0e430aead4de8ce1af7489843005c18be54e3079d58ce0e78404410cf1120947

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

151c96f50f08a4dfa6d7d0e10685899c_JaffaCakes118.html
Size

320B
MD5

151c96f50f08a4dfa6d7d0e10685899c
SHA1

f66882c8b8c85fba41130b908eb2023862eb795e
SHA256

0e430aead4de8ce1af7489843005c18be54e3079d58ce0e78404410cf1120947
SHA512

cbc2a3df4e34c65c402e2c30d528eeef9312158351fbe5d400ecc7ba2e1c6c902b4f3e3a47f4ac458bac86feb697958f92aaf8bc6440143c811d6f014d5f5125

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421029903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000021f2d24dc52f270e61bd5418023121f24c895bce51516291c358261e88624dac000000000e8000000002000020000000642e5c3670a9cffe25dad725bac5d532948e25260c5ff240afbafb51e8768c5920000000ea99f4c3aa78dd62bd3718e839c2397c64f7ae8aca02b653a550a4d07fd5d64a400000003ba2dece5c5c422013c8f7d3f796ba4867016e6ab8030ca1d979a0fb8433df65fe706134816ab558418fe51448f9c4ada38b2ed2578e8c53b88f7d3db0bc1b7c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f9e19219c316404104fe6849d69dcf6a9da1e4b593c86205912ee03b4dd4bcc0000000000e8000000002000020000000ef3aa817076d2ce4066f8fcc471dff8a1fe56e07c774862781e01a3a645036b6900000003539a7954b6c0bd8102f05197c313c589d596ab826c8f664ef82c672482950711d2915eb3a8e2c9b322d912d4a9d0830035ab8c699602fced614cf976ff3db3fad6514df8fade359ba95c78d184909ab36c013f162819730de215582961b6f67f1f209a5ee55ae41091fb5ec5285179b78d4e8b47ceb68e0542936c28f718329ddabae7fe990194f9c4aeae7d943665940000000e94d22fa9cba983d12b58e1a89a96d1f3c99753bfa2effd12c5876475246eab03ea5fa47f916ee5c60b5811786d6f37243405d315ad9bb7fd1f4b2c14dc89a12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58BDE211-0A74-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d42f2d819eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28
PID 2416 wrote to memory of 2756	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\151c96f50f08a4dfa6d7d0e10685899c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
703c6abba0643c59e6132dba924b2816

SHA1
72970e3a75f3bc94ec1f42fb47809b9701d7454a

SHA256
a6efc7ca14ce1b0c977e6e33ec1f008c212e06c463c79beee29ae7dd45f08cd1

SHA512
1c80a4012948fdae8e296830048190615f7971422490f1c0b3ff60d380150d573e464b8de562bfd4999deeaeb10ba5c3a3c0409add9a19c414a47f6eabb17af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a43cae25bc678586c0727aea024d3e9

SHA1
ed02ef5aab0bbfa82822181e5b75e05e2a81a5e4

SHA256
626e38e0bc9da31e2d6966a9319607f12a20ff7b29e5779755728ad54f8c001d

SHA512
f656a211157e8a6f8f8a845511e53c19300a8531ddf1906dc329f9747d66d115f8b9919d22560e1a9e1abb8acb6130cc515bf6c3db71512907ded7967e5161f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad854703a1b18074746a013e409ea8af

SHA1
394dca5353a9d1b32eae87010d9f4e7d7c7f1ffe

SHA256
bc86a1894562accaf9229aadf9f5500ecc6b458c7a417cd0370c8ac220798d48

SHA512
c335bf26510bdd3fb4c86e26b6b3ddf04786c50db0adaedf32e2232af88c526ce7d59cadec1715aa298d9db7690d74a9c215c6ac7532853c5b9ae822c1ef7362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab000301f670ffe6b74e6b086ca59b2e

SHA1
fafe8b24172cd81e60213975fa12f7abd75c3d6d

SHA256
98bf1d30b607207e965453e8a304a0fd120de8e613e0210e2878ea85f695f9ea

SHA512
a8b7b9f5da2488d801d3b52b73ec3a6f6d1188824229109425a1e434e112acd365807b751f45d93de5e768ff947192df5d087cd9e11d08ed7cab4316109bba41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
771ba528f31d2d806ec689447f43663a

SHA1
97948c8a916cc7fc7f92d5ac151a8bc4821ccfd5

SHA256
747bab5e38f1ee6a5fc06f6c8e6764c44fe7aaeddb3d64fe4dd23e0998c1fdc2

SHA512
39a9674a77f21504f3a807773087f674d6fbe041ecb1950d809fea0575f428abd49e21bc93a1b4436462fb0485d2388741731c3550d26907a08243f27eca2d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
218f8caff057ca97bfa716c0474541c6

SHA1
c4f090f1985644668a0a9bc4695e831c07f43897

SHA256
77fb96ded909ab87f08f545f17a30a9b646130207b905fc97d97f25c6f56273d

SHA512
a22a4640d3b0d02b69cdf28fffd66b031371cf59fe325d8cc4f2e080763f43eb9d57c8890ec7fa33eb4e2b0082b3e07fbac7c6771b99d2393bc5048c47280cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd294b63aae3bdce0ae7ff0612143381

SHA1
17d752483c97a6c57fdf4f8d7fe438aa714e42eb

SHA256
79aa4a87dfa10a51ef0358381d5fb1b640951b35fbde370a33f2f6b12fb5e72a

SHA512
cf374a93818769eb38f8fc1c6f9b70320e4366ca5aaa68fb8b6ddee1da8d5c6c99fc9248d4ab7615e15bf3db418fbc544fc4c9009c6fde9f3a405fda6834b744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b9a3c5adc53c5e40db4cd30cb6b4876

SHA1
35c1b4aa7ad1d6c49b50e337ac7ff75ef07eacf5

SHA256
69788c14e2d693896a08438b41d4a62f9d52f5e08e09a0d58b82ed2135dd5da1

SHA512
c4ae77c2cd372f2a839babcec9b7265152edee640e5d1e250e8c1a91b35dfb59b7a50a540a5ae6a61e58fc537d0a499f3770bb23066a51db49dc9d37cfa79e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68ee8f7736cf77d8efa068227415cc9

SHA1
66f7c0d07d903fdf03f8257e2bf31a3b2b918fc0

SHA256
5e545db7c6319db31bd087c7dfcf5d5b05cb359dd7a82863e6c5c9cb54ecc1ac

SHA512
470537699adc381a7e237f0db505e8d78365b626168dbb1d999038e61ec6b1418c0b0c314fbf3e5b1495c550d567f6882adb3a717366b7456e23546a315db544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32da7bd9d6d47d4b504c2a72f4fa28a1

SHA1
7e345fd99a9714938d152185d61752323a5f6de6

SHA256
85ba766da06874dc6b0f6401a8576e53be44bf58da9ab741126df525d009c310

SHA512
f5ec960b337ac9761c1d88d19337b4114282cc5b91b3c6947cc398538e40f6b3ae8a3382f8b337b365a3b5afdb071df35a00b67580410360f8290edb02926ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cfc8be7c828d2ae8dc75e6a2cf589b3

SHA1
135e56dc0e4c98b75fa33781fe4017a0f1d10d0f

SHA256
84b850c7d86b36d192f22909266ffa798e7dbb48dab1b65a33f424b651cb255a

SHA512
e47545f03b2c196169df1222db653080b018c534d3521d063487add5df1d4a3575d3689fd1ff67eb55526b8a12ae8bbd2cae25bf7d14f18511cc4714cd775a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ae56d8772adcc28537f9c7e269af9f

SHA1
8993d9113daaf1e7d4cdd72d94d1c98061b5c6e8

SHA256
a50fe6ca0cf943436c1b701df2bff9f54bea3d50b7fe4a7027d3d14302750187

SHA512
69a60605bee63892c52adc7561d5377c6f94174ff513b0cdaf63756bf84f73bbeb6f62e3116f7b183afcd8e7fdf0d7ded36e75fb8c33ac493bb5a6b62c46789a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2212.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2305.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit