16cd2817db317670d53d9d69ac0f7e57440edcd366dc79145012d28a452459d4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96008cc37001d25d766ca929fe6bde23_JaffaCakes118.html
Size

27KB
MD5

96008cc37001d25d766ca929fe6bde23
SHA1

d9a6517e967dd14bcddefbdd6782e8dcd11db1b5
SHA256

16cd2817db317670d53d9d69ac0f7e57440edcd366dc79145012d28a452459d4
SHA512

4b3e792965c22974de214d2fa05b45b873f41c7964057e350e39aacf8ca73de3164d24ec458dee14b832bcbc1d3fa05625ab8b32e1afabc1d5c012cd6d5d5fd4
SSDEEP

192:uwz4b5n8CnQjxn5Q/DnQieSNnInQOkEntVxnQTbnlnQ9egum60dW8Ql7MByqnYnq:RQ/MlmGW3Sojo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{166D25E1-22A9-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423691378"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28
PID 1660 wrote to memory of 2708	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96008cc37001d25d766ca929fe6bde23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
87547bc9c9c9632767a0a4a337dcb996

SHA1
03166cdade7d9ae0cd00b168a9a10d3d0b5bc8fe

SHA256
b3e37fdbb5bffe6788896ce50b0de40754ac6d5ffa27403455a04c9bf74dffab

SHA512
5b23770ec1c9087080e39170252ff739293e68b204778422799ba01779d393a5cf73f16de854bc87c8cce1572202197eee442565cc62323e64f55adb150df3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1026cba7cd4d83bf22198496fa9af43

SHA1
cd1bf9d2d5fb09db8e4295313a2b31c39dcec6b8

SHA256
e839fccd97159153b9c4a2958134c438b313f47f8059e62aa6e0ac6a311cf026

SHA512
ebfba2f71dcf8225e4402a5987ba6bb4dc9e5867b72308073acb9cf3c3df81474ca4093d0680872f2297795b222294332bd40c7bab02df926996acd417782060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cfb4b47a15da3d7525f4922b3057ffc

SHA1
80192eb42119c8af6e7c677c95dfaf4709793447

SHA256
c374fdc2114833ab76aecdb0ab9f07db795a9adc046305f43e455028e8e2993f

SHA512
1fa7661b4f337ea2c8692d9814cb42751df9c9d494c7078fa052b6e8709d587781a7b24e15bff7a6099ee077d790b0d27c79538961c474b45c0d1411aa111f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98f97ec6c77e410038ad6cabb5036515

SHA1
7789f55faf317c990448ae27ecf1bca5c5ea623e

SHA256
b402d2798d9b85cfbbca590d052c80eccb4dda16b8576c49d471abf727a36a57

SHA512
46fb94961201aee9afd69035f641f99d9afcfc2b86ef277024e6cfdb17e97fb4c4551db0466f1d2e9b118021c81ad41efa87b580a1ce81f5ba967585ef0c6047

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c976ca7c0cc166478c9f9d9723b53d5

SHA1
32b5493f25f72ffa024be8844d312c231f23da86

SHA256
865d7efdc446c3a63e012c491c9a8e3bd4db2c5eb260753632146da3a8730700

SHA512
ff22eabb87b070ed837fbabfce4fc91613be92eea6f9e5798edf90d9f21fa84c8b083ba02a8eb8c5e89935215e4b3dab3394b203184162f124dba9f11fd76b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1acd1cf502d96523060d5d55626547f

SHA1
47d6de807694b84cc8d988b7d79417326fb29f23

SHA256
804bd9bd81eddb13a46a926b43dfa66677cd607472b73d804aa5009d6787dc5e

SHA512
db0a14a0159838f3d2e2aae76750ecb1372a66e4208ce470db7ce7bcd5ab70c5580373407cdad06bca2c4fb2520b2d70668676a625f5bc3b00ab7d4f75f9ec33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b8370a7eb8fb0601eec89ba9371cd5f

SHA1
2c9971fe7f00d04ef42237090a499643f7b987eb

SHA256
86a5f26d0577e6768bfc447a30a4f4f8eb5bd5b1472a920a8a48b653bd086a9b

SHA512
7d1c3f4eb97e2d4462875da3403d403aa0daaa2a36054678eeba43646d99279362731015af84a0952e7fd5446a462b0738d3f2b14c10b5db9dcb078e1b4dade9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
021e4c3a969314654907b20b3cd1e69f

SHA1
13d708c38e25a760e43ebc9ff634452d77745040

SHA256
80f596ce4f268c9635e474532f3c803d662eab72038a8f33c9be535677537571

SHA512
0bbde9b93fd8e44466868c2325a485c813b3a4810b48d81a243c62cef04945ad4ee8b3b1baa735d43a90c38f3afb95d06d084b56d66843ee7ef54f566fba481c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a68818ae3d1ebe712907b9648afbfd9

SHA1
5046372bb85b5d761414c05e5dd669122b7ef658

SHA256
4b9414e80dbbc7bee73cab17a790cee8d10d04acd1eaa3d99144fa31b880568a

SHA512
4d7bdac53bf505ac5406f6c1732526ccf434e78522505accd812d5d71478a6dc103e95b1d1a3eb2262fc389dbc034707a28132e5174e843795726909f3f69ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e0d09c68ec6278937bc86e94f1ada2a

SHA1
bf3c22d8913a96a06ab392ab657ee733dd5008fd

SHA256
ea5a6fefc635da3159ae1464e917713a96bb77ea48e6356e3f9beaf1344ac797

SHA512
e9bb343d589191f4f7ca49b0f9eaee7aaeb16f4d440798c67b614eb863d9be75bb28e13ccb8790e3d5168aedabf75e925a2520d0ab998e100bc7abad89c57b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
75bd06aab10fdccd83040e3b6ce5c09d

SHA1
c26427328318da0c0af987ca802af36bad30fb1d

SHA256
ea4fdbec18a8d3957ab54aabfabb2d560026425b46e75c0720dcde291630fe2a

SHA512
3cde9f6ecbda19a2f14e6ac2341e72cdf6f8246250102edc9fd196d3f44d49255f3f06d0b632cc827292d2df1588ee43ebd0537c2978519860474e89f0b1121e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF3F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1099.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit