dc4ed15c0b7b0cefa67091272d48a8e14466f2b2524f688bfebac7d50683c2fd

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ed8605fa2abbffc0a6c64b1925486253_JaffaCakes118.html
Size

6KB
MD5

ed8605fa2abbffc0a6c64b1925486253
SHA1

f34b621d5c8494def0d017688feac232901b83ec
SHA256

dc4ed15c0b7b0cefa67091272d48a8e14466f2b2524f688bfebac7d50683c2fd
SHA512

233d849ded3d9f6e4e113fac6d46c52fd3d5a54521c195a2b55c0408608d84d4790b2f5d98feb6587fb2b36e74af08f1d8edf306967ec944a8bbc41093aaea84
SSDEEP

96:uzVs+ux7azLLY1k9o84d12ef7CSTU4LcEZ7ru7f:csz7azAYS/Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000000dfd66e7845210d8051df171919e1a0b37305f4964aee950b34dff280f57a5d8000000000e8000000002000020000000ea14ae4a3c927efed03ebdc0fb735b119d882579ffdbd38c5ab93fe96a35143d200000009ac01ac2b9be12599bc0ec467d719abd7be313d1ee4310d5e185c7cace89956c40000000453a2c80f14a1c471b54654735897392f438edb43caaf313d45c8eadc4862dc3d1b9ef1debdeb68082dee23cea4df23958d469e6e3862ae0ac8e8b347bfcc708	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419003858"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AFAF551-F807-11EE-9555-6A83D32C515E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000b76335dacd81af5f3675fa7bebcf83e9d2d84f2960248ea9bd105c36bab98837000000000e8000000002000020000000d6fcc5e9b51f616da03035f4caac5dfd655c84835605a6a73940bb24b9f8f7749000000002f9ecd561c89629ed6a0a01fd0dc14f6e021b0e21be9817573fc35acc4b4e405cd4375ca187524578680f7b4c528457a6add2e6e956b8a039a8d37981748b565465c57fec6be69cd9c8736dadce9955b4d78dcf192448528ccce2f366f9fa976d7ae4ae75a3262b10e34e9e5221051adaeae8e9df34b38b318fd8ded36a4c051a7fe5725fb0102ec4c48603ae6715bc400000001ddf39acd62b9f9ec505aaefd65958427241637ea8972ff614689b8dc117972fa80631df2d9e7799dcb868bb8787e951796df460e9168b0ff9ccebe9e347702a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0be72f0138cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2512	2928	iexplore.exe	28
PID 2928 wrote to memory of 2512	2928	iexplore.exe	28
PID 2928 wrote to memory of 2512	2928	iexplore.exe	28
PID 2928 wrote to memory of 2512	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ed8605fa2abbffc0a6c64b1925486253_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad2cc5d382346307ee1eb4dff8dc776

SHA1
0bd1bf21424fed94e0e42f3d835339be55e19ff9

SHA256
759bf43c1a3d71a4c56ba9979ef5a37bd15d57045cf8127bc9d87b7fe002d913

SHA512
611371697d9ccac66067f38db5924b771abb8415ed52f61c5b50249f6ab856236592a313bb9068f6a9e4e787a8ebf252b824e3b46cbf4a820c0d5261f9fe1d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e00a7ac677f28fa8365a03d73b3a3f3a

SHA1
c65c9c0e7ca8998c80e01156abbc357898c03ea0

SHA256
28aeeb87aa2c27eac04013b4c244c7571ea87a3af44eb935aafc7cae64a04892

SHA512
fea9bc15340bdb90f06962bce3228c38711b8a2443057b8e3229be5b7b0a35fb45619d21a80ec8c17958f54dd99eac8bbf3157342f908eb07f63e326b27dbc1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef1dfa9f8e1e90dba5741344878c43fd

SHA1
9cf4ea7816238e5e3d7314ac8821b96a8adf5562

SHA256
02a04eea90a027e45f51e41fa2283fd226999a255fcc52beaa2ffe9a8ba21b72

SHA512
3fb1bb2f66d7ed7373ec953f983284e2bdf3d7e4df13eb9cbb2537fca08a1c7d4064fda62108cbedab9eba0b30add2fd1f8009e1d9044a8767af46e626b0bc1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92e943e48ecbf0f3e4e854d5e901eb09

SHA1
2a4f1ebabfb62494fbb4b8bbe189bb81f5d0e4f3

SHA256
cb82cd8fb424f3844f9839c3b12f03add9820d1d01a3854000d3e32b59cfd046

SHA512
dc1480776cae25af0df7e47692cd137929b7e379a9f4c2f1cf7ad4771cce3e8903a83e7a18491b10fa91b83f6b37141d73dbc46285103b4a43a2e05062661b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a077690e6431a4b1429899e49a09756b

SHA1
7f588a56c964d38ee3aa349f24f228cc1aeac5cf

SHA256
2f9c31f964e64c99cc968e26d989326ad5da5a4802571a62ae6e9e4a59fcdf19

SHA512
bb452e615ac61f99811e2b2d609ae60a8befe0908af7f53bdd48961a5e54d1ab46a499012883579f2ade3216719b06d1f3e038e01436ca2c01803ec3cc82c1bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f0e5349b1a1ae61fe1e98c3abab4b03

SHA1
d0b099ae5f162af8ed4035a90593e29ea7521a25

SHA256
15cca38b9277a5580c9e17cd54b03c1bcdf92e712bf7aa517a54451a0bfd54fe

SHA512
823e30555f298a7eaad8d6166ce868ee6a80d19247df58b4fc2fe4022fdf157736718e9c50ca4d3556ff4ffa9c52b8a67381cb630c85d068cf7942e2e4742db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a30007d7e8ad1ceb2bbd45c31bf424

SHA1
eb3cad817cd31d2ae60802daf350ab0075e9f3c6

SHA256
aaf8e76d0eaed5100636d3e01cf4d65af6116f04b33aeff66ee65f9d4437a5c5

SHA512
4a848e16539c6b877f8e36f3155d73573a2cbd0e0f102cb626a2f230f7cc1a820938fc609e5edca84df2eb37c40b508304573f0b7ae66ebae352b5fbaf992bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e76532a2cc1f7761fa9f825013a750a

SHA1
c0f3114305360c9b0646192ff0ee6c0f70a68cdb

SHA256
08b30358cdde3f6bb47a1cc02e82dd284b01293772255d95ebef1b7513ce6425

SHA512
6f59d6473bb9b4d19708fabe58d8b039356c86086e64f157f657b734483951d43fb1c90ad146b9557a72b8b426a456a601692980090ec0400e3afb84aa20cc23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ce1c5220fa9261ac5a20770fbaba305

SHA1
b53b0f5f5b05473a6adbe3ad0df09cee3762ba01

SHA256
b41d9a7fc14c5f981f17fd0c0717e1a0a11072e1f87e57f2a26553c8dbff7b4a

SHA512
996018a683d78409025d11ce3e4a2397d875e6ff20b2b5f8b91e47dbf383a0dbd164c8ada8626d7e7775cf78bed73b33e80cd72430561adc7547d72fa545f45c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa98b181ec62eead981d02e7ea9c4a14

SHA1
2093f764eff3339ba94e158cb88cd2eccbe3ddb2

SHA256
3b5880d1de077dd0e40c9e07b97ae3f36fec111657269a1bc52ff3db6d83bab6

SHA512
4a47d1c7008ac468d0cca00536195c3dc2f7ff286fc875189c393b7b7c6cfd10ec08f865005be7de37e248cd69a76eaa26132836025be96cfe92c919287db317

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6153.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6294.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit