882af653512879332481dfdc5ef7bd62f1a999dd5f3842cf24ae3fac1ef31ca8

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b265c2097082db5b2f070df88aa928f_JaffaCakes118.html
Size

71KB
MD5

4b265c2097082db5b2f070df88aa928f
SHA1

45635508abaedaf94ee941ee0259964997178ea0
SHA256

882af653512879332481dfdc5ef7bd62f1a999dd5f3842cf24ae3fac1ef31ca8
SHA512

0d4f1f87849c1c2850ec711a844c97e87e63c171f470a4851acd3e02c60674b39c4bf452d0087edd3acffbb9986ebe345e101948f1f06d3c0024bde664d77cce
SSDEEP

768:Ji+gcMYRdsI+mInDD5BLd0gGezZOZoT2gwC2aZZGMdtbBnfBgN8/lboethcRTQFy:Jo/Tr2F0tbrga9nhc8nhVW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b6fb1cf49d95eef55a42125154dc39dbb35415f3cc30bf8f7c55503b05abfe1a000000000e80000000020000200000007f59120c413981c34dca290d95b5129c7c2770868361910385f0fd332c1e490920000000e42217d02bb4b53623c6ce89066c83156ae894dd1abd43bee5c75c6712d9c93b400000005f00c450a34ec3b1d9f8ea16532b24dd55c1964e816e118bd0191f1d099a349b3d64548e672c503f1a366c49527b790329a1f6c11ab999def8556ac8443cde1a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b025b36d8fa7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98E89BC1-1382-11EF-878B-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422025578"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000006a077257f7c828ddb09e9cbbc80f65c2d7ae442d0372ee5937f48caafff5848f000000000e80000000020000200000004c22fb91a442120d8b9a91e1dfdebab5699bdd2bc638242f0754c8e78996f9cc90000000133fcdcd92848bf7068627367d3854097bc0b1cc28b4219fdd02b1059bf2b508cba487d1471a40badc8547adf46ea15f37bbc519b3c060cf41c8a41b2562a8b004b8ea49b363ad09238e236dbac63a25454eb5bc10cac29d5dceb608e5d4d89ef4f3d9ea658a7db24173769bd8b763903e3eef488750c67b4677e769b682d807e8f6234f86d740f2a6314cad95d6dd4c400000004ad8e7b7426d30f9561684d2de50e9abd487f7c8b278311736c33b6ba194d877aed273754271b536b5004a75fcf0d72039e5c223f689c4e6a530c902ba14ced1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1064	2128	iexplore.exe	28
PID 2128 wrote to memory of 1064	2128	iexplore.exe	28
PID 2128 wrote to memory of 1064	2128	iexplore.exe	28
PID 2128 wrote to memory of 1064	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b265c2097082db5b2f070df88aa928f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b82c18697052f1715be9f44d4ad10dfe

SHA1
a31b0462350f0e73dc17f17cc7527f247241ec6b

SHA256
e9d3579dc5e74c11e47dc5c718dbcb1f0d86b3b345fa2c21192f4bcf60076fc1

SHA512
0ba064e4fa4fbe4f833e094ab46fdb4eb954dd7d623b4a9f6900d7039abcd26f3c28e5f7d0c86b58ce8a19b9fd6334af8d608c1cd4c07c68a38a04a08c0efe93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de41c54d5c1d30ad60a26bdb3f1b4b28

SHA1
7a4aca93f80bf2ca8831d4b5051adaa1f59a0997

SHA256
db70032f138c8211cba1edec74c16610f6a4fbaf7c144c2fe50c4c4939ed95a2

SHA512
d889c2922d4f42d6102dae7a5e4abb0edfd6ec8b4313a23f012e7ca4d98db7c67249e649d39f2bb0df5c85ad6137d94d90bf1f6829209bf6f040946c96de7b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4a95d1f7e8708066eb6db774431d3ed

SHA1
a0d7182820528060a9400f58422dcf3229527803

SHA256
d9942500675f426658859c57ea3f9353306a57ac4eeb7465d47b173bc4143ddf

SHA512
db7e0af9794d742ef145ec1259f6603eb188f3451621d250476e552a308c97a11476d5c6d69afa6a68fb83db7ee44dd414bb9670d45441be35883bac23f6f78a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f9fe928d2d57834db6000d36f5c2b3e

SHA1
8b0d3c9e6fce5434fcae21b35adfabd4837b47f4

SHA256
9e8ae1f1559fde231161c5bc8d7d32ecdf7f89f1bbf343ce4d012b49c73bc495

SHA512
5f41f702fc88f563cefce11141b8244f76b93e0c304c5dc9069d7e9bc8d6cf06a3c833747ad8238a0c5710df7a0c07fa58cdab744223e243c43d6d5d970aea8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f317022aa76c515e33e001717f22123

SHA1
2bfb366e33250e4a2b175dfbdcc2fd1bc71a231e

SHA256
c0e261418007ca8ea3c06c2deed71d7924992ea567f33eeb1873a22d29fa1458

SHA512
1f4b1ce900998914847c19e1a7b8b129fb015dde67b7dd3c580a214f37e0ef6f2ca8667359156858786c9c71c7008ec4173f16469454d9682edc0bb2b54ae6ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
842c80634c36fbb3ee563e6e4a1cf317

SHA1
e1c150c16fb54351d267b5fca97156bcdda55a61

SHA256
5d77ab8f8948754db85686b2049f65d92b950346c3ef4cb452549c0e16785ba0

SHA512
9a6e7331d2acc20fa4c7c77f18d146a43da24dc2f9d91e2ac72fa51a5d103b7f2ff5921bd3aa209d176ba53e65ea71b5a5d373cd5eb5adaf8c08f2e2ed62a7d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68dd9f064d81687384e1a2aaed49fac3

SHA1
bd409fea1f8aa3f0d1653b90e22adc095525fab5

SHA256
7445b1710c81aac3721337b7dcdd04450ba477579eb1500b5faeb4beb879f7e6

SHA512
1a36a7aff41787ad30b46fd8300fd76c7db685a59a6b699e6157c90050daa1ac6f202e744e330f866685f619eca18dd95bbac1c91007ab9cc7beee65e5913a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6b5c7500e22cfbd551bdd30a1854667

SHA1
bf450e6519fa08f65a638e883c4b10296593def2

SHA256
733f12071161c772248e9494b0b924af1507a50d2f6ed0681027c10c00f678c9

SHA512
0ddd9182e16ba72b725eb5555a2cad992abd6519c9c242302da273a54f1d257f88e6276c5173a23a92d50d3823aa229e907e5078d4186ce7b42c54c40dd48508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4801f14860481dfa2046d6aabccddb5

SHA1
f584ae4c70c258ea7a878b5e5516f92628dd861a

SHA256
cba13f1db44b4f9c5bbc2b2667e420233948dbc6a72f5a8c84ed694f5a937e63

SHA512
6411ea85c927feb7e5ae12c3648d93d78f2bfc80c180836937c991f607acf08facada8973cf53c809d42f184c7a07192d09d7704e069df5c2c588a3531b60681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc5c735474309fd55f92131df087f49

SHA1
1ba9d041eed7ea43eadc7d35d034a7e71ed4fda5

SHA256
e3190734a377fcb458fe58850b68018f7b5d2429e57486a74500fdd6551682c3

SHA512
2649418bd5d0d41197db7f43707fc775cd84514776468b5e36595e61ef8e4c6f7a4a83ee0ba9f8ed6c32f6536ced461bac8d53d368be68263626d1b9c2b9b041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab408A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41EA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit