673f6f4c1de1a574d6579368d3503dac05a9c2ae1f92fd4229be21c216681fa9

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4939e7294e9b5b6e454110c4557a52a6_JaffaCakes118.html
Size

460KB
MD5

4939e7294e9b5b6e454110c4557a52a6
SHA1

72d628a3a6f913a0d4567d98e47d6f2af28d158f
SHA256

673f6f4c1de1a574d6579368d3503dac05a9c2ae1f92fd4229be21c216681fa9
SHA512

7f0860a48f577050d4c0b80aa7f6dc9da5d3b34bb76ac938f06748f5af414c2066ca749bbea4b95ce60307bea17956a9357fd109430e7a608fc765e6ae297fd8
SSDEEP

6144:S0sMYod+X3oI+YfQNsMYod+X3oI+YDsMYod+X3oI+YLsMYod+X3oI+YQ:l5d+X3C5d+X3B5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AED2871-1332-11EF-BAEF-F2F7F00EEB0D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a877533fa7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000325773bd0b5c414544671f54984e7ad396d769875193a409340dbf6649280f12000000000e80000000020000200000001d476276ab36c7fbc439c350659e2a4e40f1b061f9ffb4414248eaf11f596d5220000000193d17d539377b0fb4634d255a70e0888db9729584397e8a44b4f2b8ee92c75f40000000f99f75db67fa2980e1e2b2516e76995502b614699503d0a6cd4e2663842cc316111ba136b790996ff6ce2bf7210f36670c8f2849eebacef7906be96458397d74	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b39a088da06354905f5def2a9f4563ab03f3073392f26bb5d466102e4649acb9000000000e8000000002000020000000cc8e003657956606c1de8e534645dc4124bae8c369261b7e172b650a259211f690000000c00733b516474c21f090ca3e0a52b7544470b87d5d98d3568ad816c41fe116ec278f6855edcd6a98b8e161d9d11c0c6efdf7e5a07ebbf09af355139ab7a17864b2733b632561f9c8d4032feeace9344e718948f79bbcd60e1e93ba1918043591fb4909348859cc1bca9b7405386e96ec6b073c7c3a15fbf912c3edf1699abf05a64d29a4e145a99ab1cb6d11f621383240000000b338c05c80c02d604de477737daca498aac77953edcb33176a46e5b182d7ebd67aa4021a074d218d3a302f02c9d9e5c6db8873a659620775e6953246580c72f0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421991184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1616	iexplore.exe
1616	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2956	1616	iexplore.exe	28
PID 1616 wrote to memory of 2956	1616	iexplore.exe	28
PID 1616 wrote to memory of 2956	1616	iexplore.exe	28
PID 1616 wrote to memory of 2956	1616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4939e7294e9b5b6e454110c4557a52a6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95e38c6a5ed84c74d456b19142a48727

SHA1
0f5b7074ccf6aa5310ec5d7454dc2fd470eae3cd

SHA256
da11e21d3f291c2cb7720f9f92368d7da5a895b0d93489db2ad143064d790595

SHA512
32d59570d8950cabed748db2f1fd89744458527df3b10b129da586ebb5faeca931c636eae0485e4c6a907259cdf7c5063ee19324dd62e965646f588f3e499dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279433b5a46d2e3529c2c9bf16be1c1b

SHA1
e078d55ba21b10a7a14148052578f223c4eb44e6

SHA256
4f579d74c015275521664bd8753521f6069cfd0b148017b5cead669e14142b40

SHA512
86d171788a92bf8949e828e7cbf7486f296566b65fe3acd88b11e6e88f6f3f2787142c04587021bcd082474eeefc6f6dcc9ea6a6428dca99dd352fbe757058f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b503a91bf56b65edae84a93a774962c

SHA1
b312c290afa1ffc07d0edfbcd347f1d3d5ad4893

SHA256
dbd04ecc1dd2d2a3ead054dd7667810e3acb6be5133f82b305725c282e501e0a

SHA512
64eab619e6007f4920d09aaef946f9f9af272a51cb36417a8074460057d9c7ffed6f5ae4d296eca723a79c6d22517cb2e65bbe52e6887b41eeb7e0b7360887af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b865033efd5b4489613e19c3879ae56a

SHA1
45649df0b040f03a9751ca1ddb8ad618b4d52750

SHA256
1ea9e8626c0571f67259212e3f2d6a9fc7e0f7c9a59dbc820a33dd350080f233

SHA512
87d3f953548c599e157aa7091677e47e1a2a7758a9af6c08b9abf43bf722be02e8fe2438e6733810d8fb32647ba09e2ed61c93f721bbdce61b162b433e03b6b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a5def6b7a63fbf339e0bcb21b408477

SHA1
bbd1a6ed790a01c749d884f48a34d8321e350aeb

SHA256
fe420936fb043288ffc02565798f6b9a4cedaf543a07adbfc282f27724ff056c

SHA512
17b2c43f8e8614e595a9e2e19629f95c33d7d9ea9c1dc43340abfaebdca510fd0e422555521be541002603f9aa369ad504b2082f2538ff34a4f71dfb339cbd45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05bf030b904f586ba42b6c4e56303ee

SHA1
da200658f5d1600e9ddaaeaa2615a48de6467c6f

SHA256
96a9438cf5196c915632ca67b40b0e9138fdbe496609c5e4bb00eac498299b64

SHA512
d052a289e7a8981af5c50f0ca503a3da8644d08604c1c284fb5ed340782b845860ca803e00b590c615230a1a1bb65ad7762588faa20837c51640b1b258dddc5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
076205dfae0afb559d4379bc25d3a938

SHA1
d141186bddcc8a803e5af922897e36501bd954a0

SHA256
a2d938120e5550e31e1e77dddd909476b38e8551d5e64b77428fa76236b5b553

SHA512
073000d9512495961f36082a17d2db695789ded775553a52b6a64496e84fd00c9fb864165aa52d74380f0628ed0330be7d640daf0b1b24104fde04ff24fbea60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1fca0bfe191845c497224245fdefcbb

SHA1
36bfdbca7247845c56fe0888822d7c7d2dfe4d79

SHA256
66fbfe4c6a3f2e147de848adc6d10d6b557e6720154cee6a72d74b434ce9f78e

SHA512
a0a9adc33b6afe7f452f3ee8cf2b25ac493445dd9717fd5210666a7f246c6efd8e73d1395eaa95a71ae1e751751a37c6af66ee538aa8d6a1b10cbf19f593706e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdfd2e59e83f3603830d5bee663d4b12

SHA1
f08f9a2fd3c571c3c4a20cf445e0ff10c1bd53d5

SHA256
9e591e6ecacf0662c0e9538591b3b851defda3bcc541b525f35a92bcb909a0b9

SHA512
fc0ed7970c94e18a85e5f060ae12c59e030d899ce24d036e66e2670f8942d7fba52df8fa5c96984e14d913c588bc8dfd484f285c99a958c7e57b62b281b7e29c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f7afc785dae1b2bdc67e61080d85635

SHA1
689b26ec03609469382f290934511cc2585073a5

SHA256
b57c620555e2525b26585279228a5989b9a6e13b0510c5c016b6d1181f15ae89

SHA512
874745e4f83eedf4a5eb63cdc88baf29ebb83fdfd7e718cb66961546401613465f4c9ad4741b207a4a365d3c68b7727f45fde10b6c1250ab8a511dcf8e01dd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14188fe0ee1c8c8cc057bab266bb0941

SHA1
24482ce21237cb24fbbec2e1e21d5e29fb6ea125

SHA256
3d5107d8aa2330f3dab93649ed81308133721316c2dfab3d211351ea3a2b7ea8

SHA512
ac369ad03a0924f99d51de4b9778540386f466f007e6b71f285087daf2d29d19d376ec981d111ee9b05840f92319a6bcb88e5e555e1dcae9d7c34ccf861a80a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757376b542063030b1a025bfa2d90ca4

SHA1
6fb6a75e47c894d31dc9f64b9b715566cc0d11de

SHA256
b1675f94da0c9055186ce5df7c662cee52199bfe7e24053d84490d690902dfbb

SHA512
b396c770a270fed2e3745a1b3cee219f228d350fd0fa210217ceb370ff96ab4dc03b8bb5424930ba53beefceb32b9c899983fcf89972115ccc16fe946cde9d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A1C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A8E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit