bf23bfc2aec0ffd586fed0345642f1dfdbf64255a110fca976301cbde35cd67b

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c485dd779392f7d8dba4713655c0297_JaffaCakes118.html
Size

24KB
MD5

4c485dd779392f7d8dba4713655c0297
SHA1

49a32160ba1a84b2707fde81ae144be00eefd44b
SHA256

bf23bfc2aec0ffd586fed0345642f1dfdbf64255a110fca976301cbde35cd67b
SHA512

3d1cf63c47fd79739a50dcc3de3b7fe1abd28611731fa3c0b45b1695c796b799a63866ef7202d2a8d7db80a8f94df8594f6240a387fc47da06553043da56d809
SSDEEP

768:f3GsCpyc+NSscTUhPNbZ04/rttrgpHOKTc:f3Gs59NTcTUhP3r7rgEV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0783b68b8a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422043177"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000122ce1f9db267e5aafa482d5c9dc29669b8f8682628efb011d094e8a9ed8e07c000000000e8000000002000020000000da6ea8de897eeadf519926e64b6831d7058af12480a2fd4374dda5f06fe95e65900000008ae2772a0dbb911a735b6d7907ae9f9ee195bafc93ef0bad2874b9cdfe31b01bfa5edc19425f4b79ddf315f60b5dea3d555a2decf5a4911ec728c6fe1e804d9effefb6e5de26d0422d96ec6cd7d28795c2b6bf88b4aea3290aa127797f5d8923f6ee398c7a7d365b0105234410f702f0e4c5ccd149d4a99d9ab31eb720c847f596e632203a85f6ba03d0789114fa46f04000000006997354437d02349f9b13451f2e3bb102d62bbfd9b888fe6fc501ce06a539613357e6385fa2b38e8e64cf48e5ff9676f225c691bb61a18027374a91731dbb45	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b79617bf66d6245656676d9d976cafea92cd244819b4e1bdc1b489fc2082b5f5000000000e8000000002000020000000601bc8f00f19e1fd1ff1d35aebfbd674231904bb1a54b3f20d9b670066e0aa1620000000f69c2de742e35470d7a4b6f212f4b7b5a106b63548fc3c3ea6adb0bb984447c340000000de26a637ce0727f0d4d362b85e99413f817176f889a8071ab70feb1c3336eadfb0cd4e68a27457717f1fe670aa829848c9ccf24ff775ad312e118f8075351e00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FB9B331-13AB-11EF-9267-5267BFD3BAD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE
1032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1032	2940	iexplore.exe	28
PID 2940 wrote to memory of 1032	2940	iexplore.exe	28
PID 2940 wrote to memory of 1032	2940	iexplore.exe	28
PID 2940 wrote to memory of 1032	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c485dd779392f7d8dba4713655c0297_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c4238b5f84663f103c7e720f3505773

SHA1
8ec273b5769ebfed0f729e31f0fee0fc970c48d7

SHA256
f5387138cb3e1bbc48d49836118216681179042431fa3e03a1a81642b0b7cd74

SHA512
6b1b80bd40e2481aa94cde2ddca11110e941317baf0f83c1b3ec313fea765e5c7e08a274bbd62ecacdac53a306563ca099ac92a3c3f215a48eaea802cd9b70dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8a29eae38d9ec18113127ea5b838d19

SHA1
6a4c5f9dccebb51f2a645ca4f2366e0ab32efd48

SHA256
1d7578bd8e05305ee9e625a7b38787edf13540a24f7b617f1e2fb8217c2e01eb

SHA512
7421f1b8455230d3639e7913e1290a0980b65858884747aace8456021ed82c87a7362b20da1ef37ea61bb35674c909968704e5f013c11293a09bdc3b774e2051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48bec0600b4367edf1199fb2e32f59be

SHA1
372d2b9aa667e6a2817879c00880f2905d6482f5

SHA256
97f9355766bb95c74fd778ea78da88839ffebfcc1bb432dc607c3b84373d851b

SHA512
c210e259ea534f3e392c8fb89f076f04068f577b288e3cd3e318dfb68050822e2ca8158250948fbf305d7bcf4666b3dcdbdc43e8f90185788b4b0d808a235d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be6eaa9e87948978b765788c3c5574df

SHA1
b34a137552d4f4e3fb5ed5e00989d0e6b1c5481e

SHA256
913743ec3bad0edb7539ed2063e6955eb301d5a8d0ffc629137a9699835ed4d5

SHA512
fd4c63796995a64a429627036f216ec1c1922448d63b9f3482daee06cda670155095163f265a7607a2536c55a0230fb80679f9563bf8c971dd0dedf2b9637c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7882d3b7158caacf561bfe5c8448710

SHA1
bafb4ef47e6c0d280c365ce6707054d674044888

SHA256
e39d581f7d52eead6596ce09f62a8659feb812580ff067438494f0382c5c1878

SHA512
fc9c0e9984f6a5a3e260d29506da6840ac7800a1aeafcd31040f505188a21f7885c43bc93d9945ff05fd014f3b6506f80d2fd7d7a6a4c816bb12c2630cb0f056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91092beaa1daa0225bc006fd6bec0340

SHA1
83d1a13356d4b51d87f19376284366b38a88e024

SHA256
bb4c52995ff30b8210ebf7607ec20b8fae1dff6d572ae7ad96d648a1a8edb69d

SHA512
100f827f5baf548b7e639e7e89d96017846751c3ae11e565258e7a756d1db3cd860c2c365c44da35aefe45a338f104c0e03c69bc9b6627a0fed8e7ed88f78e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beb3643fbf81cf7034431a8f1d199440

SHA1
e7d896a61dc0720d8e40bafa9aa5cc0544954be5

SHA256
ad013d2d9c0b7dbd51f50228d97ad71b7a790f34df5aeae8e63103d4b31ccb3e

SHA512
d98b555dbab2422dbf92f02256f84309fd04fd71fd800ebbabb3bf77679d4757f9dee55f4f9333471d50d8ef7845d9ef623a4250bfed82a1e67213bac79bcac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02e43144889c7eec3eea001a312f093

SHA1
c116dcba02bcea7d249e274e0a4bb423d85b4689

SHA256
c56187a12448c3605d4f85ef26277306f3c822567250ce667099e95c75e6a11a

SHA512
43e9ee3b7ca8b550224dd9890cb7d1efa8f3cb6f12ad881e078e34a78f8354756012af78e47123e111fbdc32b0354215d654eaf43d1b8d210f7de09214e92eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934c440a0ba4981be0d9d088aeac1b6b

SHA1
7e259ed03945671311745d5469021d03263a125a

SHA256
87157e08e8ac03137212e3474e3c12420935f7584f5de55a15cf550b6ae2d468

SHA512
b97afb9105ba4bcaf5940f80d7a9fd9dfa94c89326e8ecd2d61a5ac42f7846ed6e56299c29cd377ef8257d1a40afbc4911424258a954fbf5c4cb8b0f720aae57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1025c5692dd85a7990d2bce1b3f2e9e

SHA1
88c480015749f97b4ad0556167bc9a50c95d7669

SHA256
c9667e2ec848d8d394274055f0327a44266169aae51c7dddfa851301c92f3f4d

SHA512
d452dcb981245a6be01e4e16e6b8a16850e6345ef6af2ec6ad0e9b5491cbea93def3df0cfa211a3c999989c8621ae1b517bc2d8580df402e05a31cad15814b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da863aa1b344daf3dda4fd1808aea7cf

SHA1
2ac4b79081e604a5283323cc74aec9e35b117812

SHA256
7f76638fbea26f86d6b5b73d02367b63f88210d3a8c4f4c42f58cde9e30d3f7f

SHA512
0a99cbeccae1a79a34b20700396410a4d5233954fcce12269ab56b7f576f98e75a9ae1e96a9dae4d8019b597a039506950a8ee042ccb5c2533602e8549717f81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ce554eefade174e9e4a6dac8773476

SHA1
50ec4f3951438bfbd876114f14b648191a809147

SHA256
1444d74cf045183f89e26d392c561e15e4b3d2a5bfa0579db1efaa7a6a44abe5

SHA512
795c6bfbaca41275bea5d0a0981646873022f5048d8d88f3c258a29a801425787a9d56342120c88ca170fe27ad62554d1bfc90a2d9070ac3f48d664eff7fac4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\style[1].htm

Filesize
4KB

MD5
be230fc02acc67c10a54b30c2458be46

SHA1
cc9ca569b44d25183dfa08845c034d71272e4879

SHA256
1b3ca3f1bbd43085ec9512c2efa43e03ea7868bfbac01607284661ce666cb336

SHA512
e1b1b51b3f2c59a7577d6daac0800576c8a50c9e31da3f02d925d19fad40a8641dc9372a4d54b72e9027aef35c726b95d13a3c458cd3714429f9cd77f27340ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D61.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E42.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit