591010913a393ece967842231e93c937cbb932a08b6db92306ace5836398aca4

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

321549c229c0f668d58dfa00f24605f6_JaffaCakes118.html
Size

27KB
MD5

321549c229c0f668d58dfa00f24605f6
SHA1

c4b56a05ae355ccc944accd2b8a4704bc8f59b6e
SHA256

591010913a393ece967842231e93c937cbb932a08b6db92306ace5836398aca4
SHA512

dc123bbebcc8b12f01a5a9d9793206c2dfe84238dbcc7fac98eccee4f4d85e83399ae95356189563a374a1c7152c50af3a9441091385e9e66b31e5aa9720a466
SSDEEP

192:uwnob5nVmnQjxn5Q/knQieXNnOnQOkEnt8CnQTbnZnQ9ej/m6u3NfQl7MB3qnYnn:UQ/cShGNeSZyo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000fa76824affbf86f1cccb2440b3391af8fd53637d96b36029aa067acd338373a7000000000e8000000002000020000000ac426576e545d9173367b40ec16349c8fc4872b90a1dcdf4be1dbf9ce6969e1920000000d3632b332860beff3f728b74fd572d4d0e42384e30a2a959506d187e841a1de44000000088e80ef4568a911ff7697257d7f7b680d8841f14be5f38f4146f92367617f349b7154319a4fe50766df1b51b6b552095debc3465f509d28e0eeb399c994fd7c5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421553611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0271c8c44a3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7331961-0F37-11EF-A4DC-6EC9990C2B7A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000594a7807a62e5a3d07b66ee4f19cec899ffe11416af1dcd757bf4f58babaea6a000000000e8000000002000020000000779a61edb588baaa1aa31b5d7109e807cb83e10e002ea6a9e4dad9047ec41c7a900000009815834c115a5f07eaae22b256fcc62c3f17c40430fb81e8a14510eafb66d76c1203524c17d5b7ca3fbab6023d3f57d53aa08bd81bccf7b98b6c39ea388ea82119f778c72b62323854e5611ea17193fdf363bea2312affba233e0045ff97d00b9d645617ed7e5a1a35591a7fcb8d4f495b75ca566c244b75d955a08fc5b3e9ed66406ed23dd05d2d914492d65ab9367e40000000362f2998ad9b890eb2c47e0270d69b04c8fcbd02d71f9dcf8da35c932329d1789a6ac3c434342fdf79f31c894e2f23cac9f077740f7348b7588016106df42fe8	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28
PID 1924 wrote to memory of 3044	1924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\321549c229c0f668d58dfa00f24605f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fceec09b278660aee010b6616950d38

SHA1
066a969d3dbb1033cdd4c92067152f3f078729e9

SHA256
5631738bc3de44e5f5ddb168b64be0d3178fb5f67b167e4e1d02de5dd8ded259

SHA512
3781fb15eb25dc4afb8bbd606f0209fa56a8e3d3fc8d2d1e874f6f9d5b7cebada4f679e849d56f4562680655a318e4f52c17f359a63a09f1e44c7e374a24a792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53705dc5129647b2934bf41a8ae3814

SHA1
2b3c438d7e8b4e046fd6ffe5f1385a9c0a3c8660

SHA256
5c28bafd49a66eba4b25226c13f06b6a6c79276efba4f197477aa9d885512976

SHA512
d58d30bed41038e2a1771df2bbd67cefe5ccf967b068724f56ee164afaec84d7b8b7aa956a8e9b3e32e2383927276dfb97855aa1b2ab10c0ffe26177a7e389ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d91205d47f02cd63b6ee29d2672c8443

SHA1
7c6b7e6ea9c2678a3fa2c9143c0ce1e4b6bc8205

SHA256
14b3fbfde8cb8226d51819b589a7f0ee8ec951e50928b9bef7cff410625eb5a4

SHA512
e510ee26b04fa2831991c119357a10eb1a200d052edd4c0881cfa801cf5b571571b3aae3604d68a8f312f1f4b5326939a309dff1c3c73b6908ff43907449d97e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6932f9f2c10fcf03adf04201f945dc26

SHA1
941e3ca4c4d43a7e51d54ada77c68e10b110c7d7

SHA256
37057845568df6a5d07b73c9a04f0e62fb9056ba7e612faaad7bb94d6e3d73f2

SHA512
2efbda585827ecb0993014c3afe9fe4e20e924d40b2fd5ae6261288f15342497a02b1504efcd9e4796abf689f6e3a654f6bfd3da864e7c27ed42c276c548a969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbcfdc1ce67cf1cf8497312d649c182a

SHA1
f8161261bc4cacefd3f401e56d809d4b640854fb

SHA256
fc4d38326d806f7a687bf03b0a7331e7b99ba745785df2237511c0c445e3df0d

SHA512
0d5a7f3766f1c7a7c7465e5304b1a6dedbc77c71074b3f6163d4edaa1b61179646965d9dc25bd42b92fe8046222d61473540a220cf32f0a71aba65134b8ed9bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1b074a6ad4d036b3f69dfa76e11fc5

SHA1
8df0890966d44c3dd5f36c819f709ff68064c863

SHA256
08ceae0db29ee12bb2d98b7b7c98935aab6914e13cc1583ebf849d7867e96607

SHA512
d7b47182b120740e58ed96990c5fb4420f8256e58323f8cbb731bf2b2375733e99a69ab01549ff4ca9de42232309d40f15c899ccd20b2bfd26a710881b7fa103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c421a317b7ed076e6528eb5de2a25c7

SHA1
e116eae30d6d44a129609229daf46a62db56bf4e

SHA256
2091da71a1eb02ecbb52fa7ff16ea3690296def9430409d1f28cdc0a5f6af8e8

SHA512
8e3f447b5d29de90d0ecb84429960de1e4dfaf4a7ce7a349577bce2cf31fe496bf1f4022f623450d0869f4231eed1488f26e48dd8bdf0149993e86016006b73f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea16821a9e797ecc4db0b98d102b4852

SHA1
f0234e391b0909c05bbcf24e9f3bee133a99d97f

SHA256
d51655591e394f1ce3238f4532c08f1f81a633feed9a1ef9b4c6ce7140c9beae

SHA512
8a91377af532300ccd63cbad89556631d8d622b221616e1a8905ff73130531592f2c4d8340507102065eea5ae4bdff94aa4860ed0a4bc737ca368453a491a241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e66fa73bb74a4b48b4f851b9745958

SHA1
6838dd013dfb41ea479b4b324de09c270383de72

SHA256
4642d0bdf7653a935bdf4a2acc9fe9bdb3d0bdd896b900a3406355a91b86ca89

SHA512
04bfac2128fe6582ede9cb42c17e10666411b82f5a43127b2a7e5f6417e5a0933bc930645d877be81a8d1b9312240afc88600de96161bd235ce106be4af09370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b3e5c923f6a6b554ff41ab81449a171

SHA1
779b0b8eecc368df37886ad6c581f686e84876c6

SHA256
4b19edabe8908c6db588c20e4ec7c9d369b2a87afcc2f59fa17b1927155e2be2

SHA512
5c4d291e7fc1f6d4a75bee139eff409e6423885b1019ed791bf1e71657b4d61238932d3f8a2288c91d0298edd415b392b2f125751e9c054861ff9c13acc2c570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a81018419d1796ac463a41e45fce69ad

SHA1
e2afffe23a4721f78a57bd61559be9f184c0564a

SHA256
46f5640822a72d86f6f2114f88446b8ad0f951b977b695226bcc663721ffcc96

SHA512
51586e1eba13991ce72ee2fc3e9efc8000401737d6be65dc4d5b30ceb3d94e11df34a28454335779e9505efeb52955832aeb7510fc4bbd79b45339548858f880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4726b20f82567d322a9b6e78d3941a2f

SHA1
ba2d38f96a49c8206bf7acc4c7b41d47b1e86609

SHA256
7f61869bec1b88af8623423339c4edb717041a202340509b3f4d75e6fecdb726

SHA512
68219b72f6c9b151f9bbf4219d49949d1a86bb8b210aaaf64400a3094816b56a2d03855d891385354facb9cd26a28994327d619b4acf773ef566d73cedeaec7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A7D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B9D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit