bc248cc8f1e8db8db09e38fc0501ef6412dbc9868beb88d790efad575a4b75bd

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb677b6e1a127ffabcc822c144eeb39_JaffaCakes118.html
Size

213KB
MD5

4bb677b6e1a127ffabcc822c144eeb39
SHA1

50dd6921a308c499f02324ebb28255e62a833a60
SHA256

bc248cc8f1e8db8db09e38fc0501ef6412dbc9868beb88d790efad575a4b75bd
SHA512

da94871cc5fe9a1e1ef1a1d75a3545157682633054f19cf3e264d190a752ed45c136cf6cc0250d02ad2fa6ddacf2012d94398a3f3351e7e71dcd1c5a00e3616f
SSDEEP

3072:SK3dlC426TT/yfkMY+BES09JXAnyrZalI+YQ:SKKwKsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1880061-1396-11EF-ADEA-C2931B856BB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422034263"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2924	2756	iexplore.exe	28
PID 2756 wrote to memory of 2924	2756	iexplore.exe	28
PID 2756 wrote to memory of 2924	2756	iexplore.exe	28
PID 2756 wrote to memory of 2924	2756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4bb677b6e1a127ffabcc822c144eeb39_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640526ff5abe059d5bde4bbacedcf185

SHA1
173a1fa564748ed3c490aa08479e5e5849096215

SHA256
c4c25da2b95f552e1a661b894576cc3e56837a054793ea46bfe26568f318f5b0

SHA512
df471790cdbfe1aca31cafbd3c00a9b20937bde5e56f251cc7123451bb921860286a2a798bfdcf5e0b7bf237ddb5fa169abc246c6f149731c7f5c1f0192719c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15bdd2a441a744571978a1bac99c0122

SHA1
fbbe4d4270d5908d17cf35da2941fe2bf6e621c9

SHA256
a50b9e84b2a4c5eb898fa7a34e88e9b3021915fdbfe456b14a2b00a7a66b598e

SHA512
df85b8faedac8910e69e6aa898dc2ae745c4cebc85a6d23b040e3d34b86d35351fbea2a2cba9261030d19174703b6d4e4279108f503f569d09b774685a8472c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
516f92d4a902581adbedd5b9d41d0fac

SHA1
0a77caed3deb47ee1ac8d524bae9a98ff44ca45c

SHA256
e58d851fba2e7178792254dec8fb45a1b0258c2ac09f5020c641dc975eae6812

SHA512
7d59f3ba73b0778b18788f8d6a9ac8a28124c7b258b19f2a1698ad9963b0a49fc8faa436405e1857204d20c2c224dbc4377e59f18528aa302156e2a10e3c592f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53a5b634b12dc884334a19c659eb0479

SHA1
b8ee94c188b7906fcd27b1ef6b9b047e6e04885e

SHA256
8a0cde363e103a93ffa2aa7995962c9d4361852e3a232abb96975bd18c94295e

SHA512
b9463e1fbf143226ae6c1bb19abe3d4a7177981a03148f541427badda202b5c6ce10512f35d1c345cc938ea973338a6c5450502c5057c9209614e438da4e0056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7562eefa66f82c11f16a8822abcacb83

SHA1
7b7585812f8459cf930c1bec067fdfcbea508cda

SHA256
4264dbe7a39771d3e9bf7114992603a6b7a30f57c9cd53d0e3f11efbeba8233b

SHA512
a21b76fb98181b7d3d759ff4a0da2d17f202412adfb93bbb5aa40ef8209eacf531a9854cd43c1545fc74af79824d4bd3129342f1e9668d75be6acfb3f95bfa71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece92c783988c2b0733bebc2aae78bbb

SHA1
02940fc2c3677f8fc49df62247535e161e3c2fb4

SHA256
4ee704b17cfd8d4c442a5199fe2ef6dbd9a77ddfe726316a32ef773b6a05ef8a

SHA512
5e178a727aeeef87b4d81a75f4a89f6fb73bd7b9c1dfcfb847996996b9ea60b2329b416d6e7e3d60229d9f6094fcabcf7c9a0902dca178bf876d1116b6330ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27397de236286d01cc610ca035cd7f4e

SHA1
89e9fa29a19e9b55bab860aba3ef13bd528e96e4

SHA256
09ebef9754ce7baa95529f2c3e0057aa85f389b3eddfa200d021d158ed91c80c

SHA512
710df92216f256fa63013fac2ecde0e60ac0cbfcff93d10f5444380ba9db16faba8d6daa587ba13aa0f6dab1e8fba5772cfe09625069557ef4327355f84584da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ea10ff775298c27a8de9ed00a263b05

SHA1
0dffa3dd0f555275a5b35720d65983d99827456a

SHA256
82d26cab1d5a7b4fc195413c622da28f6ad94c5fa257cd4885e73df550ce34c8

SHA512
f7bd89a66a09a0705cda37298796de9871d1643a4ad8e8e6337560ef035f46a1abf16ac3cb4c03103bba9992b5f80e42004a196dc4509f6c5ff7892971b075eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c441f6f01ffc03d76e5d7ec8368ae5ac

SHA1
2de1927c7f67183d3c319d7b5159ba0573678eb0

SHA256
fca78955c9fe61c7ba7f8ba38034c40025df7a25f9c3756b5418427982e3ae7f

SHA512
4f041876f105d316056bfccf4a14f182ffc2f2e9849952fe680c87c1f7ead78c1f52f845fcbf4ff7932acad25502eae2bbec691d15ef251a595bd9ee00437c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df8251c8497986c749d12462869d18bc

SHA1
da8e0203efd1080107c7074805c0de5cf9f23a03

SHA256
ce12875edf42c59004d6029302a2b1f716290e3cef178cdcfc1654cf4995ab52

SHA512
5d679623f65e742186d5c5b489925780c614aa0d8e02464b807680c117ba19862a9262acafc8d891950b88eaeae88c1095765fbb4135c5fb2c3feb209c9d2112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caf81d5aa2da0dafec2b9e1ddd87102d

SHA1
46bffb6a05af0da09e5fa8579a6b952d92e46319

SHA256
fb9c18e71266de9b8c7b795a8afe4ff036f6e48261b635a027f98bb18b9dd76a

SHA512
c1d56c516bf1779c623bd6296eaef322990505ccd0696cbfccee6ade20d6c1cb0587e7680f724eb42a932080a19118cb5527d9fcb9c333e815ac02d243c7f7fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdd3931ed6f11d6f2b552de55d40947e

SHA1
7decab184ab5986e05c88a545e3af6acc0597558

SHA256
4d73854f0ff67a296f8716fe60ec44172b1991e1a5ad18ce974f8e3b92d3cdb1

SHA512
bee2a313f3a6854349facaf4a054c57e1911d67377f92c6e12c4163685291113a6bef6eb6264a6dcb01f98a6129a33a602d7dc8a395c82e350285248f6a052af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cd7d257291ad6df47241a4f93360733

SHA1
5fbe1a0b052fd1db3c98815d21f4d77fa7c8f611

SHA256
06557b1670adae7be7bf349a043be58c82f35de94a8c45b9a2a8da75e7255f37

SHA512
52794e8c6c2b916a8431c1307922198ea15fd5e82377ba30f6edb528cdd2aa81fafd65d9c8e8975153737a334f8184dca0dffc267e2c3ab6425a52db1ba3e876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f1cfeb933b003905813d6f1ed1c0133

SHA1
9e14e5b889a5b4d5acc0ea05a9d4d0cafbe5ecdc

SHA256
a0fa3b53229eaa5c85d74c32af904c96f0256dbaa4a62d89b07b92d2c993ff1c

SHA512
add168f4766c4ab8aa688e70a6ab27d733d8d1d66249ad7f3fb3122f427ca7ed1300a811d3678cae1b619762c32ab27c6a994693237c6765b038a1e6887e6fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab123B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar129C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit