892dd2a2f8f9def97046420eee0a493612273c620c8e9a615a6cdce4000915ef

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa82cc378696b30048347eed1d1d44a_JaffaCakes118.html
Size

461KB
MD5

0fa82cc378696b30048347eed1d1d44a
SHA1

ecd5582cbd34ae80616f1478ee466035dde266c9
SHA256

892dd2a2f8f9def97046420eee0a493612273c620c8e9a615a6cdce4000915ef
SHA512

b80797c0baf6d8dfa210efa94f64df0dbe95eb73c1357000be15eecf71ebc58110b0461c03d6e43b50cafd2b327aae023932f3133f97e8d89f4a20459ad7b581
SSDEEP

6144:ShsMYod+X3oI+YYQnsMYod+X3oI+YmsMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3x5d+X3K5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFBD8AE1-0904-11EF-9CEF-E299A69EE862} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420872015"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000012dd14edc5d65fadcf38a44ed96febbec567e06f20f361e998bc828ce82d3306000000000e800000000200002000000065f2a773baf03dcfdd53fe4e3673f08b59956c6fa090915fc499110e128b82f7200000002da68b455e6273cbfd7629ff1023fe584e9e9008bf9ce979765e9f6a6910edef4000000091d85aa477a2dbc87fb1537283461ed6cc160201a1a292ebedf22300a0bcd6c73a72aeddad3cdcd03fb82e35ede4d01961d1859420ffb1dee2feec7f0a16fefa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000d56356a4e22d7a1b15015437d0687e6570047b35dc61a386a2a9d73b07dab354000000000e8000000002000020000000a2dc37093c678337b5600d28342b5f49b24a2717b7b29b4790567c58241b552c90000000be005d3ff21f4162654ccbf338d940f2b3e9a4b520c96d3a7ffbe9a6980660585e2eab0a19ef3ce73cc666731bc70bfc7314474cb7156be4c0bf7b4217114ae1c22ab0312fdab6be7e1f7d076385a308a795ba5cc756d72c72bbc5e2bee807bfb2d6a59b354efdee7507047ffe9e71b40cc3be73fc5c56a199d58efdd2148732ad8240b8d095485604262b9cd3fa305b40000000093294d8cc6a1a6abb2ec353bf007f7a952cf6eca7bbba98b752170ca351511643af987dbf3282104cb8a1787dd158eefcd82a1a7118cc57b42be371788e1c8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f64098119dda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	iexplore.exe
1096	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28
PID 1096 wrote to memory of 2212	1096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fa82cc378696b30048347eed1d1d44a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fb58c70ebe1a7ed435af5da9fb3a92a

SHA1
8da784e3908f1cd6b9a2a46e6b0138c4bf2b3ebb

SHA256
bcc092579984de5a1233eb84e0214b70dc9c2d702026d11600f0194c3fb9caed

SHA512
7bdb345ee40f1c9cdc994771eaca61fe0f27497dacca6447c349e98e761b64ec37be427d171bacc7d8a3d1eaf0a204308c66539322e1c3651b48b62a55e24072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58e42e0ab55809a2acd7a08f7bc28b8

SHA1
bbac79f23193422ad4e4baa16cd1e6a04b787167

SHA256
a42c9a5e3782672250e0fc1ce10e6767f37a60ec114f974ed16ac2dcf90af454

SHA512
a0aac7112f579c20cc7a2ed11a6390a14283783f7c6a1868b10c1c804bcf3de376d94dee2391dad4108d2df3d603a3a98c68d5986b787640abfef1e6fdda97ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4b42d9a48033fa3e0bd3310695601e9

SHA1
9caeff65fc1ddbada6810a71565da65381bbacb6

SHA256
daf3defb9d224b2936aaeb0ec48796597a6efdba848eea218f4ba2fca421ea91

SHA512
4e4a91fc20a408ab1dd6a61c03e9f8b4803aa094bb8ce02ae291b78f9706f042cd06e1e628dddcaeebee1425715b86712362ff71187d531279e35055ac756829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
741111add6899432a7993583c12d5f1b

SHA1
aee284ea571d46a66c9a737ab20c7a6a75e6529f

SHA256
7e2ff3df4d2d934345f1b89a9cc6e181113f79dce5170fa2b6c6cfc8ff278cb3

SHA512
41e7028b24838c5f2b7ecb3f4db60136da2a7a5a6d07b23cea188421d1f160ca28169b8097d985234e77792b69f440e578361fe0f3e60873bf4bcd6c77914d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8966006246698d85996c63bec31b60ea

SHA1
ab2fb670cde89a866e41972e3686e11e14eec480

SHA256
1569d22055f7cd3f0a7aa49e3177e94b64519e0c3500638713bbc7d76090482f

SHA512
722a09af90456535699fa591c54658d276fe055568df9d77c1d57ef6a8f0f5e3ffccdbc8eaa7ddaeafdfee31d465551c20dbbd6bf19bc2fcae2b611acb3114c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448cb6a2af751c77e4a64f8865ceb9ab

SHA1
bb533143d3bb711f1091356958d42b8bb7366e01

SHA256
4a0ddd7f6bcd4ee9c3782c4fcdf9c8f818b2b6fa9ef3b56d56779cb8d6fe6a41

SHA512
86582e7c49d4fcd2b9000b3b7ae011ee282343d150a93d849cf9861b5e4d4ba012d686b05568044589da618049b3b6e7f6069de8a16cd71d5f551500da386efa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f2234d841f938d748a985d004f2c344

SHA1
c0c657b1119c56568e36dedf6e2488a5840137f0

SHA256
a4df429ff0854437510b8eae1c4cd54b5f863134aafb249126b9a4c0b918c2ab

SHA512
0a7660aec7748a2bd1fce6f4cca5be04bccaa71821b3d2a2120807baac8136de3130fdeb3e7495f8ac469b7216c8214f4a40b7fc535ba5f837594cb20aa8baf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc254a84753e33be1e4ac25c5b3b09b

SHA1
ba37c9ea87ec50728e7969351cca63463f105a96

SHA256
00eca7a13c0c0098fda9a8dab2da8f00d46c4cc3514b9d777f373034d8bd70f7

SHA512
d83ee9f2cb9a68d49c9b62b9cbf8c90132ff601194ee396bf73a69f7f95f0af743d87fae94988547aa5f139f4f593eec2e5b785814e4a027097b1766a96831e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe61e80aedf831da6e58bc5eb25bb1b

SHA1
8ab44d61a91719c12db749fd255b4b71a60efb3b

SHA256
abe168262155299eb3701baf4536894dc1f8c495a82768636932693c6834a6a4

SHA512
c690d08a95312d2256103025d94f495c35f06e0baf2d86f23d1b7048cc004cabc158df43098d3d2f638bfc084500605d3fcecc6c03e6bc1665f6f08e758b2514

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab539D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5490.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit