cb5ee6b45e27a14965caa27c24b32a8acf38717bb0993b77742866e345375723

Analysis

max time kernel
68s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28da1cca2991ea74fe68140491eafc99_JaffaCakes118.html
Size

36KB
MD5

28da1cca2991ea74fe68140491eafc99
SHA1

539b091c7f3f4f05052af328ab5b4b3465677c2c
SHA256

cb5ee6b45e27a14965caa27c24b32a8acf38717bb0993b77742866e345375723
SHA512

f1b8a56d40e2e509aba1f0025708566351f200aed34bc02d9b1c09cf5ba80655ea0aafbbb7d45f749283caea2c4df1a9e210cbdaf19eb328c3914f8bcbae5b7b
SSDEEP

384:j1ScFtQR7eXFHVN9gH5HFtELp+72uHdf2eS+ARz+5rlRRF:jFQ8AKH+ARyrxF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CCC2A11-3BC2-11EF-83A8-4E15D54E5731} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c4a714cfcfda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000080219a5017a31ef75d753d5dd94d3904b8df33cf77ce82cd54cbf8f340c88644000000000e8000000002000020000000f7177a933019984c825d05e2b8e8c62b9618f5e9a687441985f934de6cc97b8990000000457519a145771d3542493b943fd6776cf75188828f02accdd6e3e2548c51d078ae62aa35bf2f7506645ad0be71b382af58088e6e961f8d485593c44aa7915e85a6467ca86282833227ace4933889aa2122ee6e2dcd7dc1e2f59da77c8029099c74b5e955662dd630b69547c6e929bfe887372de2723d1b9c6e76eafc8ed7b08e21929fed655c095fbb728c90523571ac40000000140ed642e8a465348b7cd65e3f49a0f846a67ad690d9a493b3e76c7e3c3b119679d879cd28d93f1f9c72146d1c434aba93b33b615c4ca005ade577fe450611c9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426450959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fad84b75b4b72d134d4d0d1242654df9936f436ff2cea7375ea43ebde92b302b000000000e80000000020000200000003b78afa3292ec06b7320cb14538e1f207f1a1d0886552497f4b57fbb9b78cf3c200000003f41e57879bfa1d7d37eec5141346d2b98976e641c0f695154d87ac6b89e5eb8400000005a5056a2432195ba803bb42ce2136259d4d65ed0a30d906b59c7564ff83a648b5ff69d65c0ab6eda825727478fd7b069f110b63c982ead2818b209d930895297	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2716	2328	iexplore.exe	30
PID 2328 wrote to memory of 2716	2328	iexplore.exe	30
PID 2328 wrote to memory of 2716	2328	iexplore.exe	30
PID 2328 wrote to memory of 2716	2328	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28da1cca2991ea74fe68140491eafc99_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f23bf11ffa14a770cc06c8fde3fda819

SHA1
95b1e81c4636223afddcd6c2efcc3476282234fd

SHA256
b990cb765c62b7996a3ca3bc1787c7f488beb3127cdff721e5d58344ff871873

SHA512
599ddd2f9395767fe5b3ebd69f4c98684ceae944a7e0dfb60c5307e7a1266b7501217b2bb1b1e0e9d607f641c7574767eaaf074308f99e7672e612f88a62674b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e0290b10defcdbae7aac6f379613ad1

SHA1
6dc09f165bab9a87eb077b769105b9c00f291534

SHA256
7926f3aa165f0786a6b9dbbcdb6799119d58ee5ad646b83d3e6bf6d0efb56abf

SHA512
c5588fd852ef2893e6c7d027a7bc2a6175f764b45555b0c47809cb01fcc604fb5a91f118bd6ee772de39d86e7ef3b19eed79838f50efb6ca9b770501c968a30a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b411cf6a6bec5f9aa677bc7d642d0fcf

SHA1
b49e26fea2a709a50d6e801d752805415c8f0732

SHA256
87c3e62480cbe6637008e8ef3a368188c7f6361ad92a1f679e0e9c2ea1ed7a25

SHA512
8e658707e3439b1c31bfcd66745cff953c24c0cbd02b30e071c9c4fc04cde8136f3175dc6ccb96def9865174d3bf1c8b4a9b8074bd6adfba804657c63c2127b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b426344136ab002713c35d87f3ddf450

SHA1
bc6cd2806f2bce0a2993d28e118172e47c9d4056

SHA256
c00ff9fff7b8b95363832b748cfd8b9f30b4ef82890d0138b8a4629fbece718a

SHA512
13cd8269435d6ce7d6654da96d687884d4be7ec9dc5ebcb9ea8e05435444f60579782edf2f0ef0ff63f7d12d30b746952758a5e9db65cfbb52fec0d40e583d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12d33dd8e8c0156bf573908049d166f3

SHA1
192f04c728ce78f79853129ae5fe8d3b2eb4d667

SHA256
a3114b705dc7d7446db8de4625bcfd59924687526b3fed6020d0c01bc71df67d

SHA512
9172b5dedf72b20c4ff2e7e76eada3ffeabb2c509eb2d162e83c44b764789716b818024199f77b3326d7d90e64cd43e4b37b460821e11e4887fde54065dbba31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
148e0976364a22de45cd3fed55876b37

SHA1
445845fe44ce17e5d203bf483f4758aebc929486

SHA256
6de6855664b777a64ef2a980883f0fa7f5a2962debc933e3c2399ddd812ebfb3

SHA512
83743a185323f0d80b8e2d4d4a9afee2c9cfa23c89ce9fb00d9f580de45925d4575cb156c28f1b4d25934f39ad9ee12badc7db28c7331ec296cbdbd972db614c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8a06765a62315711272d754ecb65713

SHA1
3dadef42dae054b2a710b58a768c6a9302c5e94e

SHA256
15fad055ef88a665cc4bd98614760eb3d826492c2393d45d939278e1f5467867

SHA512
d886c47a9af7f8cef5d0a09dc988a21429904dfe73a8b64bd7438022d23deaad8fc92412947d21311a0871a025d283b2d7b5419473bfb1898dedb157736eb84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e654cc0a82d995a4bbd4fca0e6e1b7b5

SHA1
3fcd27c83887d5331a81228a18fc530256abe621

SHA256
29fdb851565bff250dd201b46976ba2af0913f4a5804ce9e48cc9a5989a9c7bf

SHA512
ec4f08cdb4949ccfc5ed55f412a667ca041a86a81563bafe2f050bbe8557c863496edb75ccedd4e6bbd9b2bf5ea60a70e39a7ff47daa290b9611589f991a26b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8ac0d5c138814ecc16c082798296df1

SHA1
9ead1c5ae1399729ad03fd6f386e9b8259f13727

SHA256
b29f0049466970cd01a1243bf606c42d81076fdaa728389e1c7fba13814974b4

SHA512
b076b8b8a8056c8baaa427c77d996bea31ead010e4f515453e4174d921c44486b7fe4ff94ae498bc840205cfa62fcbf5ad1ebaef85c3b10dc197c892bad69503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32794e7700c83d9fc5bbab3a66a9f345

SHA1
fa422e06d066ab46ffe52b1f8d6a8cc599b78558

SHA256
f091b573562e1196fa106cb8af68363b00538607a7617fdeabfc5848ccdcb4a7

SHA512
09119ea115b8ab4226b4f3300c160098e282d33f7ea0169d1b9d326426d57bbfa92bb3c4e50deddad8de6fc66ade67d079999d315e471abd2a3d7b8f6e87682b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e849d290339db96d4b2645117244b78

SHA1
4555a68870435e0b02e7f980846ab6c3d9aca067

SHA256
f9db2d9ae83e4b66b24d7d5fe0120d889f420167249edcf1e523a00d1eb52a88

SHA512
560260b9db7b96ca4378f3bc9b26eac9dad0085145a57425f852cc9116a82b70feeddaf9eca52f70027839ecfbc875da7834ca9995a54e04cc94737f85fab420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6181e9020ba31b08ed81073bc4e5d118

SHA1
091713106be62593b344d5595917fdecff7b1685

SHA256
a8103bcec5a72e065de4396a921583f046c7087b0fb140efd2205d7b242a363a

SHA512
94b7de11f1a40bee1dca763e687912c0d4615f18c1b417f96cdeb32f81e17805cb0a25580678b8a967ebc8d111f3a8cabd029c7f3d40f3c05c8e2966dc568ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE62.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF21.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit