557a4cf0e0d1666b344599922e5eff3a7083007cbccac062b2721b897d433642

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eb26687253a9a804dfb358dbc04fca8e_JaffaCakes118.html
Size

4KB
MD5

eb26687253a9a804dfb358dbc04fca8e
SHA1

e633015099084e76d2a275773787fa9cd161dda7
SHA256

557a4cf0e0d1666b344599922e5eff3a7083007cbccac062b2721b897d433642
SHA512

46016b9258ce24ef72701cb4c77fe56913dbeebeb2206ff65f80f8ae0732a572a41b9045e822cdda4ab79aec154630b8a679970043d6870bb40082be0737021e
SSDEEP

96:rf9seakGiwLsvfpFFOxUEYvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaDvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{399708D1-F73C-11EE-9667-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f2ca7989f08bdb0c58b3d604b70bdab98c34fc6bbe3eb92b7b7f74a189daaf2b000000000e80000000020000200000003776d5a47f2fe29b6e8f41d71dedd1ea4254f81265be3a1d63a2d578bd24cb52200000006dcfa67e88fa7df07e2623c9230df88f2a8c423366ff9cf2fd52231f1162cb4d40000000b3d0738d0e64d8346ca16e1db4e88db7d08de64967ba9a8129d9531ef32663dc8340a0d440ce52165f463293b8e0eef39ecdf32d586eeb7623c0ea77ae27e30a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004c03438e11720a081df443c4e63790caebfe5810a4c8a0efedda546865c31df4000000000e8000000002000020000000d2b5d3f873a67abbf7753acf347762154b22c3d94a89e8591e75a5650b77422c900000002da9e8f4692944118778242f7fff9d33a0ea11b98b59dccb9cd0c9762086d6520b6a77b9edd8beb71d87ef47b978f93848f6cbf8317f48e198ae900e57df767afa81e462e0843c476f02a83f6305c834148cb3fe8bf8dd39345ab6439d0a86a0d3d2df87bdf6de22b38e57f88e617e166f11154c22c3fda899b81c221a190993329a28f9e9576dc198690c452b87366340000000728c9c095288abc2c4719c64014581f04f648cfe3a5d2e071ac0fa7a75fbe85aaf6cc7bd22f1ea60b0cc125dc0b28bb76e851ade1ab514ebfa1ebad60bc68462	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c038700e498bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418916723"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1612	2776	iexplore.exe	28
PID 2776 wrote to memory of 1612	2776	iexplore.exe	28
PID 2776 wrote to memory of 1612	2776	iexplore.exe	28
PID 2776 wrote to memory of 1612	2776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb26687253a9a804dfb358dbc04fca8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b026b5016c2509e2b3aaf159316785

SHA1
7c5475d8bbf0f49047d87a22f602e10016807cb9

SHA256
0f0134b3451fcb7b1bd70f1e8c38d15dfa352bc77aae8dbf13d9ed472021be28

SHA512
7cf2e740dfd0cb89272221e3fce20348c615ddd54779d0f61c7f1826d8639dd9aa3f26c0db985bf93eb8ea2b9827e9b5867875c101ee74eba771670f72f5062d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae253c153473724c6ccb7af47713dfe

SHA1
3c9da8af8f443b3e4bb39c8d9e5319c9999d267d

SHA256
c7d1661713aa7f0fc2f92c1476b7f62438976f9aec92e7d262ad82f63204cd75

SHA512
20707c937b8838e729bd43e468d272bbfa665d569e1063d613c05e25a9be4be0de67d327036b8be0258848ba49d076c0700400fea0eafc846dc51fcb8a9a57ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd4e2199d56d5238d6e3f18699557562

SHA1
f44067ca1c80f345485199c736514efd4c57d957

SHA256
ab55a98c8d3f816c936cef2a5a87f3b9e1f9f5f4d48a773280f10852fa9ac536

SHA512
9b78d4f4bc21be275858697fa6a09a0ed67a9ece68ce2b10d41f51c61f69781a92621eee0d4ae9c01376ea5b3549ae393029bcd40d4bd252d7e5d31a557f7eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce9a78ccc1240e4219d45ecf9e479c7

SHA1
a6ee8bcb6e3843141038b8bf777cfc62c1447a28

SHA256
fc03c86315ed2ab5307991dc06cee8e1d5a42fe6959fd2c203763dc81aaf3a8c

SHA512
94e0608655bd197f6fca73aa737ca2fc78b18d71636330cfb4491951ea741adaaf661ad190b52eb9b843282619966cc9e50f0ceeef329a7feedb2a26fd79411a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28bf40f05f3ff861803bf984720821ed

SHA1
2133a9c2a77c3244621e84940d8c43fe16e5b0fe

SHA256
e355825d1676f4ec9058348aae254523fa6b97aec8f580b333ca7faf9cb24b04

SHA512
f8c151ba581fb74633feb1b206897021db5533f3597c3ef8f7b8c1342e27c65cff94eda03c738f5ffeba17d5bb292d5c443d4a7fc14ba09ec177fb3e99da109c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327b0ebff95f5c77f58d5b57005fbdc2

SHA1
3fdeef983b1d8733f4ddaf5b9476eb0d39cc0607

SHA256
a74462ace2e9d2b0cfbe0104eb00aacaa96f877241e668dc686c4a5aa07053dc

SHA512
0e6dc87566d1a093d74bf70f5d8f642b99d31880ccb4408d69e01d78750cad82f5289092f6cfa764a9ac3b3051a894bf31c6be8d4b38b4300024e93d818d2094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7e90194e3deff20fcc7abb46cd0b26

SHA1
dd1b1a2373734d43bcf84f440ef83495db0f3120

SHA256
ec170c66fc08768482fa08767410c8be8909d25e0e985812551414ec602fd825

SHA512
6d340866d893a3a8c8a106c186ab59084d2a6fbdc7858a502fa57e4d29e15bd934f62f744ec0e42c1c6982e78d5cef8ec5832f190a6665a0896a2ef4f052d4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda7b021419187342b9e5517e89387f1

SHA1
18cd8ae88939f250d0bef4c54392d867cb0f2d0a

SHA256
c6a31767647e442bf7b26c838923e12eeca35a9edede99876308f1f00a534590

SHA512
295f28d2734d991ffca230950223e895448f71dea3ae23d64b6ebc334feb46330734805234ee2d5a3ad2797537400da24a8820b8b3f30bff0f393334d271ae40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45514a26685b398f9f7af4c8376e02ba

SHA1
faf2cd657299c5abdb3a4d6321a14f07f5964c40

SHA256
853a166536abcb2b4e92ea9f53a0a2227bcffe4223baeb573722d0ac5b17b9a3

SHA512
3bd3469e90c1c30b6dd40a09060d534e7c53117af9c9edc2cb94b7b8bce0a1aa7525ffa9e525889bcdfaec151243dba1474745eaef234a1d9ab0613ea9572bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3850a144412a1d2264d521d3fb78d486

SHA1
08abda0032048c83d772a23216d6ffc3a3dfd56b

SHA256
4bdd9509979ea338a0e43ab5fbb9458816cbf82adf027eb78ad8c22cac3bd785

SHA512
fb7b07f031900d35b27717f159c0660ca7d1dee70bea81e2c16f3b33057ef89092227b95969128a99e7954224265bc5c88e906c253c0b2ed44e3afcb225c6076

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA41E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA677.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit