5855d08d381aab094c809f86eadff7a82427305c1989d0d81d2df6c7e1422eae

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fee9ae930d61e2ef2799f163310f742_JaffaCakes118.html
Size

23KB
MD5

3fee9ae930d61e2ef2799f163310f742
SHA1

2a84e622c1da9585d7f9313b68b7a56432239704
SHA256

5855d08d381aab094c809f86eadff7a82427305c1989d0d81d2df6c7e1422eae
SHA512

a5f872c154ebc886d9c241d1cfcf284dc8ec306f7c43d1062c0b6ac6cec178abf4fa1468574eeaacdee720e4be77133c403268b16a52864b3a3761296024a894
SSDEEP

192:uWvIb5npWnQjxn5Q/QnQieLNnTnQOkEntAmnQTbnxnQhCnQtLwMBrqnYnQ7tn0Yd:MQ/t91jpv2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b045190f42a5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421772445"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A69A661-1135-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003c3cf2753eaedd1b75ebfe614f9ff498ff971e4bed62f0e5b47e1863b02181e3000000000e80000000020000200000007ad35e3c5527af2a1f89b2b3a00477190be23d870a2bb11710c1f9ccf46a753620000000b5cb1fb2920b543e5a71c9f85915d9941ea1d4281ddd45e43c69a6b9b080ba0140000000da4f26f5f65a8cad4d6075ac59586882aba126ca75e4a9918e6ff72755c0890f363398c2594d7808d2326a5a3fff9537d5616150006656097328b5efe269d823	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e67fb47b16b8de9cc0db11dc9f6b9384203b239a08a043160330d6cbe2beff42000000000e8000000002000020000000da520e096605f00e3f98b7825ac9d3d16a6ed5d18ccfebc71f26c3bea2dca6fe9000000078f16851a596631142aa8f8361453b890bdced5b96996f8aec04c873be1010c2734c1ebd6d7f4f1438ac9df2de1d5055dd24d1b0ffbc8ab8ef8e1483919830732730f5271daf57e2939a64bd910dfa47a1d1d4c8a7871643bb9d6706afc0352c5e83a514fafec7905f911d302a6b6b78b8c2903144e54bd833bd94c1e61e40910a07c2379f845710d81084d647cdc64340000000b4cea9e96c26ca7b1c1a64f9373bed55dcceaf6da5354169741bfc8a85d7518a88c518f855df47af15b8fd1be4cd18076a4e9f3e2c8e6a380d843260c4098545	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2484	2476	iexplore.exe	28
PID 2476 wrote to memory of 2484	2476	iexplore.exe	28
PID 2476 wrote to memory of 2484	2476	iexplore.exe	28
PID 2476 wrote to memory of 2484	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fee9ae930d61e2ef2799f163310f742_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5f3cd66e8ebf543d4d32196af703f3

SHA1
f68c8b3885ad90fc3810fdc2bf78c5b447bdf9fb

SHA256
9246e833593284780484504c1b9c646b29f9caa7228de3263aa17f5dd6994c56

SHA512
b80949c725676e7d33e776fecb9b2ee7325d688a11165774c6d8a00ea41d3c8579096c13ff24b7f4432344ec7c319866f4db5954bc669bb44a86ea9c2bfd0511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25ddf01ea0514654c387df52229e37a6

SHA1
a346fb67caa5d980e9c617d8d0d10db8a2d09b90

SHA256
0c4d16c9d3fd763af39b4fd2d0c9c6fa48535bceb2b968853fc333bad6625a43

SHA512
e5d0f7964f83d27f5d2ec2831c603734dad34ccbf2e32763554ef953e299533b434c05649bb8747c13ec9ba512c15437f112c4c4243f8739e33a99c63008bd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4c1b9b6ac3e0f0ed44851d5c800ca3

SHA1
0ebbbd56f9e6dc5b7a536862ad913b1ffbbaf50c

SHA256
67f035ad325180fa985a49f94e304970c342c3c1d344c2ddac0100b3552d7bf0

SHA512
b08bf0d9afbd9be3d15a6785e102054ec9c369658aa21309bda7e1d1cd902f6f247e5755614f96babb3b57f003173c42dd6051d976c48884dc9bfe16893dcba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f19ace2d2e8a95b292ab9af2649ad1e5

SHA1
9c722a0cf45585b024dd1dd6875bc1c414f9e305

SHA256
fb31e5b9a2ecf83a28619aba2604a49b46d7c659aa26ce7ec4e3fed853a88cc7

SHA512
ade08429a6c8a9585d4d95442495c01a5d2b9fdfc5dc512af4b43e6ff4d7118d945356745e23f2fc98f5fc518eeb295e75ee5115abc24a508488615692871678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53efb587d0365428ae8eb5065a0a79f9

SHA1
51584154347407e64c865d0c3148461552af5acc

SHA256
1b0ed8a8d56bd4843b715f3304d407d801ba3b2fc3382ec1b789e1d5110cf100

SHA512
7cb9e1141e0f12a5224aee08980e70862df2147138cc75aa0684397f768c54c4e2ab7f1358594b2ef2e4b399ddd779f28952e02b1ea912b165d466973544f56e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cbad25c7916f31e9b60c1ff2ebe7662

SHA1
e1a76a119cf775b7f8f9c17101548a6b087018e9

SHA256
2d015b36aa28157067808ea5d43b37632fad0cccdc6f4ee25fa5a35c7cfc8623

SHA512
fdc3c86f7edaf304546641af2d12bf3e36961762537f8d5a68ec9095cc057b7e14388c209bc450ee454a5b1f302911502d441b6b19f30e7da0d254282653c8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fcd590f7a638f88c61c030af2c3ff6e

SHA1
f77e7054e78857bac54b407380641c1c7f28b4e2

SHA256
e0332bc5f385d94cf0488599be4a2d95a97b1014a2885491bab142b3694a33c0

SHA512
100c1bea999cd0c07737df12b6bc2c430186802cd89df337a538bf7d72abbec1e3bf838d5dc25a550a44f86c635fdd00fc98684f04319db1e388e5966a4964bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0826f05f797a4ba7cb1ccacb133bdcd5

SHA1
eda876113394339b587f1f56cb52c388fc9e1496

SHA256
47a199578c9aa09cf4eaf6fc77db1e432971397c1197af4575ce88b9d6ed5d37

SHA512
d54439a159bd4d0d78a10ed2daeb2e86062248a4f5a7f22e7b0ae8b4b681123014aac10d6560556b9053237f3212649aec6b56a00a6d3f73b17f58a93aa91e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac6047e001e5f26db60c0db15d37cb38

SHA1
2641db1c07e4a4269a68ec1a13f4a6c0fc307dad

SHA256
bd1a4f86b6a4f6bf724e10ad09268e7718426909d7dfb650f02c6a325399988c

SHA512
e9e12e4010987943ff3840b9eddf54a105990c6cb828c258261a155b7aa807c6550640e8398c4556c67a9b1cca7802260345f1dcac1ab70a81e304a4e55ff8bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C7F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D42.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit