6388709865b55ba26d8200ff0d9fbd60d7b824b8b0102efcdd5bfdafedfa1344

Analysis

max time kernel
129s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d3098ec0d67b21860f6592789a8df3a_JaffaCakes118.html
Size

32KB
MD5

0d3098ec0d67b21860f6592789a8df3a
SHA1

86e4911f7375c512516ae70877b8e2609d89e8fd
SHA256

6388709865b55ba26d8200ff0d9fbd60d7b824b8b0102efcdd5bfdafedfa1344
SHA512

d107767d2db48de7fd5d76fb4b0224a9987dd0fc4b4ede5f52d67b3ea60a7fa074df08f800b225b619c06ac37dd34717be0e8b05c1db4ce9ea0a4b2fece21727
SSDEEP

768:OvQvTfc3Ow0cy/etxhi9mOagrrQWOh2tlRKmfoqnFE7Qg:OIvTfc3Ow0cy/etxwmOagrt1tlRKmfoj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002a942e369cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009fade06dc3ca5b8578996357a7eea8d73e928630c817731ddafca52d6759513e000000000e80000000020000200000009cfaf0a7fc2d424527862f31d3bdc0ba0c88ad4a2b9a98183c51c1687169a4199000000066647b158da775381d8ec5ec7e2d656484dc8917d70b365e2761c526bc099ae322868ec78cbaec8be5a716c40b6cacb064511c3059801cb3f9f9f6a8938bcfcf3f22842e774b346715e8c110fbe93cfa1608b715a0e9039b366c69c626fc9a6c17f6a2ac0c84ae5ccb93b1afdc40f8f1aef2f47d15d7cdb11e31ee102f7ced3e6583288238ef052f731b4b978b4d4f7a40000000718b8a11d1a26523043e1fba8161a91beda2e334ca0bd4d82212da3c3da133a840a3e169d4d408e2ade88ba7fc8fe7ea62ea8082896bcc9ceab67398853ffdd9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420777686"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005e769154d39a6b2e6658aa8e190aaf1cba02d8390e59ffa229e6dfe1f4ea19df000000000e8000000002000020000000e76f3fa360ce5228ba6c2545d430f7191c3eee3ba2d06a3565b5a7a8ca7b209a20000000bf96f63179e6f502b3ffb702fdfa79c8eeb5c628f6201c629d48986765175978400000006f03f2946370e8385f3d60e3e1693a5c86cc4df91c98f43205b8fc26fbe6749206d869341047df4379f289a78fb1e7dc387e1653d034d7750419dec151aa2521	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F4268F1-0829-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2628	1940	iexplore.exe	28
PID 1940 wrote to memory of 2628	1940	iexplore.exe	28
PID 1940 wrote to memory of 2628	1940	iexplore.exe	28
PID 1940 wrote to memory of 2628	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d3098ec0d67b21860f6592789a8df3a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
012566023e6dfc7c1308143277d536fa

SHA1
eea352c47ef06f16f9e844640871d6972936535f

SHA256
68d363a53a68bb19cf3d6bb1b5ea4e8cd8ce09dab818d16da7ccb8f0dc006913

SHA512
c830b5b2e2c0744a26158ff0b1229343176edcf02b6cf9811768946b6a799e91e3f71d5b33fee85fd3b803754e988955835c2f277dbe2921f1c648165c57ccc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a91c7ee6cc399561334d5a7cd412c1be

SHA1
0a46460e5d1ae80cc01a47844b294d50bbb81ec0

SHA256
154d19eca11cf08b77f095094def0f225f3a7c82b0f0614f3b4bdca62d8e1269

SHA512
9823a6d58d0fb3931ac641bb336095082e3ba1bdf1dce7d2e6fb00ab61c1aecb3dc587ff0b950eb203469a531d534361371f06ef39fa57ace85e709e0381a256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19eb7515935a8faa1ccc193a3de842d7

SHA1
862e50c7cb055973b47fa0de2f2dbd89a598afc7

SHA256
2af1e3d8129c5aa730eeb70d008acc6339d8d1e41a9ed9718c9e31c77ffcd059

SHA512
521bc2f46c375a5778e39f2d7de2b753c7d737d038c94bb8470e07b238a324a8a059a04209b947efa666417ad424040863bbc0eadb309acc9e2b2d55a0c1484c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5c9988fbb221a64ffe869c989b6ffd

SHA1
45cf5db96ad76c4727e724372d2082077acd980e

SHA256
126bafc04117ae5ad5866514f314fbfa9de4b7117f1bd276ecae24f9c8fb57cd

SHA512
e47f5b659b53a023460f1fa196a4e68654c26af992ccae626fa46b1cbd98da540eec15b858b93ddc3a863a4987b85325a24a4184b9c0a1e2e58d33e0088a9645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec64eedd7d43b5731437bf6fcfd1aa5

SHA1
4d1ca8c93b7ab16994e975a9e9bd75d47f0d2040

SHA256
00c377f4c5e03cdd248bda191e9545c68898805bc949ae2fec1a58f0f995fe15

SHA512
1ecbac3a2baa49cffec508b53a80b71fcb6cdc18717690fbb896eed705ad99d7b5ff62e973c38ee493876c8fd86e0297808269db8cea23ad9b9fb5e3e4a26149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8473ab43360b2ad2ad2ea9a657c7a94b

SHA1
fb616a3e8e1be4d0e392e5161deb36acc690ee19

SHA256
69281d6ddfed939b46f7cbb04f9ddefbba8286e638e89e7899c2e124576049a6

SHA512
4078c4842688797b4e7b2093152a4f7d741978ed3f2f1327e5a73d8ec9ce6e19f5ef77c59af317c0101da2c2dde3e8345c3b7b74306f79f1e02411dc0c5e154f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2071fb793362e09ed8d4d3283d8296ec

SHA1
36b585f1de0ed1ab94c4cf953d83e3651da34357

SHA256
623a3aa71f5e1dfc2f99517285d837d4ea50e6e79083e6c48c9eb7c97b50b8eb

SHA512
ccc85bdd9ee37dff9086fbedb1fea1cecc576762c4f1fefae9c84b6034dde235e6205c8a5c66e642a835b723362650e62d62eba742f9df5cb11dbea856210537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d77eb5d7e2141101af1a851dba6cd898

SHA1
d91edaebb13a74d6c885f4c401d437e521eaba9d

SHA256
19357f7f6fce490a4c0d643c5558821c6cb915b3f0747c76de25a56474dcb4c2

SHA512
6f50a2bbe4c349aa898214015fb3d65c368c0d4b4836859a0d88a0b763b7571d62b626ef302da4ccdd8841a9180f0e963ba19efc5d9cd32dc89b78cd99fbe474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cf1d28752bbbb38171775e35a9ba564

SHA1
cb9fd3e8145be5cd8632cf5538200402b81bc4c8

SHA256
443b1dbd1f6f8aecf81189a7aa45f37b75aae2757a677222115bf8094bc2e9bf

SHA512
b1ae6ac51ffdaa38a2ef29c606a431c2daf6a1c337e40b4ec975da0195ea02e033aad5b33c53eb34ea3936822f23a92cc38edf6bab0fa15ff9083b1e93fe8971

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12AF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit