bbc5ccdc4912f81164a615e5147cc94e0c388df37c3804cff5f97abec0e1878c

Analysis

max time kernel
136s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b69acd2c6981ad53b0ff6895ea17db8_JaffaCakes118.html
Size

158KB
MD5

3b69acd2c6981ad53b0ff6895ea17db8
SHA1

b0e04deeb720059909ed428be3bde782d8f55ec5
SHA256

bbc5ccdc4912f81164a615e5147cc94e0c388df37c3804cff5f97abec0e1878c
SHA512

4d1ae4b12ff10d3130e443f9b42cb4b695d29931b5712de8b958f459ee62958399348118a267889977bf477a33ece0afac639b3442439155bece5e625deafd58
SSDEEP

3072:SKgTJNe3TyfkMY+BES09JXAnyrZalI+YQ:SKeve32sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABAB8291-108A-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000bf3c976b01412def73fbc78d1068e1d7b5af6d15b00ae13ca72ac672dc3c4f87000000000e80000000020000200000002192b544556b89daddb54a7ab19ae9c3c926620d025231d078db463b32d2ad58200000007d6327478a5e92ffe2fe382c1ec49ff26f2787d3a2e704808aeb3bc6d762c7a8400000009ab8a56f36f9a4e94456c9a4107aed7b223ef33336253dc594211010d4232d4f5976aaccc899b65cae11e0c0a2b0971f7a128b8727e05af04af6de11ba8af572	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000033e2d179817dba0b7a06b5fc68e1b998527a469606fd78231e349c457718b24e000000000e8000000002000020000000fe90577142073fb1540db72c60bdadec8fff166290e963d1d921a259eddd8543900000007a58cdb7d98a267a8df2e307d60dc98c7712e1eba97dde596f8c763d83fd46ad0465d889c1988bab78850a57072ce5142e246629f5e6fbf8f1b5ad7e099d2efa8028b59057db3a73ef350a84c6901d27af0410d294d3bdaeb66eeea096665ecfdb578a265d42626341260071d854efc00123f8e8d37e3c7307a55617c66839da30ffb15cf5e9f9b5356052225360e2c54000000011cb66cf51128467e59a7165dc0d870e3e20e44422ab83eb1939371f0bd21c0be876e3a4282248f2197e379222d3db250804532e9109c8a95b1542cfb81c58b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10992ebf97a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421699205"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2920	2452	iexplore.exe	28
PID 2452 wrote to memory of 2920	2452	iexplore.exe	28
PID 2452 wrote to memory of 2920	2452	iexplore.exe	28
PID 2452 wrote to memory of 2920	2452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b69acd2c6981ad53b0ff6895ea17db8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e2cf0d543cf97afd899451b97ca6444

SHA1
4c959307a9fda5dec5b8a0986b786522112d2479

SHA256
66e3cf98b38c6e93a0e8af2ffd834de6a519cdd774e2dc3cde54e1418e728ea8

SHA512
bdaa25c5291b5801d2bc532389d714ff0cca352b6ea8c986832b2471ddf87780a2993fb00b1182439a7358f8fe3ed5704dd7ff5717f40b28acfe451b749c2e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f61b1832ac93b631149d8afcf904e2

SHA1
99e0f72ea60ad0f0d97ac18375a78aaeb85e0848

SHA256
bc91a305df04254950b25246f007766cab0a5952d662031bc670ab09f9e2a76b

SHA512
722f45451f600c4fc1d8456b9a5ab5acfaa686fa18418a07c0ba4adf78fe8f6c4419d77c3bc866e2a97719dbffd67cfb2bb21944765466f45e61824479f4c0c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebdc672c5d59272b29046c68cddb348f

SHA1
997fa39d252d94ffbd74b623ab897fda9597209b

SHA256
0169f8438a58ae218f47f68ad931a206a90e66b41c98f8d794718f02ee7085e4

SHA512
dd09e26fa14df1a547cfd0a25469a453616df6ad9cea9070eb02f363d94ccb8843e9fc3739a75de93d7faddf202b19c6716deaa26f85794076cdea5fc212f96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e519c058cd73578b44d3a26e22e411

SHA1
2c708d35fa4aa0443070386c53e251e8c970ea85

SHA256
91f5b017435bab4d4cbd174cf7696de4716b41ff73be5ef2ffe4413eb11a71fd

SHA512
84da69ad06b091349cfe8dccaabdc59884b81d891ae2522e17cc6a47fb2076020426b6e022ada4dcdcc932122d11142d36ebf49b7a414b06819fcf496d80479c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda6dbcaad66c714dac1a5525010d952

SHA1
37e7e044bc3b3a8b5e1b7add9efc8c3feb6ecc2e

SHA256
9f981d0951feeaf0dfbb7f177a989482b549e28a283e1657805d84e0fb879b48

SHA512
f102a5ec13801084661ec071a181f768e72bd662f880f3cf0a2b2c7da017bee50317005961cddac430cfe8bb9cf5485f768a01528c08569817e519a8b13b7662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d004bd88bc360a517414770f7793991f

SHA1
415f198b511feb78550f075a56a15b4ec940cdd7

SHA256
4a24e132a585a5d0061e17f56e43c45605eaf1bc482b6839b2dd86b63d408480

SHA512
72048a1f79796594f618c3fe108ee30ff38ebca05d7e9ab3b262fa3abbc55ebbaea98fb41add21caa7b9891c6d03be2585e06514a2f0053a9c7ae374820cf540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7969f16a8bcc224c0d26d211cb62c405

SHA1
4f4a5459a82dd531efb0654d3674929b1333793f

SHA256
2dac2d7f5acbf4e854bb924e4d89ca9cb332a90c05a8b52ae3c3be8056f54ffb

SHA512
cb957ac8c0cb7d9c82f58b1aae3a518c532a144c7c30fa97819bf870f1dcf26d4699f25b0c27790258490e874129c1ac4949f4bcea84a57d68447b49f9037afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be7c098a4f2b5cd9f9eccd81007830ee

SHA1
2a55d390f8dfc62a69f1086e8125711957fa8632

SHA256
36fd31f56bf678fcfe9373b4160b0f403afe57876729a09ec64c0b4024cea1bd

SHA512
bc09b435ab139f310a589e29da45304b57bcfc769cc6dcb524ee36679cb092053897b8e27c70f0bc50a77a8475d364585e65111c56dc2b24dc2c0302e9dc6a50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca2ad12836d9cc813a401a335fce57fc

SHA1
4876393999d8ea40a052156fcc5e15f3329b96a2

SHA256
e40faa7ec9841c1411387b7d70b7b71527fe2ed3abf2292aa40a459b71779835

SHA512
609dbf4559dce0db854730d787f01f39a566e9119a543d507a34d29f126306ae8da893b08d7fd492bfb0e270071a71791faf06971007bf61c38cde620cc89543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c38f3b510ca175208a6ad7373bd133e0

SHA1
1df34758e2caa07473993c6ac0dbc2988fae0365

SHA256
50dbacccc272358dc205220115b75b4952e2d94546f5b610278f2d28792180c7

SHA512
7e640a9d1db7e3c7cbe27889f834ce5a39cce9c44d72c731486c02e546977b0c0c319159b50d2cd1bf035a45ee5d1341a5fbc5f235e5dd5f593adda830050ae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18566b01563f441897ff69a9728bef61

SHA1
ee6a422f252a1ffee9e40147f3ac41910e7381b3

SHA256
cc4ff0669b27fb7bca7ed2d121f10f2b30ad6eda264035f2bf751edfaf1c5365

SHA512
db2958925badeb51a844e245a155dd4b58db2627f3f046c5ef691c66d67829bbd735685e2664aacc4f4fd419774408794bcce6f3e1f072cbc6abac26331ffcc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13E5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit