16cff54bde2b1c014fab428f31e0ff1a0e66e504aa34598b038b36943e4dbaea

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cd98638d61b8a8b61710862abe85873_JaffaCakes118.html
Size

107KB
MD5

2cd98638d61b8a8b61710862abe85873
SHA1

d2148a3c4fcdd9ec36eb33ebaecca580bfa32ef0
SHA256

16cff54bde2b1c014fab428f31e0ff1a0e66e504aa34598b038b36943e4dbaea
SHA512

922ae957509e9164458e4895e4bd8c5547318684baa7d6fa30fb0b4587558c864e5394d5d08e173c2cfa58515d47dec38491a0a9d547f24d1f55750c413edd4a
SSDEEP

3072:Mkeiw0W5U+S7Ki/A74tRLLLlPpSLzL3Q5eyfEWRcFBjYZCCLtSgGADSrNfCQu4Zg:Mkeiw0W5U+S7Ki/A74tRfRB8H3Q5eyfR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000006b000593e73965414c4b24716dad835464fedc54cad4ce51efebe5c7c84aa56000000000e80000000020000200000001c6dd40dcc49b9a02fe567214bf96b633ec8e77d06671a170305a52df5027eb0200000005035ddedbede6106263ccf06875e57b5b8873d90c7d784613d4ee93fd51241dc400000000bf928020abbb42dfbd7559b78ceec1577cbfbcf4e09d9b72e54ce057bfd4f8518dc157c695ff75c546c8e86751343aab70956692b86201de7c24bc180f4560f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BF38C01-0E73-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109ba00080a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f85d357e9e3ba0d3f1356599ec924b068bec8d293f8c6b246e70ad002460af2d000000000e8000000002000020000000aab001e6281d6c0a07b97fe554ed1039f4712e8f34dd13ac25b9378d17906144900000009f386d6aaa6146c99e219e944aa5fe857ee0b17c94e933c626c20fe7cd77eb7961961ad6c30c50e8fe56437e0d128c80cb454f55f109f1d89febf0a0b8adcf97c2ec93b3e09089934fe5f1719154ecbf1f5fa0bb52c39c3ec023885b51708bb6a3ff985b9b9e2d7396518e18f310789647115913bd3f9b5a957fd2c55dfc751e3d4d4b33cb3c7ae0ece1440a3a26058240000000bcc13a0b4d6aad59a9dc9cd41e8528603cc63c04a999ee8d04204b28e64c77e519ddc482d429778ee428225fdae59a503e342fd96b64f622f23d0fd5b30edcca	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421469196"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1976	3028	iexplore.exe	28
PID 3028 wrote to memory of 1976	3028	iexplore.exe	28
PID 3028 wrote to memory of 1976	3028	iexplore.exe	28
PID 3028 wrote to memory of 1976	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cd98638d61b8a8b61710862abe85873_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f872950af0b9a4e6d35ba4099bb6137

SHA1
ebecfab1a874b46cf2ac38daa335129b2ee1f0bd

SHA256
9fcfc850acdcbc2bfa6dcea45c961c91d823cb57e149733fc69d8eb7c1961d1c

SHA512
d4f9d7f449d27fffd3592b8e8fb62aeb90160860a2572a5f54c29655df7027ed3ebd917315c9db80a8d675a26e70a6b188d866a09d5804ad6db189ece4e1cefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02de20038eabdde4d9f01fcca24c005e

SHA1
278c835e5b2a2a798335805e701677abf21a7089

SHA256
e94513c55069e2dc8b905bf346ca5d5976dd53b1237c8621f4c0db62b2fd41e7

SHA512
0083ec4e30859753950f1c18dad7943c89fcb09c4b7dc1d6580f932ec88a755beb79c6c2382c9012db7f20a8392baf81ba4dfe972d7092a24f434bfd32c3b3b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b324ef52906032be12397f897b190d2

SHA1
47995c524d3645a6ec981cfc9c69a2bdea6c97dd

SHA256
01e14415f5ae5f9ae167473d6092443c25352ac4f1cbf75c963ee152f1ffa70e

SHA512
26d3553a7c367646bf13d6265724cb516fed2ed08c66f28762442c7527d85af4b0e1a6369b5f67c2418d35aaee5e824a6db4b37d1229839889cffe6f4e40802f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81a7cd5f786dae72072424f16aee93b4

SHA1
8a212d68631e8701229554c7316ddd7884572204

SHA256
486eacc51b809812c508a1379c3a498a822f4421c32c00265bf49765580750c8

SHA512
2004a0bbd70473d1553997e3a5e46286970f0b01016e3429e32520803a03eaff3db93bbc476a423dae285e9ea75415d63fb0f81527d325cdca593f7e8dc3c234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ede90bd5d8b598def2d2c4fee98ab2e

SHA1
83c299e8db38d5edcc50813767e9d4155b268ebc

SHA256
44330643c5131a881dfc25c0ce8dc9948773e4e6707e83b0d96288c02bdea040

SHA512
75b0a234dcad6f8f2fcd48e07fc892b9255d73d6876e94df57c4043df20e8fdcd47a23a26659668acd40604fffb19cff6c928d6616a706ff39896318493f9ea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b4217282e8938bd94a93e1128f3d263

SHA1
8cb948afcd91019711d69c6a04a354228992bde8

SHA256
af92127d501373a0ffc355171bc1b1825121db5e92a2566c270a2b42fbfe2284

SHA512
35dfdb1100790c286d969b8d389a72f4a6aadfa7c1feb1dec973a9ad32caf22f714c073dd74b481f1e6af60c3c3625a147d26397180fea3c875486ea734c59ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a59e732826966c58414d2d3d650891d

SHA1
73142ebcc9bbf6b81002723baa3441647b8054d8

SHA256
a9583d20fe6664ad20212fdf186882ba63950ff6e0734d4b2c299ebb3849ecd9

SHA512
e625e9929ae8169a249d96bb485edbbd148717c3a457a3c22831b35037f54cb09d480f4ccd81fa10762b85013c3301860be5554fd67cd310df76d18d754e5b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd94151d2b5093f820f579f15e8aa24f

SHA1
e436dc72091dcf75e5518a34dd862d2f889e72c2

SHA256
3345e1a24649ed46a60453894aa8ac9f7364a34fbb4f5706635f398b7761a848

SHA512
24c059f967b3c3da66ffb4a4545720dbab2104a0acd74c6aec53e0657a8b417a01f5542cca222baf92777861c4eedc37ffb0bb3643d697ed2d402028b4b7dd83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac9afc6128af03e0e224217ff3f3187

SHA1
179ce0696370fccd285c67fbe1e6493d28f36f7c

SHA256
5d41398f1a602d4af0d7ea0e672cd6d02448069e9219bd2d8d8ed29d2ccdbdc1

SHA512
b8540afd813a3775ad757f87b088afa9bdfae57bf84fbe828b9b84d9f8c4305ff0da89846b93960a7db0d88862e6b1f15babe9377bdeb1b9c91e946bbb4fb1ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84bcf86e4035544fa1d1a85cbc1de3e3

SHA1
b7e2cfb43341d97deda053f7f4fbade7c0c3471d

SHA256
07c7f9b758be36ac3f8dc7cf25bdbe05ecaf456a9e43112d6bcb9779abebe9c1

SHA512
80bdc54b900283bbbcc38bcb28e945a7791ba75739ad371e897b919664f314d4c32261ace6e197b6b41a3f44e3d0109e976950ac5bd50f738a5a306c2ea87442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76825b4cdb79af0bddce521ed69178a4

SHA1
27c8d0c10e4ae3486863ab8650a83e27badc3698

SHA256
089bf14a42b7115e0aa31a1ef0a676d5b0c86f719425b394956dcbbc535bb142

SHA512
290b7d5205687e8f3cbccff8f276efefecbf8decd6f91e680c16b201600b5dc73ee11596ffa076010cec7a83bd8e3de6dd4e56fa37f53a236f6de3a86586c5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4951.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5635.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit