dbc605d77a22c88fb6c0acc9983522db12c8d07eabed47b6f4a5ac0f1a5acb6f

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff0f27e6984f601aee433f7b89bfb00f_JaffaCakes118.html
Size

1KB
MD5

ff0f27e6984f601aee433f7b89bfb00f
SHA1

f648bb963253a91a24bf012b73f659173642f77d
SHA256

dbc605d77a22c88fb6c0acc9983522db12c8d07eabed47b6f4a5ac0f1a5acb6f
SHA512

f39c66b2d29bad60fdb53cc7eede18435a5c9978988bd827b5f6e4a646e4932172740ee8fc48c5c287a03ac4fb6eed54c5cd79476b0cfed6c2fd61ed034b57e2

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\notpad.exe	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000f6170fff77adc93266db15c6ad1973cfce58548cbd32c493e08684b2cf2463ec000000000e8000000002000020000000dc8bfda7e92b15a1dc71e2edeb689c48dbe4d9fc31bdd56f68ac08d91a11970e20000000f327d893c0f60a9b4dd034bf2978015a56e2084edee079ced709b6c4f1546b37400000006cb9f9182a2dd9117ae41751c4c2365544246dfcf6df306b0cafb21275da3ac5a629d165ce2b8525b40ae8509eb1a4ba3f8b536cf6cc74bd9b3a4cce926ff0ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF496931-FFC8-11EE-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505a2e87d593da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419856663"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bf55d5bf34971c5301aa6e54b1cb2324c453020e1b1f00d206e5c724a27b44b6000000000e8000000002000020000000169ed920f08eeef96655788bee9e811445e369205c20754740d4e26953697a279000000038337dfdfd5a9d3d3561b0f6b566670e3edbfdcf3ae672912721ae3a1042a739357f6779a803c3efce422c4674e51f7a7a1ac4b00695a1af192497172c41c3a286a39e18bf4967573355f7f8c5ad6d39e7b85542bb8c9425eaeb4f7251ddf117a057f3e0ab6776ac6b7906b3c0f4a154827c470e6998cd9ee03ec2f70341b01aa4d4e20b06f7f82be04cdef61f05d85e4000000039988cafed939cea39ae2571cf25cc61fd919e31d775739d0fc0aff492260d11b3d525e40db460aa34a02eaf3dbeda92209e576205593210e354a53e8446c99d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1500	iexplore.exe
1500	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2584	1500	iexplore.exe	28
PID 1500 wrote to memory of 2584	1500	iexplore.exe	28
PID 1500 wrote to memory of 2584	1500	iexplore.exe	28
PID 1500 wrote to memory of 2584	1500	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff0f27e6984f601aee433f7b89bfb00f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:2
  2⤵
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab9c2cb62bef625b75d1f8cce890f01

SHA1
98f706a0e2e855def117d32dbe517ea69280b1c2

SHA256
7222a210985887e43f51444e84831d20922f550cc627996a25ed93811541b2bc

SHA512
ecc1c6485407c5b161317ce52c462e93c9129bd78516dd7f8a6d221e0ce3823109dad11968de4c6c71fe4dcb8640cba49b39e0461adf942baf215f5967dcb2ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd9e888825983fa095ae9f00f0da49e8

SHA1
9098ae350b6d4c798f315b61d6dffc391fc24edb

SHA256
deacf1ca4a5fe15e0c6f996ff0268c4de3887b11eed6180908559028e328e230

SHA512
4f93678270b12a1cbb50dc7e3ddd41537ae428dc74580796d2a9ccee5457cde19ae91bc7d393ec7daa7ddc3d88731132794fbfc8fb44cabfd2ba9ead8201f09c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6df13d60ff9cdc86d0891a714748df72

SHA1
c4d8cc8f8e164febbe0a46e34923074e22f3e7de

SHA256
3efd9912fbad0565563c44e58ce9ee10b44dac0ecfe11d8f181e280f9f6bf923

SHA512
6b00b3bcdba92593772524e87b9ec1bed3d316b3a2b2e87afe191830323d913c57e4bffaebd2878a9e43957d7033733c9dce5abff57634f060f1b553111cc77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f13e5cb532f737ee3b2ff0ee5e29448d

SHA1
2eded014b0abdb2f7a94be0365c2318e36dcc638

SHA256
26294960da579a517ef71e82035a70807adefa01df2bc4aefdc6687c92c5145f

SHA512
0cf088d9598dc5c2b93e8f9fd9e4a2440587bff37c31803c093ec4b06c2034359b34ca5f900fb6c8afd08e1d39762feb373b45df47949e7d8baa3bea575c694a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3fe51b888dc8dcc12ee666f45179152

SHA1
61e8d0a78ab2c79eedd1fba3e2ecaf2091ddd29b

SHA256
608394d41977a42b780dbb08a5990117b52ed6cde6e28c8ec86bf706d800a8d1

SHA512
e9e6d2dd92223b6cd9ece7e78f1051e13db1fe8c7599f5d7de149c3b5d7785f683f68b7d9b9c09185952f24e438b2c40c7d6aa94554e61c83682d892d56bf7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a869c1a690cc1ad9bfcc9dddc8be8a

SHA1
e338e6f3f363167f7abc59aac889ca25e454da99

SHA256
8c5fcec475ba26f165172913992e3bca15fc91dfe9aa71e5da16b18d0f0a9b3f

SHA512
49e81cc63fd603560304ce9308f957b336c011ce496fb269aa16c2ae5caf34b73a89011c8a831aca1878d503347e1f5e21c3f53d7d8b782d689f2644ef0f26be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9ca50bb82b65bc21c09e1ec2e1a9a3d

SHA1
44ac5eca93db90a95abba09f84ea8e41ec50f6cb

SHA256
abe0c0b832a25d4ac5f3be969a6ba6ca4c22e83f64e23a86eebafe2ed451de8f

SHA512
a0c97e48b47619308e3b28adc60d6b7d63bbdbf692cc88545ca80287b5c912352b036bed27c0f9db7a4455dafaefc4661412fa9c79065df23bf370f948627d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2179b65288b63619cf17376e5ee93ae

SHA1
1b352810b99f703177380dfcfad592d86475c832

SHA256
ced101bc453ae112769ffb4c960ec892dda6cd0a0a82b43bf21ea9e7450d8905

SHA512
829f1b1c7b61781123bd77e011df6664ccdd804f8e7fa7db42af6703d428aa9bdc129c70f93b9868697300c14b791036b4b2fd4f086eb6c91e5402c3f88a687b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB981.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF15.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit