8943cd6bb5757891bb3992ce73b74dfad6af614c7af96665a3b7e919c8a39d69

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

030a7d6e7507bf25fe44b6060e9d10de_JaffaCakes118.html
Size

460KB
MD5

030a7d6e7507bf25fe44b6060e9d10de
SHA1

a8942894f55c62314d03ed164b2e0f64d8f2122c
SHA256

8943cd6bb5757891bb3992ce73b74dfad6af614c7af96665a3b7e919c8a39d69
SHA512

c7316b79f7b6a1f1353b73628b57070a37517e10fee42e5fe5339686aeb43ae525d3757f1cacb81f743f46bab1b5017d00c5b07d52e47c3c27c4c10e90dce576
SSDEEP

6144:SosMYod+X3oI+YkQgsMYod+X3oI+YZsMYod+X3oI+YLsMYod+X3oI+YQ:/5d+X385d+X3/5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420375376"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000005c43041ed3d9aa12f86d0237fcd76d998806375d0f57febe1a1c92bb5c6ff167000000000e800000000200002000000097a583cc3f041f51e8cb212a78555313e42a8416090856368a27e65ce649bdb290000000a9fb7aebcf8c1fcdd35e7b174df6baa1c33b6b31bdb259727d0e7ef35c6011c254b78403f6a7d057e09b74af4e6e58a97b3e1c39aa739446295f2584f292988f8bd30a71a5be08686620b9db7c7283fcd86ece0f626bbb0f20e42142056e643e8b44c82edf6dcb6329f3837c14505d577a8e9034ac2b67c0ea9fdf71143f6d9acd3e59152d4e37a93e68d771bc205048400000008e1bb83a42f68f7b3bbf6bd68cb4350d48fbf82f3e27e2f088826f04c103963816bf176d4340c711b31b21a803454b595d86fb2749c9294888e2951560f06d1a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C6370E1-0480-11EF-8B56-EE69C2CE6029} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a022e7448d98da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000777648465da9ae1a077634a466bfdacc3fec174de62615fae07f24ffa552b90b000000000e80000000020000200000005de385422a48566008fcfd8c4da0e5738c7ffa12154fc3deb97c731d72f3630320000000a88a92a8de69e917dbb8a149b541f87b2838c4dc29c6fb993c2166167a4a09064000000089bad285b927085bac48bbf8f89e8ebd9db86594d4ebcf3366f7e6ce822a8fed16ca1c5dfb6d37952eaad566065296d39168ea8aecca88a888bd86c1c7aac8d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2944	2184	iexplore.exe	28
PID 2184 wrote to memory of 2944	2184	iexplore.exe	28
PID 2184 wrote to memory of 2944	2184	iexplore.exe	28
PID 2184 wrote to memory of 2944	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\030a7d6e7507bf25fe44b6060e9d10de_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33429784d181e9b57d43db03be5ff01

SHA1
78a4e1a500ccdf8753abc62f3ff295e64b76bc88

SHA256
913e8cef9985d22ede076bb900c4e347e648dd5ba09f0a57a9864dd202343c4b

SHA512
771c939d60c0570dc7b7b6466834fb47fc3c871b48f80c5501e85e314e64bcb6efe61dbca68a0df2937938f90f66cf8768d0f0f259726feff4074f414d6f2457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ccb8fb34ca57798ecc0a400e91e580

SHA1
9a1c25f76e5e0ba2e10b3e915a8602c114535a16

SHA256
5e70d1324802f11747a8303636f7bfac7c837b89764d1af397a32c7a11c8a313

SHA512
a4e38c599af5a17a64ea4726abeed4d49399790ca2eb55cf2a92ab7e013b74f0de004c2c7898acb2299557c9a1f23fae53c0cb5e1a8f35e34556af36e9dd77bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ffc8b5ea34d317e4dc4efa459cf1617

SHA1
172f21fbc0c8f361924c339083d84d6c61c91595

SHA256
35de70b604119ccc69a5fecbef3d9dca4fff0aa3d514b5bef3421ce751426df9

SHA512
29549bb7930e31050f923ba7b3bd7cedd140cb0f7aa34330816b61ffbd9dbe25771815cd3da35e701f0c08a3ecff354aa78f16c9e86a4f3ea6f5acbf7bd59211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c624af07ff1a753451a30624753fc694

SHA1
a88dc622aeb74e552c4b2a8e2effdcb19f1bf37a

SHA256
6f220bcb247089cc23e3ff8f2d26dc215900f536656c7fd2ca9a6ace7c41a629

SHA512
f509d1f2303750165d84314628577297b00548a198cc711ae9641f97e393ab7ac7b5cc61d70019c0bd0acdecc7c1b95bcd1b21cbf29fdbab2af6888f3f65c51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c8ffdaa51a9b520addaf842ffbf122a

SHA1
4aa4a5abbb9d611ee35be9846cef4103546e4a35

SHA256
3c5491ea0505ed15ddd52f443d6a1d02bd89c47ae8c41bc9b325f7883bf43e24

SHA512
b29be257783fd2ea9795968e176223e63364484d50191922e501a4b5ba9c5193dbfb8c296c6de3d004817f3a360c0f6598363474bce8b1bfb316673aef2229b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d89d293f8ff26bdd751c03788f03a1a

SHA1
c6db6d2e24d44a385ffd7826a6de09a1a3ca0bb8

SHA256
233b6f4d4b33b94f4f483a3644073a92b58b4a273d5b8900838c0c570e118dfb

SHA512
75690a37dd4e19d9742dbe438ff091b1f81aa6c25d0639d007d507b5def0c1db36f5bc259209c10214cd890bc8ef8f6b3bf8133c2374685a5c15d878d949a857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8be4fb2f76536ca254b1a12973174ebb

SHA1
27175f977f3adccd820b406716dd98848aaada8a

SHA256
dda6291722cf3b3e5ef8b270f2a00d5c8c7d7c4813ff6c6c44524f71af40c75a

SHA512
6623395ccf6b20af41b4a330820bae28ea1b63bede6125f52451aab38e1d89a6f8f2808e41efa752610f0a4158e922699b04d87161dd40042d437dffd67bfc09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe4a9d924ec9c2b4550311c6a2ff822

SHA1
0b8e0b53947ec6c525c042bb5a587d9f6d22cecf

SHA256
12e45049fecdeae6fea2296313ce227d52745868b117c0af80a02f33d395e869

SHA512
902aef9f0a3082de0c6cf0e79bd5a348e682df26f12e79382fe4457b04c20123f63fa663f7ba8045747791d5a9ca637afea591cc05792ac706697f97b2517c92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb14772a73b48f3327b11ffc226a1ee1

SHA1
8bd34b0bb3bc1ab74f21a65604e24f23bf7fb02f

SHA256
30f506d8c8a6153d564a83ece0a466e494a6a65e5674977b2e8c75a8ba9410c1

SHA512
660b6537fbaf79bca97d77bb6f6bb6eb71654a7137772571ea3a79f7e100c104466b8c6d74632006dc53782bf96ce0088f12cadcdf6406f0ec9c51223fa13ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E79.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FA9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit