2a0cda2bde9ab1c4ccf9b04ae341db369795b877a4a87278e2ad513832d963f0

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11428c2a20f76db9b60c5746e387e383_JaffaCakes118.html
Size

28KB
MD5

11428c2a20f76db9b60c5746e387e383
SHA1

e4d8bb000505fe2dbd32caeef06cd79a2ff6ce5a
SHA256

2a0cda2bde9ab1c4ccf9b04ae341db369795b877a4a87278e2ad513832d963f0
SHA512

e041ebdd084e4783f7b9f0330294f89452419b1ee4b6bef24072e955c6b0c23aa544d4eb000bf68be20a8461cef9ed53db22a42cd5fb55167a55f2a504f887ca
SSDEEP

384:Wuz+d/quo96cLjygyaRTUvMTenchbh7O4Wkhh8aK92JeqAR+mZtihf3e2ea9wj:I/VoUEGPaRTyMinchbhYaWohve2eam

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000007e5510c2af7de57606711eed9fe1083a8c05311cdb241feb9ab701aac90a1769000000000e80000000020000200000003a8b4ce6aef8a2d4a7838ee6880ee29e5889c22ed4bad880d4f92f72d253fc7e2000000055d1f143871c4ac0963a80fee50ec9a5e3523445f0a803618d9b7e3d40fb697540000000d3133896ff38b5327f154e049cd0d3873a91a863e0cf87922e323966b4027156fd987178f6ca5d2fec2096fecc1a8d87f3a8270609bcb36e4965325e8b05846f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fcdbffcb9dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A990251-09BF-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000038e859a939c574816fd997b93d6894aece6cb1e54e81a8413f30afffa0c85bc4000000000e80000000020000200000003d9d3f18f1b53b3eccac1958341734c800ea1f51f263759f5366d39b5e836479900000003b808da9bf99f43df969ac8e45319ea5a18fc818dbdfc964988f8560064b134402f793050c21e40fb5fc81e483313b90b0a5ee3f790fef0b036c590565a9dcffed7c043b39b621235595f5d7409402640efc4a8e76c6059a742da75b01340537a070a64b76938310704bf5135732e19b32026f0007a79f54773eafa456f6d1dd65d99997ef44e88afa6f0f4f2b10c37a40000000ad3e22477a685c36f06b761ab4c2ee214faca42c316e7ea3117911f2fbeb709ab5d8cb56e71773a34a07ee4cdb79c97a3bd231b64f408bdcf74cb09986af0d42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420952030"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28
PID 2412 wrote to memory of 2644	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11428c2a20f76db9b60c5746e387e383_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7a100d2931455a1f9419b8a1923ecbb

SHA1
5de3a657fac7aca8261945e7169384443d8535e4

SHA256
6993564d81890e28efdcfa88cfb19666cd3d97b77417a07d6c6f0c356907da00

SHA512
6154b0deb5784fdccc5bf51163e91f48ab0ae854e30a6054976c244028e484eae2c8e175578b2cbb7936346f24b08199d23af03c21be6e587261145e544e1e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bbc29c31c807d047c36fcc8775ad460

SHA1
e0e639cae013429047f94e11c53b7cc12e22826a

SHA256
635c52db564894eea025b2eca72ca2b27446ed5d4d3297cb97f3340df04dd0ec

SHA512
aa32a18b67b99ac7437dfd99f83de7c7b0111882a5b227b4eadb04473478fc8bea24422da40bf59abae1528a37a4c767c72e2cce696e3612b80b1078854866a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05bd614a08f63d30cc97780bb3b2701

SHA1
bf19f6eb8a280633dbf4565f4e9a861acfe7f986

SHA256
626ca48c229255248e7be4f7c92177930f183c4f663dd986d29166b69eb48926

SHA512
584545408754e4efa23e6642d44d29391dc72df71ff77995f741d064d5574e91ac6b2cc26a085b96ff6aa1bf84f2a897d681777ca3fd1bfcc1466ec06f3016c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
190445dd2abd6ae737853217d525e9ef

SHA1
1a49c31eb1d1c68206904e789243c28ac6666493

SHA256
378998c00aeabb610036d8f198b4b21596d05c54c45e87941f67a35ca170965a

SHA512
1b0936c35a4b45193581e477a8b3c8563c6d1a563d916450863757b4b2612ebcb5f3ee3a4d476bd182d0d3bbe5807fd800eae5235b7f6e51724f76df6d429ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
491f53c6f5386ee36abfba6bfe71626b

SHA1
0a0af27b0c37561f3083eec9f19c1c00ea6cce20

SHA256
cf47f6dd1ddeda43fe4e6b4f78ce84d0ad8ac41b0f865cbf0232282fc32af373

SHA512
0786f68550c3667e13612e09766e4d02dbbc854eae981a3ea3cff40f136ba45d01cc114f1f24a7f1abbacc7561481a124cc3f17d7754f8aff47a8cef946949d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46c8cc0ef0439f700d58c09b1ed6ff3a

SHA1
78a58758592f84aad265c69ec94a41ec1459f4f2

SHA256
fadad468f9ddf5c8905f35f542afa408c2edea2b674606b7c4697f76f65a137f

SHA512
c10014482051258d2e3b93979445b8ac91a12020735f9ec28802ac430da0ac9f2c45eae3f7f19e7d7c57f5db94bbeaa9c8f7fc3ca68fe52ec1bcd0691f6f84b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b09089fc3c19541d1d630594f8c9c39

SHA1
dc6c3b8a1d9d697bf87ab509cdb13b05a540e1f9

SHA256
72b538f99ebeb73122d88961c6057e0b7d213c19a1b37b78dd1e1b03140aa9f9

SHA512
228224412513d8533bed2d3efbdf102260c4d0fd08112308003349bd2315b5a242715ec3a4f1d4005ba56797661a4a981903731be3f51cd112d467bd5d255184

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE547.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit