89297497b3b49d9d456f5a460392c0b8926dfc7f517e81d091c752d760f9fe52

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29909ed92f23210168059aff98835503_JaffaCakes118.html
Size

73KB
MD5

29909ed92f23210168059aff98835503
SHA1

78a36bad316b7971884524ee1264dfd141e0c75a
SHA256

89297497b3b49d9d456f5a460392c0b8926dfc7f517e81d091c752d760f9fe52
SHA512

48135c11bbc02ea8b4406bd53bf9f2ab97e4c5bdab19b2da423cd43c9844e98c7fce3b1977ecbfbff2916d61c3c62a5c8bcdee990381d28062c551b6bd8b3cdd
SSDEEP

1536:5HxDEe/t+tdjIKmzJrddCFnw6VE5xEUrNEouT5mCvJfF/vzefxkAepDCt3Xalk61:rDJt+tdI1CvpF/vkxk3DCt3XalV1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000333d11ffce05c07d32696d3c0739d649e4cf452b297b196845ac076c40e7bec9000000000e8000000002000020000000577af68e1b8920c6f75521a0893306ea75498fd0bd2384736ce8d669040ee3d62000000097e070b76055d54ca7fed2af564a333ea516c83eb1bab3ae396f6338f24791bd400000005a49c29880441f85a72ce59c174ccf687312b70575e2ddbe513025042b8f164b7c8478601bba774b298c018ee1d820f212055f69df61d5cfbafb151229aa1f9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85606571-0DF0-11EF-B04F-52AF0AAB4D51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421413082"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005f68c41ebe5d17642b7e04ada28ac4e7ac172800442cfe541445f89809af6ded000000000e80000000020000200000008785b7402181c62f3840765f7564a07b72ce0d3cc2bf025a61fb0c16e7b82abb900000005042f6f5580ce26d1957590e813bbd7f28280e745ab438469d3bdd9b174718561dd7b19ca6d03be915b8721027b021ad29b25de2b0c6b52109dd65cf853acbbc00437d51f0e54801d596701e3e438cf566571d45af1ffb30126db0d6eddb11626a2b568bcb3f00bf77b380787e13e7aec69688e297d8d29c2d1107a07ac02402002353c28e9c3ad69fe4ccee9439da3e4000000024672b44980b8f55344761fa1f00ce022e3ab48d11e836ddd8a8bbd969abf7e4a3db0b7346d89a1981c2d8aac46ee927981b40d165fc863ecf847aadc98f28a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a6c774fda1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1944	1976	iexplore.exe	28
PID 1976 wrote to memory of 1944	1976	iexplore.exe	28
PID 1976 wrote to memory of 1944	1976	iexplore.exe	28
PID 1976 wrote to memory of 1944	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29909ed92f23210168059aff98835503_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae260b5219df707aa191a554a4cd3cbd

SHA1
a4783d371c16338db6a072144a6264cc03339e59

SHA256
6015fde2c36939f627dbe80a8bdd002a3352a022441c98cf84f0695afe464891

SHA512
7d2ae0134bb4a21dc479ac089125672b2878d1e280b81e03e15ecbf75970e2ffdb1d08f9cfe772830be4681ee5e8299e68fa7bb0ca1cae589bbda2134c85f2ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd91cdea205f7d7cdc2190c45fa7b988

SHA1
4b2f52bef7f1674996d66ae8797dc18b41153609

SHA256
d8f3609432d83b9af9246ac9d008421c93b0941a7761eaa70dc1d2593e3b3dde

SHA512
5833f1a44e90acb48c36626752b1c0700143ff0abf15c279ae6cb18a2d6825294a28f9a4d2a46e38f8fb7bad46f6c1cd06d03658c87d55e97771767ed9c4c87a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e3b7a034104c4a395606ed6f16a52d2

SHA1
da8b0f7c58a1863a678076553b89e90df837f08b

SHA256
0422143ca6c1265b1106de9fbc053165376756b247dcd0f1ffb7f0f1f9087b11

SHA512
18b5e921fecef03ac58a58603b60fa4491cea79d6f965295ee8ed7f811313b5fede8ae9424f955ef59c2a3bcac9c473322129a666f5858b8fd581d5746186365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e4b95307fd9f09fa991237063caf7d

SHA1
55fb0e50b2580a25bf8800480ee01425cdb029cc

SHA256
1957e2673263e2bcd9eb435c81c52aabf91c446efe7a9b5d216b53b9893976e5

SHA512
8c555a4424e09de188522f1451ddceea5e0aa3e93242dc5163dc9742f5873330bfeaea83e846fe262fc7cdb0acbebabbb1d64b9ac870f8374461a1e2635f4488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a37ef1d0c643c72b70f99a11f2ca826

SHA1
d5d4048e8aaf46b6e5de1a3e22585160bbda9518

SHA256
be96e2666ba81fe98fb53c9a7ad6e0418db2aaafcfe73fea556d2005df82bc2f

SHA512
53a6df0f908fb23847f7059369576ed7da71a72ccb2a8b21692726c6f919d4fd9314cfb008112ee07d13947557bf18b07aa8327012a6f6bf034b99465800e346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d06b520ba8b85c3fdf6534b1683d8f02

SHA1
5c51b1f0511b350061036f6ae938089857ac64b6

SHA256
4a1b710165e4a31740c2defdc15568a2682bc29cafe6448fb0aa6d119088f647

SHA512
c022c841057b8235989805b9d5fdc30c454b40f5d0b5e3add55bf100194db839b9a25257fee32928136e416d4729d0f67499021f2edaadfacf15b952d50779e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f55455cdd0ae69463fe32987026324b

SHA1
86b8cc92f3081ae64e64e0db38a51a0ea8c35111

SHA256
db78d426c09d02fc6ac262d9444f0d3f0b30437f9d46380d57a20a9e6c8a1047

SHA512
d912f4cba952a61c57f9258f5609b4942c5ddf25791a2ccd75a126519e644785c4e8eeb9af413bc459cb0cace850d5d2a001d8e867ec9acbaba14746b618edbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d7762b95ee45e926330a45ebe6caad

SHA1
7c6c022ea7f47e0c540ed47986b59fe4f4462023

SHA256
39f88638e12b81d22321642f1eb47ce221401308172ba82fb1593952bc8f58e0

SHA512
9fd4de6dbfd2dfbabfa91d29ed304346a54948bc34b14a52f7dbcf37cd29b4a70768c29203bb59ced92caf7e00bb5cdf2336d6b010fd6254f7f4fe301ed113c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a08ff42cae7752a9ff661ba42161813

SHA1
2641187b9e4501fe4dda4c986666a3e11a4db48c

SHA256
abc439729fecd1a08d2e5c303e12956fdf5adc9592bc4b8615a3893efddc472d

SHA512
8cbaa5d22ffa659bc14789562f96917c876b4e98816e73fb6547133e9312f6747668c915596c3fb92369d0dbd7519b0415aa5cba86077e9eab52def50bb086ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cb03fcd3ef03f5c09e53a52a35abdc0

SHA1
41e9322079995ce0aa25c345ee6e6082f43eee6d

SHA256
855f2fab9468684fbbeb70c5d2880b50ef01ef7a16b3c8d179dbe2a293fe216a

SHA512
ee275af9a915daba5ca7535b6c47f2321478ae4b99e363df9df65865740a99d9e1ae6ab2a40d24a7c52aac8ab358f5b69b158231e0ebb73a90a0ae7e7da9984a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9750200cf8c16675fa87fe595f777f7

SHA1
c61daaf5039c29f2791026502d987a864f29721b

SHA256
a4ed052584f12bda58b66bd5dc9ca03675fb7acdafb785e9df683d52e5549f50

SHA512
9fdf2c5c6817baf05e83f48a999436577a99ae81a86550d30c7682ed84e94a6b7b394ad0bb5e94de72566028768b01e6e2bc36ac2f900867b86a84d8ccd592d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8c38d1bd1771743a67c0bddc71bf24

SHA1
bfeb282ea213c1fa9763f9509ac8613a283761ba

SHA256
512be4a9459331d1e696a1f4fc24a07ab19ccae856a308c157df8bd9706ee161

SHA512
12c93490ab9d52b8ca99cf845297ce77c18753d87e22af486d83737ec30c663f1c5d47a8c994b2f8a1807ccc57477574a44a749963f63b0a77fd650887aca4df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE35F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3E0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit