19713654902b8e2c2f66188942ed85ca7a4a4b03ef174e7bcc2973eed7e8d2be

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cad176be93d6fae4fc646160e57861c_JaffaCakes118.html
Size

28KB
MD5

2cad176be93d6fae4fc646160e57861c
SHA1

1f66a01f177de2d4d1ad98313d684dc4894720e1
SHA256

19713654902b8e2c2f66188942ed85ca7a4a4b03ef174e7bcc2973eed7e8d2be
SHA512

116b53db53547b0ffe11c1e86e1ec48e92f8cb1dcf5922cb2fd9c4f51a35a3d926eccf84440991f7f5480ae0b48dfe077dc33534be8aacc60350288ca227e09a
SSDEEP

192:uwjgb5nZ+D0nQjxn5Q/lnQiegNnznQOkEntnjnQTbnRnQ9eG9am649WSvHQl7MBI:dQ/9nA0WSOSI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000d68e5895b0247a4c0a8a690163eec1759d6fca4f1150d63f322efc1063ee7c4000000000e8000000002000020000000b241d407598a60a1c1a9a997aa7b2874221ec22165257941317ffdb204c6c2df9000000068bb4807868b446284d43b2d46f220fcb6700c3194e53908b64dac07e666084dc0e6b2f069de0d322ddd4a2862b161c181e62ca8ba6f058357c2c914458be0e978aa40b72cdd80723b989941ddd7824cf82407cd04ad31300fbfcf27b6a755aa9b3dd9b72b15784a1e152422beb1a713bddc5a7e8f8d0c426d4ccbe1a02f24a30b1daf5e491a5744e08502abc35e68964000000052c5b9a83ddb44b7c60890be28ce9ac3bf5c6192863282bc0b6b746c4260ac5ba7b80ac73bec08202e51dae665dd856280f417d6d3ccf16532c9c864efe5c296	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000df05016e86c8fa196f5d4128cedb91a8d2a4d2c4150a76e4d22dbe37044efcd2000000000e8000000002000020000000cb6f757ae42b2abb36530613a506be3107fee057dc30a461a380acd27aee88ff200000007435b32147105a1967bcc22156207544afbbc60cdba0ade70c4a76cd9012fb0840000000b57eefab032e33327b123b63b45620355ce113b13d043290abfd1fdab152ffad74e6d1db753d07db0d09918b10fede184a227bb24cd2ef6aad69e8519c05cbc7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d0007979a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3DF3591-0E6C-11EF-A336-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421466393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2908	2248	iexplore.exe	28
PID 2248 wrote to memory of 2908	2248	iexplore.exe	28
PID 2248 wrote to memory of 2908	2248	iexplore.exe	28
PID 2248 wrote to memory of 2908	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cad176be93d6fae4fc646160e57861c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d412fba17fea4dab7e49436502fb128

SHA1
1c5653d9f726f8a88d1c36e17f9926cafca59868

SHA256
80430559e7234f34cbc26f4958fa58a94fedfe8b65e52bf03ff53eabd1c2671e

SHA512
43a5c159c71705da8916a536fa21454971a9076c0cc40269c3f8a7a7db24fcbff1f4fbfbe076f3897d006ebc21c53b4ccd458433e9464e61da3a5b407bc4840b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6e7ced2bac8936a75c373ed6152cdcc

SHA1
f58cab7f7fc6e74437b1c5fe1903d3cb1e402e82

SHA256
3d07b8561a48d95f0b0407ef7c01bfc8bea24ccce5ac0581c942e970149cf0a2

SHA512
59a7dcaf10802887c1a9dc0e0913da9a774c066d43d09562a9819675a21232a549e8a0706f8f284e6ab1c42be656a63cdc5c7414a63a1119a24649b21e78bb19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4601103b02c7d9b02164d838800c36b7

SHA1
b50e4b89d1876c866eeaba6c998c00d8f01981b4

SHA256
71f667dc6d617dac594b671aa39b9fc9de0eb95c2e89a972c7a7280d306ac964

SHA512
a629e47b7f668502e51edd2343caf4b1801d171537d5eab124ca5aa0d5f7e02efc481016b1fed93bda38406323324440275a2f5da93eff80ad62f6b38e66ad63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4289c42c87e36745ac5b7981aedc1289

SHA1
686f9d2921c222f65f17fa16d28d5cb1738defd0

SHA256
5dc35618110bbdf344b33685cd28d19a209d2028f1bb3daa39ddf9a8b187bb57

SHA512
77e967dbf96bd3a816fbe360972bbb264aec7e25324dbcbf649884e4eef718cff0dcccbda71064ac84e8e7880fd95758756739aadb4b269de26971be30d1569f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4947818ee76c5f0c6fd32909cc7c732c

SHA1
af2df5543269739db86263419f6bbbb4400794da

SHA256
b2be888bbd2f2b3d6bbc126d91d3d1e9f976e317980757e8379f1bdef8a33b2e

SHA512
072165bd8ac5998596e6d87ff05ba883a7fc9cd6576f94b1a18bc7a394a53f2c03464e602dec465e32387298f448032f2cd12b937285a801337039b645234af6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bf7bbe5299e276c063acc7d2ada316a

SHA1
8b08fc98e1005fb7b1200f3e9a28d28f4de0845a

SHA256
c37a66298f4a619c90d783055f58ef50362c7503442361e36ad60a8cebf77db9

SHA512
5da2380790d6c1e1b36e56e01cd341415cd4540cbce0d096f0bcbd49bcede2847d32e4cafa4530fd558845f4081e9ea2d0dd81faa745c0dabe932434f22b1a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7f8994ba59aa06dff1936d8b93cef6d

SHA1
bf15cc9ccb3b3696c9a89600fa14aefc40858cfc

SHA256
35351bc0751d8a091dc9f44b48055c55773b8c3fd3036cd404c0f78f14836018

SHA512
f4f23725840fdd67d07418723d54d0430ca26653d6cd9c63971654a2fd4f28657b9a3b4d9b559d25450d44d04b47a07f68164d92aca3c7012e4f06237f71b5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e24f8f85bf78b0734811be0727b085f1

SHA1
327e08a7ac077596a2601d155f5ab84e8c743409

SHA256
cf93a4a44eefd857cb07466b8327f7c30bc012752236882e4cc6ded5a9a5d07a

SHA512
c7e83ddc3b49b6f1259809b37e794d3824bdb2ab85fdc4dd5dcfdfeb636da19c7dbe41adff9aa56ffd9d60a22a6d87686ef9addacf488becf2ae38f73d5e9601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59cedbb6f6b32100d1c3cc38a350c6de

SHA1
c79538cb42414f193116e1ce383bbd8c614fb51e

SHA256
9f5945ab0c05c88f09fbbb0e1d4a65bf7cdf5e1a62b8e07962b5182bdf2bb03d

SHA512
849f781219ae35955b8f464553e3a876f51467c5a303e4b504af76795992b03c56152a01113dfaa81b4caa0aeb6d01f4c53e3e571e50bc0f23c4ffdd6110717a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A10.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B5F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit