18787cbd986cfb5cfe6cf31b899a1ad6dd51e753637c12bf075bb009752ac435

Analysis

max time kernel
138s
max time network
137s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2245a4b163cd7568634157451ae84770_JaffaCakes118.html
Size

53KB
MD5

2245a4b163cd7568634157451ae84770
SHA1

3fb2bc8425151bfb79b7d9c0477308dd09775e15
SHA256

18787cbd986cfb5cfe6cf31b899a1ad6dd51e753637c12bf075bb009752ac435
SHA512

73caa1dfb5bacab3774e7e5723c35e5c6aa03d23d794e7e1cb35dddf2ed3d2d5a93b0261645206a2724bb848a18530685ccd523621257a6ffef67542d0d956d6
SSDEEP

1536:CkgUiIakTqGivi+PyUnrunlYV63Nj+q5VyvR0w2AzTICbb/oG/t9M/dNwIUTDmDH:CkgUiIakTqGivi+PyUnrunlYV63Nj+qT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426168934"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08a556d3ecdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007eaee2d5e750e8a4107be4847685db6f6567d63d05530d71019c98ed768ad045000000000e800000000200002000000031760bfb38d3cddb1ec13304fc7512352be89edf80d26deb25dc45323ef168e290000000018cda10ef7a7d485cdd221f2700a2a0b4dff0ab2dd406719561d6bf0b7432b4a424375f7b93b15a90c2d1632b1599e8d8fcc891e6a0d064f7dad6bb0bd0f5c9a12dccda97d15096ada3c4e670443d4239e7c5cb8da61089aa4eb80d3aab1bea0f2d298ae2dd58fee5d1a9e0d95614a596974ca5a52dbb74bc425727ee66e8cd19e99ccf70e64dea179174150081c84240000000582bcc34af5900bf3b78b4203c3c2c882eb80a5bc7128e10f1cdb21e045a26b9be2f395a155e8e602d99380399a85337a44638a63ff5e1b928b909f49b305ea7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{972425A1-3931-11EF-A155-FAD28091DCF5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000a4d13c0f2debc67471b8cefaf85b9907395aad340f2277a0d67b7341ba67f7e000000000e800000000200002000000053d00aea42cedfddcc768c95609d95c6812c1bb23056a9c71b35b6dd042df09f200000008fc5be5528807cb00bf0622337a9d479f320c8a72b660a005fffc77f10d562a840000000674e7e32ba992569d049c7bd848e93aa605b2b0b856212c70da5bfe3689b24b6f28d4290fde2dc13b29e3eb9cd5d1ecec09dffbcc1ae6f410bdaa0fa9d672352	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2768	2184	iexplore.exe	28
PID 2184 wrote to memory of 2768	2184	iexplore.exe	28
PID 2184 wrote to memory of 2768	2184	iexplore.exe	28
PID 2184 wrote to memory of 2768	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2245a4b163cd7568634157451ae84770_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76f80c025c09cb69364fb197108e21a8

SHA1
8a8e717ce41da66c808e1a6056c3802c541f3e87

SHA256
6a051cee51d7a94f3192c3e8fb624db7bc19e8456f7866a93f3872b86ff300b8

SHA512
386044ff3b26735d3d36e5e0d74997051a033cb18e3fb0047d606517b59da2c3871e3febd1bd64f73038d779a071c131115b4fc700942e1583a1bdfdd4b0e63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3831afcd7d7933a896e8b40ffea83a1d

SHA1
55e947dc8c98f711545035865f43f507d3e17c68

SHA256
b8d73fce0c0dc14bed16561af44f8797eae3d9c32917cb9d8918926829938dd9

SHA512
76a3792e2871ecc37831c5cd1779fd706cebd4e35844537ea57a4b6db082509023340c9d5a8a75628ca510b145fd45bdbc1287d4f3b7a03c75fbea9d79e216e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b19870c211ce143e3435067a12aa0b52

SHA1
dd784ab0e5e5599a25c258209dfa81c9375e305a

SHA256
8eb380bced917685560f3fbc9ea7b934d4ad857d2732164f7050e051f0451f41

SHA512
acd05d2a018e71119bf1d4cc5267dd358e5cb50fd2018582729277acc8bdd1f15fba36bcac1b0b59573e75cdf4feb505b4e81a54a28f70ea40dd3c51adc3ffa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed879c1ec3f6276d87f2e828eed0cc2d

SHA1
8ad4c56205b7c9c9009f4639b622c23c4c46e0e2

SHA256
ea2262a9e36ee56216c18c341e7e4caba230d8269cc483211c329d14033ccdcc

SHA512
d0dd04d5d1f0eb6f6003911fff3f7dfaed5f1b92e3f50507f13736a2adbebfc61b45a318704cc9becc675f3721e7587fd7d0fcc22e3b3b83890ded2c7526e34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06aed7e265013337060607be3dac64a1

SHA1
b562913254ef963f74ab360803f94c7f0eac9875

SHA256
ac4c1025b3acb3d60d956d5b55cae00d95301aef32417873aaef0b6412098005

SHA512
b0839a601b48ddf2d9dd535e9e5cd990ca2e531df62ea6b73d385017ef5b8869f8f11e42e28fbf26018ac718ad26e6697b6295f2201a225ea94960ee367754a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71c47015c6a6e0f4ebdb2e5856c4bd93

SHA1
0bb351771f37ae1c0766405e728200bf6ce13693

SHA256
21fdc327259973da201eab1542d1127d8e2798be8c2f3206eec73efd42c28375

SHA512
77bacc57359e20ecefc9d614f7a0046514a4f13c02871c7a934eac0c253a01def6bd49277df4312912b2345f456229519f6579aadd494ff2452f44c64eac91eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
278d31bb7f7c6e3b49350282295bba43

SHA1
7c426afef9af86a9f775f15fcc4a9a01b09945a0

SHA256
e3ae30af458963b489bf59a93a5a9265b3d13dd590143c56ad703b70b3a4d10c

SHA512
d055110a476cb4d5e66a0b3cb9ca83db560f556da9ed50b9ffb8213d869bdbbc71d4e142c103744d44bcbe960f74b95e6af3be2d52c7a290dcc0daf46a51a96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d611836f590dfdef0452b3542679ecaa

SHA1
1cc01596363cc9206016f126259f1098d7864ca0

SHA256
f0c7cbcaed1594e416d02079af3cbe3310e9f9bc86c66fccc0bbc9dfd7782e8c

SHA512
bf4bf7c9626ce9edca1f973af46cacd2fa22d56b874e269a2ab02cd3d418f694e83b5f13f8afc0405b080d607dd440f537d2c7d79dbda94d8d3f378f45e67416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa7eede0b309944494aec0ea8b25cdc8

SHA1
0eb091ec118604c838677af90cc05e447f9f8dd3

SHA256
06449122a95051a869c36bdf3f7c648488619a76a71b32758cbbbbac91958672

SHA512
3a8c55d2302353d33431569fd12976c7b792d9b377053085a9689e180153e5097be2ae10a7f9479db6461766352d6e204aecf435ec3d0f37c06cb8bace47e0c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88b3bdd73d78ae3227aec10348cfff5c

SHA1
1ef4921d3b9baf362e14bafb72edaa3f8a0f562c

SHA256
8eed4d6c50d7b9caae546fb88011aeae59808a9a61a6380a33ead2e5972838bf

SHA512
a7358315f577300a81b0c874c97b778a29d8bb98ed0075013277a4ebe7895f0ca9af59e80089b201633e5dfc978410cb7ddec931b073ecaebef2268c7bb96c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67effaa0203f4cbb89744eab08f32d6a

SHA1
69e1f9754f3833011d9a811ec89fb35eed7773ed

SHA256
a05d3ab617c19d1ef370b8b3fdb958aa47c029c3176f64196449a27863109745

SHA512
2e8b0b04c13dd55e7bcbe697b5f19cf93ba49599346a97f6de2bfb67863b7a8cc7ece4729bdf54595391038c53dd2ce0beae92c1e4a2d37b1c3e6522535d87c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dd7fa4c7d688e108796ae52f3f5d14a

SHA1
7bdc84013b896c3e40464aeca20576947c588a24

SHA256
64f85653a8773ae01da7f857a6af467a6ba1cf4cc42730f86d33e421719ba0a8

SHA512
d00899fbfd38839e178a3a7d84895e299b72804832d3e034bfd0091a1960d7fc8dfe2cf33b67c92ce0c91446d3565b05d0e8822aa762956da38fb15f040cb5d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f01c96af7089c12fd55caa7267225e

SHA1
fe52187a1c182f259b42bb2b840c50e39c6f5ba7

SHA256
3760cb73cc990187edad430588bc556d91e3fd662b6e960f5228be148a0e3131

SHA512
498d6d75e4ad09fd698a5e11badd01a3da608f44fe139f1bd7dcfc1ec182953f81c2cfa85465b94b1bdfdcb0a4ee788e1b8599dbf779f6827710f4ff4a9ab90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D72.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E51.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit