7899e015c1ac10eb260b5ac7273fbecd8883bf90250606a25ed75ae5d19baa10

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1739d7a188a293b23ee0c510e86c4130_JaffaCakes118.html
Size

140KB
MD5

1739d7a188a293b23ee0c510e86c4130
SHA1

bac0dfa99d8d6249579034d802ed13af5ea27333
SHA256

7899e015c1ac10eb260b5ac7273fbecd8883bf90250606a25ed75ae5d19baa10
SHA512

eaa9b1dc93098808356a615a11a2179758adc06f4799d06a091ff0c4b5be684d2c4b034ca466d53c9a3f4e42982ff9f4790d6a6393761affc6429a0876d9468d
SSDEEP

1536:SpUiyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCI:SeiyfkMY+BES09JXAnyrZalI+YaFWW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10248531d69eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4323F161-0AC9-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004a5fbf00a65b04c8a0773f5c2f4685347611359701a39d66264409a99b58a738000000000e80000000020000200000007c368596f2c24c349de7df62aad63a0c73f8e4fb7627336e6f937bc56e0acc2220000000d350fe57f3323535bd47e2a1056dbdf31b4f1bf4b6cd29ab06ca3d9df2eaf85640000000725fc1e9024b98444eceedaf1dbdd61c844908fef70b47f11b9fb3b320c8b3dbc56acbc58cb3c2aedfe97b2558c265231c967a61646248e00245411bb2f653be	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b45cf4db305c3f5378f470cec4d03c33d239d2181b9512ec7d3169f80439063b000000000e80000000020000200000001f694fc6b73838485767f4a67a3b049333d2cf95f8ab99ce72099518136eb9de90000000eb6dd4615c0825607d9631bac181173dd773ba21fac244be44d821ff1d72f24ac9a79f41bdd43508dc3fcf01157ae425f26287b67822b7d6f42b86c36fc14ceefe0d529470883a8597e762506f05b7c51a7a273d322e412218dbdfaa33106c62a3c1545c522d2c4fd809e00340c6c6113bce4ddaed1b00e220611a2f55e25a2da1764a19619fb52d83563bc419ecf63740000000a8bbae9e41c605fc5f8d350cb200e32f1c58f9bff3e0300fde7a248af452ee6e5ef4cea64fd8031d2271ee3ca1f2da75505f9229e0e4d09fa5f17fb598476f64	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421066398"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28
PID 1912 wrote to memory of 2504	1912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1739d7a188a293b23ee0c510e86c4130_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804415123d19d097a417b818871dcb57

SHA1
e4de5f5a12faa8600a01bf018d654a12d3e7d82d

SHA256
81d82f0fc100a624fdba8c07a7ded1db75b19b800bb4d1d8a03f85d35938552e

SHA512
1a5a5028f23f61125d757ff86d7e65249870015836690e2df32d50539e65047ed983caee5a3a296853ad235736402db84a94b3b7551a71582e481884013261f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cda46dc7b3c08241c48ca6b2d0e4e6b

SHA1
869660799b7cb6111eb42cc1cfd8d149af318eee

SHA256
d34db2b99501cb1fd63ff6823d0b25585859377339888a4dec4015032208dbc7

SHA512
454ccffdca9170d098e9fe21be5fc268d71b4da6f6170cab4d1d04cbd2467e88f0498dfc45466e9b2b04956cef1929d6a00aa43db9b4ef60344899ce03589e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ee12c7aecea284fd6cdb475a726ea3

SHA1
2d07c45dd3d0452611ce5add1b4c702f8289496f

SHA256
9c0d2952ddfe16ac4c1fe1ffdc19ebca201224db6cf048caf1abe0ce702fd7c0

SHA512
74e9b0cd60630b4bd3a4ae61dbc83ce4cae5547151b04f03ad2e4fd31c702873fb833eb55e709b307bcf996c86f231d60370df347613a08dbbfae5cab4136e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64963fc56501bfef1c93a77e0eaff7d5

SHA1
0fbfcf811ba953b587d00dfae0ba5e4f28e372ba

SHA256
82327563e773c69cbcd561f0cbec05276beaebd515d3992fbeaa451ec5982a2d

SHA512
795f31895832f88e0bb32f5a48a1b92021630af989e294285b910cf13e8af937dc03a4b60b9c1695f5552623e9274e7e1c4e28db81fed4980192563c5db65cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88c8d3fd74c150d270534df2ba65aef7

SHA1
626eb70ab40f43711058cd5f1c364d25c29ca4c5

SHA256
d44dd27908ff620f19a87c470c4bbf82bd7d28abf196797f3bfc4d7f2f19a873

SHA512
4976c047499a62eb0b567156a3587fdaa352083310c2483054e5a5abbd462775b658fd15702702a4d53d55bd01436b15af7a5a9b4b301d9d9651accb6a1c3b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95367e4206ffa404d28a6deb4f0347a5

SHA1
85aaaf80ff9ef6bf742dc7d84b0480e01e739c15

SHA256
d42d1f8e2b285df5e81e2b15184bc83db1071dad46c00c4af9fcc7f4023594b9

SHA512
00c174c46d0ab76bd66fc10084736e3e2d61da393692045167799261f63607e73553e00a1bf904ce9a2cdfc4c45ea57a0625559926586919d7ceba363a7c1e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b5709115a8de80c50aa84b138e727d

SHA1
bdd62e48186bc33051dde5c6647b97678e3cd66c

SHA256
6e49f83892abe183f003fe25540fe0f1199a1dbd9dce8950d87cc7d69462524a

SHA512
4a17de48aaeae0a5c01ad4968a102d8abe819b5d13af441ed4da9ab631f3835d5a5bb855b86b57fb484e1450bb9f579c3c24d1dd44508854d4b4ea38867036a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c53920062884542e95e8887c92b9a9

SHA1
3b03fbcde99c83bbc7599941f390c0fa6899816c

SHA256
cea451b740c0afd87fae70d6289783fb1bde9430ab31677445b179c34400da0a

SHA512
a2ab775a38a745ffaaea708ab13d66ac216553714366629597c6260807573f5ede760c9047e14d6352dbfd4985d96a986b7a324c0e065ad59e86bfede6a89c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD04D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD17C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit