b3b2299521ad1511bc6256197aca814467693

SHA512
41deccabfeb1e706f5034fc8748989e041d96c4477254ab615d1d219590eacdce1e468f7d87d64ab666f7a9a3e06d9e7214af627b2519b38df7a80d47f80cd00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693e02244afa3755c46857d4ebffce81

SHA1
57eb430347bc3165279a5f18b0dbce6d8611dab7

SHA256
b21a998f12c5f59dd2a5cd2f7f1aead6e652a3d5a539ebf34d950a129564e83c

SHA512
a4433ffcff245d9b88631962609f6ea5cb547340dcd5b3f484ee7c3b2e14a1c6e0f47d182e514c5a9ff6788ba829a47b72f9e940dfb4b0f4c565b1027449368a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
798ede6eb38393e6026a6797e188a9ff

SHA1
0275add2eb33a45c518408bd398cacac1e6ec323

SHA256
a5bdc10d151f2e83642dbfd91b4100fafbb4c27aad16fe9cc672e3bd0409e657

SHA512
0e75c4dd7c09bc10cc6db42a92b52c7cf5e3a08674af5b92d48d104c23f98705dfcdffa9049217d74499245740e1042810d6ab33c1ec8a168384223a44369dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1616fd65c190e1606c930dec1aeeb4c5

SHA1
045652ce9d94e314cd1af50076d33943ec648f60

SHA256
0b056957f9ea95cacf0ef0a5501998600e92c7f37d2f142b4a30d650f0c57291

SHA512
268a62ca4ed3b3c92311c64691f4bf6d6dd788beca5b3c80424430d8308e09ba7e6768a423bbd8dbb5571dc8e091032c16124cce440ad765fc5793596a99e310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e9234a6f0c088930f85dca316162923

SHA1
8d2fd7d8f5c37e495e8f1c219bdb290c53150eed

SHA256
038520a121ee8229450eb38fc4fe0d9bb1e7d89d436e55db3cfd19ef47bc5984

SHA512
f068fe14b58f00feb5b10eb68f613db7c4c48980532249bbc145156cc688cc6d9bd514a45b125d1b6b774990a2923ce8854327d5e71e7f627e48b2ffda531587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11f18235d815c7233a89f2779e81c94

SHA1
6cc3b1cf40ef851d697c0782cc1cd750707e8892

SHA256
1419395ca090f626e4faf48581ea3981bb2f83d9c14c38feecb03d69d0bccfff

SHA512
baa5b67f4e1da62561d36492844be239d874ea1b29be0535e5e9c570125e3828c9a8d0e22c0de69eec2428b29fa70653b633d905512ab0a45a290146ba785102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CCE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E0D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit