df397d663b8b6db9271693259008a3133b8edf27d4fb609862e2b86442c54e52

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbab5919a39285324b87b97c360b40de_JaffaCakes118.html
Size

40KB
MD5

fbab5919a39285324b87b97c360b40de
SHA1

14937f4e341b99b17a64fbb60d0347645f3f3b8d
SHA256

df397d663b8b6db9271693259008a3133b8edf27d4fb609862e2b86442c54e52
SHA512

313c56734168f328992dd7b51b5b1983cc88b8abd6fb4a4765c9ac2089a79643fdbcb1acedeffee8f2228d0717b5a9def5ada6d1b00a5e9c71f04f8c5197235a
SSDEEP

768:SgprQyl6M476ffD8H6GGdpZOZK15JRjyBbUb7kh5Jnk6/F0yR57Gb/PuUIzynh:SgprQyl6M47w8H6GGdTj8bUXkh5Z/Kc0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fa1da1c592da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000052aec94491a495ac33ef535b1293845a4fda0dac5e1bad2835b92eb49f73d7f0000000000e80000000020000200000009f177383dafe8da3cd3d530034177c74969e3d6dd38aac066b5e5c575108e2ee200000008376ad827e0da80987b04504c75325160b23efb9546bf422fd18836077eb9c7f400000000e6d03515db063bbb92252d88ea7eb0d80f206ef2652249bc302a6848d61d16c74aeb6f1976d57fdf036f18c79f2380aefa7bfc035d064410f804de38c3f3586	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e25c60bcd9feaa63c139732b98f71ad1da3c8c6e335d60d2362b5afe6f9647f7000000000e8000000002000020000000617d52f680c8ebfd43383f7bb36bdb5200cd7a2fe037589bc315e0d1898180b0900000007e7dd11ea0feed089c58725f887ccab4d78fa90543e3a8ee03fb56f5e71b95322701d96f6c8162a0de422595e390a5ed6693a5cd114ede41016f4cef07b6f26c9e79633227a06f6b99348c2e7d3b4bae8462effceea1d4e6e479b3107cc2efcc0bcb0bfb77925df3438625f5c590da0430beddace04261fface1fc30cb71a0521fd04d7e726baa30e4f76cf70f901d8b4000000024b9843063e3b95d370d83adc72569cf4d253838e129f308bff46d7d1f6b75624698bf823883aadb6e8b4eb6a9f3538eb881a0650c53ccc543113a4da8282a43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC76D711-FEB8-11EE-9F07-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419739887"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2500	3064	iexplore.exe	28
PID 3064 wrote to memory of 2500	3064	iexplore.exe	28
PID 3064 wrote to memory of 2500	3064	iexplore.exe	28
PID 3064 wrote to memory of 2500	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fbab5919a39285324b87b97c360b40de_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5bb706cdc05b51d46c888e07c46a4b8

SHA1
6d6a1119c873282f1565089dfd4cfa330e724ac8

SHA256
185308b926efc428a9497a5df476392de629aa176bf010ef66f02989d6cc3238

SHA512
65c2a15c6f2c72100d9e675215d2f4312a4725c5dce9eb951e2397dd7f3c7ce6a971a68507df474caceeb46127954c954d7f34e18a6148a38c36d5e34394b66d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d39c28f71a0ca8b847276dc5069b01b2

SHA1
bfa8d4fca63d6ba33b754b8a66f42c977fe91b81

SHA256
0d337f1e144133d8d1e0ef77da69f71410b0367753fca5e46d51807513cb9e5f

SHA512
03fc67439f7b4545f0b64341771e6bd0b8a1ff118967139bb395335a73a42faac99f7bcbe3bc60b990b71d623ba337e03f1aff57d4ecc7af8a4ae2507bd4a084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d07ba8bcde7ba90520e883e6dce70ba

SHA1
f42e29795065eb33046ea8b5cf10239e8e76863c

SHA256
e4b5b9c9a814c56f6804165a3173a4c6645dae2f48af514361bb0b3062e7799e

SHA512
4abb0733b2733d28cfd3a88d17d3345c953be0a450690fea6bf5be754291a378aa94ababd381910556b4acf2e23a45b6d516f0d8f48254046fc63993d892eeb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c36a37b84b5ac00a8ac76e01855fbf

SHA1
5762402683dffd45ab8176b23e2d315975ffa6b4

SHA256
82c74ff7516c28b6f0bf2fa64f62fd9404f53b75cedff8ca2537c2cfa7749dd1

SHA512
87011efa57395f4ee8c5bb34459ee6574e848a1f311eed6b8083aecdab1e179c090e25e4f672a373fab104c5f59f7cc4875df59557503f3bf6c22714f13e65c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc1c54f3b2a77d41732a62c82a5f6549

SHA1
6a00faf3b0eba80eb5674506fbc0ae4af2335711

SHA256
33ca35c8f45df5b43aa2fa97c27d811235f9c3b27319508732afeda440da6901

SHA512
2b3d91ed9405b130b22e6d0017c228b5b6b981539df5cf1b8f31677a932b66a0f8015699b1732f7ac57549387c23e384dd7b4af13e082b2145e09ccf4fcd4ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae47f4d281ed6b2d3bbd2526e3f0293c

SHA1
55a45571b0faf13032b8e185f4dedf3029782daf

SHA256
132e5b4258e17a3281254c67f45a3d081a52bc2cccb3bdbc194fda8cf5083bab

SHA512
33667cca5af3dc81e770550ffe7635905163ca3e615ec9fe9f9abacd1a3424325773cf247469b43acc154f5eb3365afe31a2ed4ac95224474e627d2e9027f8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d80b86293e9ee25df8f360b77e03c93

SHA1
026729a5190560afe90f9fdcf0c8d4abef8f6f3b

SHA256
858b0199f0f91643ec90c0c0d9771af1236fb124d3868745c6fd134ee80de777

SHA512
e8588a6f8a5cfb2dd9ab3613b40ef9ab8863a2bb2c827c47d61f291becd46de9441ecc485f402883536e740d3665f877282e3b3b36382803bd27353b537e5241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a374aff101ee0af677d205d44b5884b8

SHA1
d9547bb284c079d0d511da99b714f72df518755d

SHA256
e9708203e855fa4ba186166a4c89d3418c3749d5407e5bddefccfbf6995bf59b

SHA512
1a5e48851c1d92cc167a2348312f9e237d1341e7c62ab36abb7489a2f6f18b4963b5bfeccbb1cbc54ab177673bc0db80e5203d766eead5de46a3aeaa2e2293a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3887c23478bfd453464727c3f9be90b

SHA1
ad8a1d47f43fc0940b29172ec96f26dc3020d6d4

SHA256
7d92c26406ce7fb9d24e28c26c5545204bbce1aaf64e3f24330dc80db8690092

SHA512
725456442e8dc7e00ae463b558f306ee29a2e1d177d37a07643723f62e7d0008ac0f5f4b13f0b322124d1037828d715e31f3407144f5d0581f237e3ad7530f46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25D3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit