9a010d6c2330391640964927b42a89a6d26e7f18b9b6413cd196e02f23396913

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

274ffeb74985bf4b11c2ccbffb27e95c_JaffaCakes118.html
Size

754B
MD5

274ffeb74985bf4b11c2ccbffb27e95c
SHA1

f8fbbcd757308d950c933d6523301e0986ed50ae
SHA256

9a010d6c2330391640964927b42a89a6d26e7f18b9b6413cd196e02f23396913
SHA512

3c03d95ce086b0997d87a0ba955f1e0b442058e1b0aff34da8de90fc79dbd8ba7597a7e8219c03850f6fcca10858f8bdc8aafe6206f7bf6d5d1f637795fb1a6d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e47d48f9daeedbb2092e3ea8247493898c10eb20c6610d0e3a04f80f7904c7c2000000000e80000000020000200000007d27dce8111677109cd3cb023638bfec2ba35f43e7b039fe203c8a6be151344c90000000f07af478d2a144ea826c7419f31b80c0c12778e2b1e0b636d70fe64aaa60ee53b663048dbc970584dced7cde179c25d07d7bb8016674c3eac8a0fd206a746e0f6760a2af4198645d316fdcb1a7344b007903adb9b1deb352f74b88c7d839fc3eddda397f1d554f81bc95dea66ed3c5871613d401aec4f756af7a641ee89813bf3f3c3d9c3adf0fd1f4ae40b468ce41db40000000527a7db4f312dfc9a740a4154da5453b813a32dbf55fe92ffb2a38067c587e7b8551d8a34162752d3b823abd2148d861de1428126c84f46f1792705aa2ed846b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50392AD1-0D96-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c1d1883eb238634121443b85a0c3e3ced872f685f6ddc82e81ab6df8e4d71e90000000000e80000000020000200000006e7c828ca151a98f464c245ab0ff869b33be8ba6729fdebf5cb6dcaf4e14623220000000f0efe3953b36873a76e32d6a1d8c16f6c0f5d1f6f540125ccf26e5a0fd7720fe4000000062e088f1dd9b9352f41785ec43e2abe80d9dd5334f7fcb57e52112db6a5113ba8771fd108073871568dc44ec443f8e55c959f8413dd3e00fdbb6135f39c54ab0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bfbe13a3a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421374339"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28
PID 2412 wrote to memory of 2004	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\274ffeb74985bf4b11c2ccbffb27e95c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e7ae2abbc8e61f8df16b0a92a4f1cc

SHA1
04af9379cbde9613edc4508bb1bf318893973e29

SHA256
bd3b91c9389b7a4c3c762e625f3b4cece2e14374821fa9c772c4d0d1025f5377

SHA512
6bfc64e3d6151f3b9cfe447e078044f07157ef65ec81cfaa08210fb26882b920c514b326a053bfc6fb1386bd9d040fa759d5f8c832f0abded59256ed83b1059b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a9c7fa99d011fb04c6c7501113e25e

SHA1
6886bddcd37cbcc22d9490a1f2ac1c4ebc2d6956

SHA256
696838d6ff6b4ca0ea926c4f51cc51279c1e6d52a0f9ae4301a99e8b5eee06a5

SHA512
2e2df581da18025fb94facbb98a320443d45d046f2db395809b8daf761a22b1a57b2466cd9f66d8d3efce25fd594cd2f83f114fc3e2f777a41ffb4de0e05020e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4679675633c29144d10ca1e885e6d501

SHA1
84dc6f721e041c119ce2693c759ede74f81a362e

SHA256
7ce0ed0ae6af5f974c3c71bdf96ac2c183826dec2217308ed5dd3d6132a97c9b

SHA512
6b9821b2c89971b5a2329d7272bef8383194c7f028bc48785039b39d766c4cda26cb1509a9fef93ee74a8ad35e7649da4c3b22d81cd9b72085a7bd7a735c6f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b30de5e1904821a85bc201e309f8b092

SHA1
9da235566cecab6606ef63eea42850dc9cf82ac9

SHA256
154e75874b7fa64575ee081022a9ee022901a7b60d7b2c6042b48b387c2603b9

SHA512
066079f2a5453fca07447d78dfcd88f359a22a5b412a5b813c4f1e186d4618a4dae4c23c893e4d74f83ef25cea79852779c58f1ed337f413ee6a02e757879564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31d55288889732219391d1d3e5d9e50d

SHA1
646c6edb5897d3ba0cb23b4d786f98354ecd2378

SHA256
21180e2d4f5acb2ca642c1271e91e40a94905857b41d28036ecfd13314ea09d6

SHA512
65845bc0aae633f0a132dcb2d9669cb27e2a18d03984bb3baf68ea008185be97ae98534012953d1ec1405e3fcc84159b5fd9c3105e3943bc4faf1352117ca87a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872dae4abade15cb9b688c23c769f769

SHA1
de28c274da1eadccd15cd3b6fad9eb526ccef417

SHA256
1e442a861950020ba6efa01a1961bdbb2aae9278be2ee6df5b5866f50083429e

SHA512
49cc846ccb5a884cc1ba76aea4cac9e3104429e2a94786747bd895552d6c9e537f9cca367bcff3da0974fc74ff0e58229b51c91f0bd2c29afac69f0c6b8f366f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1609e797af62939df9f394bfccc0a9c

SHA1
944aba68600cfe8ff2dd0a27cd1cbd3625606a20

SHA256
84faf35efdb989adac698124621936ae90b7ffb16271d474e3f7f54d94f36d98

SHA512
9c423d5831cd5f4fd0ba4ce3ad543d252a55fa519665b914017a2ef87b3bf70d53c4713230a2aae91159968a820edc87a29cf55b1efef5a036dc90a1ef61295a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e76ae2c7d82b305c6125b9d0cc90d7a

SHA1
d7cbdf4e8b14e2255c3e51d82f12b00f83713a62

SHA256
809116ec1cda45c3b31ee5f00bd4ff2fe223caa2d6267425cf88a4bd0dcae429

SHA512
13dfc26d9dc74f8f41f413f0f5dd3358628580f6ee835adfdf0251878f270d304cfedb145e26cb08a67af4d9be43e112f679cad6ef0cb9f46f9ccaedd124a9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9544bc38b3aa77ae9175a7f802a8cbe

SHA1
4cd40c9baefc1e47f58456c898a7d0fcaf92e506

SHA256
0eb0daf5859f43e5637ca5ebad484701469436fb881e86ddf158d7db285a286a

SHA512
ff70101121a5e435e32c91eafa57f94f4fbe79bcece5d276ce8a694d8510969d30e223abb38aefb21a239eda8017eaaadf9bebb52e39efa05947d4e9a308af7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbf9e5c7651a115eedb93168ce265d3d

SHA1
98c6eb7565bb315a83fff81c1caa4f50d4c9e876

SHA256
cb5c67cc71720e93bc4ad45f1853ab2b7ed0ace998b2b1d840e918128c86bf72

SHA512
a22bba9700845f7ce69873dae1b0261ce02e2aa614721948e97d1f500d18b0d87dcaefa94d9bf051cdee23d6f9cf323209654454c63af75feb5cf4349eddcbeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
771093f1ecd2c34cf80a53dec8f41423

SHA1
3965f514c22860c9b7934ce5a13c3968823d70f0

SHA256
0f12d4dba09ca4b50bb8b8b37e8f655ba8c8761497edbcac560b3260090d31ff

SHA512
895b60ea5f3f030716a64ecebdf322e54993b0457185a9e096650373dcfe07ef99bfb6a8af68dd0b310571533d232b2f9018978713763dbbfafd1e2d89f8302a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E53.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit