aca62449cae4b6e99f6d9c1c5cea47407b2883a872a61e3c52f088a9597276f4

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1717fd787dbfc82e4b2d00e2a41c5642_JaffaCakes118.html
Size

460KB
MD5

1717fd787dbfc82e4b2d00e2a41c5642
SHA1

3e25fe90c34c4effdd81071a62623b45bafaad4f
SHA256

aca62449cae4b6e99f6d9c1c5cea47407b2883a872a61e3c52f088a9597276f4
SHA512

d15ec1cfad2008877f2911fd1f812675b792eafadaf921dc495ae07f63c5e7d995de893428331193665fd030595cbd5efc98587158063d622f5dbd1be8a8da9e
SSDEEP

6144:SGsMYod+X3oI+YYjsMYod+X3oI+YKQsMYod+X3oI+YLsMYod+X3oI+YQ:T5d+X3a5d+X395d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421064244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e7b526d19eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E257C51-0AC4-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000024bd3fb974528748d30cae0d5c71fe8aaa965d4e6a374c178d9de6b14f085ef2000000000e8000000002000020000000f451d18f5a9d807d9cf83625c850a20dad5946d453e4288bc67a401dd4a40d13900000005d3d5d50e21dec9ef8f270bdcb3b1cee3d57aed0dc1d3ff8f7b22830e915311d8a56657fe029a624ff97ee4adf73d062bc6ed54433c46cd030f475a09cd4e95f444a42ad4c30bb411496a13ae83c80abf812361ddd35b75ced71ed75c83ffd349f8b8d8d4d2e8b4700635327a864ef8250ae388861fa108afbb1341ad03438d4c4c5cdde9d478bad0658ed28fbf612e340000000840eadf131dde2073ed4f628c6523979b9cca2414d9337ad833401ea4a0d2acad47ac7318754eb5fbd8f9b8f9dea66d446de685d937f471b75d30379ac99a37f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009f84790f45150f528405ce0d9b86a95d7779b00f4d2a65ac69e039b9d421cc8b000000000e800000000200002000000087908fab02c7ed61bc91c77cfe0f626992c050f103f461db67c17b00d27eee7320000000c4d496cb4036d79a5e4c0e0e7ebe838ce956170d35ea33dddc8be6971fffe8a740000000af77c702d703f3fcff39b6b16577197c09ce9cddab359a9db7fa0c59722f52a02d5d19cd403975ec33a56ba880da804e42909dd9e12220496a788594c2f4b085	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2960	1660	iexplore.exe	28
PID 1660 wrote to memory of 2960	1660	iexplore.exe	28
PID 1660 wrote to memory of 2960	1660	iexplore.exe	28
PID 1660 wrote to memory of 2960	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1717fd787dbfc82e4b2d00e2a41c5642_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd947d9810a8799a4b369ae42549a83

SHA1
629e7ed435b951f4a547e197cd2903e86c36120a

SHA256
56da6e363d33d681bc8504366047955c5e827ccc044a58e0b03794d4cc3682d4

SHA512
eb98e6385d49d170771771de99cb9a51367523577ffc4758173abac20cce7b68ab3dd6672acbd6a306932e3f2c2851a0d22d0e12f8c63a01f4853fe357aefbed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c26a26b05c9bc4f3cc3b714fec87f9c7

SHA1
4e20ef3c6e3d0e2b990499539401fa86c11865ea

SHA256
aed23aa0b038dad2e38206c35625bc679358348ac1feb7e548b4de99b9005887

SHA512
0bf3a9dd190833749f955c333be4254ce86b7156375f28011b5c31ed04a78186bc607fa5909098bdee0d99be256250a4cc0e1d35b402804ab3c20d3e7c8883ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c230824c74b5ddebe88f22dc835ae40

SHA1
f4016df3dcf5a5f794ac6583af5855a0553cf4af

SHA256
57b68132105145bbbe0fed15d613b1fee2f124416002575970788ae79c9e2535

SHA512
d3f72e326efd3ff87eac41b7806de409684b2cb5a207482f0ea3d4ff296d23f80aabe7166e74ebe495051a43063d6ec0619518869382f7130fbb141e93b34445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e906c9d49070610573da55314dbebe1f

SHA1
359201d4ecf6aa51c67c5314c6c3a1c42d29d34a

SHA256
d4ae9e1489b689a63b6496bb4b2dd39fa19d178ce73682bc9f3ec5eda2b8509d

SHA512
7f4784dcc5d8c460419681b09f25a27ff9670c73518463e16546ab5a35f4e5fba7b0ab252c0da66b3096d9c9ea1139d415d3ba239c4d9de9d9029472f0a65354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c47b38fd8c01a01c38ccdc477c4e2407

SHA1
2fa1444ce3f5422c608a366260c4f603e5e19023

SHA256
3b2eba8ab4ba53590c2232fc7d603088a2c53cf24266b2746e8a58b33ecf0095

SHA512
df376791c723a0f12b7f45e9516581977fa0094c728daa2fdb30cbb1ba1b877e922d55a18f029e27c90b05e9f8a93864bc763995049f947689888eb6f37757aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
443a98f6379277729356df896231ba2b

SHA1
9473c693b67916f61ba3ff4839e283c04545e793

SHA256
f2daf64c428a6a50d8c9e7ab41775ab66c351e6bef9be4a8f00c2253db214096

SHA512
92ca5ee0449d230394d4e17ee3f9faef94a10ba68b85d38eca61851aae62b4310f51fe0d36b4b2ea451875902de206dcc4d3eadeacd778cd97e8e2517a094eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5846513a2e8d8e1cf0af2bc977f7587a

SHA1
c10652343bbf3cfbe130ee1951dd714ec5699dbe

SHA256
54523f4e1f6404bd4dea94abf3f8f3d8dcf03346ba11546a9104c784d68bbfd8

SHA512
7247215805ae95949c90a8d9e06ff01ae0cc0e6dea86a0f654128d9ac8dc4c93ce47712338f9c43be17335ffa4823335de580a7556b0fbaed6b2b5954c99b67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
689c952fdab1718d2642d65e10d54b1d

SHA1
bdf3235854f452b194a0019eea852b9855fe1242

SHA256
9b8cd70c9ca10b9065a5bc31145e831a11e9859e2931283c7ca19b0ef1f3367e

SHA512
e3ee1655a0e7e13bdb40a5c00ec1f3c3fb12720ac3163d27bdfb1ac0f90f5d5bf0c1b679ea3e1047636d7634f5997ca95751a68955af61b638f84b68dad390d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c850c1eae6c65f5558de9b235b1b879

SHA1
a5a9cce30ffa5a8f265f9ef4e367582add6e0431

SHA256
a4c8adc0d286c3de970625f5c439a152d9667fbcac94a8312c4e4b28854654d2

SHA512
8f93c199d10962cec7e535614683007c47782887a4ea34cad169e8536a14ff0461bcf01179d798afee6c8008beeaed0575ffc1173ea292a920f48786b241f4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41F3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F04.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit