079a209c00a27c36b270ded4f11b96a6bfaeb62e59bfc4da362f9f2f3867167b

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0825233c2e217a87faa0800f6dfbd4a5_JaffaCakes118.html
Size

142KB
MD5

0825233c2e217a87faa0800f6dfbd4a5
SHA1

5ccb816b3e2e7cc19ae8af928572b9017c4d56e7
SHA256

079a209c00a27c36b270ded4f11b96a6bfaeb62e59bfc4da362f9f2f3867167b
SHA512

1aa6410134ced9c108eeca38bdf1a50b321d926cea1578814759bf2e3b14ef66fea8019461b3c738ef9578db334763454223182a8568b4d6f9c1750506090073
SSDEEP

3072:S2dNgEkJHKTneIyd1RCQyfkMY+BES09JXAnyrZalI+YQ:SrCNsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420571292"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cc8764559ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c7dcde799928178d00d017354485e0be22f5f2bc4ddc9874602bfcd9adbe1623000000000e80000000020000200000002e1f8cc9a647d7e1f7f1fa3cba01e005041b735ecc6eb1db66583f6a06b529169000000062939703213b00c6bbb4ac785cb307c90df55ff03af3f6acf9e5e610e032cce3f20f00425457c36899fae6884d07c006e27df31c5cbd06db821d41444780fca6ba043d3e0c87b3f50711e6aa1eef73bdaf6214cbcace173f17d8e9ca61d1134807ed6d3b5e2318170b762d9514a1cfb74df8f3a1572789428429fda8d23534f83003e7ee4fea1260b224bfefec3b34734000000097cb23b4027d09dbe8815e5f1e51819a05d49737d704e60e3c906639bee56d321c0a0d9e48cac7a358de51a206213146ffaaaf4be07f76ae6c053fcee6db286b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000010c7788a855508f230f8bc7bc1c2d306dd4472463f6666cc9092dc6ca61007d8000000000e8000000002000020000000e4bc00b7aff8ffcd9d6300fbfadb1d877153e44ac6eaf2318e390cbe9001293420000000cc85edd14d3474b2b11512a66e27ff535b577be53595af323e1e3e435102d3bd40000000306f7ff629c5203d7fc22bf17a6771cb8feaa94022f04ffa60a8a03e3ae13ccc205a3b3ae219e009d50ba00831afb97d82cdc41f1bba836a48cfe53e88d800e1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FDD26F1-0648-11EF-B904-5A22F41CCA2C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28
PID 2236 wrote to memory of 2628	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0825233c2e217a87faa0800f6dfbd4a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f649fb8bbfbc35efa53b236fec312eb

SHA1
b8a94b1b444ba323920e8011a6a318eaed82b8e7

SHA256
88c10aae3a13722881faab5592a6bf664d52fed41f43afbde1c87c69c0ce56d0

SHA512
6563998132ad07dfec8bf15c77547194fd15618e8f8f80713151e3e160a5b327c466a13779246d0b165872652716515f1c775ecc04afdbe966c8037a9ae93bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b25db03ed0a530f6f3e35bc54119246

SHA1
f810f7760b4a0115049af99a4ad8983cac4b9aef

SHA256
3e8f54399f7c3cf4d33e9231e912d39c686f2088354b6938767366f1507d577b

SHA512
b0db99156f66ca200cef5189c12ae23b5039a210bd430ca4bde71196e9be76ffd1a9db368bac6b857f7f03b86ebdc2eade93e5d3cd506a25c74c00efcac1d346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4021d8a7beef232784bc276e2a7904a

SHA1
6bfc371d7ad869b82ddad3b53cab5b1e2673a5c3

SHA256
1a70a02e44339bb0a8852e23c419dbe86c81687ffde9e2a293cd70a6caa18e6d

SHA512
4478536b85e8a004cad1123a63578bf5fff40fbdb9e0295264d7deae8f90d55acbbb0f6f66c7f89c4dbb7859502b1bb136ba97972bf10dcd137693ee343af900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2242e1b65f462f565f59744a998746a5

SHA1
f1c38039cd806219040bdf5c5c8ec748e7c6b29e

SHA256
5878cf3c3d07644690726abe680214a2080b2cd6e1efd0450018ceb4cae932d4

SHA512
8db249fcc13aaabf6a02a0bff448cc5c9e27a5b96bcd20fb7f6a04cd7a9eb45daf96b2b06be8b2edf3ce913815a8bc1092a98f76376de57a33a179253511b841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ebbf30bdf8ec152fa28eb03d901833

SHA1
418dbf71d0a1b8e5462ed3f868cdc2365283a247

SHA256
808b1e3bd21d9cda46110b13f2912465d3565905379427eef1a1437e99eb96e8

SHA512
b99a85653bfb5cfea689c0e3cc0358435257de57a148b3ad6d96733f638fac5c823a962e040c2937e7259df630e7a96b3cd460cd59714afe13735d71a5a9e649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f7865753c664b5772b88c4c4cb5525d

SHA1
ddb46404a6d178aa0e4e2c8cf598e9290295467a

SHA256
c71c2d3b9ef7b88c5a27ab2ba41e5eea236f90e01d2994fa3ce51d839fdd38bd

SHA512
ebab9ace51f6c5b217ee79e12d593e475574c5b61a17e08e1aea327d0df9e611faeaef6df9317b0730ae3d9d3525377ccca773f15d0f7b1a9d3cc9454ae4d32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d2613362946b5207e2c180af2a30d03

SHA1
6ae4b5ba315fde059fdc9fadc971ad54f1e3b8ce

SHA256
d3a739f9fda3e615d8a6eff752bfddcbcd5e14a8e22ada26a049d579fc64131a

SHA512
1e0b574d7fd51bfc2e1ae0f0e4390be066d71884a3bdb1eacee4d8a1e5abdffacd7d29b9d06b9c01bd30c648ac74ba21760a9b0f4e00361c5a366f4983ad45e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980f60a3089035facdcec92e39fd6d9d

SHA1
412795363437232215422d8d5ba89001dc9b7f0b

SHA256
d933d0e695b3d1fafe27c18a48997b331253b9f4676dea11d9c338d458325a41

SHA512
9a101cc9f08e0c36c454dd1880f595091dc1df795a855d4f91cde8cf578797996f7c976afee5d9bdd7009774824b85af1c4ffc99d542197cf17d6daa1d225e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b4e15db8ef78787ff03ef1cafe0ae5

SHA1
8de7f28a52845657d036f439431cdd34187dd022

SHA256
faf2e06072a96ef96b1ab2c0341a41c4eab20f791a20ab72034fb2fb4ca21630

SHA512
f348f8b7344eaaee10273bb97b6de0b8ed3885693bc7ee6aae4650d89ee143da5243100ac09122578909274132934417109c06a4d27e565a0891f5e167e7d9c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2436.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2487.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit