19d043bcaeb41bda0ae8020988544cf6bd94191d033f403ed154397e1bc2ebed

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fba593101152df58866bf7ecbc6f3b58_JaffaCakes118.html
Size

106KB
MD5

fba593101152df58866bf7ecbc6f3b58
SHA1

381d48e75691a8873c0921a82700eac7a8dafdb3
SHA256

19d043bcaeb41bda0ae8020988544cf6bd94191d033f403ed154397e1bc2ebed
SHA512

aa61af978672aca772970fd605420b98adf47144fdb0cca8943d7982f22bea9e9b15517363481512799e8c56016636fe4ee785199f879085138de57bd14852c1
SSDEEP

1536:IH3jwOXDTWkbE7XV/CmBIqzYgPx65/GljWc3ZXTUeo/znu:wzwOXDpE7lamBIyY8lNhou

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419739089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF0EEDA1-FEB6-11EE-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f17dc3c392da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000fcffbe8a60ecadb51a5e29573347cd7c631de3c9000551cd3f44c93d92fe1195000000000e800000000200002000000092a135f39fcc30586218b7614d871ef901a439f768ea4c5debdf7fcecb542ee82000000011e527333f379dbd27a26486112c4396105b6b014e12783d2449aabb31cb2c6f400000004a5d0692af0ac44cf8c0b5e4a90981cd2449eadef254391aaa1c9e59b83b80b96407d3dd78f9d0173fd69aa1b3ba87e8ab13ad5b5ba4cbf83499e3c652fcca8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e372e5a0facac9d7e603adce486bdb38513e710d899b5b6e91d34f4606577848000000000e8000000002000020000000d6f6a8c3832ff67027adfa222e75b9c3d2c84effb14334f4643840ea2beb7a23900000000eaf3a5117f13e67a50a671ef11f6877f06f4e124ba19247d03fce6b6d67baa3de31d1931542022ebbbc613d15f4588c954cbf5ea1337fc3ddf9edca4739735ff6611f23b6f94f2c429a52aaf5d6317f04f5c41bfa56d3b951ed2d67ab6ef633d9355699ee39afab04b7d834c16af89e180bef35d4f645a5673b41976e33fdb983c2961b05060fc8fc3713b6272d2c9540000000fc5a8cbdb98c400d886eabd0e5d513bfcbf3c7fcb55130c595ceb8f39ca7b28b097c6a54209c0a3e403424ee9d4b12cf58b1ffaf51f273f9f75141124e125fa6	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28
PID 2080 wrote to memory of 2348	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fba593101152df58866bf7ecbc6f3b58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e68b08021b11f79c1699e41de555a33c

SHA1
b1b1df821253e7fea857c4f066681ef542ba2f1f

SHA256
a7591f55626c3c133b07bc01e2c82d53c687daba6b923efed3460d584f43ab1e

SHA512
46a0408da93c1be027a87eb2dc718bd113a4a5f911039e3f7809d6c1778393c9beb1bdeb63bb1b9e9f38d5aadd79089d4f43f7e04649ddb5f6c3b47ad29dad7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db21d47a17b5388996b169c18a893a58

SHA1
aaa68bfe9ca3093a151fd57e5d72d7a18df9c509

SHA256
3fc546f90f5b583353425cb8d8cc90f218c483428243cec39f30883f396dc2bb

SHA512
c8626a7881684896f4823266d7e6b71ebacfddc008841000e03f49e64cc3b9ab057ecaa50ec69b3ef394e5c99656f5c619ef4087b0594890ccfd446ae4419662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ca91da1619ae7ef7bc048481d1c4a4a

SHA1
3e51a5ba80852c416856c7413165c98dc53c0a31

SHA256
a457f83e7251622b47f459055fea6e790b97ed2070b402c97dcccf96f2d65817

SHA512
a60297b8a579fd4c86b50842c9f42d81988ca2a135e7941234111fc5e0736ea05448657df0191eb75cda3031303893c6583aa2bacf4b1e65a8d4254c3f07b93c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0697c0487e8b23470a1d5548ae879091

SHA1
8d9495b14aa59a88fb1c8e64d2145387a373f4fa

SHA256
5d954520de954c3b15d6141b98e20dd0fdc263c23afdcf00e468a4c4a2c543e2

SHA512
27a35c8139dfdae64abadd69a08271d75931a490a83a1686f291007988135b0d9f8af14cd982ca7c44b247ffd15c5e16dde5dae3389bad8ef8eae6ca7f1cc123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4adc590cfa99977bd67873396fc8662

SHA1
eef3d8428bcdfef59c3e08d2009fab2bb6b6c297

SHA256
79b690d40b8c1b3097b9a7379918c545fcb8b09b7384802536c8f52744024809

SHA512
56d5c69a8b5a973a10c71cec6ab9c73a01f4b46e5fc44671657d9cc4de13ab88a00ae8ebd1d4ba96aabae5f8a3b4270f44e7b0a012659d141e3c32041f48e228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a104c00d56cb311fb4ad735bf3e4357c

SHA1
25c695517de8291a692ed6427a371db3f05f25c9

SHA256
a9b4de59a92528d1c3670ac2be4dae8f2cde445b1ee4495e77cf4e45ad79e7b7

SHA512
dd952257c415cbdc39919afe6d0112fcc2324c741d9d989cfc9af73c2765c32f0f5366dac4b1a5365685990a41c19b6a2bebcf69a055a725f07bbb0818828baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc69a7f019b42bbf60a164d1d8ecc1e

SHA1
c640058a8f1260b4e630f29db507a79bef0d8d8c

SHA256
e01fa2dd3af12ee82aa6f3c2530e4a3ca9b9d3c4db5623550dac65d57c06c6f4

SHA512
c473b5ccdfc37266635f3ba5e7d3d42363783e7b5335863dba381f5cc05506990d3c175dffc66b5b87d2662fcf0cb9ab4578cbf70a323da1f6ceca7d00beb9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1df3b9ed03a156955101a46dc2f65fe5

SHA1
b2983c11797a5f58f80257704aaf5e7d9e30d460

SHA256
7c51d8f886c38eb31d680f5d9147a90e25a12dc51e0361b97224c98b770bce0e

SHA512
fff72fc516580a12291efd20789cca0e74c57bfb8558a483fe7c54c4b7fbed7338acd66cfa16408b54781c4dc01330fdc681a621b1988cf4f0b06215e284c4ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83de44cd01e8dc891f829a7336356888

SHA1
fea0e1da347ef78318d05073f6fe22985b051400

SHA256
8b819238ce57356c4fe30ee139591b9ce998e6dac9793af442a5448566ace7ed

SHA512
27b9a944b08ff94f672f2c7570d58472432e203273ff057c21227b4201e9fb2b860cc6478801627d41e7f5a2cac6965f814e2348355d54deba0a4fa2f9ad10c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2853bed65760c5d567111a0d2ecde9c6

SHA1
130bff218c17c1107a07e5bffbb64a6c8711c41e

SHA256
20360eadf3ecf995a92f3084b2cee897cf0544811b523c9ee9d0da8481cd2886

SHA512
566d4b1016bcf7f68ff68e26f0fb902455adab47d7ece9824888e17c79227c6da6cfc0548ad63f40021dbcfdb1ccd6759c4921e4138f37d04a42ad5cddb104d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1d34372d959c6b196a349176dd91d87

SHA1
efa6096dd599a183dbfc0ac59b84b291714ef8d1

SHA256
fe36e731120953348a78b6de40219168d1947476fec6bb4756c4eebb65578475

SHA512
1165244e0b927f1d111fe4756ab8f97d41cea82f8b0ce15eca4d7d32f8f3ef46db61fb4d202a8a86801323b654180b91caf1960a9a235c560b33f3955a8acab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f14a5ec3f12496d94ac2a355344e38

SHA1
2335cb90b9cdc77962b2e4f88822ed4548f872bf

SHA256
d557cf29fef06239f55c87a04a49ba930c61e9b88d1a2437fd34a5df51b1ea19

SHA512
6efbf47b3f299a9c8010d6ebd770b13cab31e9e3e490da13fd375f969cf39cee1699d6661d355743a840723b0fac6861e546cec7c88fa90f1f80cd3d1f6f5105

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D98.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3280.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit