102ccdd093969284cbe2d055bab34d2a79128037d5c61e01f341ee8c1056c048

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7484e9e72365718447c591e5cc5db90c_JaffaCakes118.html
Size

147KB
MD5

7484e9e72365718447c591e5cc5db90c
SHA1

1333ba788c2f18d729a010550a63054d278dfc0a
SHA256

102ccdd093969284cbe2d055bab34d2a79128037d5c61e01f341ee8c1056c048
SHA512

3138cbf3dbbfe06048e3441d31e9f75ece18e7f984477e72bc6970835ac230001efda5096777761661d95924b7685239ba952115b4a44ed50460cc9a3409d438
SSDEEP

1536:Smmy7fz5z3xPA/6S+VBNKAa/26upJRtSyLi+rffMxqNisaQx4V5roEIfGJZN8qbI:ShMGyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422864750"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9064e94631afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{725C1281-1B24-11EF-AA6D-D62CE60191A1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000217d9bd4153604fb2d946ef186665228fb0f0520cd371d5e90a983c3e8d90214000000000e8000000002000020000000a530f8b4722905ac2dc56e3e2032fb0bcc3dd6a90641c852605bfb9dd27746712000000007473a2e7a19020e9b83849c779a3788d0538fc2fab1b90162b8c0cf3da4147d4000000006b21489f8cb50a0e679ce2adeac0d4a5d8589395fce4e733ce412a74217f01ab7243f93dd9f73692b2635c745bb251a74695cc7c671e7e016d7b5b534a842c4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000001d5376417edc5c3fffb71e2732336a8b3579ed75ab48eae3212cd4f83808e1e5000000000e8000000002000020000000af29e65bd5325993b894f4bdd63e051864062cc3668bffde4927304aff3a1bd5900000006df666567ed8b634c34a012225ee0bf8a5a956b144aa164ad1b276b07d7e17fc43e2f1484fd84482a8cbd86c1545e006c0dee87f7bc604fcd81e60d5acef9f0e2576d1dd484d8dd05ff9f7bfbfb5b48fb09f807f3181e2fff9904848239d6657b9de4167ea1c49fd54e93c380e2d109e6be17cf10a1a3134f442aaadf05866644c4d54f59606bba1e82ee49e9cccd89a400000007c702551817f401f03da1077b24624232b4c753233040f553927f32df9399df0047ff069200d7decb30ac6bb41f41d4dafede3c9855fcfbe752351134c8e6604	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2852	3016	iexplore.exe	28
PID 3016 wrote to memory of 2852	3016	iexplore.exe	28
PID 3016 wrote to memory of 2852	3016	iexplore.exe	28
PID 3016 wrote to memory of 2852	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7484e9e72365718447c591e5cc5db90c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3025371689ddc46b269166f84185bfbd

SHA1
326b4ed8b34b514408c096af6e7d1e2ba0f1f213

SHA256
a177411def3741c08d28ae5f9cdd68df273a4ee6e28990155246c092d887bf7a

SHA512
03df6705bbbef67cbc9935cf57a2954e2d19876be3326293c541326cc710577241466f1ed6237a97b0e2005f8433e15ddd0424d865c800a5c1326d7134d88db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a2e3d6d2399a53ee7e80bdb701e99eb

SHA1
6c99b91d9b645cf4ccccfdd469005800a15b6195

SHA256
bf77ac5babe73dd59289ecc9bd5921ac305c18ac1680436a21c388a65a3c48fb

SHA512
480fa8e7f6c674c2094c6fb7bf03cda302a6f2dea99d9e04172fb69251e4a959e42cf5c0280b7b949038b5a712c10fec57dc644a479ac48f23b4f207ec122ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79296d96bcf9c23678fbc3b4b1812389

SHA1
91229b1b00ae1399b93144a07578dcaf1b48eedc

SHA256
0dbff6670a200767fc1cadf93f021c83c45385ba7de7e0e1d8280c448d8e3fbb

SHA512
eb6a65887ee4d00b78eeb89630c962169da91c0002b00a8e5ed0641b6ac3af1e053cb6825a66d3f5a4b2704b0e1826dd4568bec5da9feb1aa089f3d92c41b23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd768692fdb6657d14da6eb766159a6a

SHA1
1cee2482371d112e154b021bc5d9f717e78093e7

SHA256
7ea5c9226e43077ef644dc6f086f440680b3c9942aa00760d907f5e1578c7ab9

SHA512
bbdbfaf38021702a53e19dd216b1314cb7769253efb50418d8edec740bc6b6dd19866efdd0536e5287de599f67518a8ba29c384e336eb2640c9c3e248294429c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9634074b2918667d5bbb60a086a631bc

SHA1
e7c545232d114eb790b785131c5cad807f6d56a6

SHA256
bef402ce219261371acdcf8a0dc07a5bb1f8ca8b68a5b74000ef13a65f210b2e

SHA512
e8b2762ac9a0e352604b1dab8470059621792f2994e31b6f1b9e801525b48bc68dcae89da14f218daf530d373bc17ff04201f17e8809b6a89babda7340a666a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0583a9274facbb9d198773e32d2461e2

SHA1
de8dffb66c6c9c4c9a628a30b887ab848bcc17d4

SHA256
15309d282055aaf05b522c2f876b1288e2be51da5b296cb7ebcb3305d6354fd5

SHA512
b65883f2a8359dd24208c6f7255b9888187f63149d7c01c68e6c2d470a1f92395cfacedfd0dc3d359bdb19e695d42960113628efec29c70cc4bd5416d73ad385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8d81016e46abe61162ef1543334fa3

SHA1
f1ae7f68c4fd1e8a02da2356dd841a0fcaa5170f

SHA256
835bed763635b1081b4e6af1228616548b7e35b12e884c10902a09d89007bab4

SHA512
febdcca2bf9c0cf3fccfbd0e75366a96dc104703d0229882d96ba4e1f6d04ba3be239b2e688ee898980ba4fd4afcaa0075cfe58e0f3cc1a8eee2c1187cff9a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb7173e4d0e8a87b437a83d27e3d00b

SHA1
356f28e1bcdffe7edda35705041456a1783b9de1

SHA256
e27971275e1a1e03f6fa42400ef29109973daee671c500687f031790fc20ebf3

SHA512
326a2396f4f6ff584015bfc644e0fbb5e6bab24dbdf40fb6f1231ad10230db0170d78148b4e5611e809bde39b1a34be4de040ac38e4ad7b9971852bcd2b947ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a99eafbc31c0687f01640b75cd5227

SHA1
35404e1b324367724de97c3a265f73a1de28febf

SHA256
78dd4542e458764793d2f7059e4726c43863fdee60951f63031e0d7ab9680968

SHA512
b6907b6dd7f07ed3fd20a46a5a02245df3387fbd659ce2fb0718681f4afa6ec3dc8f9a4ba8d71ba60cbabfb383fe8a7946a6cb1b8bd963280118e8f5a2ed8e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20cbe64839c841570fc3e0983245f01

SHA1
de2fb903e08891baa07588ad0860302f5db3d487

SHA256
1b4b251f5be4baa1b0c11a958b57bb8efd320777fb5e475d47df6d834f0b2363

SHA512
a06146ccc48eaee15a495e6f042ec09b5b6098a8429e8416f084863c298f34bc1b92007aa79b475c876900336b34a788029e9df67ad0750b159c7e518c42e303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4c0d2804c03098d2f7d6d0b25661962

SHA1
4995e55ddf4feb7e41f631ce1a905b1e1c6ea3fc

SHA256
5184bf024de1c783134cb9b34184c8136548c953588ed2b8dab68be0012c4104

SHA512
91eb805b2192040f1b0b832712a302a78f5d09257019a124f457a9cdb5737656c4044654d319553b4f1def2b2ab95995ab5923d6225ee5023236c01b8ede02ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b61be192e1a60963366ca9a37b3e8171

SHA1
c6b7cd9ddce7105190057d59495842d5953f57ae

SHA256
427f56f316740219016ff48d01b5bc0e7176b7e7ab333acb5cc6914be8c68582

SHA512
364f20b4a4749d93c1081a37e069df8e2d7cfa4583c8badd234ddc441f11f58b7d97d5c36e4bf51611c0e2d72a5f88ac57e91a371fc4d011668fd44eff2f8056

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F25.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F86.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit