ebbe408575746d48426a7901ec0c94208a24e60c91af7b75412a4fc6842c8830

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25ddc2086a4c64ca96eeb7059b0ca392_JaffaCakes118.html
Size

461KB
MD5

25ddc2086a4c64ca96eeb7059b0ca392
SHA1

9906394e4dac13571165c9d387677b453f399876
SHA256

ebbe408575746d48426a7901ec0c94208a24e60c91af7b75412a4fc6842c8830
SHA512

10aab5229e4e22640d68a6abf6be66185f138fc765765a45bd56f985e29f1d1856e4e594965e8817029d51fa38fc91430c6def18457b40aad7061c21e367e0c0
SSDEEP

6144:SkesMYod+X3oI+YlsMYod+X3oI+YrsMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3z5d+X3J5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003a114a7f9bee131cd6acd6725f2793c726cf2e28d03defbe7acbeffb4bf9445e000000000e8000000002000020000000518d9c0cbcdf1d7bdc39a4aa3f25030c513f33497360583b7a13ff4543eaa69490000000ed2284485db05104b1259d62aca5817949ba2863be3b1cf0c9fe0b4643b50cf7e49db4263d6dc36e9458d1b815801c5d1da860d6bc43668b0ce006efd21f6989d7ee5d38f9fa9e387a303027d5737b3789c7ac9e49bc80185d4b65291d14a320d8c972897d4dfbb12d916f5873c7cacfcf02d6d85d0ba87b2f41231dfe3bc6b5d2d7302c2613125a69ee9356660d2030400000002db6468cdbb13d64c65696a7ed8f73cbe150dc1b5c4825af342931000bee216a80915473b0150af52875e51a16c90a0ead64e9975ba47fc9f582915171c992ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421350161"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009aac98b356bf89d0146a48a5d746a175e88b9c4a753d63c373a85f6988afbfd1000000000e8000000002000020000000fedc1f3b39e54b72793d37b148e42442c8cbf9417c4d5ef7a4aeea43817bfa3a20000000b21a557c8b0f5f060b4aaef3baafaefd2fe14a1ea6af3af1f8642c5a7d1743ce400000006a576cf127c1dc3ec9b79b670f3976988546280eb1c02340f4bb96ba04acf7dc518ba52c2022aa4ce44bedfd59146c356fbf3f67c0eea822f531324af49fccd8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08f74dd6aa1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04F1C881-0D5E-11EF-A18A-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
840	iexplore.exe
840	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2112	840	iexplore.exe	28
PID 840 wrote to memory of 2112	840	iexplore.exe	28
PID 840 wrote to memory of 2112	840	iexplore.exe	28
PID 840 wrote to memory of 2112	840	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25ddc2086a4c64ca96eeb7059b0ca392_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32645f8d26cb67c611374c314ed64030

SHA1
52b9a52b6a1db5355839acd0b45538cc4ec94eb4

SHA256
d92b931fc8e5df1a1714e27e019259797289375b6d4127bf2a5e55a302d8491e

SHA512
f3b4f93805e4aea054db322a210f28fb673f281c72b7408efc38b401a268c5f6c053ea27f43e72a4d34e89a3852ab322cd63ad54fc2a14a1b6f6acd7dc90d2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d16539c3e1e0bb82e25b0425d0695cce

SHA1
a607a32cddf40497fca1420ff2ddc2eb9ab0d1f1

SHA256
ad4446eaaffcea04ccfa2514c4fa9e3e97bd89ad40ba6a865ce8a15122214413

SHA512
24a440036bf0bd1b20b1c9210e87a8c0693becd3ef8a77042a025d1954422a72afd29edd97fedbe4a89fa4f53cc984a31a8ee9add5306e76baca0bfc464d6875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63fc7e8cd30ecf294495315c73a269e8

SHA1
015b33a13e1385935bc385c29cdb31aa187dcff5

SHA256
e95544756406febf225578de2e38945427be1b4c3c6813cbb4666db77dd5a408

SHA512
6fa754e909d680f343df7787d723488d95fbfb5454407978157518f2c4b0246611411978e953d4e00862a9fbffbe1d13062b615f708961809fad9a77f8a9878d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d74b30ec1381c6568d33f8891b96efb

SHA1
b10f0787e0f799c1e49682d555f0c2a99f03b734

SHA256
60d2e8a766817740cb51eb650da2b0039e595c707ea2dde8f87082ad3fbd9aff

SHA512
dd24ebda356e27dbbf684c4ebb98d731d0ca4174b4bf77ee5b2e347f8fe6f82d901fa2d4e081cc19fbc1097a52046df50c2c8d1df9a79cb2dca6b5aed04ef932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2005df534ac27561473d9a393d3fb859

SHA1
6f21c0c96ab27c214dd23b82a98d947ae690cd2c

SHA256
8e50e2fd59a4ccfd355432378978bae7b9e55a43e58ce57c28bad60b9e6983c6

SHA512
b01380684439ac6f01ae0d511027f3a3a6ab8fd655873f0ff8b9c0b4a12d5ad2f37b42a8cb795726a9b3e1bd1f357b9419210699066989aa8f2d6b2a0362b680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e518a364897a5e0f3b2e7d29c82967

SHA1
d3f1539108ab62ba506a9d8b9d45ceded48cd360

SHA256
d3a984d381e4406221514f27b872804d8b1a62bcaa2ce8110af0027c1c6ef39f

SHA512
fd88de0bdd16e97e6ea2b79b76f36c7ddd040b2d98da8b43edb3dcb6a673bf075679a3fd10b219c99223690200d0b567a20544886128ca84252cc538074f8a35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fba23346d396eb64157f26727757d05

SHA1
d2710d1beefcff1fac6dc025138d1e7126e57fd1

SHA256
cf3ab12321295f9905d73eb451800f5b61e7435b5745739d63398db87cc5d2bf

SHA512
6d31da6653b5632153ad9b5c25a636d5d0258c2ec8b10e3d1ce178846aab6b141e76146e6b1ebf0ecfbca614c88d4c615e06f55b35a51d77f3c5e543501b4bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
134037980bf032438e2c3ae220902dea

SHA1
f7db972b33104f7acf2d0f8516764b8459ef075e

SHA256
f9ea3b64ad162baeda0e680990e898bc442d9a36f057c9ba87d95bdf2aeabd74

SHA512
9b6400bbb380f0cf15b4dc2dbb978364711cc57d81307053ff7bb2e1c77464037532c93c1f4611bc8531f1f9cf5cad3df82f114a80d16d55e642b8a2f668ad4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32ffb3007d64d74b56800537799b6daf

SHA1
4fdf488c7ac528bf8c599614fc4b9b04ca4a9054

SHA256
94274c3229182dd0899553747b04e2cdd968e3290aad6e8ba5dfcb33428fffa0

SHA512
e30f2bccd362c154749a0a0cfba19273c95b9f2906521a8bb71b923d6be674eff4259094f3b2c82766d9d822c4275846b09624590fbc8ace01dc994345c6eea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07bff7e2f71257fd009407b8a8a04819

SHA1
383749da2ebe0d4e2e9127f93ae78aaffc58af6b

SHA256
d669f606fadc02a77c805ea226de2945000f8c2a72ed4611dd0cd3da8f5dd20c

SHA512
0905d8eb8a45a7bb6988f38bea7b831f61915749b1fa8a2737278bd02b00d8dd690de6fcac519c220f5bb8c34686062ab19c1bda5f1e7dc0d6e5d51d7c863051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A05.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A18.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit