112c682d0395d48963b5381a37f309081fcff98c1b12cc3e7c2d65d37ca6aef1

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03194d7fbbb501d1c46c741ea3b4a3d0_JaffaCakes118.html
Size

4KB
MD5

03194d7fbbb501d1c46c741ea3b4a3d0
SHA1

58a674c161111f51c9688b395f699133c7dfed01
SHA256

112c682d0395d48963b5381a37f309081fcff98c1b12cc3e7c2d65d37ca6aef1
SHA512

f2d797d5571a9def7ec948bcf4fdd4888c27693b421bc953479b59ffdd56e672f939731bf0818d572720ad467e0fbade664c91b5166f35fc0b6cca857938cc0e
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o3gBeu4d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25370921-0485-11EF-AB14-E299A69EE862} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420377407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005325443b3e68bdf85648dc34f638c1acf35b8f8bf5825a9536ec24f34a1ce87f000000000e80000000020000200000009bb27c56d41745c3b9655a780227cd6416c463568b89ae9826926317deffbde8200000002a452172b56217e8f48caff8429ea68fd26ed639d189f62290b4a07baeebbbf94000000099a535ec3b8ecf1a744e3be71890424eed1432a1cb6f13ba64a5c1afe954b4761402b77e5f6e4ba37ac1a77b67b3677e4891def50244f74fa4b225cdaea263e8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80aeadf99198da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000077e2812ed787e575fad1e5f1e55b31878f281bd56a8cf6d94a0d17567f67bad5000000000e800000000200002000000014d5bdb8cf707bd439bca587f7e0221c83cee307969681341e78f13d685818a290000000348ead34f5a504b8f8292c71b2cbab4158ae88f7692285c83db0da71b0dfb690ac2879662ddeaa8b51b14596555d8c9cdf71f8f8daee968bd4f842bbcd2898b2a44c7e746b1af850cf08037c89b9f377e247e9b9ec41d4ea3ce469e57c04e06a6f917d4d5f566ff3a2ec7b88cbb2e00f07b20010eab04ce4313507878faa88d3cb467fabe386c593a8ab93a496ee937540000000ff6841b90e0509c61d72f53e6257c32d23025ba3690c5d3b72cd4ddb779fe60b9485121f277bad050e475904353a280ad1848034e05436365913e7ff107626e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28
PID 2612 wrote to memory of 2332	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03194d7fbbb501d1c46c741ea3b4a3d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
852bff6f3a5ba3335e473ff8d0a41fee

SHA1
9cf429f85b6ad45ca97a4b2709fbb544dab156e0

SHA256
679d58608b640b946556c000883af1d25c4e0b57a94aad7adceaacf389f9f810

SHA512
728eb248043a1da0f9686fd9e20cfe7a017acbcea6d71e0a1ed35ccee8da2618bca1563bb483cd9c3ff12d0df382595fa8a56fc52813fa23a0bcbb6a503bfd32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cefbe47a1b6d2277c28c1abd83ab3a3

SHA1
4fdd74a3121ded64f02070eaf85c0739efb6d772

SHA256
5d7e21975763127bfb1cc37a3b1546859637e7c146cf376e5d5a2321cc0c6c5b

SHA512
18a314e63b932ff68f795b9248fba538a6184d75f19ddfefeab1e247559f6204f924566e52b2e5ec0e1040823c9510f97a932e3c50cc6e962bcef97b0aa14be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1440e08c5bc69cb36b810f8ca4819e5c

SHA1
379edc19c1c069bffdb3aec629d91d2f0192afd0

SHA256
774f56915806f2c5f56092ca299113c16654003207521702fe30cbe5a7123a44

SHA512
ec1f0bec6d5009ef819d36f964dad307b1c3a1d224e2aed3d40de40eada2d3c89182b904308f7656fe61895de23e0b5118bff7c793eebbc47ae0a81f61174d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f2cb5944e754329e67a48e65d4d1d7

SHA1
4afb0f2fd1aeab97ffc74d6601579af63b864348

SHA256
a636cb5ed863c69af55b963c25531c2d05d6b2a7b933f211a5af0dfddbead57b

SHA512
0cf94492bc60be0d0bfdc7e6e22bb89d1d401670595b4c5e5162fad4040c635a6989a348f414e0fa38a780b760eefb15299634ff735a0834acb248e915f0eca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a9b0eb394c45b31df301c3a287c5fa4

SHA1
9017802295aee1f719eb46bdc11c777fcabdc2b6

SHA256
e4ef1ef07f1e2244ab1ca6ee20ba7cfbec21cd0348c39ff9548869c1668364c0

SHA512
35f69c22b87c94427ed9e262d765fb46263e7b4b30ed1698ae0fcb97bc9ee1858607a744efb9a4016a36f0b49da422428cc2187ffa0ad86c2859c870eaafc6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
422754f3cc880c2a3051854a99c6531b

SHA1
e4053d9edc27908bb87db2edb87a5d18bcf83dac

SHA256
554c5ec603e6546fc03af018e9d8fb4bdf5d9c18214e8db64cafeb60008c0ae1

SHA512
938b347ac3f74524d13e1601356c62700f846703f70704b33b6eec0bf11d695106e7529475917d82b862b5988fc7fd0e549c323a5b88bed79b45cd99e99de0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa46f5bd65c9690bab56dff1245c6b53

SHA1
3d31abd7525ee8db15e8abe74e3489bd0caf56e4

SHA256
aeb2955cf0606536ffc885b013722949356828abcd3d1678a2618bcdd6482135

SHA512
ae9f2fe72a677520aa9b5baf84c17d6c6c323e4c4a335a49d46378bc0da5147c5d9fb8c83be14996ee0a45548ca60f89c63ad60cb7b785288ee2f80cd8cf1144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59cd86fd3ade2f68481b36064d0c0ab1

SHA1
781dc9357301e68f4e7fe9aa66d89479d725cb98

SHA256
97de5559c9848d4719bf591306bc708e39ca717e39d8d5da015f4f5264df4345

SHA512
e075f4dd73195893458e42c2d9fb21403b961d365f0074d4653801c4fac0ca67e8dc1f020f542eecacb103787a9e14564faffa3882f48b143e658ddd459dce21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f187517b902827d0043b704441e2e43

SHA1
ea88de5856f07fd0e3f092c0bee6e85a2e3ca9a6

SHA256
04b5f75b45580be6f866d2ff3e740d7e9c1b9ca20dd31939bcf5708e4eb85639

SHA512
01421098ad9bde6867dc1242e8992d7cee5a62b6a1f8387ff9ad003d66a76c9cbcfd23a0db97285bb48f0a16c79fab0e2ed59d738b96db0ca6bbc98c44dfa599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a46dd7946b26247486ba2f2673bb52fb

SHA1
a7e7a44511810fbe081a921cea15c84fbd34c5fc

SHA256
3d010e25b17966ce94d16c452094cf531ca8d8198c274016d59cd4f1b68b8230

SHA512
26616011822c3376aaeb75bb6e0140a1d56d927c46e029b48a2f4628b3087b12633b1b70dda3e73e29c85a57b16a290c823fa6aa29abf086144c7f9d653631e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c060bc7e198f0be04935f0c93d25b1

SHA1
7df8f34e70a6a03c861f63e2b51bf49197fc81c7

SHA256
53acb0d55b6275347d0976f0afce7534bd9a754bb3126763b61c1ab618816945

SHA512
6d9d7fe74d871bf9653100df20191c4b2c5307ef0b6b50066a0f11e09142742b5dc355b05e982b035a9e5857377d11688b74e9bcbc808d07b51053b34003f79d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e5ab6a7d45d904554874af5c20ad7a9

SHA1
32abfcf7d2691ea6e1f2a62933cc0431278025b7

SHA256
4a271b9ced25c08a2b140dbd684a0f47b5a9230a2dc30a519fb86718e9a3bdae

SHA512
9b0392f8acf7fff7a0a8590c7d98ed08b45305afd17bc6bb38fc76485386bcd89b4095772ca9ad52369f6e30a45ded28aaef63b9e87a609aecdb83436039928b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27DE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28B0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit