7a37803aae0b5e7a1800ca67bef9e3ec4b31679cb3d57ab956e98db4de10e68a

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

042e2959713aff822b81b44f5d51b6fc_JaffaCakes118.html
Size

9KB
MD5

042e2959713aff822b81b44f5d51b6fc
SHA1

576360f9f8749f8daecf95f1d7ef1729b350b954
SHA256

7a37803aae0b5e7a1800ca67bef9e3ec4b31679cb3d57ab956e98db4de10e68a
SHA512

24c301b0379974bc6126228a91cbacdfe04784fefff21eccd98ee9dcfe0049c0089b224842b1c6edf785aae1d32e9a55d22af0d936e703aeb214b3f001535d2e
SSDEEP

192:4s+wVyBiSxwlYwjNNbEu/bEuWz/2mSFDrPKK:4wjDbEu/bEuWCmSFHKK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9047ea361499da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{610DD871-0507-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f84870520ef84863a6e01e886467800ed4c86dac962662d74cc2a14221c631cb000000000e80000000020000200000009c9e7283a4774648071298b6af3746c4408178418679dfdeec808998bd7c4ffb200000009ba18eefdc15a4902648370f1860a93fa7443d8b6566ff3e29b256826e60dd74400000007bbe1183de4dc2d08cd0c8b8e21b9ae0d90d25b8a65daf46b64f7e4475745299477126e6638c7cbfe0a0aabdc5b0c032fedaff3d89d98b532b57470e0040d9fb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f14efb2950b770a7c7f0fa16b26e0d148bb2eec5d4c58192392ac929aae374c9000000000e80000000020000200000001742d99af1dfe62fcabf9a57f48f2de9f4cd706a4558706d3013124e6aa1dc06900000004a7246eb4fbaa43591bc99548475ee46ca5ff98454b7b270be42954f80fbfad2115502334992e062f37695c6d1c7e445ccb80c5f3bc653c2bee7a20a8f702fc2fd7a1941c87c5bb599323b23b981e5fe62537d93306230ee5d7602d8303f5c88a381cf60da20c0fe7ec1c71897e3a1345ab8418d2eca4313834a5d58e3904913615dddb8c94c40300ae738a295c6dcce4000000005130534050ecf0c9ad5376721562c3b6f9d5e9af2a10cc9426b2398484017a261d0e3074c7d5aa314adbc49ac2d7611d25cdcae77327946e964a068c01ad924	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420433340"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2204	2112	iexplore.exe	28
PID 2112 wrote to memory of 2204	2112	iexplore.exe	28
PID 2112 wrote to memory of 2204	2112	iexplore.exe	28
PID 2112 wrote to memory of 2204	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\042e2959713aff822b81b44f5d51b6fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c314cbb9b7b828af8f2be4a55aa044f5

SHA1
8d1ea871dac7faa7eaba3e21447a63aa1cfd55b6

SHA256
dd0a5ee79cf750e0f4d1fbf6b473bab7f50432acaf5b03c395e3c47039f7f3b3

SHA512
09c357869f811fdf3f3fd9704a96715e97da9e3532c7bea8465384f153a77b26e9fbf01345d4ac40647b76e3114a7c39356a8a4f51ab279d0133ba1830d7b1af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
608d3fba4a3bb05d96db5bac71af5d47

SHA1
8d08d731a379b1f1e7b86c08c29472c76c723c2e

SHA256
78552eb75e28cff74c303b8e6eb6719fc21ae81fd9769c3d347f7aa3d4fb6b37

SHA512
5ec8577847acd49c749f3749d98fbccc8223c3c39dea03f3409ae08b93442b50ef89ccfbfab8acf04718893583d02b0e04a634a878855f7fa8344f09296b742f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c52a6334c6fd0cf467748c781277835

SHA1
e468e968419294749fddf0f87c86685d597998db

SHA256
bb0bc66c23338cd293fb58ced1680d686f44b27708ef0a60bbb62e3a534cbb93

SHA512
5857e2ad364d6a44bf977362d4381c53941069c856b430cb45baa0c364c669f689aa64ad051881cfc5461901f26d3576c0a3a7625af8cefce6b75066ddf82249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e73d53abe90e3792b5b43024ff6eca4

SHA1
f19838681657a8b909b0be7213bf73a38c2cd6c5

SHA256
75f21c7d6fe6a44f3ec1539c44b4abe6969dc50c62abad1098ad89e34aa0c3d3

SHA512
aa4882b02623a1625d0c5c2616f21799ef92f2ef213473857a13905b2ab79a72ab479d2dd10522ed32200a45b0074f24bada97286f65fe4274777ec8c6f5d48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556459eb7414b0bb93fed03ca5485fd7

SHA1
7c446cba125313c693509fed5dee028c78375a37

SHA256
2fcad1639b49a348c3194255e3e54f3f397decd3ce239b176538d54493542d69

SHA512
54b0199370c8a8909d13d2330d20ece6677edaf9d7aa68d6703ca0b31a0622ae04e8d99678c9373e5209a4e3aab04853f3bf769a140213cb76decffc3e17ce7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aac2131ceb29a8ade405b64aff03a26a

SHA1
3af60f26ac438180d6802e592e69bf4241110d54

SHA256
1f88e7279d2617328a3783afa7a05da5abdc0baf629739a7b0f2e7906ccb34e9

SHA512
e8a153b2738c92caef8b2dfbd655761e755e37cb85f9ab33a2554c13e2f67f430327bb740070ba0ad16329f9030f4f7c98f07dbe3a37237ca7407066c9edc1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503750efd3a5eb73cbbd17ce3d205f54

SHA1
c4502f177e4f5af57d5a06d3d2fe9b9202fabde9

SHA256
88b615935ff7e8cce440fc48183df92b47e0cc8d58dc93d91a625c8ee437bc14

SHA512
50f06fbf8bf47552db856aaffddeaef04b639e8a310cd1d61f61b84d2bcfe1072393a8c5f7a3d36fcde06a9a0447eb5650a761b766869a756505663d4f1d741d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb4666e340aa3d68dc0fdd072745d3d8

SHA1
325593b0f913d8496a6efc6cafce0ddf72b75d49

SHA256
4b6ec4c2242849dd6c559cb2d5cf2a1676a287fb78dfef294f7ef5488d4e950d

SHA512
10d59e04416978aace54275e242dcf21a5157386a77fff62133c5cfcf50e1aec87a351f0d245a1f22487da19b5fb8e629a612a04605a48cbc8777ca898b2d22c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defb6b45baa842dc6e81f844f9cc67e4

SHA1
3f3e7196e39534bbc9525c8e507a9529fc3ce8fc

SHA256
4dcd69208586d3bde1f1ba93b07d4dc9c910f5a2c29d707a5ea721d02294e846

SHA512
9142dbd1c17fcfd1243cf5c571650af20196d873da979f4c124ee5c774b253cf4a58217886cf68fb4091b219b0b4c5ac7b0e6e00e47db88dc31315e226ad9082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e4e805d04b83f22944f2dd7485248d

SHA1
746862041f5f13884b31c9b81afcd7b619f82ad4

SHA256
df5215bfedd2e42f0b7a86f147a3f87afca5c0ec0fc639a522748da4c1d4d647

SHA512
5d61a69f9e73010dcc9aba9aaa777e6d4d732db107446a89ce776fc43a77721f9d99c817c2be25907692ab002a24b14eaf0b2b03a9a6af7293932a20cdbd40e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F16.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit