fa6b6cecc3fce503a373e48b0a66786418b3ce610baf80174821c81ccf5c8694

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4708e7d3e5ca4a1388f75599dac94744_JaffaCakes118.html
Size

44KB
MD5

4708e7d3e5ca4a1388f75599dac94744
SHA1

487d40f14709148800f162dca98b025cd50c0303
SHA256

fa6b6cecc3fce503a373e48b0a66786418b3ce610baf80174821c81ccf5c8694
SHA512

209b093cd3aced35bef5bb58c4c3859f0dc9e359b7875becad3a924584c571f543528aa6546d1ef6b5ddb0ae8baba31bc39d69be79131556e45e9aea217237b8
SSDEEP

768:o7AGgRGG4j8Jbd4UzGKo51C+8DMONgC2zNFy/ZhTmngwCiCcCZC+CdCaCcCXwaSG:oMGgRGG4jrUzGKo51C+8DMONgC2zNFyb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000af2b3e387a22f6cb956f5fd53c2e4700ce3b02ad96350ae040a9ca68d451617a000000000e8000000002000020000000929b5dbce58a5943061aab9a49ad90d9462d03e16e72f1a1c8e771b71a6587482000000096f86c649ecce4d2e07bf8c79f76f838f78700024efab1c70fdcba01c40e339040000000cc59cb63e5e26a55f2e3e52fb312b79bffa669d29179c0a02d76246bc1233b4a76cb7ffd749d3d2f85389510481d6fc39944c2c14989c8b33f48a0c80eb28d15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF3189F1-12D8-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000047136688fb2dbeebcaf7939ed108521814a8acc4213a7ac11f55bb912b3768af000000000e8000000002000020000000379e0d3ad71cdecadbfff21c3c811b1326e72b127128ecec24a91664f19fee369000000033e5fc8a39c86af5aabbd1259d2dc05a469bf241f0591ca8c74cdb12a8d074eecde09d64d09413b2b23a2140889a592ab9e330b2064b3d6e36de478b719f7d23e0210d44b8e0da20f4b80904126f6fbe3d7c7cacefacd03afcc8236b7da464f1abcf2a3867c16415cfb479f9f76790e3c46f607e16c21e89817fb89dd6069065f9ebda4b64f0d862b7ef75908a8b52eb40000000804c3cee0952cb025e559aa86044f63129cd6c38affb028feb315da5a241b06a0d88f6da1dc853a21a4aceb33b04c8a43acaf7a2a5dbb5536d8557969d76aaee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80775987e5a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421952606"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2308	2844	iexplore.exe	28
PID 2844 wrote to memory of 2308	2844	iexplore.exe	28
PID 2844 wrote to memory of 2308	2844	iexplore.exe	28
PID 2844 wrote to memory of 2308	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4708e7d3e5ca4a1388f75599dac94744_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36637726836209aa4f5ce6925ecce978

SHA1
19039ee542de3fef5d95f15cc311aa24c94a79e0

SHA256
f3c64aa0dccc3b3142a557f22188965ee4fecc713b9cf117423d3297f4d35de1

SHA512
37eff7a3ba0306211b5af8994fb27a6bf1ebc0a2809b100d41da32d7be3918ce7d423d3590109fe4aa6a0d5e9243c4f0ccb183b1afaa9b3c6bcaf8e3c42ef309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
712721cbbd39b48fabb6ecabe528b20c

SHA1
71446fd64460da46811cd24a0dede548d920f762

SHA256
f3d313474b4c63621812e1a2546036e4e068ee1dbc1674c40e481ca2c7f18098

SHA512
8f677df35f0f219e1f2e4f3a3bb672be16bb85a316895fd9ce60e8350f2588853466dad1ab519ad64b02bf91815e13a79bde22f51a479a10ae2cd97a0c310ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
538a030c4e9a0c5bb47b9cf0f8c6b9ef

SHA1
2c81a792e2269f065434a3624dc380a710e6d5ef

SHA256
e99318101d9d49e668746769daa0597b09cdafc2feb99c5fc7c3ae0a18692d16

SHA512
075980d5789b315718a4f2000a3a553e2c522c0d24e3ddbb9809488be1e7f8ca151a8898e1d95c4bd6c89a6509abe12c19788538008708f741faff8a51eb4326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c32cf827ddfd45ae15e166884fa3ef4b

SHA1
ac237e57e52b1b9fee9cfaae0709361bbf683cfa

SHA256
5c342503d7b1597b9639bc44615dc0bfa3229a5020caaf9d9e337783e4a4a322

SHA512
285024fd80b17b2247521f441c0ebab6d1546a2c1a9c31a5f04107e0939c5b3d05ec003b3d7a8fca87af7df3e901367c45605cbeb5162cd0578168196b03c741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2857036011257648375042e66a29a21

SHA1
4bb8bebae9ef3de64b34d263acc286a0a55feb34

SHA256
bea553c9e47735d95c1cb3d51566ff6e958e807d7b0aa8a0e2ff7dac52ec300d

SHA512
57fed43bb59a830390e8e1e5a18595c2dfa67a13057edddd12bc40507f0c151277b510be6561ab464d9de791ea733a08ea72143772083c33182fb7dd7f36a537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e5bfe58453b35e2e7e4bca1df851092

SHA1
1be76c7a420ad42d1574b9e937476c0c29e3bcd4

SHA256
bb75ac1362f72aaf72a6b8dfdb9f02c6a2b4dc9e0db15b7e17fd42c9c9ed4357

SHA512
cf7b66056030365a5ed13e02879bd08b3b3db1ad4ef7baad088c7449afb3030dc0ab2faedf21807688423a14ab31e9af4d3a113b076bf1fd88be4fd762676523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f754c16dc447140c285eb75792cf658

SHA1
37f2beebc051f410158f44c3515db738bcc029f0

SHA256
fc1cec4cdac19a3273bfa044f74931378292c74f5c8399444f13203eb365f321

SHA512
e7b5225e9c2c24aeb86599db930ee9d565c73b70bf98912228c6a0a5d3a8b12de63c05560e96704ef43fba209a2402cf0bc561e5c5fdf5dfee5bb01665d6f45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4dfc511a8b459366d78ee51678653a1

SHA1
5a6ecf1864ab6f62c3ed4f23cea452a6e15f573e

SHA256
fd787b0d61e715abfe95b53e7d83230048d9365eceaff258dade9df99e251055

SHA512
8d733652bbe1474f07368e40253ea22da0c3f19e281a23966d72ee639af4ebcce99a95a47a31ec4342e27350d50d268bf133241ba9cc4d3525966f689441c04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a59e246d4ace133cbca0b3b5ec6f95

SHA1
aa49324561c30a9b7fbc8a16095a1943bf78fc71

SHA256
05ad85912eb55313522f4db1a82deee7680a104004125da70d04d323b82ab4c3

SHA512
d0fb0238df1a5437c607c9fedcdf2dd9d8556b412ea884b1e09ba91c1f99c7d5819af8331ebaa0608afe3b9259f860659571de4d3c6ad931e5ab1163abd30e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4038742cba5c241a1a3838da32f71d29

SHA1
aa53cdcb4382b0a1e908ce1210d7d0fe82038830

SHA256
e42fb1154e808ca9ccae19f874ca784423db4fdf9f12893c8ccf2120a2d0a6c5

SHA512
6c67a8e887fe0dae8f3f5e04d0a74046e2ce94c3d8deb830817e6844871c7e04b57d90aced848dbf58fcbc522632f0a9bfec0188e5591b139b61510e52388433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2ef391ae434066238b2b1839c8504f5

SHA1
ac1c2bd4c4608fc8d4809f8b32053482436456ed

SHA256
ad09793b0ca06d0b583923fe993552638e566fab15cd9abbb56186e148f9c5ab

SHA512
3b433932460a91239ef786d9b1ce54766667b3c7a68097dfe441a7e47c74103c2ab6b197e32090e36b836633d7b163f1f34607c797ab3c9cbdec0f49a8d6977c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9a5e0c602b03c4fff7b5ce885048b2

SHA1
33dfee7aaa0017bcef0abf65b26fbf590e026f9d

SHA256
06e8b1ac0e835a2b5f8d23e2f6d5f0126dc3fff164d12392845a2b1d7773b711

SHA512
5231d35b8e1509ddfcfd8c79248becf21cb93b51f1013e3936926b219cb8ede660d34ae236c5938a01ece154a78a10fb5785bde4f6e1ebb079e80aeda3dc71e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46f075c144271921c1cb086f70a59d52

SHA1
08d3679e9461c4b0c62386a688cf55a904d0be47

SHA256
5e25bb3de9f1cec108363b7d798415456a293d8627f5470b91e8b5a540c11b47

SHA512
81fb035f26a946e45f576d3fd23c6188c3776d4d3345dd11fe3a1bc6ecbf6b418304fbeb1e7793b3980772f352bc9293a3a0d92a0ae37dc5972f813918345070

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F5B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5028.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar503C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit