6f9c8af31f515221661c1e4efcbfff06c08caeee3a9d54de86f3360489fc289e

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f5984a190c21fd8e28264e8139e89a_JaffaCakes118.html
Size

69KB
MD5

27f5984a190c21fd8e28264e8139e89a
SHA1

72a0ff2b3e036005586c78216b5514d250408017
SHA256

6f9c8af31f515221661c1e4efcbfff06c08caeee3a9d54de86f3360489fc289e
SHA512

4bbb928fe73906f1aa96dc4f4da7cdce4a273ebb589e13346ad8272fc8c4e83c8d8592a8e749d977f4dc2c085e3d1fa51ef5af01b607d33c879369983f68e435
SSDEEP

768:JiVgcMWR3sI2PDDnd0g60Gj7BoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8o:JhyWTvNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421385266"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f3d333540227f7f44dfe6ee19df0ade83621ee9a580be85bf466a623f736a3fa000000000e800000000200002000000051eb2eead9970fd903e9c34a7a3ae9d7f0440d7c394e937c4c5fb86dfdcf9f219000000075f6a63e6759cf9507b8ead1274eebad1fc1c7059c2db1381787f21da7704ff57586f01d0a13d2451aa4d0cb49ae97d9f95eb3560f664990be7c7189401b140b6ac883fc2ead0e8a9be57a16b6b7aa17071c396087267b609eb1a47025106ffc0a7cac25887076f575bab0f2cd103b14d6656b214e5fb277f7d87d3c3e43797587845e8acaf115f68ef5d839aeffa8e640000000dcfac7f9ab7040dece73856ce78ddbed8b0e886fa6737c5877a4bd2a468d7a3be982ac5a181ca17565f263bee75464a68afdc94d9397572b925255d54fa3d53c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1CB0381-0DAF-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a1eb9d9307914606577822121e4e2c3457de33253637acb2a4e375e7d74f1f82000000000e80000000020000200000000c0e46e1a823b70ffe902bec41a0dd7447d2ed7146f37c0927e5ef6d683ed63020000000deb5a193a6193a45355c9db1ae015cd217a5c00828d81853c4237f8e942ab6f5400000000d1b76063b71802624c602ef75751c8da240d6619c932c4ecf3e035354c878b55fa908bb03c2f38837352821ad8918d550c218fa0d6380c46da30aca397b3736	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c66b96bca1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28
PID 2288 wrote to memory of 2260	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27f5984a190c21fd8e28264e8139e89a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7246b78997ee19035378b78d5a5bb33

SHA1
3ec469d5837e67d9874d0a95c2ab1ae8a641cff5

SHA256
c9c29f984a30df375d9dd2339cbfc2e729a996f886890a2ce47d42057a37853c

SHA512
9e865b0415ecef2fab4610f8f9120a47e7944632d7260968dad961b56dd355f0802dda4ca93aabab73e8c105d4be838c059d92a125394423b52ca16bc9fcfdd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5dfaaa52f38cc090f6ba57cea7f2891

SHA1
907990a36b96158577cd926500fa1cf4821ff45b

SHA256
7a7721b10828b6c670284e50b4d1218b54fe363f3ccf1341679327062b6c9297

SHA512
a20ffbd3f2a3ce547b5dda91ae81fe21efa1a3c4bcae9d378a37adda79ecbeaaa102b5c9e339e06938fede0bd87af7d7d5c97ce36f16803ed96b69e40e0f06d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0833eb83cfd7d913468b5274d52602f1

SHA1
d8920a932e86c423068a47984155289bcdccb468

SHA256
3cd54f7ffc9d31c7758da2170d00ba5c06fe4e534b8e59242c68b2c342b73f64

SHA512
9ed175e58e4b6faaf216917c9eeffe6b29174628453650c1701439d34a5e52a25334eb9be075a188bce5de28cab9b9f3e1a0a17f17ddc2f04f4c44d1f742e580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4fa926b2291f0aaf2da079095892cc

SHA1
27784ee4c4f9d18d8d271facea70ee5730909ac0

SHA256
b11b8fa10692480ca44c4aa55c01876e1a5d3dcaf5bffcda8cb4af8766d771a1

SHA512
c664fbb7dcb45db8f75d6507399471ca8e4079af8c7515ad07e39eda0d7300ad02d5299c8f104f537dc0fd32a1ec052c1ecee60a0c185ee4174e5e5cdc4eb939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b901d79c3e5f8465a729523feeb22c

SHA1
c78ce2ba8404cac157c222f41156279a04459222

SHA256
d38d53a87bfc8b3a2a24420b07ebdd34d2fad98615d4f8eabbb1ad8dc90f723b

SHA512
e0639f7e00d76f1c6ae01c2f47dd861475feff0c42e5be254c2c2a580d260449e54d54cc5c4329b6e2c61a74df1881314192bb10e9aa1e0733c6b26a5b37c638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b20a66527a1e8c241434af2ee0d40a1

SHA1
d6dbfc2be6d8b385b3ba6115b80bd49464761cd3

SHA256
84cf86404c94f3b84e62e42f62e364c77a86015d33c3e8e94f514c2dfe47290b

SHA512
c2bc9303948d79ea0f4c3b77e0e3893b8df42f56ffc0ac44c7b6ed445165bf332c60a890379827c124ec5cfddda74cdfc6347f64c5e4cfc18c113e4d630ff69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abc55c58c10960d45660c5059aab9971

SHA1
da773eac163224e92b3f6d50b392bbd291ad48fb

SHA256
7049b5e0f09172f65e5ee20b594b0f4e846f614a127220ba13b30a9e59c850ab

SHA512
f39c749464cf13ae3d12cc9ea99038890aa2d4c3f5fd8ae221b36da0fb1473f254bdc9b49ffdcc45a10f659c5496802030dfa41721ce40887c79edf9b344032e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68e4771f75d0e69dcaf83f3728039c0

SHA1
b72106a0990262f79ccfa2377dbdeb2e258b38da

SHA256
992956cadd28ff1340de02e7b6bc0f349fe7e19101bcfecef608a80108132699

SHA512
2e8bbff5d1a10dd507f647a21e92a11cb58ef55bcb140983c54a3c1a6651fba7a99496f28dccf78b63e470bb2dab5d8d069c187fe4310084f58518f928fbe2d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1a20f2a020cda4abe2c4fe053f6f36

SHA1
a2ccb2390f86d480a39b12e51266481b70b9dda6

SHA256
dea43c01c436616dd141dbd50402eca9b89bb8c93875a53db67b2a2b8dcd568c

SHA512
78a1406e3a4fda031cb9216448c9bae0b1b2199c434cf58d34c7edbe0ddab5ba949a32b9080dd3f9b0d957d43cd5ec7e592f7afef27f0617c2dd49b26b5f1204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8a9ee8538552173c7db82c8813dc87

SHA1
6c3f47ed7b8743cf62a544e183faf36bb844ab79

SHA256
92df0a2af1fcba643486e5734319ac98e7f329d5a7e18dd1a89cf12a061c370a

SHA512
d73303af76dc2a517b89965646e2dbd2a76a5ef26882ac5df301b6d84ee1bfd51f4f343d1ae87db51cecc8a63213191180eeefcc5b6f3c674ad284980d68b056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ef6c37919e3999d5e55a9048e186a9

SHA1
cb5389e130d63693b20b6f2bfee944bec3eca17e

SHA256
b21c7f8d786117f07831f1486533133283a733cfc13ba1df4180dc742689152b

SHA512
298f140f461a5653a7b4dd70d4f30e1e3480d480dfa53770955532d3ee0f4abf1dccb3d754a6f063ab170ce06ace927c1e82d0de7ce802febb3aef276a9b03dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22DF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2726.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit