0dcbc1c8d2d3c305fd632731013582614f2020c1f6b91caaad8ede6d6763dc60

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e672c87913063c6d96b92d8d5c85750_JaffaCakes118.html
Size

68KB
MD5

0e672c87913063c6d96b92d8d5c85750
SHA1

99df09e9befd7200d63bd1f026147090dbb58f0f
SHA256

0dcbc1c8d2d3c305fd632731013582614f2020c1f6b91caaad8ede6d6763dc60
SHA512

02e7c824d0df4be5b3212c7d2d7a796701d4cdc386162b3d502d867a1f38896cd6bec65f00482794413ae548bbee42e0e6ce224d7aba70bda336ade4c8f95f3f
SSDEEP

768:JiCgcMiR3sI2PDDnX0g6J2LnCfmUmzjoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpq:JunbCe9z8TcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420812203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000091dfd8e4cc5ee8a61d076e2f550c6663f1d31e3e2be04b064e7275d785227cb1000000000e8000000002000020000000e57001ac2ac4fc1fe795b8bc4cf94bbaafbde2bbc806ae021be21a1798dcec8820000000d98cc1d63b2bd06c5a40485dc58c7926c7096500c408ae36d5f086ec62896aba40000000c25e114f3e7c00e2bf5bb15da8e4aaafbf06573eda60bb3fc3e6451eebcda5cf948c12616dde0c94b09f3a516210367336a39b2d161116672127f0538bcf4966	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D98ED71-0879-11EF-B937-729E5AF85804} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10453652869cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009af7ee5c0c4ebe3298a0425160250ac483a5a3de1b4bac98c9d4716aa0797f8d000000000e8000000002000020000000c450a99f98aee1dd629871d3afefbe421f29df24a1fe11005cd7f49d8fc253aa90000000c15a2a4f4a039e4b6fff34ad0c345ca7b537a995f9201895579d26285e2f02ed449fda1b811538dbd20fe66e4dbbebf310b135dd6e41f527bef47677bbcf0dda98f8f5d5e129f66c5cbac3c647ce1373b2f1041faad6a37c2488b484631aba6c3ccd57e8009b1c0f3358db0cf075e0646d79f0604e57dee704f4d7643389cad277af6276ec565627941949ed8916267b40000000477e42dd9ac516161d3736f76950bb7a06821ae1e73a255e81f8c0d0b9ffa9cd2afb0776fa7fcfe82fb307cf69fcb74ac6c2b4c974d2e5038d6c7e66eb2f9ee9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2640	1700	iexplore.exe	28
PID 1700 wrote to memory of 2640	1700	iexplore.exe	28
PID 1700 wrote to memory of 2640	1700	iexplore.exe	28
PID 1700 wrote to memory of 2640	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e672c87913063c6d96b92d8d5c85750_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccebd02ab721c5b4a9db6bfda9d71897

SHA1
2313fd6c786d1c9f9080ca25852af17e9f6b7758

SHA256
8f96ab600e726d007cffcd9623e3ad8052d876b48c0a23d667cf457d8b26f107

SHA512
1756946abcc4adcd5284bf8380e94500af9ccc32146e4c5a2c652aa362acea155589202328bb5ead8b1f1a66221abcd597c55f9e5b9be418e775c9962132cd1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78679638327131fbc459c282b14b1ae7

SHA1
82985803495cc9755078bd3155d415d774ca91f0

SHA256
9384b34adffea76d6b7f94cfeed6ab4743c330c6215d57a146dbf9cd8026f65b

SHA512
c7c500f4bcc9406002dc5cf713c137100eb751099c63de6789977e90962b4be427680d4d8de7e3ac4de4c78a1905ede691dd94a57f463d936adaf5d68207689f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b189ed7ee634c08760f3b1f2a574b1e

SHA1
83337e2abd099b8e7f83cc6252ce69405592096c

SHA256
5e9fcee3f0b5c641902d35f42ebd16660408172ed4dd2935d3292768572a3673

SHA512
73b7fba662d4bb35852b283f46ea95ce5359d9cd94d8e0ea41c50817adc9598187f37ecb71415fb6e6884e289c47e060543993b8b4dc016717d8a2a2eb977e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9576f69d3171beb78c175a12049ac25f

SHA1
3bc87f20f99b7fde64ac3c1644f2fb161167d19a

SHA256
377aaf57f92dfcf5eae01359dcaab72ec4e3b6dd3624dc2320490a85da8e98b8

SHA512
139160eb5a6f8eafdf066ae1cb432a6a3bf51891c557a7335a4ff88d2459a4e0fdad50e736e5bd0876a3f04aa3e0cbc5a38a25f63e1695a6764c5cea073e5153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
278ee002a2521970db5ec8e3f08a71e7

SHA1
a5fc2577f089315cb9888a1991a8e35ac11930bb

SHA256
adebbe7234c99ef0813fc2345972a421c2a59bb9391ce90f8e0909880480cfa2

SHA512
f94e0d3203d2fb6caee19d0cef21c58a509f3bc373df56b4b19cd1c1d1c701a2f190af540f585eef9fdcab613aa18b860ca52782d73872bace565c0010fe2e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3524e9a111ce86ad36d1f1d44814b034

SHA1
710c8a3fea6a2c181740b5b863b634e09f7a905d

SHA256
0c2b4133c5c31ad36a335382f0324de9085c0cd0769703654a3e3c7cdbb372f7

SHA512
d0d9ec322f867d748d7665cc034a5d6cb9a8dfe3cb6c834699b5543536133db39c6af8008810050a122a82208dc27a2621eaf81ec031ffba3684acee9d47b270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a643af021df224e2450325b3662451fa

SHA1
a70575e98fdd0a37af33cb3000fec600edd142dd

SHA256
b612eaa5aa458916dffe29adfc8663811b0cb57f5712a5d42870e130f38d9f72

SHA512
40b0a7618bd89bb3f68f795724d91813b75ad4179fd85631c3bf9804ba2073147db7d7f30c71793d854f22a61cdc736343d058f1d05a755a8274df4b22caba76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4813da00ee058bc0baa2196a2302757

SHA1
f09053b3e64586ba375257dff3cfe1323788536e

SHA256
b7f0ee0946b0d985c37e476798e2ad21b23391774c0a93c9c7cbbfbb8b82ab3a

SHA512
a5a520f77571c325b399ced6a7710573f6713104e84c79807489c8a2129b993f7a02f47a98c5720bee13a9ddb920b868bda9cca9fd686c91700de6c5c81062ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2bf683bab41dee289237f9cbcdae0d1

SHA1
aadeb36283c6e73c9ec9cd5598e6199e4c94f61a

SHA256
e5446794916b5ae347578e29ffc9c0fa6eae67bc014c0dd9f511f6f1587534e9

SHA512
e2dec96f59c60199ad28839c353b3278de995fff9ae5e1f1a00f408a52c166a5cad3ad81a14f257519eea819932712ab500165b26feec968e41b58a925292c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de97fd88fb18d3f03f5294f70b0d435d

SHA1
89b884fee0caaa7e3508716296c79e15e7bbd2b9

SHA256
6137d5358ecb94bab5fa4a84dc10838d22d4cdf6f1ae0b2bfa06de67a9f9bccb

SHA512
b7aaa9373f4e2d26f5d46335314fece6246d9d6f4e02d8dbffe1f0c4546b9738574dace551f0c24c6fa3e3f6d8e595e6c410472a9cee22a0e4a860629a60aafe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab235C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24BA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit