6d8f4abbda996be368504e8f0a0f3fe8c7042d26271c90e89ea61738bee9c2f6

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27e32a030410af17ad1a6b988706ca79_JaffaCakes118.html
Size

46KB
MD5

27e32a030410af17ad1a6b988706ca79
SHA1

88e387e2528890639140cd8ed167b1dfb9d2a3bb
SHA256

6d8f4abbda996be368504e8f0a0f3fe8c7042d26271c90e89ea61738bee9c2f6
SHA512

15f5e1e3f07997662b10205b5edc7b1481a2fc61010eed9cc656d6c7e4e561be1415192f23c9df1f8af25060535eb0902d38f733350459d955d74a33faef6c76
SSDEEP

768:NJS6S7B8ROZOrggBbvFICSCfC1C1C+C+CQCQC+C+CtCtCECECQCQCAoY3o+W1IpE:u62BkOZOrggBbvFIzCAA99xxllAAppxc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421384099"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000079c050789236602632cbc8e53da71abc03d1a2495afcb35e70c19855f3be8c04000000000e80000000020000200000006100d815a377e170e193d455891507e37d5e46fc4c9ebad32bda638ef7f2b3e390000000c6cfd0371aedf867dfa338225f804f5d115fb608742bb41da3e4877509961fe70a1fcef011dec1a7f6aa07e5968dcc28a57fee96678c0d70560786c4730dceb2353e147e4ea380629102df7a97c64372d3b55dd46a8435320d941cad53e964eb06272b691da613d5e9a076b12e6b4012803cadf565335647c3b022cf4bbe586b8ef101a2aeb1f076a5e86129a91f9af8400000007756bef0c7fd33307a315a2c216ebcc12b52fd15acc6720f67d9fc24c637d6fd2fa625dcf8ce01e6bf9e03ac4f54511d2834cd42f7d03b6c8a07f27b6d270702	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000083f59641b3bb1749f11cc93afcb570d3c7d1a08df4cdb1764c43af34f1c65866000000000e80000000020000200000008ebef0021b6f12a0bcc74c2a39cd52a56a4acd1f041f0a0098c907a8a433b13520000000a42d2cc0ed53f00195945247365a0122db0aaaba870aee6099e7787faba29a5640000000c8d400e0913311847d5227988a6e603c895def2769999245f5e4c627b9692d318d68c98920915262446eab85f049bfba6aeedfcf1cc4b62e4b9704ff20c65267	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e15fe1b9a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09929781-0DAD-11EF-A4A3-CE86F81DDAFE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2688	1656	iexplore.exe	28
PID 1656 wrote to memory of 2688	1656	iexplore.exe	28
PID 1656 wrote to memory of 2688	1656	iexplore.exe	28
PID 1656 wrote to memory of 2688	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27e32a030410af17ad1a6b988706ca79_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2abc5db65abc34d2de4701c5bc9d26e

SHA1
7581614134814a117081d091cada6c5c20f7420a

SHA256
d28aa482c9a66e14d526834655939ec312849bfd63462214005557b2c061c615

SHA512
986f75177df56c1ac5779efbb232f21fb5be3c1a4e28938101e54abe0bfc27ce37520dadef297299970d1d860f900ea6424162f55cd3cd2f44c1208ae725825f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b47f48b18de5f02f7f7dd39746cc7b5f

SHA1
7d43e904b02d75a888a434b56b6f800e2d2492ec

SHA256
8d6bb45a6277ff9c49bd4c6338918094bbc899bab661cb2d25909c60d63837ff

SHA512
0c6a7bd075e35fc690cbea08868155987dda763f99c2caf51140e811e9a78e372b5ba9486f7c1decc0aff0d84ef3900d92dc9395b8d6b2a7365ab525cf20822a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c1bf44dfb357a7cd956226eac6db643

SHA1
dd61fbb713f450c2dfa01ac35832601b64ec04d6

SHA256
330a788e5d9ee8d5b1a4df872c1247b9c26c781126fa57349202e471090854d6

SHA512
4a984c5a2c2d47e2aa5b3dc15aba37d53402fdafe2e739ec74fd3510643a0406d4574eec76616e263553b099ae1b7a5d64c351848f8ac3812d12ef454e0f6be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c66d41bdaf56c2a208a2e0dd1427998

SHA1
a576f6ce21fad2bcca56093153780eae170f6198

SHA256
04d2b039f932b07df83afb1f27bae4c8c1be359633500adada4302136b7fdd72

SHA512
86f8cf278da877554fd3562a046dc52754177cd3f781e6b65f0dafc1be41fbb9721166ebeb20d5f5d736f322c01dc76f61d773b69d87eb4a7f34afa800b8b638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3da83894e0e85740f3ec0036e8ca7087

SHA1
4cdc6161236a798fd37630edc19b89e92e3ec509

SHA256
f07ac57fa99ecb99059b2171682b599fe1a3e0d05877b76467ab9279af8ffcdd

SHA512
4e851d50c18aef4089d6ba040eda2ab1732f0bbf15c06cff591ed718981cb5ba828501732e5675a55f5d452bd6c6221a06068075b333ce888d8c9f1f3e57fe80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0412b4b1d4ed6da03b5fcec94805d1f3

SHA1
dc45056c516288c96259b2253ee462bcce9f1e5f

SHA256
167501132613adcc8e3d5687b8bc1c30ef8f1665fdf8b3ec9144f3b2ffa60c04

SHA512
fccd00ba4d3e7569236a2302bd47e1361705cd019eab043e345d42c246ab0427bce07abeab67b3b30cad865a52591a79f9331688e4f624bafb515f900d952c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b737777d47e5666883ce01dfe9ef0d5

SHA1
f74339fc7ea619870f9c46249d016952ac4a0472

SHA256
0ec93bb952d61f7a6cdf02392b15a8d35588841694f09e7df1485550cf1f15bb

SHA512
c6bff04bf65f37d1448e80056c2613df52a106a0e15ebc3dd5075f9808198815cf166a3ad4bf9ef434279bd3f856d4fe1259ba1baa49caff4d6814e55b2aa715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b54113a7a70033b8cb713d1349af712a

SHA1
c832611a66bc74339d9e1d20ccfbd5eda9881fd4

SHA256
97700d34238e1e439dd10cc0c29414539fdb42efecac33b8aa320caab2957de9

SHA512
ae8ab62c49b98d88d7025be0485398d0d6683f033d456f4def54d088a9b8d073bf52c1ab4cd282695f3f3b13aeae658a15c8e4b4fe38798ff4119642c8bae2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68d5a8624b9a635eec4c493b62ba6bc8

SHA1
d9da20d035c7b3727278da7f0ba380d2abffb53d

SHA256
eeb6faff97ecf2088646f84b1e6b73de4ac90f797ca6feaa20434d981ac106d1

SHA512
b6b5d165a0d67ca258e66a7b2e14d430433ad4a3dc1ced3254e7719077cbaf4d9b644604a721e6a99077033ba0ce092df72e802d290e26c8a613a10c1b3b574e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ed807b2e1869b6f50337f010f05c23e

SHA1
c75811a3a4f77034193638db083e8864bc264f13

SHA256
94ae1e56765ae74064c9dbfd83bd97d9194416e40da72e7890696ad3d88faf67

SHA512
7bdbda9bc9f8decbbaee625fd5891b099e22af992322876573f723cacdc8ac1a10615ff4c19c7e004bb4a3ce5490c0a095ee4b27cf0bab5e2379c4216b35a831

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4887.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4979.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit