92d1e878ecdca5b8a0b9335cde1e8dcb5ccda82b18af884d66833087a59df95b

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b5328621f09a92c6e0abe6f07e29da5_JaffaCakes118.html
Size

3KB
MD5

2b5328621f09a92c6e0abe6f07e29da5
SHA1

f578e88cccb854cab748ae1664162073f75a7667
SHA256

92d1e878ecdca5b8a0b9335cde1e8dcb5ccda82b18af884d66833087a59df95b
SHA512

06a1b98842e3aa1d771e19ddd3b50f6134c44f85b1a4bb725e9646a7c8989a54b06e3df429f455a37f9fdd84853e3e8c1d8327adfd6d694ed8b226d32f7b46cb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000002ee03cffa28a4f8ec705afcd8bb1b6dc6bd537d1a54206e92050c6708513ad3a000000000e800000000200002000000061761663fd48030c398bf89907f30c17e0dd62ddd2cb18668cbd6c98e98a9f8d20000000e78a15b00f7c267765c1fb1093c92205e7ac8bf9ed3fcfde277ec5cc98380cee400000000747b8db308a71ee86bb6b9f650f1db3ac39d23bd56a90603df94b40d7925fb46de8e145cc080665fbb9c870b48e914d4125ed96795642baa4ccd9448284b7b8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fbc8823fa2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421441498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE2C1931-0E32-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c7d7882151e65d5836cc20ed67b9399a7ac18ff3fde469c4ffa680ff28e1c0bf000000000e8000000002000020000000982e34821f7802baca61a07046e067c95318f87c713f22723b4a6ce9997c5ed19000000043a226d892fc1a366c93f94fda43aa3001af21a4f1c0d7246d7bdc2b6c62b61e6c7aeac9367c7a4a8a384aba272d4f94d621a9895ef6e6598b37a1f45eda87bbec5906bf8b255c952a1ce7a5ceca3be07f9371976943849bade3f040ef6d83adb40a44bc2d7a994fc5c35898b23f575857e3b0ac5c772fc2fdae0046cb3a8dda998883d189cfcf635ddb1d983caccaf3400000002fc4811733ddaa5b158f3308133a187fd9233b86b51e4e11be627956e33358616a3c30a5e0b1e62a27bd2e3f83e640c32529f41394155f9a6c1025beabd2e671	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2044	iexplore.exe
2044	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2548	2044	iexplore.exe	28
PID 2044 wrote to memory of 2548	2044	iexplore.exe	28
PID 2044 wrote to memory of 2548	2044	iexplore.exe	28
PID 2044 wrote to memory of 2548	2044	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b5328621f09a92c6e0abe6f07e29da5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff287f478dda949571a8b7623da17d5

SHA1
19e1039fbcd6df98ed18f60b079aa593bf42a66a

SHA256
f15812c3a2945999dfc5f4cb90a8ab4d9a472ee243f9c07293ca82702b36fcad

SHA512
e19ce3473056ba0cc357da72381bcd5b086ad373338da552a6d57e326c3307802db3abb86662e2084f5cef54732a3f33d02280af9f0c9303b49612ce8e77ec4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5cc0998e08edf90067fa8353f9ba714

SHA1
e04db9573eeb0a3513272dfb14e082d1893a8c87

SHA256
17b2b3911e777d70e3f6f912dffb0bcee0093075bf182de44cdc2e09030cb2d8

SHA512
3e2b4f9b9681f217960ba4f59f131fc98ed5e611704dc18e781e080588f3fecc79d63466735abadc898226ac4931ac05e40bf5749c3b6cee273a13c82826ec53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
724392eb2d92819b847893d9e3fe4bc2

SHA1
a2c6d95b545fabbf95ca1bf27357f9d7eba28fe2

SHA256
eecf644679c152abb85068cefa4b1b4607858816ccd4812c18a4972a30485b87

SHA512
77a4e269d65fb255feba8fdba6d576e21eec1c5307834e282adabbf552a3cffefd73113d67cff87761e6ad73a7c2b224123a791be42d1e1c7d83993519594048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e3b3b417080c9041b40364834a7ad77

SHA1
7b3b0e09d021a2aa1193a547b37dfdb9cb58cbd3

SHA256
b40ed7494d248f451eec194c314cc9ca4675d058eff89076097bce63b858d084

SHA512
c72e8f45ff9818ce43a72addd278093fef3798b98bba2ac05c3f201e5fb1ebe1481a6ae7e1d67e968fca4a575a3643800e115b1c8d204632cc037fcb53883756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598b4225771183917296ffdca3344716

SHA1
ca1baf94b4787d528dee9dee45df5288d1500135

SHA256
bc63b06281f9bffa28837491afe077ad759cdb7837432751d352fbdaf11066d8

SHA512
0c2498c91adf69224202f1043cdd0d2ab12a3e8cffe3775d47a2590fbaa754b700b976c8728b511621b0fadd525b8140372aab3687317499ee35cb5f64c83541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65033f4a638a44d00b8ecd8b0b2173cc

SHA1
4dedac6d4b3a8f2924c703f6914ed723aec983d6

SHA256
c107ba9470250ef87ef5b84329ce1ad8a7cc981bf97da3663757eee5ad97fdaf

SHA512
4d5ecf59a8a9bb5869ee36bf3ab12ab7f31c9ee60b5f37098b026ca81b36f62ab40cc5ad3bbdae44022817696167d1dec97f4a9b15bbd2fb3ec201894c6f3335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10aaab143def06e5c60755f38aab52a7

SHA1
8682116af93600a739650cca04996c035e334cbc

SHA256
27d219f4bafc7be851eeb0d7ee943ead3b5fc0b96c8ddbb06e7dc0f35f8efa2c

SHA512
f8ee97c296171792edc5d2dbf73f56c5075012cb6912b0ac2aad64f5cbc5c724072e520d2c7ba42795add4441095236e3fa4ca4a57b8b55497491f9e05a38748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfde2920ed2cc32963af38ab9f6404f1

SHA1
93a10c55f77176dfe1da65a038e6d26509aa0a05

SHA256
2781f0c7ae0a74c074127483e42a4e6a6d37a97eb28be14dd2385a07c6a97b32

SHA512
bf4aa690aa11dc704a53bf25bbb748a385ef069011c5237d7197fe84298b92686c1014bceffbac981a25f3d8becf4c325c9c50dd6441ccd55c1b3fef6b2df5e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a995f967c6ac12cf4263bb8d23a486b

SHA1
779bacaa07107f3df91d30e976169ec475e63e3a

SHA256
f9de5728009b7608d6022079478865dab4d89336ef9562ea73ee23f3b9478718

SHA512
edbbaa687a79f776de984048dda32d76fd0bd05848ba46768670994beda69cfe3d22d19ce36639a49ce76fdb05213c13724131100fc106889b71e18aa662bcd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4664.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4776.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit