11ad1d1dc85bd95652ef598b52028ff0c8458391d0a2ff043dc3352fb44fc6c7

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1717f781669376b8645d16c1b296edbf_JaffaCakes118.html
Size

22KB
MD5

1717f781669376b8645d16c1b296edbf
SHA1

a0df05995a2fe931e2dcd238badc18bb22ae0b3d
SHA256

11ad1d1dc85bd95652ef598b52028ff0c8458391d0a2ff043dc3352fb44fc6c7
SHA512

9feaa78b03232deed54d91b5a82e5ce9474521510ad0f868477a57aa18d9aed740ee6dd87e252337d51b2e5dd209fac5350589926701b2f4293ce986f6507421
SSDEEP

384:zxlQ/SQyqxPM7sLjI5uLbsZMe6d3pRhVXGL+15V02I7Yq6qC0gAfIdiJjtLW2Lq:zxlQ/SQywPMw+uLbsZMZpRrGZbA/AfIP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000647546ef9c4bfb4880b2e087f279c71f00000000020000000000106600000001000020000000589702ae89046394e00b80210ad6d730e8d4f5e7def9bdeae7f165b4493a3058000000000e8000000002000020000000b3ff3593fcd5505ea85fff6124afe80bb778f094e7ef12255e3ac3a3f2287d2b20000000b645efe7b27b8ee04390d16d472d0a4ae10587682156f6b0502c5ef8abb12af8400000009ae0592cc0fbc86d20acb5daf8cddc93d3a3790c02156f1bebd0e0a2bad3b1e847570620fd431a79956b4adfdad34c4cf3ffff79185db847de6c26da12e36ac7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421064236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B2DEF01-0AC4-11EF-BDEB-D6E40795ECBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fe1c22d19eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000647546ef9c4bfb4880b2e087f279c71f00000000020000000000106600000001000020000000864bbf93ffc9db40bc9cab420ba50c6a5cc7a415286cb98736959d049ca93061000000000e8000000002000020000000bae16b79b0577aaf0f8bfb1af5a293474916d78fcf913ceb20e8f49a250bfed19000000000406b0dedd8cc9a9343391f24b0a57cefa0c0e96f795d9985fd579df6f751cf93a9f7dd125d443bdfffbf04eef67169ec5ec5c0c0203d88f9d8751f4f4bbb9a197369dd1ed86a4f250b64b4d3d786add0f2f7a25457819819f92eac0c1d63e49707eeee4542782553c3e445e303bfa1a0850afae62cb2dd36ba5220e677ea15da9243468426d49fc471b6c0f5b9d5d240000000f0b8eb088cf32865f8b0b37ed9b638636ee8543e5e03c8499a76192d125a9b5d0c8026ef2c52fbd5f7f822152a49bd7cbf49bed0b59f4637eaf813756bfa01c3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2912	2188	iexplore.exe	28
PID 2188 wrote to memory of 2912	2188	iexplore.exe	28
PID 2188 wrote to memory of 2912	2188	iexplore.exe	28
PID 2188 wrote to memory of 2912	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1717f781669376b8645d16c1b296edbf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a5eb59ee77c50ef21557fc8d74df18c0

SHA1
1ee801f4250be198276f0f40ba354bc87b8148e0

SHA256
f9248824b6568be214097d41ea93dcfe973561716699a50b431969f992ad5df1

SHA512
961a121e4023ffadf5cad5e4660848ced60a3b9005b23dc1b72cc68c6306385ba598af89f5aae53fd23642dfbfd903a33c370e281cfeb60a8c2551a18248c5e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c0ed8087a49ed940c1e972ed88f6789

SHA1
7d2f5d1ab54506db04adee18a809162c734269a3

SHA256
0ef068e85f6906a487c93b145077672048919ffa528783aa1f6320946d46ccfa

SHA512
5e7fd61f72149f3dbf143c1d9e05a10ac899d3f7a02a1711490ff51aa57067d04129f093ac471c7a0140503b09b170712bace04526223de132169149a45fc8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cacc1c9aad9a32ad6fd807f1a87f3578

SHA1
be780f73525fd0187e01f4f67dd823132236d2b8

SHA256
af8bcceaadba25f0b046a8c2b0d644f6b70a2fb068abc951b57b4fc9b90c4efb

SHA512
fce63e83b0c79e7be0829897d8d8f55222fb5c818b328829f9508b14ce6b5ead066606d7d2374978dc59ad5371780957734450bb0068ad246fcbc6a77735f0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ef4602f2b93d74203ae4d3d2eb2473d

SHA1
87d158217f848287cff75c883a05c6a874782a21

SHA256
999598341446a4e7d18e9b08a7a39a9fc3ec23b10adaa347aa718ce0d46ec1e9

SHA512
f15557f3dd58fd6f4526ca73edc36cbc25e7b8f6bfa65ed8d58fdad2e74bb297ec966afa596338c7feb465373f1db6ddcbb04484614df657304aed5a038b6c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31ba90b088bbcf2e1bd28b639b41144f

SHA1
84e51a6571407e1e74c6bf4f4ea97e1ae3ef6825

SHA256
dc58ea5e7542ccaf2cc8068ebcac9cb43c5e264fce1fc64634f2585787b958bc

SHA512
977dc6dc7a699569c8716e35114c62316ab0638ef63c783976bdd37eb6c8898f9fe989788460ff775e3cf1f1f253af8757add842ec31f998e6585a85b1acb1f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9746aa031f3ad528a18e88717c0f1db8

SHA1
61199576a0375c9ab84bdf2783eba90aef6aa085

SHA256
2bed7edb148da8d96d7d878988c74d39f8bc6304c09e1374f270fa07298fee94

SHA512
a5b5ddd1f033c5cd34d4c7ea317650b48036fcfbb18d9e62a7a1e7e3fd84b009b1abe53d2befcef277989bcab99a2df8a72f4a75f0404a1df8aa14b796b0ffae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb3e64ec213789868ada344d610c73bc

SHA1
ef6d11fa7994820558c031c61d7cd36b8ac98eef

SHA256
67c9996629004f16de5985ec43fa7f732f0567372b1c001a156228b3912c1be2

SHA512
77445947c616cb0b7d119cebbc4fdcf5457a5cb2eb6522b0b55bc09dd71b07536dd34a1dcaa81807d7cfa4db425289c106e32ebb445e6bcb919493b1a911f1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a0d5d418485194db96a470b14f878a6d

SHA1
054a84418a6c7a37188214b4c06621a4cd09088d

SHA256
9d4ac376e3c082dbaf1a8919d50e0adcad62b0718f796f474741798e6d39171a

SHA512
813f7bcde8796f14b60c658aa3ccd508b7484b62764924d072ff05fef4ebd55d210732ec60c0241a5771e4dad9037d9ae7a90097ba35e05e3cf07c4a7fce20b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit