167e192784bc3d2c5bcf6ada16791567eb11d7c391546608575bab9fbc672737

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec792921e83229dd3dbe377c6e52abfd_JaffaCakes118.html
Size

25KB
MD5

ec792921e83229dd3dbe377c6e52abfd
SHA1

ec15cf0611d40332af6fded6e4cbdd185d8d6a7a
SHA256

167e192784bc3d2c5bcf6ada16791567eb11d7c391546608575bab9fbc672737
SHA512

69320e839508f202dc25c599f692d044110da14123beccc749acdc6baea5f19deff0175741b0c905e23f8f8ce59edde48a088f3df681745b1b50e1b9eee7e074
SSDEEP

768:HFKwlH3/KvjIaeezeeHeeHeejeeDeeOS0XZeeVS0XfeeVS0XFeeVS0XdeeVS0X3T:HEwlH3/KvjIaeezeeHeeHeejeeDeeOS8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008d1bc60b10ad0dfd821ac1f1a849bfd409b3dfba2d409cdb4b73bf92f8d99f61000000000e8000000002000020000000df0237a45cf1892c00eb279984f149db01d5b613237daa2de35b3bdff4232040200000003b75ddfeba6f4cd35d3eca2557dbc1cde544a44bab275f1381a520e4cf4e93f140000000b0553bc130446b6e6bc627cbb324d524bd32135c22f54a8d5360ece483065969c1b0f0b02e21ccd13aca6d101570d5af44be2d70064c092d30d062131faab542	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418963974"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DFC7BD1-F7AA-11EE-B2DC-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0310613b78bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000002afad58c48d4b15c372a345ddc05f189ac3b57395494095a35e1ed5bcbf12a65000000000e80000000020000200000003df4d4fd4e4163aa97f28a2424484ace160e1ab7e67883f7488ceabc86371d639000000071460d06674904ba197e4386ba57d832b817adbc7c468d9d4509a0613994d3594ef5e1a413bc00ff020bf9035217ae2c261ebb08fa7be3238882022df902433a8d9d1283d7edb13624f3fac9efb671091c7d409e8fb4cc6af7530cbe0a09e7f1aa9975021f4a88ff78ef484cad8487664ce35884a03c9e587be1de7dd47c10e26a2125a30448093adba9526899eaae0e40000000528f2ed32ed82130ad5fb9cdafb54fbb79161b42053acb87e00607af3dc46a85ead96046b11013a7f71e3bc4ee5b49d27a1b5d72fcef6fafe5ee22cbc31cf7ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1744	2860	iexplore.exe	28
PID 2860 wrote to memory of 1744	2860	iexplore.exe	28
PID 2860 wrote to memory of 1744	2860	iexplore.exe	28
PID 2860 wrote to memory of 1744	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ec792921e83229dd3dbe377c6e52abfd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fc91b82fcc62f7c0bee68f9dce5a8b0

SHA1
623d1baa42e77bb7f86dc67d4b144880254a21f0

SHA256
69dddabf303de294958bec53b38ba8e75b66319da832ed9ea8f230917b742e75

SHA512
3e4d1671ff1c53867d5bda955c7809d636424e39a14bdf774369232a5773dbf7cc20d2f1b198b002707408a462887c6eb4371bd01b244c9a2822b2bb0b06d3cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e27cb1667a03907a88401ab55cb2502

SHA1
7fc0db2ca9c041acc1926bbd90700714b73c16f5

SHA256
754935b6cf471f5f07eecce325512456696c56e459ca84aa0a0b246c534f6e0a

SHA512
3ec429cddd12545bc781b413ea5c0966f6763042740bcd22c7be01754723768605f878a3ccd84598efee2cb1b5f50940239223576bd529b26e19428bec32f238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eda50c57b517fd57e8b397490b09809

SHA1
1f0a9b1158e262a6dd77177e7b6fe9d7c35e3c8a

SHA256
4c10d3d3a032d4b5b0f51206bacaee634c7cf397e8d87a577a4981b15f96cdb5

SHA512
2dcc486e23d5ef70704a87a89760e1ecdeadd045b7ef970740bd86d1b4bc3bd5aba6dcbd4730d903b8da85de70e6a703c5cd438749a89a431ba5af144052626e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59c5cbba2cf6db5bd61359c094914642

SHA1
19e2fa3d0664c6ca0890a5f0dde962ead4f2ab82

SHA256
72a4e18dbd88f763fa7b97c690167e2c586b5d01b5701d0609fe420926b2013c

SHA512
b34b2ca0fad0839f7bd0a51fa30a6666c83b04aec9e9af8c2bea2b465f44676032ae76cfde8c40d48855ac7606f60b71a366c379ee8c582ee8f88ef041bf3fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
471b51e5af2af4d602d570f8783dc1b7

SHA1
d45463210ee45043649d2a06bd414601c140e467

SHA256
a13e65d9c14462b054b9f60299585233c260bb086a50d1505cc35f2ad70c5b71

SHA512
e5975a3458df22af2fd1019c3a65f2fb17d5c1febba8650aff6e6a7a8c1c4d3b823705268083989a1219cc6ccb2b413f1b34ed31b0c6a48754d0820924ad5a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef2f1898cdecc973bb9532e12ba4af32

SHA1
9c3302e8956694c87ba857f01b879ed0af2f6567

SHA256
4e23a740bced5bd582afa3a7d8b8421d03a544ee73888a86d20c26d4096515e5

SHA512
f898bc4960c39dc345c4a6425628c7d0447cff791a852bac72881a60e7cefa97f02d92da7653ae322e11c992163e9d6a0a732193704b99fcf8585741a1d36edd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d62e73e94c70e6f5bac640639dff4f

SHA1
626c8fe507167609b71f35f8ae74f7f14e28b447

SHA256
76a7fbd3c5082be5c034ccb4e27e35e9dc3d144bf2d1db44ac95ebd8880ac05f

SHA512
fca075e7c9f124698c7d4c5d0a69366d08e63705fbcd3596ddfea4c82c6d23d7cab49a8c5ee4a8626739efba672fba1f973e557ec8789583821fabdcd9f89ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d97eadd500501d574230037f20de8ea6

SHA1
e066ad0bbfe3092ff77110f5707ee490de74da7f

SHA256
0e5d2ba940ce1cbb2d2b9ccdc93d464bfbc538e71c66db0e336897294be8dd36

SHA512
6f8287b94fe0c394cbeb7c948cae82ea896bd2c8a13e177798669c6fe3e9fb314205c8884e85f04fd5d9dccef5b40a9be21032c0179564b32a651d24577c5657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1ddcb1cf799f50d1e6ceb03d594a0c8

SHA1
8dbea715130e1b591b0751e8e3f63d4fd98ea2b1

SHA256
041736b35883c7dd76c70a13d920af8b99c71f0b59f1a2f19e99060b438e0470

SHA512
85a4c17fd835978431c00bd5acafa539d8320f97a47ee829d9aa7d71a0a445debc02ed228f3a1d279730506365b579265ad39480a5f907f7adb6c42eeb6ddfa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
365349f9120c2e2f9b0a27bbe0025197

SHA1
4a59a631ce886665c75919e8e4c9535683990ac5

SHA256
3dae513ec5e733c2ed387b38a1a170c9923702f4e8104d375735b09af7e3211e

SHA512
4d6d2a90225c185d89e9395092ced0dfe0b103ee21e4040f5c4887f731972c6cdff187a6701fe8d1c1c42646bd65a1cd2bfb60edebba7372ca0ee5836dd8c16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\jquery.touchwipe.1.1.1[1].js

Filesize
32KB

MD5
541042442c672a7bf899314fe3d8d1d4

SHA1
b1836113dbb371d4f5ffb9c0db1ad4ed345750ec

SHA256
ba15d84094d63776888bacb68ace37552837c89da2cc5b09463206db06688e5e

SHA512
e0cc512183701d09b77d8aa2e8fb7a5799be73cd1bba141ecf3a1c7df6aeb3a25b4eca57fd89e4fcb603bd6a6fd1d3c9fc8612ee6d2fbd1b03f0f9bc70607bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB91A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit