27e49d131ef58f0a27abd001cb2281f4536590e9df35ca89cb607e3fe78f7a28

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25d86d97623c7f0c7d7c86bea45bfeee_JaffaCakes118.html
Size

1.1MB
MD5

25d86d97623c7f0c7d7c86bea45bfeee
SHA1

76900f9796f99b6205c253b4e3bdf145e4279e25
SHA256

27e49d131ef58f0a27abd001cb2281f4536590e9df35ca89cb607e3fe78f7a28
SHA512

b238d15763e04015439271bc92add7f28b5448fe5d0a5ba586ee4731c74133295cd11250f9ad8b9a77d0efa3d9d108768fb4fa6f7d44f0212decb2639f1dee58
SSDEEP

12288:H5d+X3ZrscWy9dH5j5d+X3ZrscWy9dHh5d+X3ZrscWy9dHI5d+X3ZrscWy9dHr:3+1jV7+1jZ+1ju+1jP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008b5bc03e4c5d02d6ad5cbdbfce959820e5210505200392f5c03377b1c0d5ee71000000000e8000000002000020000000559433cc72d7ebae6056660364fd3589aa3f252c7b6dafd1974166b5a7af0735900000005b8e2489aede4d91f47d37f73d9956467614d7ce92681da24a6be6637c30eeda267d29dfe62ae151d3ac2fc28a5163c1f3ef716311a30fb3815620bc98072c9210ab1b60da60ac53b75c9677a7067f2aa328d035db6312b6b306381881c47e85c418c461538e216e9311bca1f81206d35f54a913af41b9f3f74df878d63a21ad8de3715c815d64386ca9a99d4a3e8f4340000000976d937f11c44d0e0e85cdf95f3ce4c6c1d09f4c40cb19f0f68cfd43ef00d8c291c91d276841590522750ee75b8bfe6beb470a087f7565a32b98b7876bd639db	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FA5C1D1-0D5D-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fb30316aa1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421349836"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000af8a5d84f74d25766ac582a5d6b69a9d926c63d23f0f96100c2a7b025bae74b0000000000e80000000020000200000003e8aa6fd4fe37314cb336603afbbcfb0a9e7079605b6aa90dd781a89b28fccb72000000010d8a430f6f5db4c315fbd391eb7ab4f52217a52e4ac4885f4368bca2547fe7140000000fda03225a4d1db15be781429d735d31ba89f86706de00d8f70c81cc2cfc35b3434c7ea79e95faea74e6841c4e656ad0ebff4564f73cdf9708c5990302a4c4bc8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2332	1924	iexplore.exe	28
PID 1924 wrote to memory of 2332	1924	iexplore.exe	28
PID 1924 wrote to memory of 2332	1924	iexplore.exe	28
PID 1924 wrote to memory of 2332	1924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25d86d97623c7f0c7d7c86bea45bfeee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3984e863bbd1bc07a22d0115138d2e6d

SHA1
671b1977909d82d1ec360c3bdeda296699c21c8e

SHA256
f0543f2f8a394d2ba678b82ff182dff937ab9a1f7ccdbdce4c26759524a2ef5d

SHA512
044b5ba2048c9a76880e6df0bd7cce00c948015c3e219791b4be188358a9dab2a8feaa3518f5cc74f6db294bd39f3186b770add6dbcf3fdcda5c7210a45c1eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1f056957761616de1f1d6e0dd92ba38

SHA1
c2fde0ad1ca74c0323cc706a62116c86d1e99eb5

SHA256
e51a76566630147814296136eb0071f6822b1957b39de6ec8d214572b54594ed

SHA512
ba690502470e26df624eb1a5e28b1ade4c6d5f4a79a8618457dae4968f8c70c356f69e504605b952c3720837c793586272077bd4fd6993723f40ed7a784f62dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae02678e0f829c5c030bb69bfc05a761

SHA1
020d7e971bda2d0fc25c201595ea1a59822b37bf

SHA256
03b9c36421d38c98e9f30c7e88ebdd3a9569385549d40994f6119a002a9f1650

SHA512
c6c1ef782e8ebbb7052842b8114a1dbc456acd4956d6df68605bfa160d109c31072e521cd445cf0ae14f2a13f082862d969de9412fe5116fa2e15c675fda0cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ece2f15af03a17fdd40932b73e0f4b25

SHA1
33931032261bad2d3abfce2f85982a39f5e32ec4

SHA256
81878d54b3adafd112ad7cb8b745dc01a2239679aa13d4db0f73f5051efabf2c

SHA512
b6d4ba439caedae7fc0a36057340335c444a8edcf15a17c8503b0bc46ebf99b149e57812a437e61afd09c09528dd4ed6cdc78226efbee22abd4d82f88fc98161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbaaf0d45e425781f678999470a97240

SHA1
646ede323483c67714815efad9f34513e8dac14a

SHA256
150c99b223cec60340e390fa4f2dae8652cbf26b8748786d9619661cacd49468

SHA512
c7530959a94c6375185fb72a46f96d7afb35a1201e5b1405a7976d34431c090a94fd2cef900dd9049099f12b7adf75cc8a26b0865c3edf814f5e25ec308b3cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a3dd00ab79dc88b0007f72a82360e3

SHA1
9bfabc7e5a18bb0ef1b5a5f9bd3b6730edbe5846

SHA256
8ce578b4073b563a345ea4e8867299ed2df106cdc538f0ded2c5228a61318964

SHA512
64628a94352fd4cf9e7d7c40e3f4d4e3559f673c77745bd6719c0486ec6f3988679b192717041dbbaf47f1d391512cba56f42c37bbd88f199370f38441ab42bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61619ab14ae41e0ec162187aa99955fe

SHA1
bf5813656f33c0691d0a10440651bb802ca30719

SHA256
bcbafb3190a14301562f16a393978afd1b0b4abd8c2f6ec13137127783210250

SHA512
aa43f3b8f0ffd77fc2fdc5a2705bdbdc01c1ed56cf0dc9f6db3be3fd96271013d509b036e03f46bb64c167d0a825df1773456eb5baab1f1cd1b445345306bfab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
488ef6e83eb42329defdd64ebd084cfb

SHA1
53693096b29ab5c52c5366f7786dce6fd2f6e6f3

SHA256
746e6a8a2533e7943c4e489bc6a0c4265c250e3b6490e3b8bb576bf4867a19e8

SHA512
49c29f0374ed58ff049cf253c79171e32a28b03329de84b2afdabd1bd36de64b264ffac290e583aff058c0def4dd725fe44d0c2895896aaf3f404e754c4e8496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52a969e7769d226d3219d0788f9a6fad

SHA1
16787ee327ac4b50bdb038ba898e09c6756b97eb

SHA256
77cab4c23b1cd037d09b7278bef755dde45eaa3ec9dcdeb70a84c9c63f4abbeb

SHA512
e2333374c1a32869d8422e3c16cbedf32f1e90ed0502004a9ad88623c93492a4f2d4656d59837b087b67766ffdaf52930b695cb86f02bef1999e34b8fc95ab3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
764bae5dae4b9d140572b33727fa7552

SHA1
36ea91e9bae406daddf9161b5d3b8c15ece90496

SHA256
6223a42448915378bd0f369739309c76c2cc1759eff7ea99c982a29cf670646d

SHA512
2970791403d8d88da5bf3c43b57006375e7fac468b70f506fcd3379dfb91f4018aabbf36db715d376c022c27392725af5eae30f2da9b347b6a0675f59cea9398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a284dd0211699866b756ee16b86d668b

SHA1
bc74090d868ff9fa3b22021a06f2e7f9b40f5fd2

SHA256
c57e7e752f86556e59fd2b2b9824173a70dae4e0ea98992756265fc410074a93

SHA512
dd71f1c812523e5df92c00f1182d36c2f4ab33cabe1e2ee25d34991b6afcbefa44f6a795db2464916d992ed5daf285ca1c325a603142dd628288f1997a149bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF55A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF81F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit