e0edb399ba83d975556caa10ebbf885780c8948482c83371677ad964ce6a7807

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28f490a363b7146ef943a4cae46c08e4_JaffaCakes118.html
Size

85KB
MD5

28f490a363b7146ef943a4cae46c08e4
SHA1

8fe8b4193f0f6587ebd3bd7feabf53f5beed5b20
SHA256

e0edb399ba83d975556caa10ebbf885780c8948482c83371677ad964ce6a7807
SHA512

61e3f0f525164a6179f7bb22babd69f4233059589e4884f9a2323a210a4fc2240585ae45d5c3d52838246bc382c6337459df68c9facc84a8844a239b5b17f5c7
SSDEEP

768:hvGaFC6FiC5w82hom7alEla7yJrOE1wFZBCWuq1FvcFD8gxOQhGfKhX+dAk2cCSt:UcbWDB5NS/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d3cf00d3cfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426452648"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C2D62B1-3BC6-11EF-80FD-52723B22090D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000ed7fd52cb60690b1c51a2e3ca909c0949be06ece1f2cee3a1113c44546817a27000000000e800000000200002000000030fe19f8097cf7b59c354d6e5709ae52aac21d0a49c0bdaf976ea86328c934a22000000099179a1637613483caa54553eb523aa5cb8bc9921cb103fc504f22ed0c2643f640000000e1fa2deab1a7c0386da3d2d0add47cf7647b83afb4aa538491ea351a7ead54bbeed4037f23a0e4082ee21ee0819e60982443ed28d05d0a157ef0ce36ee46e550	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000050c9b65ef64c760643e515b863ac14302a6d35a9a2549d778b4108ca1bfdf499000000000e8000000002000020000000a882e4f8e4d1f413b290a434345de04c9370195ebb445300d0bc7e1c6a0a8c3f90000000f1f0a2a18e8f815c68029062857f30a5286ad7c32f4037cf3c8c72a1048e022b50dc4baf9d0c8a02fce8c36f0ada6acd931469438e1c06783999dadab895b10c75f13be9d46308549f76687b1134c06ffbfe7e788d312d41c2b9c486ca3b2613a71b5dcead63b4d4056737d58699273c4ff5069d244657b2c7486f3406f26f076403b7ccf44feadbad80e4951822f82940000000b7d56f93c84c9b82f598aa4fde97db1d7f42521c2543634221ad8270593943960155832d7c8f4c28a420b60283b7561c8cf82ecdda2b3b3ccb5cb7acac33c3cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2988	2748	iexplore.exe	30
PID 2748 wrote to memory of 2988	2748	iexplore.exe	30
PID 2748 wrote to memory of 2988	2748	iexplore.exe	30
PID 2748 wrote to memory of 2988	2748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28f490a363b7146ef943a4cae46c08e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f056e50d4becbc0848f4b7138f1774

SHA1
faf9013c714659b4ea30609e24f8a2b37b8109c9

SHA256
dab8ad153b793a94a495b167eee7881357da0581684a03755abad8f194d9c226

SHA512
9bd8811f9f7da227ae9b3f7c35c947be2dbd0844a645fa996f8a544b9e4ba15938c31b2f6fb2457da5a7c5d1f51802723a2816c105b78a8aeca546418c348c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbec91b05b2abf5d47f1c9420561cc39

SHA1
937bb862e84b6fb239d3c8c20b57fd6e4a769351

SHA256
13b6b23a7a03de56070f952b3d604c8a1a1590d7f984d94c6874f534ab6132b3

SHA512
26984bef2ce3aa3f75e49da6da38f0a2dff6a7d2e8430e66891e508353c1e987fcccd791e1d9ac82fbb31f4b659677846548bada8f54f93c358d8ffb547816fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d789de7912a0ab91a3255b3f9e976e6

SHA1
1a7c8e39271a4c44e4ab29e60dc445755ef99ecd

SHA256
7461da5ba71b82eb7144da7bb33aa2384e531872c48f10715bae89bd1bb5d035

SHA512
5db3e8e393fdd6e41dfa42d779695b1bf0a9a4647db9e03387cbb165c2b0904a8ff3693a1b3eddbbaabc8a47af3645867a431cc8f8d6ec08c95af303643acf9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9f913cdb76aa924fcbd578933501bb1

SHA1
27d4e45c81d4374d7754a6f0002b9aaffe52baf3

SHA256
9862fe73916d5ab992200f8aebe1b30fca490d7ca91cd49a32de5c2953b206d2

SHA512
a1f4f52315dcfbe05f59356de28b15ad3de5a3213596f20268e8733dcbe31e391b943588fbae68b9dc3ab1af3c00f1f4d5d2a8df4a4eaec357fb09d70a9a6481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5abdbfccca25073a489c02e3e3f30f

SHA1
f4193d40ee1b617fb3db1dafcfa9b2e6da530ad6

SHA256
f264ebe138c7fb043343fc5a9ae9cb1b4dcf2e86ff7118bfb14a10dbd03ab131

SHA512
b16b1d10830903f89fc887295dfb12cabd43444bf8003d9c9ad8466c92a79e31e4b3f427b3e9890bd73f50542f64126a17f62dcdbfc1bc66eec1ee05b364c671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4264f3a6a8d1547b842c59ebb4558e0e

SHA1
7a4b6c00e4872748445978909f40e04b6c5f89a0

SHA256
2235a795366b49220f08f950b286618dacda379e0d0686ed0d0043ec0da3f788

SHA512
db934c402652e9f4a2feedaa9c4e9b6e4515c2847d516424f4833e63aae9e8c75bf8de52302746b1cbaf9bca14a5d63748245482f64b375397ae6ff0164d1fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df78a2ab933cbe4782b34734601f06ba

SHA1
7979a41e0745ca74ed68df8bc4ee6e0793e58bae

SHA256
df25bf8360c2f88ba63c3439edb1caca963dd39935284215c0eb4df975327a1b

SHA512
85c36d4aa5983ae0e77e5d4a53606f2fe131f23232340747f5b53a24fd28162954b0f05df9998ee3083682cd8c3168e788f542bc8e90676a1a0b898bc2a5df01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c69ca477880d19389eebb650e5f8bde

SHA1
057c6df7c631c170d46a8046b1169fd6c9d723c2

SHA256
ad8967b2f06dcbec7022e8fdedce539689f5d33e94a3480bdf5f325d3987e978

SHA512
3f77d801674b9808b4158e36746dfd51784018476fa1f54916a7013fcdd6107dfd6aac8694545cb02fca3027821ed337bddc755b0d2c00a42dff9a4101b9d30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f221f54197e4bf16005886865e22060d

SHA1
8487e34af5de1f3d21d0220b15c5aba979a115eb

SHA256
b9999fcc663d849441bfe32b1218effb3fa405cb6911f9f5bcb6d9c7a67935a6

SHA512
b7d0d213f3c9385ae92bec4e867393074574b6eacd9af9fc4f473b507ee85ab529dd4ab10a8b110dd24cb587274198438f8898b9261f37224171d6d9902ae993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af9da7e36cd2bb7736b1283cb8b54896

SHA1
87fe27d6f71a70de7dc872ce0211e929ae0dba6c

SHA256
b89b00a0d742db8b3db8ccdd4c37cae467c4fbe3cf8f78f2c485b189a5bd46e2

SHA512
507da00d6d4962d05482cce0bd0a2026a0c30959cb9054e480e6dab9ad1133b5af84c338ee3b226ed3d333ae1fb3d69cfce512dd7aed1ecc3ab2103db4b22b9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c63f9096b1121ee4a287f962b71a8eb

SHA1
f6d6e72f5506b6e0294b84a47f1039644b8039b7

SHA256
d05957603fdce626dad31e12c6e0009cb87d8d44dcfed533d85486b2be6dfe3e

SHA512
ae2d33778c9989f481a4ecc3ad855173d13022837d726018d12ff3e54ea824d05433d52a1e97fa1168c5b9d38bd4d6b89dd3f84f9cf3a39cf93098adb3408880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0b6055c8a9519415734614d68752f10

SHA1
3a058ba066382d3b2463e6b5f491f94ca69a5503

SHA256
edaa904cf38359c2b433c3490d9e541cd6aa473f7db9c21742f504b68283f342

SHA512
cb25f9d400367ae361f4debab04ed0144ba6b36bc836da56307e49286cdd7de8ae3a97304631a994b499d8bfca6dc9d327f13a8bf7969136a5f899336fde3d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fe837c518b1f1a6c0c314cf2895d99d

SHA1
dd226724c0d5835d8eb237c1901e91819bf2378c

SHA256
d2d835703e047908f4822d87a39221826a39a6b88c784bfce7dc6be36c37ef30

SHA512
42d31bb25cc0736c5cd8cba8715b91b0e3b59cb3fc6e672151351b6a925da422385b6006ff72ffda724e1d339fe89593663790149c0e232dd7aa1991776de8cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8893.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8913.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit