828f77cf4eddc1c60549c5f354bf51b8bac3868a01b7559d2cc070165aa4bbc2

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403e50abefcf169330b6b190882cddab_JaffaCakes118.html
Size

461KB
MD5

403e50abefcf169330b6b190882cddab
SHA1

746f0597c66836be17456602fe7ed0a3a6c64fe1
SHA256

828f77cf4eddc1c60549c5f354bf51b8bac3868a01b7559d2cc070165aa4bbc2
SHA512

a3f40d37b66261a0956df7c40af7588c53d9535179902f8175171b7d231baede52d8f524e9f75c6314513c1c07b59aaa944c0f1c84cc3467a0389995a01973d9
SSDEEP

6144:S8sMYod+X3oI+YtsMYod+X3oI+YlsMYod+X3oI+YLsMYod+X3oI+YQ:h5d+X3P5d+X3f5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B755E6B1-1140-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000004c05aef0267e992ee4e8e548603e449492f0b6c84894c93a7a15d85ab45f0e4c000000000e8000000002000020000000f5f4a9d3b6c48f7ebe7c5f39a085aba2108144afdae1f7a4e88961f96ac45d7a200000004b9c8ddc52a9c41e4d44858a555dd93f566dba6dcf87578fc19504ac03ede1ef400000005afe80909b0aaf5e384b23eb99d002676460ed4e913490ca9d5347eb3360b58bda8985890f15de9b2dc1654b52939ae921d4a5ac4cfb34af7f1c43787e51e7c2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ec7446a5a9f41d374b0f762773b31774c219d024fbdf08c9aa8aa0d396e9f8b6000000000e800000000200002000000017a2d014e41d055e04600c0bd1ab46bb51865c7f7638d4628ca65ce91a82af1c9000000080e9428ca22c88779c8bc5d80cf1a0a99c5a89e8dd3cc5d75999a49205a129454cdd90fdebc3e452ad48c4dfdca3bc032ba24bcd0c0cb4962c725d7b679b0bad84e407f9e788c38971def404a883e19cbdf76e2aa6c0ad46eff8a39ec3c3e87423b8f6f6a1b4412b97cd3c5e51b8c255b71917fa21b06be52db328e9082832b58bfed21e3705352984e80ec754d848e8400000006eac8953c69e68c006f78c4590674b83734d04fab87063e9a760a5290522002a957410d9cb7430b119769c7cd8c6339208a1e5d08c1329d3d7ae29002e8f433d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421777392"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402fd78f4da5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3036	2180	iexplore.exe	28
PID 2180 wrote to memory of 3036	2180	iexplore.exe	28
PID 2180 wrote to memory of 3036	2180	iexplore.exe	28
PID 2180 wrote to memory of 3036	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\403e50abefcf169330b6b190882cddab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a49d06f900f499d7bc87234200ca0ca7

SHA1
b35e206e38a3cf48db72aa0d8ab443bf6cac7410

SHA256
8ab236d2b9d04aa749fb555fcb1a42ec8fa006fedd466ddd865cf9a247010622

SHA512
0105d596b9dbd897ef8e5ca440a0c770f9cb4a0a68f49530eb6924c8a2e40cb4504294d760b95a55731f32820b36f88eab6fb3e79b1008b779601fd815fa7e82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361aac9de0bc6709227f34c48ca94d63

SHA1
f9fd8772b867dca2acf6607a7314ffced4396bcc

SHA256
2458d02f43fd9bfabbceb30455fbbe2e8fbead01e71ccd37431325f51a0e61ca

SHA512
6a21d1bc25eb7e9217f470a2c1965b4b4a4c90f4eb5cf326c27948873860dbec5eedbe7e7a46622261e70f7b14a682f2ea587b5a6a9014578ef5b2a84f52f638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e589d57a791443198d0f7091d4a4b214

SHA1
04112c8a40c0d66c5357dc24eafa0da8e55e7ca3

SHA256
e91df35f17c3f0bbc6f8080452133ac82e964e3034949afc7663e1a3d673f83f

SHA512
5ff2fe348c1348823c571b628699a0b53b1f569915f47c53041493d31d21b278414f47e3f9910bee31c0b63d579fb5679af1935976897ff4476b07f4cabf4633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16152d38d09f68b33045dd05d56a2fbb

SHA1
48c45a4ac3a410bbb2b1df01a82e697869ff9eac

SHA256
e9c0700ab6abb600aba25879b5821ae70b61ac0bd250b6be36de989ef4095834

SHA512
2763886ac8c7f563d6783ef0692cede2bd1cca95258ba458ee8931fae5b3c7868bf21e2fe62a3409cb6180cc744f7aa6522948b012fa012f88e1a1999fd170eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65fc24600c4808f2113e1b5398f8f6d

SHA1
1a0ee241fe835994cf53402b2f601f2b712c1584

SHA256
ba5bf44e245f7a133adf31f5ef370e4972575616ce72a801017b664453101c34

SHA512
8f9eb3361a382f6509e4f03ce3c3304d1571e45a18f3f9a4dbb9f68705e6d8fd793ac54c8c8b0ad7254507578d71b19d06e954d3ffef89d6df08c7064d96b3ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71aff36e55fa8c63f27093647a3ccbf1

SHA1
f1dc9905da18a8f57238782458a93fcaf008e13b

SHA256
8ac1f0a0cec64a2aad6085b91c3e7fc2643b9d47f4d8ba49da88850eb3de5219

SHA512
44d0482aea49f9830be1fc0cb746f4cce8c1882be5c24da07d100d9dc8c38b838c1a8eac2c14eb38448a494776df0c4c85337beb88295796cc24e397a6ed0ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fdc221bebb31d98b0b13ae76aff256d

SHA1
8d30c48d4585561602f2785a009a73f6da77c4ba

SHA256
646638b4ff472b4e4dcf1d24f6c89e9971aada5ced4558671afbdb0b153034da

SHA512
3d7d3bfb1968e36db00f6fe9c58968c640534382cfb3c93f5b5d942b0573237e6870e52ae97c788d3e8b46ce0b02bb0f2d3c73342f1504c289a1f9cd4b0d1dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d423f779f273299de5b798a967a4a085

SHA1
73152eeec4910b1644c48a42ab30b85a92c5a6a7

SHA256
6001eddebbcbe02b05d2400c3071d1d714aa71de095a9abf6c539daf83cb7447

SHA512
142f32fccd7cfe6aac5aa6757c7d271a42bd8ac811fc867587eaef58fe365b41a871647021778988b18714d0c081d6dfaae232cca5d442ff0f403176f2ce3e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84754d5cd63bb765f603d5f3d966a908

SHA1
95b8addbb99d5cb2ff6831cb30f53b342ffeb63f

SHA256
b438d2fb1dba58edd2ffdd27f8110a4f19fe47fee978f086946314c02956ef96

SHA512
8b6d8bc9bd6303dd35faad425da6c0ef0ac3af967046d740c1aa8fa4002d7517d1fab51180d0ab21b7c16ecc0e89bbb14f731d8e701f6f102384e420d1f1436d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea937a04b152eb5c17340d5819476d4e

SHA1
3aa2cce35f43a533475079aa3aca3c39db6d757c

SHA256
8800589dd2e5aa2723ffb976ef87ea09e5dc6ec3c66e3fedab8b262e823abdf8

SHA512
107ec1659c79a02e215eb9d74111be0aa56568d3df9ca5019a911c9041876d85dcdee5f71161c7349cddf135afa5ca5431e7667d5a4e7d8ee10a0b30cea70995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d40f6d4781011405f845e79737516a78

SHA1
4829370146aa97f37890f31b3438188c6954e4e7

SHA256
912f024667116bc70c4f945c475c63053d7c1552be2a74a1f0ed642c6ba5210d

SHA512
5dcc049ead68c9e049899c7057fc9c489d914e4688416fb0280ea96ca98f65a3958a509a0b1fc19d0d524d545acfaa87876148dd71ee2283447e0ed19b2e0fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c6d6b49f5474772513d33a64bd4a647

SHA1
ed9dc227eacecfa9a7217265e0f74d4f4c748019

SHA256
198295d589b80767b7a333df09c102d1d63429f7f2a86862049d339785dba3b8

SHA512
7a3486e10d42f606793a72a8f6ae226afaa22865c8502164b7bc1ae7163ebcae3aa6cd739504a7da4925d15523b00e815bee90060927cdfa8f2ad0cc1651fcf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B4C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C0A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C1E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit