18270f389bd3d3544a8dfe56871d23c6098ffe15782888d1bb9ecec2686bbca3

Analysis

max time kernel
143s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab6483313396d26ebd2211d0e5ca2054_JaffaCakes118.html
Size

122KB
MD5

ab6483313396d26ebd2211d0e5ca2054
SHA1

303dde6bc8252c412e7301bcabeb8ceeab327a32
SHA256

18270f389bd3d3544a8dfe56871d23c6098ffe15782888d1bb9ecec2686bbca3
SHA512

cfb41da078d67f0f5939fb56c9933d2e893fa7400515cab2f0862abe6ecfacaf888be4160b797dcc6843a72d418534cffa8edb93db40acfdadf785c1fe348727
SSDEEP

1536:SYUyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SXyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9828A081-2A8F-11EF-A34E-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424560046"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ba5516a197a0d468f6bcc03cc7a6e3f00000000020000000000106600000001000020000000eb92b45c4177c189794f3f4b882f4e200fb1aab22e6eb13c396ff75f91744c60000000000e8000000002000020000000d050fdce49a6e315936099e2e37f0c2cda716be4c47a31061eba7a5ebbe7dcbf2000000084d3f95b0cff7aa3eed5540b08e7fdc5643d4d9bcb487a2bf42226bfa7a4ad8b400000001922e3810edba9ab81a406a2b6d58960097665c61dfec2b821086cb6feb78bf4ddfff6c27182d2fa799bb130bf562d7274c204cd8b820713e3300441b81ca0fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c5dd6c9cbeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ba5516a197a0d468f6bcc03cc7a6e3f00000000020000000000106600000001000020000000ce583b332c072c4bd68b7dd025bfcacf8a305f501b2bae0991b451350f390247000000000e80000000020000200000004060cd41502740e06bb245b0f418939631c7fd3d334d49a6ce7b83eba6b31dbd900000006e6378ad4cb095063d9fd53ae2947655918baf208236f02de9c7217c1547a4a7f9043b7c5dd17b6ddd7e6471333f025719e67416a3134100c30d4c40a7f21945935832ef47154f979c26185376858f12e7ccf8d55ec89a3725f8fc415ae6e2f227c98ef5ce5dd3d82fb539d74f8a0f1763d497dedb0bc8ba7be9a32747bbabeb30a75ed7d1a77cee6876b1f7436474bc400000009bcec0886645fe624b044bced7a33b3b283f37d72dc2facd10731d2fc26dbf9cbd10375548105d75cebf78192c908c5ed85c2760e4865915e73177e21774846e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28
PID 2204 wrote to memory of 2612	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab6483313396d26ebd2211d0e5ca2054_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47d08d4f273381c69777234ff3613f49

SHA1
ac30bc909b243dd93d1f42c986f3934e5cde5cb4

SHA256
c23e2d80ad5be48708b1052848726d08b566a6df46ba0b90980c959b2932c312

SHA512
6ce12669cc1fe927e72d8b73d72748567bdaf43913c2c67411ed951d3322a13814d6b96255afbb4633f3ef7c7f88474be722c135a225de9854ab2b8e2de76899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e67f2d7f5c3cf6f2d0bbd6a6ba430c72

SHA1
a8d6c5ed2af325733c5c61a89123a5819ef39e4a

SHA256
0b842715e841b0d304ea389153ae06b1e3fe64976e87dc634c76011a1c744627

SHA512
677ac35689a82234a0410a7c11eed0d841b4da51230590a60f02976a5d5a7dea52c019569d6c38d50cc7fad04c0c730968489267139858441aa66aae1a2b4b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ebb0d1ea0c8fa6c71bc6aa01a285008

SHA1
47e2ecf4fbf53128325012d0678b56223787e613

SHA256
05ce4931b320bf5f0bed2f636a939c18bfc378429a68493023f46d5297662960

SHA512
d6fe135a2fb2c04ef03e8de7adaab0be33c22121be7becc43d851bdc61ee4c53d5e22644f2f29ff21b01acb254e3c2f9e04eecf1e89b855a981e8b7cd231ebb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
899cabad078220c60e887fd682a63f2c

SHA1
a384ca12c9351f5c53f7a6101e0f9ad3a64787bb

SHA256
2d36a3c9394fe823d512e56a099bf2f4b332ce09353df4ddc15d326459ce78f4

SHA512
446ddce9fe0b5c1ebf77abaf6b4794896d4c6730885ca343da1ec4b864143cb7cd53cfe162d50a5359ee085dade581fa9e2574c77bbeb87fdc31b2875a0a8482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db482163b7e4faf705fdecf2164a778a

SHA1
1aadd4f68c7f6c41f0b98f0110411474ea82a242

SHA256
798a5c2b1cc2ca7fd612b344c90971aeb016fbe2e82e9de949d1e4e37f9bf100

SHA512
1dd0f7208cc25d2ca2a99ade17aa97e8b0804e6895fee60a58801e273ed4cfbf0c68ad01d618377d93c8fdd10c71f1d51e0c8b7f9b716ee03178575ee8deea2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e85b146ceb11e584090e522e3cf9c7a

SHA1
7686eb9f5a32c73d70ef0cff704a2e51330c91b2

SHA256
cc654115322dc921672111100506272b3a9240596501f3c0f5943129652064e6

SHA512
13f93d5953dd5a5f6ddd408099ac7d459b75cab97a6cb4db52c793440da178b8e4bd2be5778e4a2d3e0ea888a466e899a22fb5dbe1e5d57ed82ed1266372a70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4976c5e250b8fcb29ae5b5a1f1e68184

SHA1
004e3e5f7d59d105c30176569dd72b80698ea451

SHA256
5e857e441205e3abcd0e19292c042dca1f584e650e4c82435c3e35453a4d6875

SHA512
5d5804880c8c22c729b1a1420163ad6f11094dd25345f3d2a9ef28add1738344770e31433bd8fd0bd50d741eac03759b9cc149aa5c50136a7ff81233924f405f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd0bee380fd8413118c95203d0ec161

SHA1
af41e0733c027058691535ebacf9d0df9f1a97b9

SHA256
dfe871654f5dcf4861e865b14699c338ef90a3176cc2e34a1f0f9554796fa976

SHA512
17c978d3278ae1510e20022f24426369509b8f61e649af15775cf8753a3e62924b15be47468dc4591d9c476975c196bcc3515debac82dcba954c6bc871dbbd75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca1d2509f136e880933e20f86088e3c2

SHA1
c50c2e9f5f9e4a7f5dbdfd2ce27a629b2fd487f1

SHA256
9ae5dfa4d6bfd02be2c5f1949c2cbd1f18f691742df1eb59260ed2de598b00fb

SHA512
bc2d814878c94f42bde70dc7fbb9b6ece47186bc139dbb5260aecb78371005c1fb84be3ddf19ec99f941c62dcf8f9ad858344199c78f50888da1ac5bb37c4953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6fec80645de49ffa26da3271f02beee

SHA1
306241b0da0c5f2f54e18b24b9c7bdef11ba4172

SHA256
5c0129a19562a9c229ac00d707a0a992a76c2e32feb99a5e8505b6fbc0b15c41

SHA512
bc878f97e43025abfec44e9aa873b3a7f85260c44c7ea5b21578766fac08bb3094671834e64a69d062770d957be6066ae29dcf37e09f7fbb45dcbd9bf6715ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6042a8ea7099c4d17f5cc65fb4744c89

SHA1
1ad27f69de1622c8a87a66c4333cc1fad2ba82e6

SHA256
1a95c096d4acec570d0a9e9306b1a7ec77689c58f8e93dc018eb7a944ec7f339

SHA512
98d034dcb8c84a531c7147ed9bae341291cb4e7f04954d667e0c3f82e620dcda3eab3f73cd5d818f17a85633a354b8e5cd3ac0c38b1bac940a66ae8056eec50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a685cc8d839b9655f29657470af6b9d7

SHA1
fde0bdddfd9eda9ac20bb02bfdae12bcb5025676

SHA256
2920c84fb76b62260b86b9714ea10504e4e18584a35b5a4a119278621664d6eb

SHA512
98eb78e10918414ca09e243553662c1a86e25f9fb70b59cf4975cf4c15a7e32e1b86cc0e9e6f74ee2ab14d4098b0e39ac5786e0129ea9332d72974b3dd4764ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c0f9d13ef8eb65319a233033c492d44

SHA1
ae36bc081a57cee574414c7a8aeebd86bd6698ce

SHA256
9f6e6651c9436d3aaeed7a7f84b9b497d748604e9971fb54e02e03b504b28f67

SHA512
7f7be70015d1a82f7160bde0ad4549f12365314b0e669ab1f8a353edb356e951340323693d77c8c5c30db54ec4b47a0e2ceddf57ab9b230768369c056ef21af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab48C6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55B8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit