1b8db72af770a7e40e51e919c8845dd93bcba11eaecb139326259629b8ce8c4f

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176bffb26def82b3d4b3229059991a32_JaffaCakes118.html
Size

461KB
MD5

176bffb26def82b3d4b3229059991a32
SHA1

231ba25a74183805a3ef140ba30046100fd0b756
SHA256

1b8db72af770a7e40e51e919c8845dd93bcba11eaecb139326259629b8ce8c4f
SHA512

c13632949722c0d09ebbca5f690113f94bfa99bc0c554b52e45ec2eda2cdc414546cf2f3ac287cd3c46ed878f0729e97de5b284d5b474c0bf269b0e1ea35fe83
SSDEEP

6144:SYsMYod+X3oI+YwsMYod+X3oI+YHsMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X3o5d+X3J5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAF736C1-0AD0-11EF-9C17-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a68c67442139dfdf5529f906c6c7ea1ca8fd4100c20fb07a28248d5af86e7311000000000e80000000020000200000000d9f374bb84591aaea3327d626c6d8730b814f2a52a6b35646d178e8ee1398b620000000e94b55d0718ec9c6ab4394693a9bbc8943ba5ad9c13ca1bedc6f4737b62cc35040000000b503d470708ed5e89c742c139112c9f0b3690ca3afb887b07d00c3ea6d1b1b6d19b7d844bcaece572c233c084fabec61128674f3349025ee8a907e8130046706	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000b7fb266fb7d71a725563b53e01acbff00fd2116b30ad1c5ef6e5a309780fcde000000000e80000000020000200000004ed639efa01e8a571f3fb4d6bf01e52175f9982ca9bc9bd2f443060a76c78b9390000000ac9ba21874f945f0445c9a885d0705ced6cef9c9c37ef1980b5bc03e6b900d0a779f47b183d98ea0960cb34d35550dd5ecdd902462e9b38d16d6d9890f918becb07365c89ba72a7a20502fa7135b953cc4896478ada380a267126c853581149838d056b509209383523e7356c024ed12775a4cf2b759f46b56f021708727655a1c57745529a2ee4859b92b70cac7726f40000000f23a8030bc1ee4a9e671ab3fdd60fee3e5d75a77c6b3e795dda3d6fa78348802464724fb2356c0fdd3265da9e9fdeb1088a571c67c86d768b99a8556bcaf02c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bf86c3dd9eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421069656"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE
1308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1308	2092	iexplore.exe	28
PID 2092 wrote to memory of 1308	2092	iexplore.exe	28
PID 2092 wrote to memory of 1308	2092	iexplore.exe	28
PID 2092 wrote to memory of 1308	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\176bffb26def82b3d4b3229059991a32_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c03d22bb44344f1ecfdf3325031f885

SHA1
8c0f09b2b1961352b49c886a8e9013ce1935b47b

SHA256
53d5730a3ea58cde9717a63450f8247f67bc0906d7ae0894840784bf85e8d5a9

SHA512
b1678481905e8229e716a7595c2515d27b565b1161f9bdbe208417a0382db85685964b2d35e11e26fd3726920a89128a71729929217193ec9dbad2d2a4113f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e7dd3504b75d12efba956c2f3db1d8

SHA1
de981b4dbd039f197fde7102921830b7dc019d77

SHA256
6fc28f83dac00810ccc76c0915b760108b35e15ea1833330a6f9a2b01e243e28

SHA512
c79c709dffd78e6b5487403d81ee12625e66c9d88fde2fa24f9f548b35ddb4ceb0cd5314553c7533ded74b3c494666bab2f9f0ea7ea3ddb98ede58973b9599e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86bf98fac64353883c016e9df368eca

SHA1
33f615d1fbede1a4df01573bb04d30fb07b1cd71

SHA256
ceb688e29bc6d967806d17a58a0bf48d367e627b085c0701fe64117e20c416ce

SHA512
41c77e53e995de3ec9d446ece5f7a28869fde14096fd6c5ad2dcde86cf21a82c6e5efa3084b0e1fe8309a1717b8ecb75bf2fdef2430064da805664148010c839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f816c14b3f6bf36ccd39410a0f22994

SHA1
ae30867016d54841839b501b1798a00c493cbc7e

SHA256
2c5d0d249c90eda93b80ad284f8429bab131b2e6f31138ac8196a591e39d17d1

SHA512
fb86ec42384229b193c17e81e82b12c0c0c825d7a8efeb4171b4c0b0320c9a33430d53c1ab87ca88df5e48fcd43cd04b3fac93cf9e6860bb0c4acabd37c8d7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58939eaa21aeb4005230b974d3c86fad

SHA1
dd740dcfeecafa1d854f18298ef444097d0fdc12

SHA256
0f6f1c39280585bcc8f730e277e547c8b553d079fbb3f31f81a2fe14f91e73a3

SHA512
ea1fb1dd27ecddba1d8897e0f3992ae6e7aee37376702a69ef317cc4f5c850945eafc1f3ad71806a3ed4621318dd6c742f07ee4546dc795ad83326c8a8d67a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3ebed3a86c449eadf0bd9ca2e38a2ed

SHA1
17df070439f937979493fa07d6fda81eb139c09d

SHA256
81cd90e6f19e9640529681d6976d385f9a511f1cc66ff81bb6403a8c37702eae

SHA512
0cba1cb293702c137c0cda0595303faf7c323c7e12ee69cdb81fbdb057f7c83dd8d192ff5041d68e16e8c5879011de55b65bd072b357f7166bf7998a1673f26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c5fc1d7768be81fe1ae954d00f93851

SHA1
4a6ed9da890270cbe4bb4ff5be3644f434e459d7

SHA256
74add2daf1426c34d67a2cde86f5b23d98225f6698379824ec4f1e9ea1bc73f8

SHA512
ebed604064ba1bd22c47b86f34e937df760fc5adab9d69664469deea365e981ec060626a47c2cd0efa3e760c2b7d5e325ae20a3b616518ca71442b2d5f23beef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c0cac41a3786cb6043eecaa9830bd3a

SHA1
05308fb2b34cdff8a4a45c8782679b40495ff3e9

SHA256
53965d929bf48c70011c001495f7d31e932a158029e8160297849147e071eb8b

SHA512
a689306e97fad5a3f38cdafb00ae6cef016f26df5edd7f4353b887d925bca738f52baa8453a8a2356ad67c19987fe3de45144a41295d704a3cfd3e2a6cb0fb33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb613c91d1122e5954375a47489061a

SHA1
37df9f2121e9c5856e6f206a5d30d009d664a845

SHA256
a3d4b350162ace0c4bf42f9c7deb91956f174ee5ce84be047bccd1db6cdf43c2

SHA512
90d1803418c54f1da0903011826f3d4c1f6ac063ee69671269a42e65db23699f40142108ed0f3495a03db2ea0ad0e7682b57dff37b09966486e9cafe70ce031a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f3ba3d25fcf39cf5da9e69c4cb37c7e

SHA1
1b89d900abad92e94a6960e7c73b39016b2e14c6

SHA256
6e728e66f7208168ef96fedd8d2db46ab853eed2b6db4d5002fd0ebfdba5b364

SHA512
9225bbbc2324ca417663fdadfd7b6a04691414d2225ddb2b6b689634fd6667b5e61186d9b5caea446ae85432252c5828a5802b240c4b38f6cb7db870541ae906

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4665.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4776.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit