dc20d8d5a30181e41614367384fd2b57e0c2684bc1d67e1d96e8f29044d8ddcb

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28bbbdb0d9edcc1b090b61cc71ee9110_JaffaCakes118.html
Size

67KB
MD5

28bbbdb0d9edcc1b090b61cc71ee9110
SHA1

977a11a30cd30db2e5481af741f70aeb2fab17ce
SHA256

dc20d8d5a30181e41614367384fd2b57e0c2684bc1d67e1d96e8f29044d8ddcb
SHA512

7bf0d80b2a0e93aca290998fb00297c8dd8d67fa346e208fe8a569a773187f6b6c8e77ac951f2686921f93ac718538f7444eedddfdbc2096ea1d5c68ce6f1210
SSDEEP

768:Ji0gcMiR3sI2PDDnX0g6X7xdmOTxoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JQ8/mOTGTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22FEF8F1-0DCE-11EF-80DF-F60046394256} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e036348b5c1892f92ed8d9dc5b9c6d84eaeb1affd8eda1d87d8eef4896b41a10000000000e80000000020000200000000fec00f32f1d5e530fa3cd6158f9f03a1e934f40fa0094f031a8fd8828b1224c90000000efac36b23233c16a002de0bf838b5e85f5a637a9e8f48dd6ad08c86a3a788bab1e01bad68653533fbe2170c902a11f9545bb3fc85fce1eac400f1dcb376c1af48aff40ebba07b24465e409dfaa97cb4f6cd4d9f9d398585966bdc8f6166bd2e549f0ba0ce11c0116a95a63407497be61918755442a44c569bad9d3b2c24cdfea10597f9b52938dc19c4c779b360315d340000000fc517149fbab85cc30ceff2c9a380b95863db1dd097360e1f5518eaa08e8815c341de9b530ae81d6fd8dca01fc40c670b7dcf98a495366ede79e78d3ad84968d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009af05ae7c4949be1cb5dfb912fbff97317bb48f772b041076b4c637b8e0d872b000000000e8000000002000020000000c8efdf64dc77dfa2bd07a8794a1b60ff043477b6549f4efa9b4356181b1db71d2000000030872e7dbef7b3b728ddb36bc6b2313006df07541d3a1c3b77097a9e766b564040000000b224919b687643c1268f377edfc70a0ba185c8a898dd5330a1e300b683546ddd3109e56403a693fb7293437692d1b8eb55677d157adfff3b9dce8ce7038f2091	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09597f7daa1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421398315"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1564	2896	iexplore.exe	28
PID 2896 wrote to memory of 1564	2896	iexplore.exe	28
PID 2896 wrote to memory of 1564	2896	iexplore.exe	28
PID 2896 wrote to memory of 1564	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28bbbdb0d9edcc1b090b61cc71ee9110_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb9e5e1c92be73b2a2b700c996d3a2c7

SHA1
9cf811579cc8bde0b34dd72f0da444017ea6cea8

SHA256
54dcef29d91f33a6f148befe9cf849b64d040958a796261f95af0f835d7350a0

SHA512
7cd4f4b939117ade1ec39911a72d20da91291a54ad28f9365ca545ec2674c3eecd1091b132d24519258f112a6010a8035095918e91806d88597b3f5ffcdb0fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fe405a4049a54ef40146804edb13238

SHA1
11db924bb475cacf323cf070330b520e82b1f95a

SHA256
97d7eca9fd667a79a424b0da7dacbe10d57efc70ad64d774789ebac659957b13

SHA512
b0ac42fac6150df708f6544b1bb51583eded1afa66df5e838d34c167d6492ad1e6801a07a980540ade3450f2e84c35dfdae53e0b6ef15379f142e7411dd867dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f4a812880036ab850b0f614fd3c77d

SHA1
d9c5c14c3713a82a94c853b119d096faac5a7b0b

SHA256
76430d99785b79c171e3b13a000e9a3116f800a160a71b418b1141d9a43fa2c7

SHA512
3137330a3dc90a4bda568873beed32e4cc9e1dbb5a9f7c559ab1e1f50dcae70f87626e07488c60bc761ed7fbd7efde29aef800ed00c91d6d0f21a3b712490746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf1d6320031dd724c47e37a493e54f8b

SHA1
94af22031feefe007b66fcd30a3703c9c8f98b4d

SHA256
cc664aeca2455f88c9034ec18300dde6e8e8224e13ce63b9d76d24133a5fa048

SHA512
b4c596e9491611c3c968a5a86d5fa80aa0d3fd969fb78da7353a065f0cf4c1541ee63d38001180889c430b27cc642b21c59ed9749f8d194b32508b73618d01bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
060b08dbe108a4a2d75c443aa0abacd7

SHA1
94ed1d4c8a5d7f1f578a3ca59b6bde71f641490d

SHA256
9ac3db46677de6dbb7cddb397814c529c25eadb12782affdf239248514af5a26

SHA512
4ec15452a89329ac31bd3e82c1f37b2f296d09fd867727e6505486826a3b93111e2044ee7f59242c1726c7816622edf08af4d067649f02c4cff795e5dfe642a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a1c5b94b9e5046056ad1b6e8800909

SHA1
2c592e7fc7e77cbb21e03807c3e5c3116e4aab71

SHA256
fe4bb4dabf05167a6fb1e82dae13c118d6954a70f9891071d386299d244b6b32

SHA512
2a2bb40a253ad4dd7d8467d37cfd4c93223f920388e1e6a872ed652c6dced322857a74edd72477fe091ee808772543ae31492bb893b34b43bd2ca5f390d331f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99cf53c3f2c554373e35c0003f27022c

SHA1
ce2022dc7d09fec065edf8e4afc5a8d825626eb5

SHA256
d29570120de75d5502afde1ac880376a2e1274b59a1a9e41adde27d0abc54c92

SHA512
eb59d17c8cca740aa44fcff87241ca4948badbbef8a86222f5ad440776dbe453248aaf5fc0f3719a724757d701498a1e74e6e1c058a261a6e1b54ef2a05c64a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f42a91b85788976947028a10acc5f76

SHA1
b3f2f28c8b90ee1358efb8f3ccdeeb8264b07ab3

SHA256
f51805ce9a3428893fda4615e43140d9a4fe2431460df6b96fb504f3c42cda64

SHA512
96164fefa490386e0ae286fa0669f5244ff6b170151260317b925430fa215f0a7ee5db5f43deea36e6d2263aea2e7bf0d2e2638a188c46b2589222a30d9f391a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7987ae996b3719c42a29d1155218a7f

SHA1
5eec3100ba9432def76c7e728608cf6f5cefc390

SHA256
2d5412361cdfdfd09331dd7e25d8404ab06246486ccd35ee7a176aa263e7a49e

SHA512
fbc2ddc6c928edc844781aa26a9a481969096429d1fb629fa25207a7472597ce488fae94c694b437a4f1159f5615d2067b9ef2a37602dfcdad571974dce1bd6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5626106ef53a8607dd6843498ed0c11b

SHA1
f1510f27d6f0935fac70cc79e2f765150ac63cc3

SHA256
8265666ed1e2e8dc6eb9475fa389086296828f91547887bf528733385b1320bb

SHA512
0b338e30ee27c6e72ba8b243a03b452533455f8ceecc4e3910199a2a69b9c1595673d5fe68a94594fbf0ac1ae3134122ff7a96d77aa6fbed48f27231c6e23160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7bc816dacccc2235ccef49a380b892a

SHA1
3e790f225a715dbb7099889bacc0a8d8e1fae1a9

SHA256
3284b1da785c934549a8750b76e53c022f5a38de21108e05472e3ccc2d9cd11b

SHA512
c56ae300ca539998d5c5e14cc4e9e2fa93341909f01d5d876bd7be148ed5e1e4465a82d39141faec1291b1027e5d785a266a1008d7c908d4a309f0354bdb4073

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3343.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3434.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit