da1d14b15128611aa7e76bc778fbc9ffdc47c1457cc9dec4fbeac4e895fc05e9

Analysis

max time kernel
139s
max time network
143s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c01482f81e06356e470e99a55b7f2263_JaffaCakes118.html
Size

12KB
MD5

c01482f81e06356e470e99a55b7f2263
SHA1

55462fd543bb9e0d98e685517c98d7ecaaff7d21
SHA256

da1d14b15128611aa7e76bc778fbc9ffdc47c1457cc9dec4fbeac4e895fc05e9
SHA512

ee1b739be0bc998f1016b3306576f78efe456b4ade370f97b09d2dd99f7062e5f0fa7c328568e3752cf59ba4fcd4ea8d84131fe06a3aedd6216dd952c9b1acff
SSDEEP

192:Vm/zXLYAyr5W03uBMCTw7FAgwkcIlCwIg1y2Fsh2J0p:VmLLAr5W3BMUgAgwkcIDw2Fsh2J0p

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b20000000002000000000010660000000100002000000067de3a52e159bcaf7d7bafb3c5ddc60c35119acbdd856495df1c0390057c6f42000000000e8000000002000020000000ccd80d1081ef4268e23563b2d71892214e0ed8d33f2d16facfb0237b2db120e79000000018f5e1ae2f3b6b1ca007532630a34647eedfdd5ecdee7f0324ba7b207d79f80c249d0a4837b7fad8d2efcfb6a252d4491eb5f9962cd0bdd041371d1530e73d2f8d974eeadb79f674dc2057f0bf15d495631f8b5fe7ddd00ff69836c266de32e9b723e3987660dedf54fecea8a131f4faabb6ad50ae5bcab930e2a8032dddb0d5a9bbbd1bfa3d7108eeb42f52e11d55d340000000212c53536b02083365a26e2b32245d1b26e332bc79cde9fa65f97ba57db9bea78cef7cc5deeb02f5f70877de3bc599d7f4a72f1e24cbf74544811c7da4056bd7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0afef81c186da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418418706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACBB1951-F2B4-11EE-A13A-7ABC93571F1C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000000189a7fb83a73263ff7a7203148a8fbf5d29927d911e39443757cce6417e57b9000000000e800000000200002000000088bc72db2ac0f3123c6ede27e8338425244ed940c63945e185f82b1d432d971d20000000164821ee334812a2778ae5d20df27f506706b45ec0d596cc6ee18616cac2732440000000eb2c0ed565435347ec0aef8b12a6a2c294464a621ca6e095b11d69d4e12fbe7e83c3cc760252cf36b0d5267e3417275d430b20c812b25b72ca557714d67f534b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1356	2180	iexplore.exe	28
PID 2180 wrote to memory of 1356	2180	iexplore.exe	28
PID 2180 wrote to memory of 1356	2180	iexplore.exe	28
PID 2180 wrote to memory of 1356	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c01482f81e06356e470e99a55b7f2263_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eee24540d507ccf1cb9598b2b445ee0

SHA1
3e94f3822ef9064cd973b4d1987bcbf9bd5e520d

SHA256
029b4269c1e0da28396dadfbd16f973c3df5c75f14ae3d2abea30e21c5c53811

SHA512
56586fdad40de493ee7fa61d602dc7962c30893e8c1deed0cdbbfa957899b4c52a8adc79b515686a6ffdcd2ee3f50232c4a82526c8c4175ff89bdb1100764b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e48cf6aed03ee91b7fd72e30915cdd

SHA1
7b9578079a042cb8343df7eac7ee96fb64717082

SHA256
0f2475d8deac9befcd3f0223bc003a2161ec12a94e29062de37bddf3dbf66892

SHA512
dd1bd001ed5dd3c3db2f7821ff420b81cfda3ed07952867eb5f9a112f8b9f461453f7d5aba8ee0dd8268479fd09c0bd8ab4c0eabc9cd3e955b83facd578c12b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b80ecab48a1f2739275827ab5902b43

SHA1
0d16892b8adfb6b3dffc75052163365b6833eec8

SHA256
514cbabdcccc4a30998572dbfa3084b5b9cb90c746d4a8330c26a72a6fb0e2c3

SHA512
142c60cf75ce5497d10dca9eb2f0b2b0df5ce448d7e68302cc975960ae3e1f9b4d6f32a6b2463abbe00e82a4b9372c9296ad080260f42b12f25f62549f7e9bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cc28249e40de3ebe9c0259420689b46

SHA1
cb8cdb4bfc9dc78f4069a0002ef5a773dec54727

SHA256
2924bdd147f5035c9c7add050747f93aca679449a0b99f82677d10cdf5666b75

SHA512
edd113fb2e84a8724453597199e1c0bbcbae6ea82eb613ce0f490ca9c5f81e8831a535b40203a5e543c8b7688a429edf8cfa0b8de373afa17f09fa59ef9e23bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b07d6abba8ba8e2b7eb8d368030a160b

SHA1
d056ed315c3d98c804195a3eaa38e8271b3359aa

SHA256
71f155cd9f0422bb00ee6ed85501121e81a949053b2591836d923d84163e9cc8

SHA512
4b40899ec2f3ac810c9e66c0937bd631195717d474749993566a748c7a726992e185573ceb10ee155e28415665a447f55fe4af85ae49a0168d2e31f63b362daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a023c2bd3df86d3d96c964827b1c1c9d

SHA1
f280e974d031105293151aaecf9a3d892e6cc8de

SHA256
eae3a4b7735891b507a0076691c2525873efa551a682b219813872fb45efb032

SHA512
73d47233dd847b5d4ab4d47ec4c80ab11e9d5d98a08da86b9779244bbd727b064a3c9ea20f2bec82b732776cbf7a2aaa48ab1776faae132c6f0c63024482b1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a70806fb1dab6b09ea06bdadea1cd4f8

SHA1
bb0ad3e1a97f1776dea7fcad479d6be3ecbf109b

SHA256
3af35018ea12d8af42042311a3e4f2182a8f4c9f2fc4fcf892efbc4c279b72d8

SHA512
0bcfc76e1ae407587dc6e2e28a4007bb52f681a93d688e74134c10e0796e8d361deb11c16adee53348d37d52d9f5bae43a70c325f4fd908b2c989bc999b798f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd6629953df61a64035cfbad9a86f40

SHA1
73df003478ce579f789575d4664b053d75bfba3d

SHA256
d94995d2fd063f59dc061434dff3db0b90648eec7a1a089004b9fd751590c590

SHA512
660aab797d76688c608eb7f9e654bd8c0394965cb445309e7209bbb2acb90f088e786e52c790104d55be657ce7f11660ead14cf520145bde260e9ee5bcdcfed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22ab27170683a495f31d3435eb6aaeee

SHA1
b73831b5dba0edd481dac613e567b6a44099d9b7

SHA256
b7fd6c42f6192ce089da674f4ed5b4973b7139349d41905e2d3566c710c40d70

SHA512
dcdf6975a4b21a66c1a09fa82ad134f08577f2124a6b1c1aecc6a25644f80c1d2a65649eb32d8dd4d730d9369388c3aec23324f66d69b9b77d7d2e2d9efd09b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63F4.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit