1baa607ebe0156fbd2c6e5b58b3c2b308f4dbd02d72cfced998cf664d6b4f11e

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28392076cf060ef85a16c1a260dc7c7c_JaffaCakes118.html
Size

117KB
MD5

28392076cf060ef85a16c1a260dc7c7c
SHA1

e8dab1394a78bad31ab10e0312b49e27acbf8f1d
SHA256

1baa607ebe0156fbd2c6e5b58b3c2b308f4dbd02d72cfced998cf664d6b4f11e
SHA512

96684ef8818ab49c0012179600461589b6e4258ede8aaa5821c07251430377e5a5ff257668aae7b2d295869072c33cc39941a03ed4b1561964f4037e797b2caa
SSDEEP

1536:kSGmHeFayLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:7yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000033f32694694451d43e94c5cb35366c3079cccc18cc7725dc5bfac4db7b66ea6000000000e80000000020000200000008eb849b798fad0db037f946e618cf6496ee66959e8e25ef00bab81badb5259cb200000003be393fc5d1dcab7d30282ecf9f6c352b3e801a208151605ac49202089e3911e40000000e03104caf132716684661fc41397c5b4b2658ee3dd13fff24ecb00dba6d8d28fa476407a65f0b8ef5b6d4d5b393c2e7d4de34773aefdd94bef79afcef3bb598b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b3b18461de55de5812a4e39526452ebb617ed4de11d487013ddb14c75e966089000000000e8000000002000020000000922aa96f9ab927c2e4d6d98bc5dabd625293a4acc3884d9b0c136479f84a420290000000fc7fd1c1f4be63a2071954f7add69a30efea7e0679e465533e5ce981b87574e00b4def4975ba58b86c8e559fd1a561fab3e31a9ae9db2303697df22b7a5386a6f4f204518fa198601cffc285b46d74c5a5ed3b17ecdafac19a52876cced4ff646954f47b2279be29301a2e7d62f99c5360ab196313e28d939ce489a3747844efa6ea134f31fe36796a402e18b14e95d6400000006db8089f46608e86cab1cf2e029a5bf1736c0536190cb469b05b05866adc46755f184ea46d0ce0dcd25b23c13ae00c4c54b4d0c28439b912567f13eba19c76e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421389253"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A344FB1-0DB9-11EF-9E38-E60682B688C9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303c25f8c5a1da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2588	2164	iexplore.exe	28
PID 2164 wrote to memory of 2588	2164	iexplore.exe	28
PID 2164 wrote to memory of 2588	2164	iexplore.exe	28
PID 2164 wrote to memory of 2588	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28392076cf060ef85a16c1a260dc7c7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e912a4248d594ac416b753e51ae23e

SHA1
9ac343a7260219d33ee63e9246e7e192bdb7626c

SHA256
ead0d16504bf76110b38735015cfc95501217e94cf70a92cb46fc13cd72d98bf

SHA512
0e688c9f9e82466ec266b4c52f0d0a9b649aaac1d1b6eb0571ac5186e573f7c09b7b19a41faa4388cd72e5100054735b00fc281ba81f2523f8d7c524aeb794f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29766749dbaac078bc03fac6661a9a52

SHA1
abaebf43f8e408d93fdd215b13568a99d8769be0

SHA256
798f5d8a5a0ba8af5f29678d4eafcb8546459fb74a63e3a1b1d0d9b11f3e2da1

SHA512
48407716a11eb75d536ea7fd1b500f109934800ffc21d52ebb944e9109e3b244ec5ed2cffe697513b833471495fd3b187f45eded05f60ae10112fc395cb7f5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b26149173084e4023f64b956ddaf332

SHA1
c0bab91dc5c6c39800ea25873468c6dd0689effd

SHA256
b652945486b5dee4fa99c4ef6598aa53ce5d80cbab65cde2a5d0e851e235c051

SHA512
d3826f14313f970066a7ea44f5f23b1c1f6f67ef188ea3136aa9a13140654ddf289dfdd965c8381d294a673e8722b32a7da3cd022e2d4ce15eba6f2831c8efc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31b8485d7eff782ac1700751d48c2df6

SHA1
b2839b1619a54fdc864de20e33bfdfc4fb26187b

SHA256
c93f3e0e3f365356353c97753cdff0ecfbdb853071fd969105d7523ef53ce245

SHA512
7b211ed7c101a02211ebd60b30587c9bcb13840e88ea98ce6a778cf25455ac73ed37a075a1f08525ad195c9b0033875aa7249658362c8750e4b0934227362b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0368cd01de2b0ac69f77205b21bb43dc

SHA1
d5c3acfbc8ca6b45f8728ad24b4b8d4036e0b508

SHA256
a5b9565b04bc5daaf5d2505e306bd2e50daa3d78639a84631ed9d2e70e9891be

SHA512
635b9129d0c96d39331a16304ce33f1cccb95c0d04a7a333bfcd785a5aa21759de99f3317c9f8aa80d2f68e676869839336679d4d90eee6a1d76e81fb4374050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ac2b56b161de27aa666a2c49e9fe302

SHA1
531d08c872ae30443c33c244f8401bb80efb68d0

SHA256
d8e4cdc9b2c1a6c89eea8e374b7bdeacc08484c051dbd18f13ae99280e6c4d96

SHA512
6ea0612b58dea0169131b8e252b68ee1e555e28700eb03bd0f43b7b4b372260a59b6b06a33c96a8a6f1155e9024610d78ebb27fb94991f8ac09d56fec5650fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a11e0fa0cc4ae99c4f6df759058524a0

SHA1
b8e3fbe6c062ec5464c882954ac7c367198e1ed8

SHA256
62aab6f04c7d0fc4d886ead11b211edf1dac19f3a0e840f4b5f127dcf7ddbd57

SHA512
21b6bb4445374a5a333ea1f12f866c7705ea75f5def106d0979e45dacde6d4eae0e5d7c3a83d269072077d1969d5da3f6a20da46f2d05970deb22134f2defd2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e87d0ebe15253e9548e1ffed0f16f4c1

SHA1
72d3da133779ab85816387b7203cacc07348d8a9

SHA256
afc245430ec593811cf3ff7ce4b325e7c6dad9763d8c6b90c77e8c8f80de9b48

SHA512
d8866ab4189eb49db614159d2b2142a7a61a701a0860a18d033f94612069b0f76156eed3200a95615829ca3a50a0c032656767f0f681a6bb69684d4a17180058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8327e34651ca445887b11bc1c14b05e0

SHA1
c096b98175fcf810b9095eff948ef2a1fdc3ace3

SHA256
d7b5e7bfc1fc3498934c1b1401e55ba2746453a85b2220a9ad4c49ca6ff99ebe

SHA512
0c7ebacab9548606312c4ad2d69ed08d98b974fe15e4d0956e3836788ee6093c704f0e89b45acaca3f0edc986754f9ffba99437c0e72cb73bc345da6607d9395

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabECF1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0EE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit