216cfdbf0c27853b7bd0b35ec4ac12fb7987b7926c2ffa7040c3d9c3c10843fc

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

304994a8d46fd1964d8c7d04594318ac_JaffaCakes118.html
Size

776B
MD5

304994a8d46fd1964d8c7d04594318ac
SHA1

8e17a7094c78ee7ed4a164e15e8a697e764168e8
SHA256

216cfdbf0c27853b7bd0b35ec4ac12fb7987b7926c2ffa7040c3d9c3c10843fc
SHA512

f22e72bcf789190b2f7ca18919a2ab1d0d1b78f02375e5f961468d69b96be62a71fa03543ddffc080fb61373bf9c120e8d7307ed8950c6dfaacb5f1dc2d8cb37

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0098f9e701a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f4d919c1c28cafef86e717a73f5a660b41112d45afa209a7bf80a22829cb1ab8000000000e80000000020000200000004f80820ee3fbb9cd022b6f6ff431ea1cfd5deea3326dbfed7ab230f534c9652420000000698a8fe1720f941606e516cdecbab25e3aec4ee5ba8e1e318fc3b89d05907f4240000000285a86781389ce1b17bd6fc5d12145820baa11a1f5a313af3a66a40bfe7d0d38308968716f91b8695cd01cce69bec4f32091bc3fa48817f4fe3f6cd63e98ec56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421525020"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000006857d0c102cf5d6cd122280bc1d35b279253180b1632e882c7eee4ebaa20cd30000000000e800000000200002000000021b2ced3ce6c750d4ec32af1c0680b2aed854018ba217418b2b1c8bcbe8db51d90000000b5758477d0fcfd3118e8c16d99cf50cb6516905f0a1dd82a68198161ffb3dc7327146e58ecffbd29e8bc4ce6e3d814377709cf6172c4d43dfd2a97d362d5ccc57da2f677d8bd623b525c86ca18548d1c269fd5781dd154b3dc6d53c2dddbd6800f87dc11864d803f6991c88ed40e76bbd9274c2f3af4731eeafb3c13efec9d3ec77a85f054c029d57e834c3771f5117240000000bad5dcc6247e5c8a544e22965099badbe4f03cb2234fa6ab65d622d7c2ec0dfeb0a6d4dc60c2304168055033d267930f95e9ab2a6fd0bafc8a55aa41f481f90f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2482B181-0EF5-11EF-AD12-DE87C8C490F0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
888	IEXPLORE.EXE
888	IEXPLORE.EXE
888	IEXPLORE.EXE
888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 888	1728	iexplore.exe	29
PID 1728 wrote to memory of 888	1728	iexplore.exe	29
PID 1728 wrote to memory of 888	1728	iexplore.exe	29
PID 1728 wrote to memory of 888	1728	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\304994a8d46fd1964d8c7d04594318ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b46e6fc02cb94af5bc5c26dc4b4f407

SHA1
2af9d8d175f4338d010eca042a6dd80bcc765e34

SHA256
76e1965b42160175b70d042b98254d7e3317b179ec60a6d2e7131de92b3ae434

SHA512
6d96ad6e13b28f7c813c58990de20b36612387b8cbe6af08fa4845dbe0055421981135a917533a209097c9675141e0b7155464d1838a9dc725c732fbea391d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6690742ef10aa102eb40bc11281f1990

SHA1
92091a155ccd2ef161077389e87cc97d0179176c

SHA256
2fcd73ec3041ab95a2f1b724f4deb9a37f4e8924eccf65a3903ef99af551d756

SHA512
92d96a67d99750bdf52d972dbf0beb6c8126e9b480f8bc03fefdeb1aa64de586149765171abfd3fda75a40c812286558d521445f51d961430ca95395d3573f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bc0adc09dce3f2a0a9e90377c3a1664

SHA1
0f6433d45ce876629d2c89a149fdbca3bb241dab

SHA256
683d33838f688970151fd38af2f89381ae03a33191eb77fedc9f27ce297975b0

SHA512
83447b5d87686a438248ab9fc636d91042456003a021190c43b0cd20e553b341bafcbf5e535061ed43449e10c1d31458cef8ea029861bbbe015397cebfb7c691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fccbfc7b91750cc2711281f3ad961d1

SHA1
923cf9c85f842bc43cdc142e8bc7d526be5ada3e

SHA256
b4e69641d2c6cf812bc0a2ddc0112a0db22239ac970b910628afdc484ef71632

SHA512
b17d6a98e6d17c781288695cd60e0ac780e2d31e50fb0583444048609698860d9a21bb48edd2d306e634b2e9681564aed90498eb40fb71798c763e64f9ca4736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
353b47d48911ec3affa5a7afe58454e9

SHA1
aceab7332b8ca390c34ef3f128f84928fff71d08

SHA256
8e85a06c8c6474d7276c784b3babd2c9fdfaeaee45e28d9aa684486712f0c136

SHA512
43e12811fc5f1aa069d2028bb8d6dae668e6b94cc9d27a4935850d63f5b2c9b2d3ab3b39689272639e8c77bdbf1043575c189b6fec85dfb742b8bfc3ad921573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3a404bc0239e5880ed4992f7a2f3add

SHA1
53d9121fd2aa0d40fb4ac8d78659fc119bd38322

SHA256
2322c96e21c6d2d03ddc0832695dcc2094e8884fa6bedd759cf41dcbeac06116

SHA512
b6005aea1574aec4e0ec73fa48863dc4bd81a262590412bd124429f12826fd12526bd232fc387b1346ccb265139bc7f428bcc29e42b90553b65e8f8631825899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1bfb57ef43c0fb0d6d8578496bf9945

SHA1
da4c9dfe7b2893c36ce4912cb50dc788810cf59b

SHA256
1fbec754c36b8cf0a5daac726872cca7cfabb938c21ae50896b6689752b3b684

SHA512
28914685a5783f6e62b6b4b5237d7ce61a6743d45c3e1197adb1e2de639c0812c045241457c626b851e619611a4a5b9c0aa678bef84a22edb8009c596f9ed311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9682fdc4fb8e75f28f287103d5e3d7df

SHA1
990cac4bb691972ab5ddcd595a3515c584a83584

SHA256
ac8e726c125140595ecbec0970f4a49349c1cc76d379edbdbf28cbbcdae5312b

SHA512
8a2078232ff0c83b3f4959382907d88f823fc7e80f1308f3b99155d83d949e7950e0e854da90256c9d65417205a75c10c99444a2414d1d98b505bf34f1fdc7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55bc9af68295155c94c69168510328e8

SHA1
d9eb12f2934ae29192cfb4dca61ca12b9cd3ddeb

SHA256
888d2e8b8dde349cb33c0b17120a12bd1b712593b23447f33caa7abd215b427a

SHA512
06d39d96b17db547f51d4613eaaac1aab17e26a8a48fe9d3e9833f5bfa401b62a9605c36cc62dc87cd5e751ab469c6229c42b2737e19b11b32960fc3fe2cbf58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a8113ea8a259387d031a8963b9e8ec7

SHA1
3df222f0c4fed1f1be1ebccc0337554550dbeeba

SHA256
7957f683c0fa05e002d59109866635ba829fd8208ad10882a783db3d890787e8

SHA512
35c517e91aec85bba5833003311d9bfc173a71bce7526e343abca74d7b9fce9db50c5812121d447f21023b2d76242f65b092fb782b9af2edfba07301cf7c697d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3151d5015c9ddc7db7537655e8f22778

SHA1
11c1ea1312464b29694ff3cf75b48d400c6686d6

SHA256
b1914828e86f6e371c593211a6497f6ca92c7be6a0d0cde48f6591be19590df0

SHA512
54ba2cc751d41b5024092aed886fc7895eacc60680b7af3b97576bc2ac66fe29288a3c013e02f5a5c9af3da8b4bbd5797532f8712683c196caec2e9615905de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f432e5e78543654ba5f4a2fc991a7b

SHA1
76b0212e61866f88016ee83d42fd296094209c54

SHA256
42742ce5a6fd259833ad98c1a89ff8eb0c6197195d263c0052190fd5b18e03cb

SHA512
cfe452570c4f22494014138fae2597063feaa8dfddcae7927184cf8ab4fcfdd682c8f7145c6720b81aa15c62564ecd305166d4d057328d680e1501a8e1bf26a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0775d3e8dc4d193d968dda06ac31f8c

SHA1
807258c26a0bf37b3306a9cc138096f9794da003

SHA256
0b1fb409aece0e4ff004cff6f0c269a439639cd822f07f0bca361cc5f424306a

SHA512
08eb5ce2043ed75f5dcfaf825e2fcb85d10a9fce38437d399a317d022421082fb6bcc9a409be7aed0753f7f0ab8085e6417dda21a6150ee31e1002456cf1e551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
309d304d77072c98a11169c05c76b555

SHA1
4764cfb256231dc04e7229f07be291414cfa4b04

SHA256
e5cf718cb370eb60f6e9e7af52aae33c1f742f42dcb6ad2358a3a1f5ace52035

SHA512
a4067d657c37ac2157390561596dd2f378ad0103b0a7c70efb3770cd54eef4ece720a51b2435da42372027a2b00aeb16e9f52de3e15ac13b47768a58c50421b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dde04536b7ffe4580629e20f5bb4764

SHA1
d2bda160b3b6ca81d15a8fa0919e16b7b19abe30

SHA256
d24c4eb469c0afe066aeed320cb0ee24793836c673c4494ce1ec32bc49b5a6e8

SHA512
76e0ef1bfbde284e7e4f0ede6b33bc2b45227101baa48f0ab1517b285efb41944e1c01966ae15157f94e9effa190201e65d28f40f45a0042fa8f1e9c04304844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34f0b485141377cfb8e8ebed7bf9de32

SHA1
0fc53f22c9467f70caaad0330c8ceb8e1ec41121

SHA256
4810b95c87b321671bd3ff43f3d682e598554b3d2e2d092e8d1ff589ca5274b6

SHA512
ccd234026629622a6aa9e29fef7b5c08ffc538396d590449fd8c91a2e463190677fbb764cafbf684dedb0c0bb60b6ebfaf177eea4f6a46f23bab80abf1c1192e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C8F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D61.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit