823e7c8896b1494aa107ed5daf3910b9bf95c706d1a4a06d011559de01a69df2

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bad98e7dbf90661b43607b76f41ee98_JaffaCakes118.html
Size

4KB
MD5

2bad98e7dbf90661b43607b76f41ee98
SHA1

09094642fc26f245cab419854642f4fbbd792a6e
SHA256

823e7c8896b1494aa107ed5daf3910b9bf95c706d1a4a06d011559de01a69df2
SHA512

876dbad33dee715f949b2de57e62eb802072e996d13a1e0cdd517e7fe2c11765b9ae1d64d5b5844bd55e23d086a40bd6443eb49d7614c285fc750f82b80bdce9
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oid:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303cd4dd53a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000888a1960edc4b589d5dacd08cbece9cd8ec143070ece1f9a7e58ab214328323b000000000e8000000002000020000000741821f8909a35031157c5d179b1857773558ad8e04a862287f309c359e4708f20000000fe647aa67e1953a9ef89bb17a0df5728a3b462743ec0b0c258c76f3a5f379f4d40000000ee6b94ad72464099f71bd357180076ba3357d796904e9e23cda11966675e44a0426dfaa82f36e0b23e25b09338f60223cdf871457ffe223285fc90dc1408024f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08D14CC1-0E47-11EF-A1FB-E299A69EE862} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000590a83728a75eaa3f5cbe28cda00410ef4ba5f64e2da63051c6bee4677b51c33000000000e8000000002000020000000b38319ac3b295b0485d609b89d07f312355c8e1ed07d45bf712bf107ee885a8e9000000036fa9c862fe1156347264b7706488cdb635a5c3a27fab2bcdce77f0e63246d6bf4800ff6e45624bfe9e565692149a12a2d63f874e4e2deb48aea87b14a7c7f32cc1311a57c4b84163bc846afb5129fbce05018b486cffc78c7de380895ca27b7864c3c939adbb4c5df81693d191448a23f2ace8f2e70166e2c9e3e68478e5d6fa00e43b52797a28624f79c570de6076b400000001560f64b08fc84f6080aed9e3d9a5f7cc84a419c21cdbef66ab968fb05df170c2552f161acfef4a1244bbe6a63722e92a895dfcdb9bbb04a2c6a488a6facd8bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421450241"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2492	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2492	iexplore.exe
2492	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bad98e7dbf90661b43607b76f41ee98_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff94105a19cf62b96f71fb65f3cbf474

SHA1
9473d65939c00d35c0f47b6cebbae43ae693856f

SHA256
558e702c505d12b2d64f97e6f1f2eed7aa62656e01f1b0ac07dfd60ef6eb2568

SHA512
162fe8947a58f76c73799f886bd7f564330942fa7a7a53f063e98fe415d613edad92614dc304aef009172152275aa77789902ee41194c3e31f4fec3f5f860cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1f16cf2152fc620216190e55e4cb583

SHA1
0553333fc2eafe08126a5b206bfec2e6c09f1cd5

SHA256
bc155f1230bab8f6fb99b9c0277978b55b3da72f7715e042009399b52760e26e

SHA512
45f6f65c4cad999d98d6b1e04ac26225c9fe3ac03631cf71429e43f613a64c07df724a1694b78836c6c61b0ed6350cc04cad0270d63e27932ccdfa9c283a165f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
783db37940c8b85aadf4530a3a7a947a

SHA1
a433c0d56bb6ae68f6a61458292aaea98809ecd8

SHA256
47a41ff1161a7a44042c05d426403e2f5ad8ed6fbc082898614eb6dc4b988d35

SHA512
ae7b1dd5a1d1ab91dd0e4a7fcfbc4ebc92a9a7064455ee2021f16d008effad1a9cc9fc3a688f36f7f110903f5f28fb8e1c54fe4a0f35655328e0b0cf4e99bc33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
418c6bc24c1d39e8e3a5d98a4a076eae

SHA1
ea48f03601012ccdcdd586e46015f8189c398b70

SHA256
10d051f5b44241170b028e71c02943db3076093dc1686797bd9eb91b36aa9d88

SHA512
1812b57dd5db7811773e5d258f8e6812ba356e3e8f40e7b1a309f5b40fb0eec3f7274c6a8d708bfb30eb70b8e8dc07f5bab1773d1fddc0944d6355afb9d16c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b668140cda392a48bed37b6f5cf25c7d

SHA1
2082d00d6ce127cf3f22c2ae6fbb9846300168e8

SHA256
76ab6db39b3aa7c0025182a4d394112a4cddb58af55d0251cadc2b41b55bb720

SHA512
27aeccf8e45f94fc2afcd4f4cd611288787469f1eaecf706edffe764894e17aeff2886ff9f7833b5eb5d090c41beeccf1bd527e2268dd5e7653e9422020ecf6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d046e01022c8b48d0fc2f46c60c80cb7

SHA1
78d3b23b18b902847af71edb67f728c03931a4c3

SHA256
d2c8c246803c9f7553eaebb897aded9105696aa1f4c53835421e908cf5589709

SHA512
601dd32ce062b6ec21e43b878e48673a8cd68bd299eb8a6654d84b39e10a77938cfa2431093fa8651fdf6cd3877b1f9adfe8da971ca3f40819fca7d96824fef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7625ab6786e426964aff7976abff4ad9

SHA1
6c34c7054ebf4600f72565a1bf7bd547372e7399

SHA256
f2af1c69d9fe81349ca683e912bedd7b32f0a5663887306c21a6d24dd129185f

SHA512
b12cba799d6df1f6d7022f58b8d24e68951d1fbe62943fb51cf9eb715662cf779c27459bbeeecf9feadf8c7d9d29d3f22bb7ed35730afc7a9748c716d6dd62a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1154a056dc46f86cb4feddad2b8e29d0

SHA1
82e665e940d4b6950bfa8d089668731260ce603b

SHA256
a97ca430e7d54811f84aadc3d8682534aeccdca4a93da58ec23d000162074ab0

SHA512
b71ce12167301a31e22e576053661ef0bc3dd72489c265083585752c3cbdd59a790af9ce3621f3902b3f4f88af3b6b42a9129bc491eab9d164263b0324c52afb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8822fb6c02203bd9f83edc7a605f3152

SHA1
c9ce4dc6c0e659bf7c25a6cbcc88b219c4a6ea86

SHA256
e432c06e8799014ee9d9ae99a7e5761f6e9054a342615939a84c5a43297ae4c5

SHA512
2a5c7f765cad478ad06f722cb1aa756312ab4343af5c9510b461e597fefd6aa540215e5ecf3dcc579c87017f9a9cccd29dd18d874f6fdc4d46d5bfd0b765f044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802eb50795c9e46066cf2f3807341b54

SHA1
2eeb062ce776f99c022c40bc41c742495dcf997c

SHA256
17774c389f4dc35653ea73f617da50daf8e4133b33cb359b2bba1bfcf0c27148

SHA512
f541018e77ba4143f3f002f20a52e38067a18bc8d77543b566f9502923e28b585c63227ff87aec77d8daeb40dc47f4421c5dfbf9589d62281c77201e67a5a828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb8b8c484b2cb9127a4fe707af2b77cd

SHA1
9b4568466d3793dfc8e559ad937036a53e64f5e4

SHA256
37e8bc23e119e02e12d98f22a598c9207de1800bb81ea6fbaed9a9901435ef86

SHA512
1df08c684623abab087b512e3e7ee7e5263d1510dee23613980b9ce1c046f54a87e8d2d90e267f91b603448776577cd21c16afafc6c1a25a27dffea065ffb867

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97E4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit