55e66ede4e4641b46f67c5e3eb04c1fd0f52c40638a9d6c2caa76ee56f91da48

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2da04e766216bdb2a781e84976ea08d7_JaffaCakes118.html
Size

16KB
MD5

2da04e766216bdb2a781e84976ea08d7
SHA1

28be7df0df75d5bdb26607edceaaeadcd4c705cf
SHA256

55e66ede4e4641b46f67c5e3eb04c1fd0f52c40638a9d6c2caa76ee56f91da48
SHA512

2135033c8523df365b3113163b666e527dc77d9730df7267283f34e07b3df939e80b1bf0cd8353856a1d3dfe67b6fda3f9ab15a14dd980bdd58aa5baba15a30f
SSDEEP

384:CWwOkjHav/Z/zUKjSjTjyjdj0j9jJj0jP:CiW6v/Z/AKO/+5QpFQj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F1D1B61-0E90-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007188f274870e420da9781f7afeba507f1b87090f4a89d707d89b289409331abd000000000e80000000020000200000008f3ed7cc5c57d609ceb65d58b88bcd343630055253935404001d25448081f64220000000159d296c54b8b9049ec5001019e5df7f3e87edfe568112c13b7b46f2c005c358400000000a1a66ad89dec7eaed7d27e3deb765167c29f3bc1981764ba4b21c7c288542fb33bbe9ff9dec82794b44098d494cc6a9515a74cb7601498e30d2b79d879ce9ea	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421481604"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50045ee69ca2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e4daad3cbfe4cdc628d53a827bfc785ab8fb666d5907f7891b41cd581f02a603000000000e80000000020000200000005e56766de8495a996db73d09276cc394e776de3e033511faf39857511e022783900000002519476936dbbbd0edf4d96a7a1624c81a78858f34eab23d7b1cba67e9eae91aab91fa3fb81b9f78f7dc75c99690f83f27544a8d4dc907f5eb3632492bccb5eaf60374ca418e67901494cba4a21950b998948b963e345f9ec55a641b6c17e808e00053bf6ce714c176abbffbf930c01fff1ba9a3638d6446f9162de53919f709b00a523bc8cebab2d80f2580c088e61e40000000588864c3fd3370fdd7b614c877d1133663b9ef56d2bb210d67f9908112818ed3df1caf9223180a33d2f06bd78f531df8e1a7be913f80c3da86e5779245c7a344	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2da04e766216bdb2a781e84976ea08d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b7b8869c5dbbe70c67999726f4ea36

SHA1
9ff556b5d24b40c5325a5b6687df0496211f602f

SHA256
53f7069935cb225516d60baf28b8763f1b3a079dd22f32b548736f2ebada05d9

SHA512
088dddc344fe452cdbea7dc068e4003d6b178315073f17c79931407a6fc213a6e49b8a29895b669bd8a60941e7f87eda6f4775f09c3a5df9921adad983e65109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecd3c588c932a1d403efde89f78c5693

SHA1
e071a78fcc14840cccb5c498ac9777f3b2925bec

SHA256
9a5603a9f8d65a7f21ae140ab650f55e440bdf8df0defd630b0b4de52b13e0ba

SHA512
056ef38c2f12c967a05b4bff3420d8189a2dc34225fd7791ff8c07a212387345727aa8b5042dd33a70eff228d3a3a908c340099b39946c9562d7959ebcb9de4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1a2000ca63bf82986a8938b3850ef57

SHA1
3227f2f21b690713a60719ae7cde6664378fe322

SHA256
3d2453d9ce7b5fb56e583d54e24c30a3a2c86195d9359f367667dd75b072ec38

SHA512
a3d1e9e12ba14a1cff551ba44ab8932e3c0e672b2bb26a4edd06d4867cbe804df613704c30cac742bd8d6741abde3d4e1ced316008d73c2c276b5833048aaffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23ee337438b7315b551a4a8bb9365434

SHA1
7d4134bcc941c394c86deeed732aac5a8b68e020

SHA256
8a822bfdc5e9586cb433280a0183759d93f117e47c076fa2f875fcb4f4bf3cf0

SHA512
3d3494217976c4374ac6934783da6fb6ea2ae02aece63ae7fca227fd3ca13eb2dda1314658b7ca6e8592e8bd261b34a9245417378f7628c542a7c41661cc4808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b501d948bc48574d2d272bfb15e2527

SHA1
70c5645690d477f37dcfb106b289c68f46d249bf

SHA256
0bb21355092abc4d46af9de0e1a779bb0eea76f03d637123fc7c4035fe5d6517

SHA512
7f3c9aeda56ea982e854b77fa0b58eacbe8c7ec030bb93b4262f126b4b61897e2ff95693e14e62fa216f72780dcc097265f2a8688048e36ed6c65a0fb961d0ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9deb5fae2670a6a8c3d292a166cfeb09

SHA1
fc7c78ac328e058d2e02457c293fde3954697d9c

SHA256
a4e2be76bb185ffe2bb6848ab4c75882ef0974ac31e1dac335562ba69fa06431

SHA512
fb44b0141d9544e7904a80150c20e677e5e7d0f5e7a2562b30f2fc793cce48a9016eef981896e41aec835ac0afae2648c69a9083aca902a46b35c22e6e03bd44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e26067ba6da7589bbcf5f0f63e1e8d37

SHA1
20ff6337a01e3267363f764e95e7f0f5b2e04d6b

SHA256
0b690a2ece642e020946cf04b14ca421c8dc034362bcf4687fd3c5a647d8e6b6

SHA512
9a5a849632dbaaa445dbc73ee1b6ad5fc9f0a9af3cd381036d1321cd4c99f1c794755f2b3199ba714aaf5246c7f8ee828db4efe40cf57fa177a0a31272747a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
013440265943cfa26e9613cfb3c101fe

SHA1
d02cec6e814907d1be9babfe4fcded8dd7c3afa4

SHA256
78d694b065df7b06b72c45ded7f7edd44806f7421bd55c4139afa7f68c5dbd97

SHA512
8356dee96438c32d98bbc6316b9f6baf2b4d014c39a43655cb8c6e6454180fa30fbb7afbf81ef651729609cd0148246dd7b0a60c687d5ae1a10fb63bd3b47839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66617a1a5fc911cebb4ee3014bf9d8e9

SHA1
a7d7cc06c3922f55e895e955b9b3ab4e4af0e486

SHA256
e27e5fdb7e197f217e56395e151e10651bcb726fa08fa38d2fee571fa8a98fd7

SHA512
861f2d811cb60e1bf93ff6b7535a12c7803021fc5af260952683b1a81ac52d2e77ebaa2de6623b24645613a9bc9d2db3a74eb6d0a16e2db834bcf44bd99d4394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab777c34eefaf1f231c39388d28ec84e

SHA1
eb4fbd895164073f182676c8c41a94bd77ae94d6

SHA256
848512a885919b9f17ac993a338f3baebe714bbc69e3d0bbf733278a29077675

SHA512
d630af2e2c5e2cd7b048e6689bb22ec96f180d43eab22109bdb06c8dc50a300cc3928e359806a5c2d76f1d6824e6bc9206afbbe7ef7aeab5f13078e61192d253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d31372ba67c72ea7ec042680ad8bd5e

SHA1
6bbd824ac0409ee4350178d90d1907c044e5aad1

SHA256
7dca601d47e70ff2d11e5eff06566526b109134fb20a9b72912175305e47310f

SHA512
47d7cbaedf061f02deae81ab8dd46eaafd7587cade04f4ca989029ac6e8182173adddac853efb44fd30e81c805e7e258fba5ec47dbf057b4111907ee3ba76113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bbdacce1f276f675448714d9872f262

SHA1
0b002bce123972a947fc0b487d282506009ccf29

SHA256
790c8560c76a65be4a4259464efd6ea6452433962a12326b079c1e8783bb5ab3

SHA512
b3244211c4f4683142a0dcea8fa5a96ae1e857979d2188da7f73d657caa6ce593352c514b451ee9928bd0823045c532f0a5d8c29247f530a29a17caa23066341

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49B0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EA7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit