aa88d2c1de38e6203870482a5d9485a31df52f9487d5a3f0394b0317e09d7e12

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

306c7bbc22097b46149987cefc195157_JaffaCakes118.html
Size

134KB
MD5

306c7bbc22097b46149987cefc195157
SHA1

7453f4f72a29f3b839205df7839b22f99e65ba61
SHA256

aa88d2c1de38e6203870482a5d9485a31df52f9487d5a3f0394b0317e09d7e12
SHA512

d6ba44ff6b0376bb7914aeef1452529748335ceb2f6f2a2ef420d29123644b19a54e694619280b21c41397bdfe66603de2c3042e7a06d58300b0fd727206355b
SSDEEP

1536:SccS/tyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SWtyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{272C1CF1-0EFA-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004ff805b620fda3d8e7f4ec179a986f04b4d8833a93e846bd890fca76a3d5437f000000000e8000000002000020000000fb06125ff801a73a66cf6016ef4a76bdf5a307d0c9b16ea32640a56fe1c3ef2a20000000860cc120d1173d8ae680ec17e06cbe7ef7d2cc57cb33d893a54f648f527f47f740000000dce7362d2d1bf23734ce9074d7ad65fc091df46be8179c333d0142c8e449451cff9f5e86757f10b43c7153312b463f07e58a32985f07dd886f0a3eae0d5a09b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421527172"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05dd2fb06a3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000077d37fa873fbdfab2226e50a6325983b7e4dddfe0d719e1c356bf03b06942093000000000e8000000002000020000000ba5cc47ff754183adde125c37610a73cf234a29d0a6474116c9ce10d85bc475190000000e55e7142eb40776110280a4fc269f61928a6b0d3c6d179b5c9fb4750edf33baf22789469ecccd6d525e5e28faac29e090bc0ce26f8104c1ecea5d3e4c7077cc900e9238868d46f55fd681461d51f54c3aeedde66f74bf4688dd6009cb6fbd06b812f88f761bf55efe6e2636fab40446d2ec727e530e319d417ce3d8a4dbc3de58b8a1740cec657f25bde0e825dda9cb0400000003f87c91004a678dfb7da6d192c2e1e16a276c6fa8ae950b5476c762350d5e88bd2f1b0b0024b17637b36f34c914a6d74504f4e1b166b636465f453224e18e30e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\306c7bbc22097b46149987cefc195157_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fca3ce546265a856ea422c2cf6d5807d

SHA1
1e9e4a1f27c90719eee2163b558eb2ed00a88656

SHA256
5c842e933b88c4f54d3857da740e516a2a30d19e93d6dfda84d3651289e28b4c

SHA512
f1fc4e5c1a9cc6029e7aae00ca023cdcc6364c4053b796bca7f25effa19e220e0270cf31f205041977fc5dde746553578827f19e5b79a33fab1965856b8c99a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
120873ecb67283b4618eb9013b2c70ae

SHA1
a4d27821247792034e1608141e3e46085d69a18e

SHA256
6e4428ef506552ec99c46e803f913802ac458d63836bfd97f89fac8f616c880c

SHA512
635cd5c165c0c30bc6233a75a076b2852ead2d702161dcfe669d3c8598cb650322e4b872f666991376b3de2b1e73ea0ffb590c2ab36ffa8cdd40b934c73a27f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57cdf8b058a7bc1b543f747a266a7e7a

SHA1
0c61d13bf55748914cb52c88fe8ea41f51b80b46

SHA256
53329fb3962a90e4f769e2aaeced7bbaa8a3fe88d1d5d618c616350560a44acb

SHA512
f9682c75d3f2fe06adb334da967e71b9ca5f43db76f032d3f7d354cb4dc2934da0710c55cb54c7000918c53ebd618718e9026a64d49239c3b049d81dfe89ce20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f07e6ebfddbf584774c9a814e33821b

SHA1
fa06739817dcda6094f9cfe781251628a04a500b

SHA256
64cda6427996d8e38664a8c031360da2e1704a50257c59d9af9ef70adc27c54a

SHA512
d326e337329b66963676447871e99c5ba74eac38646904c2f315b18dd0fae38a560e2b6c255dcf49588c69ae5bfef142d03a0962f1e2f6603be80725660f6e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa73f61f2b659e3ac9d59c4449bc5af

SHA1
4e219adc6d4c35956c8f0de6ca1db497c51e0553

SHA256
3e20fdb494476894663654756680d83c2fc941e967ebcfbc1d4a6270b076e73f

SHA512
5dd53bf48f0d8df5ea604f3942de455bd41b23a9a4a81670a46de432fd9cb670768a9053c14b784b0b43a5b7315818525114658502d03a5cf639b2b20d76eadc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56babbf2edab956ac6a07463dd6dc047

SHA1
dc7056cbacce037ab0850ee921b0ddbde55e0394

SHA256
079d0a5932e3f118243014ca82053dac184025021536941d49343c1d7820ad66

SHA512
6e54b8c719efb2eda45d7a62dd005e9ad9c50b8b404466154a224fcdb853f2069f181b290cd4c6c2c8b48d31722a7ca8e4bea73de774ffae2bb8ed3197d80593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65577986c99b3395c5f01511ebfd02f2

SHA1
a88e44a02d2373993ff993c5bfa857393a43f34a

SHA256
9a8737a668fcaedac722bbd3a067395213db36c90543be14f6c2524ad4bb72a9

SHA512
8f928caea642f1912cd59d408ccfb4380b01c3b333b3292bcd7b09c3ae03161e2dec561c515b664ecce0d3de91c1f5c168f1337d9af63ce4efb35730d224e101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fd277fa2cf55ebe384b052eef3d18e9

SHA1
f8255ef27fe2a5c475f33320f43547d0272f0537

SHA256
0bf3c682ba7eaede6fe571b33929461f293dc3066a726a4a471fd1b4fcf3c061

SHA512
360a3e5604e541b2002284b6ab7f4224a2f8559f7e3ed80f59c0d0a571b34341ad6ff0f4a5ee8f541d96fc3f94d0871daa0bf64245fe023c869cc5d5144daa61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56fecef0c846bb7b45c2a68b0fb80665

SHA1
8fee44052f4a2f08c1db33ba104dc1ae3f858631

SHA256
4841b7e50921a332426e01a379c1d1a3a1ee74580856c86ccb90e533e4cfec84

SHA512
0397976bf696e1977e1b4c9769fdfd4f658426cd30c91349a583c555c3cc3bc7b25a2537b3c0fdfb7173273c3007e034471aed668d2dfe5d5f5c92243632defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D77.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DDA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit