487fb03bddf9cc22beda530ebf5cd3023794c27e530f065c3a5a9bd1315125db

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a0f2204edcbfd1a58d7b7798ff48524_JaffaCakes118.html
Size

27KB
MD5

2a0f2204edcbfd1a58d7b7798ff48524
SHA1

54bc6550b279131f2adfe923114e3159f9323728
SHA256

487fb03bddf9cc22beda530ebf5cd3023794c27e530f065c3a5a9bd1315125db
SHA512

303b271479800e8805babe05cba8bd123018e6e7d168806c7f00e3b1bf2baae7b11cfc5f550e68a30d66b325d6ff3543f4d2fd5f1c629f5ea17d6e3be76ab444
SSDEEP

192:uwXwb5nE+nQjxn5Q/bnQieSNnvnQOkEntpBnQTbnhnQ9ekWm6uNKAQl7MByqnYnH:VQ/xJ+UKjSEN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000648a0828b0f0f1c3282efa929c374583ca3e85eeb98134bd362ab034c31fa4d8000000000e8000000002000020000000d317c87f35b2f994720a7e9ebddd9fad5d3dc5844f4f3296ab43c719802dfa4c90000000b4688343f2e433579e8e4c3c26002ee641ab7817d7292bb28c8ba2f472aba38fb02c30ccb9e1ca33baf5bf18c7d9ce2cb2dca44feff3773855e17256304415e2503c12c0f8c4a88f871450b0bbe4879b59b1ea1b705f33fdae4fafb238f30931f649cf7283316b46970c05be88cea0d686b9d0f7ba6506b4aa30cef255bdc244d2c1a8a51b6fde5787e287f7e42346f840000000e859c87330cd5b5bbead8f62ba658702437a47e7fa38a7ef32b94563a3598bab0acd677879ebb9a4d7ca7cb4999e69abbd4c50c2d7fcc72ec09653bcbfcd3424	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b4804510a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421421209"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70DAFFD1-0E03-11EF-90CD-4A18CE615B84} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000087c0c454d304bb8f892a81313427faa76d016b2a3c9adab5c256e4b8de5acc46000000000e800000000200002000000089d1249f2285d080ea15963274d2dd7822b005bc29ced22bd28e82c5cde4bb23200000009118d8d8b3024debad28515f0aedc17bb7e979df5fd2666cb073314472095e5240000000223e305e4aa0351c5af9515a86c0138abd173b361b7a2e4832ae2ccfb5dc3541e7cd7fcbaf754c76ada0b995fa160162e1e282a7e0853686dd1b29d82510e92e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3040	1916	iexplore.exe	28
PID 1916 wrote to memory of 3040	1916	iexplore.exe	28
PID 1916 wrote to memory of 3040	1916	iexplore.exe	28
PID 1916 wrote to memory of 3040	1916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a0f2204edcbfd1a58d7b7798ff48524_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37eba67f114ecb63226bcfa476f8bb69

SHA1
5be2ce081d48462ef340d8fa965c5d5949f0fd10

SHA256
f73e5761e07651277de20af813f8201c773e026d825312da314b82d00ed6f5e6

SHA512
a7c8b7754017362eaafa378f01b8535512c6d4f905c0d8a3948f646b797d5d19da8c7bac0ebcc2a7e90cbe1bb7739e77efcaa4b0663e8f66ad53f1cf993fbb37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505addaa6145c9e1c5c91f7395e9af70

SHA1
9f44b06b5d2f02fdfbce88572ddd5c517bc5e044

SHA256
a6d56adc8265581174930424d1f219b5bc7a8a008d54d603a8327b4fa995d203

SHA512
7cbceb7d8350a0ac271782cd8c67663de8b7348b31639019bf977531d8f3eb183fb981b1e0502bc9827bbabc7376f548df2d63455cd0a3250cf95468b2551b8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae6aef4c27f73c5bcb2c218fac66951a

SHA1
01bd5edaf70815e6370c85e73ee46c85605e059e

SHA256
6bb809b824f0c258e9364d5e691773deeba61d6d21197ad87800bcc3d7ce4aa2

SHA512
50fd75df06b0e95cdf6a9d4fc2a4d36711dcb5c8f270f58b6023b31ccc8ec53b2a12586cddd172d3752588f29c5100b07ae97ff36f4ed143d0e1c3fc8906314e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9acdaa5063d80de3a80b559b43373585

SHA1
1d2f27e8e77414e81341cfaa7519169b6b3b8be2

SHA256
e8d635486c9109f740f4e38134e1c2105a870fd14cc30afc0fe2d02cde1f1c3e

SHA512
929c4a2a82cb00af552f9dcc0296d8b9095cb4f22da662b85978bc7dcf644e7ce75c8e9b741c47b13cfd6021c658295408517f56a51e3be97cf4cde3cf2e3137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3059f2c3c4b5bb94ecac0981d51260b0

SHA1
da9f0d21b3604218cd5044be70ae4c575a43691d

SHA256
6decaf88ef23d050413ad021b922ed175126941d50c4e3e54f13d1e1681e1664

SHA512
3170b8deffdf9a544218ce8e7be853caa3ba821fa9c5e018934d3bb67f65e6282acc9154799abeab3cd4cd167b29cea487951799029b5f4e594f2f398f8ab586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61657714de477375b4bd4cb26b1cab9a

SHA1
5f8fcd611d2582f8322f877a87628692291215ed

SHA256
11fc611000494dafe209fc342a5e3b7e7069c4d31774a9238b1b6822adff5833

SHA512
163ae998b4a45398f6d661503dff86d89b6908704d865df6055f35601f78021465c2848a835866ff3c73da4e27769de95031f19b4a74b96af9fa90e915c3643e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50392a021ff81510afceaddf6b2889f

SHA1
ff083a93754639953e26c7183cb7b2e749eaaced

SHA256
1c77f702aef75c5ac3f410f0ec6783c5ac82742b8b6c242d59c0c5f835ed4492

SHA512
9f0eaa635c3a53a46af42b5320b73b560e104cabf0df4fa03696b1e06b06d59c98b444274d21f61ec801495e08c75ff44860bae8ee710b8fbab9888c33827e95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99d55cedbe1cf28611f5508443b6de5a

SHA1
bd484eabb2405ee5fe881445127b9e3a11f20cb1

SHA256
4427450bd236330571e55e0368afba3839d5632ca69197f17ca4577225a15105

SHA512
4b706e2042800b4b6c965dd553b7346f4eb5dd13506195f84353c5e33a36a6af936090ddc34f37884d6f44bf6ed202edc6d437a51a2f667554c75a5aaa59dcac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a40ca0524e7cf2e7a7183d38737ac6

SHA1
97427bd220d3a873f65a11507827216ec585820b

SHA256
560ead56151ba178776ab33dbdfdd4038856de3bf8c3ec5dc63571007b27c4ad

SHA512
388ef8e093b0c7afa36e677cb9ffff39eb5c3b6a04cdce4e4cded1e406e9fc57a662689f54aafc35202e6cf750636d713180d8ba83aaa12cfb8f610daa028197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca23f6acfd831538d407209f7beb0906

SHA1
90c8b7f1fcba07c477c207fa0231871c8be3f80c

SHA256
2a83aa88becc27ecce47459df8db560b32eddbd167f8f43e9b923d6f2bb096ad

SHA512
23e4211d8aca531d4e4113b8b5505de6e2fb176d9789d19ea53cff7aaec019a74ce264835b493a411c788f8da35d8c7ca4f7ae11d34d602741464ecb9d69ecf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
401fd08339050ccdb09197bd051766d3

SHA1
37b7e5ab215d7cc6fd80efe198e2f83c98bfb7cf

SHA256
4ca0baec124daac8bca19b113fc1480c2c3fb0bc597bc2bf3b13e2da83cd51d7

SHA512
761290a254265cc082057395d926154ce43830b28986a1dcc017907aba348701e39cd524d3595fb8562f0bdc8fa5fa2e0b1ab7af94c78ece385e124299417575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c7870b1fb02e7ac3951b40e2809be8

SHA1
46e37044a499edd011d09b3f3d74a6b8604d717f

SHA256
88aadb2d4a81fb1dab7a594cf89bd33155ff01f84e5aab73fba32de0dabd7a8e

SHA512
efd541c308135cff0a47d5e560285918ec698ff134870cd7f039f87ac8e510c8f531762c27aa71bd245f3376548e97cd69a0ab3b73551dda940334b610adc817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d89bc686bde3c894134ff507a5575b1b

SHA1
426fbf3b0be6aef0b70a011c1a48c4842518f8e7

SHA256
e9eb8b8ee0dc8b70f1e205cb8e7c808ce5d964311bc4576f529bc559fcd4493e

SHA512
329ec5aefafb0c5dd5411c70fb2611ded194fc867c51f4cb133d761d3a6c874fe5b243fddb589507a843ca3b2a95699a78b6ec220e5a8efd82cda14c59d413d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
536c0e710b4b8a1798dcae5b034e77ac

SHA1
06043233c10b212d9af70a0c7ff65d80e3a946f3

SHA256
5d6125e9ca1639a9035a90708c78d450491e3c38d737e1f82bf9bc45d8229904

SHA512
60e957152a1ad373a28c756407a0d6679d297ec875db7a5d1181cbf70417aac8053cb22496d35fe3d8ea7f6a1a46490c917aa0daf773fad10e10c30c9c66a9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22BF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2320.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit