06bc48dc67f8752c19685380f6ef09dddeda606fcd053faecf8e42437e224b29

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f118b205478123b4e7bb68fb41fc15f_JaffaCakes118.html
Size

30KB
MD5

2f118b205478123b4e7bb68fb41fc15f
SHA1

953d3c48b53d755ff621865482f63a08d491aba4
SHA256

06bc48dc67f8752c19685380f6ef09dddeda606fcd053faecf8e42437e224b29
SHA512

33e3dbd0670b9ef4091215cbf78bfedb668ad592bdd9ab7b49b29ec57c80c5132c6e19153451a3c320eee94d87fcd50925ef9cff3228ffa56bad9ae1b5677e7a
SSDEEP

384:TfA5MW5M15MYd9UVIvy+wUh6xlnATLpVeMxDzINjJfeJ+YTK:TfA5MW5M15MGvAUkPuvBOjJfeJ+Y+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005ddcdab7cb1030df72add964f876d02467e8d3e45a9ca1862513d4cfb16ca54a000000000e80000000020000200000005f328f64efb762210ad190884ee175777afd12eb9ccce2c16c25585125905ae92000000025ade334121c04a2461d40ae33f7ee0ce83f73d969d660947cd8458a21a1a5da40000000d6e16e0f689cf4468cea4efe3ec4ea71cf06c7ba078558a4aa0400560e31310afc0fe28fb46850b47b6307e84bac294f8389cb367ee22ad6a6616cbfb99449e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC8E3A21-0EC7-11EF-AD96-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00cd50b1d4a2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009f3ea4dce9d116934940cd4de05dd0388d9c5fb8d3fd9727bb61cd75fa95b71c000000000e8000000002000020000000b09a23e5e6edcdd5f5d97dcb491d4a8d7d15efedb43df193f140ce29d2a129f890000000e96e42ce6a6189121e9e0f739de0a57a59717cf10e506d9f0db7fa79d393f12a2ec72902bb130dd76f975a3092fe6787b29c05d71f9a9cf94fc17a9348610c953cb2b17dbda740494d235ac8a86ade30bad91d1c310dd4bc551a46abd7b163bc37c6296d3e93995c031133203c16e42c2a463679489145c94192e41b6ea00be33b5dd919dbaf916b9430461e2b01812640000000c06d5105293e5f70fe4cab80ba73c21edffd400dbcd287a1140b9e5f89f98af941bf0e3c04252b118864d4cbe9cccd8a71c1cbdf46405300cc0ba05af3a8fbaa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421505571"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f118b205478123b4e7bb68fb41fc15f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef60cec18dd2e4a45bb9266bd04a16cb

SHA1
b9c9630c3c2e08e756310b8e37585b3bbea9b15e

SHA256
f6b261b80b395296deebf8448fd9a85434c5f269122c25e26fdf02f7f82984e7

SHA512
10f4f277d667d86add82e5750e5035f55d0dfc52d029c03f784f998da2ade69d50a08fa3c783a5f580411dca7dafcbe21d08754dc68dfe19b11bab46ea92093d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff2cd88c083d70378aa34c3d80fabf3e

SHA1
23529bf53297fd35d42abf4d2a2892715bcd927f

SHA256
9d5f6b4a9039d44e806640494731d4d79594b0f90b4d0c25c909f59dcad694c2

SHA512
1e3902222effa7daea644944b381350eb277d9642b879a3d276051524779cddb34034d87b240d048d304dd98416e4429877aa32606ce9386d2a38bb0aa056d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c09931ef37c7b61d9b6b15a0ffa6931f

SHA1
841c7b5aa70570565d0725f76832c767fd818cac

SHA256
66427a0056350c0cf57edfff7baddc93fbe7d472c2b95b7c23034c6a0274cb79

SHA512
69c73560484537312fccf300ec2d18284b10668ef1169e33a05815e6f3dda8c4e35c8f5c64bde32aec70acc74ccb4c905d2890ce13f4a8cca20dee910c07ac23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b4009df682f26320852c7ee296bb4d

SHA1
441eb3cff0ee237f90ebbcf5e5ee8ff8175523bd

SHA256
f98437ae749ace3a3276ba5387673eea340a57fbd28667f96a5fb1cd64f2cfe4

SHA512
8c20de6a72f8390de420a82957601ade447b49f4cb6833479ac1e9fca9d2faf6b8425cf859d121bb73d1e06e11c9a7993209f935f8c331292e1ac3d8df0d931d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b969a231bf60ed62e7f30b7ee33f10ec

SHA1
5590c928e9437c0f1c58e7a20428a73f00326b28

SHA256
58dfc9f52c98c88d9d2f36f821f2149ecb5b7887e9bc1112c604584238198526

SHA512
556cf7c0c2054c3015fb7b51986f7790140752c90a50573c037359fae4e7c99e4ea86feb3255441949e9a1a1f51c1b950d455ce6d566924e64c660a69d173f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ca7d67a5dd5d485d57621e9111d82c

SHA1
ac2893edf0362fc268115d6740481b76b3f0bfbb

SHA256
38f7fadc36b1969e30815e702fbb462c5fecd8880891415cf6c4dac4f21c7f5e

SHA512
a1206a07d35ca94e67b258b4682bb2321a58a20a65ef635ace3a079931c51e2f0eae5605b81d99ee606b010e91c8486ff8073166c2e40de61073efedf23ff89c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
190027aaf4ca2b2f3e9ee6545a1d9d19

SHA1
4f90974d5f1460ce8be56aafc63e2b33a879629b

SHA256
3737a762b45175e70a6e6e372db7984f2ec559ded56ebb1a962f0c314514e401

SHA512
ee5d9296265c960a345818a4a8e33090ec7a2c95072df37c9b0bf9884d6f08a5fe50e55989f0b81ab0d8b8e8e76ccd18df54dfe73691a316f155da0856f16807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7413e84f14da4028c60f33358dd2323a

SHA1
b0fbdcc7897d096c8e94a08c5cea95b93599448d

SHA256
d2c20214ae31359836b0208bfc17e52f53d2288ae60b713e3beb1d951a004abf

SHA512
fc6b45c034af02f0a17b23df4c4407a90c5ad26ff890d7d6835061b36547e5d248d68566b480a06db4e8e6cc0c0ddcee4df1788f5a57bc8561c552754d103d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be30717ba28fdb0601614a11d32ebabc

SHA1
10e1c3e166dc70241b40a07a643df06dd7926d4c

SHA256
d21db3dfa1736b3858ce3b2e1a1fa78be6dee17513bf142d6baf49c81d67ce65

SHA512
6e451ea9b1ba6007f881e7478d75082512f578a6c37919643d82aab946263d29bc53525b1e1f6787384f02fa6e268c76936061aa7a65781c3bfdd3071dade59e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8115e83916c31f0f376e9706fc34c3

SHA1
714cc458e70eb32377a389b0a3120d5c62918d6f

SHA256
1f7d6ec1f958f4e7aef8c5e4cc69bda55f0514f2141b6aeef7a7c3daf6bede92

SHA512
e2c0972a6686f5e8e14316806ccb5efa32572941033eacd1fef43cd35e2f777eb6abfb412ec20ce15024ccf3ce2fa0a4fa4d03962a096d8893b09e580823be66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c65753a14f8a5da43856289030a689b

SHA1
c6341e8789a700fc73b06aab62342a7066915c21

SHA256
edc3a3ee107a029e796ce149893c7626f467c07c9821cb925a96232faf89dcd5

SHA512
39db18f5e89418c9a9c5b45a93a6976fc55f1062ebfdd219e9b158387175faa189250f133df522be75b44e5dc014542e46ec11cb110eac78be1e5c6c0682b982

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab370A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar377B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit