a0c745e540ab2c76da130e301a760f1d35e648b0283e9c963e5cfa1f21898a19

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e2294095fb2396c8565449590c4b0f1_JaffaCakes118.html
Size

461KB
MD5

2e2294095fb2396c8565449590c4b0f1
SHA1

9c6143f487cad01adc66a87fb3f4752fcc8cada4
SHA256

a0c745e540ab2c76da130e301a760f1d35e648b0283e9c963e5cfa1f21898a19
SHA512

97dc0cd7a4db28fc1a5c10ca7a3acbd6501a9bb38167997a249ae1a6384f3da5faa1e5d31a69185c6f76946b3d3048b154b897811e104ea9d6dea52aa148f61b
SSDEEP

6144:SYsMYod+X3oI+Y6sMYod+X3oI+YjsMYod+X3oI+YLsMYod+X3oI+YQ:z5d+X3K5d+X355d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421490011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A213A7F1-0EA3-11EF-88AC-F2AB90EC9A26} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006d3e6759f1bc1a2182c001eafe5f5b128d7e87952a41990a9365afad2d1e6558000000000e8000000002000020000000e0653c784a8366e28ea976bd3a9b7f03101f7d72a267ca24e35565a961163e6d2000000063d2025f0b28ec288725df8ae1b75af92af533a02442077d9c8004fc75fe0dac400000009f29f6ae1f51f129e8e7cbb1178799f1bc5b59572d51069c8db49861f0233daf384c4e0a75f4d073ea6646269d9c8715fa74942b5f305613a3908536a91b6805	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000000c0bc65091e82afff2229ecc48a54abe9321b0d06c1da68338adf04b647a769f000000000e800000000200002000000073dab473f82c1e97348d702498e4b2121c4e08ce4c3f6fae9414094dce0ff891900000002f5a52ef35336aca228676348961b9f1db710c9b81b18abd10620d6f55ed57017a12b60f857aae27e734a909670bf0f52a9769871ac60bfd7f8a86205720d5d1e32e5ffb5dc5770e744920b5ad899e8acce8f487acb0cb7cb8ef0ffb4fd01b3cef51024fa24317658a81d1902da2e2484920ba8f6698bb273fffeb3bf06994d3d2db5ab417c7daaffa4bcbde8164615f40000000631be193537e8f49c37cb44353ad4f6efada62d4d091fd187732abcb75a7df15ae44ad7d22a8040f28f2854ed8cd37f6733dd18de6b4a4e394a7e4bb669ca77d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e098a07ab0a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1008	iexplore.exe
1008	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28
PID 1008 wrote to memory of 3048	1008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e2294095fb2396c8565449590c4b0f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
189b4da3fb722041336de6c349e30deb

SHA1
b9ed8528bc39255a593e2101b82c5a8d517db9cb

SHA256
70041fd931d3b5cc95c2c84b099bacee8c317d7880558273ba3ecd510359c2b3

SHA512
aceed967db122d7f872e03fe251ebdb3385a88185ca42df959e2a7df2889da7cffbc43c5b4c21a07f6f4ac9b69bc3898c9c91883bb89c9af94c738f8fd7ad47b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dc0bc528812f30f9f64097eef0afd40

SHA1
9d974b31ba2660bb315bd67d79007e8a2c14f716

SHA256
bff6cd19b17aad77c791f53f118e89fc986a2ba2722d8aaafa3439a65f1abb97

SHA512
57fd4a2580f0cd78fa0f9b66e6a917460b262dfba72cc0eb0d1cfe35817cc2f8d76ece9909c3f66ccad7c2c4447aea35abd5ebc8348edf61491b38d6a7b05fc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab3d2519b22ae8725f3001cc1d9acaef

SHA1
1ec2326e228dd6d6f8653af95b88bc0942c1a5a1

SHA256
ebfd3bd08deda3473da05f49206f8e19504d37c3e4979800efc4cfc1b61a5445

SHA512
59303a6164fd05fb13b1fd9d7348f6e7cc93f3b9dea5b96e67fe300aad11145cdd669592d6ebe76f3c2b310a246ef12c1d5cf688528ba2a592331316df3d55ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9e7d95116fa8d303decf6b77a10f2a2

SHA1
09df61e3b7a457bd70aa65add84daad09f4d7f9d

SHA256
90f491f6a83a2affa2e225355ffeff538132a57fe96fa999a18f3c832599f2d4

SHA512
5046dcb1aa97e2442f4a41b4ee87bc63d9fba78e682c0aea5e476669a2f288afe7206ad6952e79b64192b993a2a7d18eff1f041085c6b96b54b4ea68e08e63c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08bf487c73bf52598278449cb3aa50c2

SHA1
17032495e2382de8d7c9bd91a894641c0e030844

SHA256
1723084669a53d5137c7ff0cbfb08365085a7330950643e8aaba554c8ed17c5e

SHA512
233ef6d605f832393be080e87f3d52234887202acce56b88e70dfcf2f87a13f278140f814a503e0eda16aa847087b43e4745d5c3fabc8494ffab03349c6cd790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e829c22086ce29aff77a7228360c1e9d

SHA1
c48294cb97b871edf15cffb431aaff93bd97575f

SHA256
b8d418cae521f6cf46d2c8874c641f2e5059acfe4a0eb9d4c050d240b1f96cbc

SHA512
50c5adc4b70f1aeb5ef1a3b0ac62ace9aa16dd2b164451ec31a0106691ce471aa626f3460ed096e02d77321529e16c68d6584f8b191941751506404b24dfa517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33655410600b3d0dce4b8255dfa68728

SHA1
578bce2b37bd57ba097599f670a603fa21eb866e

SHA256
e80a75110ca2963cd1a9dcda68162a0e9f2d71076ebd4e4cccd666b5c7430069

SHA512
99b8d518cb5a4b44d2eebdc97552663edab6fe245fd762d3dc5c61555981c32b537901aac85b727811d3b606f593b6aa0843941cc5bbc0d4ec78f3d53dbc6719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42f02229e04bd9bf2417ea11d73daa67

SHA1
7614716e3484a65d1a389ceb8e35bcf7825b39b0

SHA256
41d4066d8819e5ebd9beb6538e4106e2f7f3d768fba320690e0dc838196d1ec9

SHA512
50555f294190d3f93f6b5e91049557fd76cd54e9d2e8526f89790d9b172e3a317d8ec70f98e7582fa26bb72b6a5918eff1e3aaf3325488f568757e0feb395d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9677cde864b5925f66e2de9b02be7b5d

SHA1
af87cc5400c532d31ed8c60ab9f70d6b3765eded

SHA256
711a5fd3c58930e27b52417be3090d12440b6324af9ce8fbac24c454c7e552e2

SHA512
f55cfd645761d91b3506860929959b813037b02b2f3a1387b88bc7b2f9614cd4857bc4e44ab34b282d11de508b1863335c7a5d05166ba1156a94be5d3c4d9fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AE1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B71.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit