8140bae716a67079f832020a036b3343738952de11cca1aa532171e2b74fbdaf

Analysis

max time kernel
144s
max time network
144s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e818d4873e563db1a48b111775c76ce_JaffaCakes118.html
Size

18KB
MD5

0e818d4873e563db1a48b111775c76ce
SHA1

5ade22910a8014d16c370c0b94169b5050cc3fbc
SHA256

8140bae716a67079f832020a036b3343738952de11cca1aa532171e2b74fbdaf
SHA512

fbb7a56b38c95646ab733da24093c61b3d943bcad31bae266a6d2584d0ff2e01b65bba86dc99b08fd6f021152415393fb037858b08a1ea6d1cadfdf32b8c9667
SSDEEP

384:G709J+pzOOTlZDiDocfQYVxTMHUki90oeeWikTY4a/lwHj:m09JohZG0cJxTMH8CoeeWVTY4a/lwHj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E68AE41-087F-11EF-85C1-E69D59618A5A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004a39b41c68b64cdc111f18f5bf418a31381540e59b6befe27e6ee377e0b19d68000000000e80000000020000200000007d0244a7551c9fc26d157f8df19e54ffd375d985fe68ba98a93889230b6ec6bd900000000e5a693085714d113d5a6dc16fccc23ae4ce63d6d0ff185aa38286368a9d6bc048d5d6ce4170caddd5e2e6c7b58279fc1c27f8b120e62deeb1ea855cccc22c9a679fdd8ac40810dbe3d7ba17a7d0437d88911cb167ac0a2aae096b24c392dfd9aa14444ef17cc00fd01934a54279e04716aa43dbd4d47ec39f1a93a80b800afdc3d86130579923292181d12deffa2eab400000003c445d275b731caf710bc07ff8254b79a70341355b6dfd4d4663172e9cc1a103f082224aacbe20fc25bcac16f02a70afe514347035734a195b4b671106ff9dfd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420814838"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b1c87d8c9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002cd08ca412b1949d11408028c8cab04e354494a625be31a1d723657d6e9bd55c000000000e800000000200002000000052465a940ca666be3641c0e7337208fa17ae6433f2ba183d3f13a108c6c3aef020000000c402c36961e9f50cac898d519917a6940bb285a87f27e57ade581c3b394355eb40000000ed352c42cb13952cc503babc2b3fef096f996c583fb80ad0cc012cb1108d0535869be4aeed0aa9d83ee8f68a410babd7e049c9c9ac2ce693eecadce70fca8d41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2384	1640	iexplore.exe	28
PID 1640 wrote to memory of 2384	1640	iexplore.exe	28
PID 1640 wrote to memory of 2384	1640	iexplore.exe	28
PID 1640 wrote to memory of 2384	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e818d4873e563db1a48b111775c76ce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b64b8db97b3d774ae0f50398a26ed05e

SHA1
0553a796f2c664480ebc903e1d56e104dea1b88a

SHA256
570cfafa3f88653fe0184547036eb0bd92d5ed1eb85df30767889106ce7e3367

SHA512
221d9f07fdfba3c5e36ad0ebbc7e1ef370b1f225c6b10eefd19f57a5dde654fbc317c5291ce5a5ca6ad82aeda0ef2af736689601e8ecca0c6d36042eadcfb2bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4188b487eda5404e974f9add3f632f1

SHA1
3ad92a1c8b6dc59f703eadda8958ba59cf28eb86

SHA256
5eedc9c6cc81697a895d3de55ef0d16824c82974d9633dd724c071daf6870164

SHA512
12efa5e3a9d670b6876c57af274a7e6ad473bcc2ef104c3c80a3a6bcdd5b519ce31e9a849ea8d3953743c3c242a5c8d50cf7b06c3924023c5511feaf1d2b8c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c6078bdca4c21d3ae6bfb9eaafb19a8

SHA1
b496c4eb7877d456e2b9a93ef8c118df29d412b1

SHA256
4322b0b5234e146924542483089095e2084ed08400b61b99de6b461973bd731a

SHA512
2f8a08e5a27ff6410bde95cb7997332e4bf2dd7874165c5d6a165bff0dce17ca0d2b5642f3fd195b052121e57f87080d6ef8fc81216027315b55c156849344e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c1ddc8d2619210aa8730211b1509936

SHA1
c77c7e6a362d850c0bc24fd0e7257a0e6a8c5407

SHA256
ee287c776eeafcbb9a8f1c26cb03dce513cca20d0644cfd9dd6af73b6acd8c3d

SHA512
4838ea4ca8fc56e00d886bf52b3fb12c9ee985ec13f65afd19c7e1f7c73ce375bb16fdc3cc03c323f7f25537c707c67e14b31402cebaada21020a8eda7fe464a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57238126fc27892e55b87e61c324c6c7

SHA1
4ae3e6f94e0b2a2c48848d34c1a05ae45f175cb4

SHA256
558b9f7c081a1ee963a5ea5c194b667a6938a09df9cf68daec091043af4fdc96

SHA512
624c314e362458ee9b6d9cac39b2902bb9e5f1b0f1f4a4bec7d4a641dab6e50cfaa45940a580a8357aff345316379fd79f6fa92a12cdd4d5a44ea8f5e9edc3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07666dadda4c8f9af40900e4f415405e

SHA1
fd1efe0e74d120fe45beda5f0050fca28bf1332a

SHA256
e8cdf56379f84359762df2dcc240111cc288a46eaa3451d31bf24b0c59bd0155

SHA512
a034d19e627c32390faf377d2d1d77beda039e48eea5a2d3ea1eef96854c4f938d105aaa55bc08dfaa8952eb100ae47c6ff38d89680a523a56b1aac452ac4715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e21d023d1863bf8faaf3953e0e6bf6d

SHA1
17654c3c12b322ab946013df4fdac83056e67723

SHA256
e5c8007cef8c3da0d7018f187218b33df32b59ae9368ec05fabfbf466a9c2510

SHA512
ca089df475e852f4ca7d75d56696e299d364c02bb6cf44ac26fae13a668ea2ef6b5bb721c7aee51a105c43ee37157863b5de240c603cdce0206a1fac0e325127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61a1e4c7f99917ec22fca58da89f7c8a

SHA1
fa8d3d3c968688eabc01285c62377931956c796d

SHA256
1cc683ab7886b94cd23f86517033ad28af625324e8986e331f25dcc133de57d8

SHA512
b87c382d01d9313d56c00729a70c023b064e0a4fb0f19088dc5e398760ab53588486ab89f1d683196c33117da9de6de0eb30c1b7c3d79526952afef2a0c7aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ae1bc125844f022f80c00670294731

SHA1
a8bac16d517dee426628298409c1525472ad2638

SHA256
029a8a6722aaf9695c7daa222fe1a72f6d777bfd06322c7c208df9d873235a7c

SHA512
05223a406243e9ff032c5da846594d6ead2d1c3e77ab6144e1dd829997c888d0601412a942a1d10c5cfe89fff170c188d1a9891e9e1f63aff3f2649ba2ece1cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac25cfd9c8643266da1faff3ae9cc06

SHA1
218326dd3659800279419a5a0d0a07ab1e6a68ac

SHA256
7b8b4817cd4bc4fdc6ce9665e92713b85439a3373cfe963a4b8e97e4be9e5425

SHA512
347cfc80a9228befb384de66d3de0a5766f3451bc792f47d9509279572e2ef268387c693cb1d97a19e582feb9ea3b7da028e789459ff25322b481e23010b3da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\genericons[1].htm

Filesize
224B

MD5
7b6da9a33eab1423c622a3733e13799b

SHA1
68793ca185e4982e9acddd42ba1ebda357216f7f

SHA256
859a4df61667eb07a2622b69f39a8a729f9979871917b856424fd491ba56b0a5

SHA512
eacc0d5ac4e0ef6e511431d7b6b5dddb6c380bc28a5730342a43a67c1f3f072ffab377a808abd520a863fc3d35c2dc92cc83e3d40a9285f825b3f4440ae27d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CCB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73DB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit