6aa67d8aecf06ee6c8ada3bd1b52a87f73915dc09ee8eabae7578e103970d549

Analysis

max time kernel
142s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a89dc911285878153da32c2d3c2dc8b_JaffaCakes118.html
Size

147KB
MD5

4a89dc911285878153da32c2d3c2dc8b
SHA1

a406ce0d283ea15a8e71ab269aaada22214fd80d
SHA256

6aa67d8aecf06ee6c8ada3bd1b52a87f73915dc09ee8eabae7578e103970d549
SHA512

40753071307d99bcd4893c8965a7cb106a77514534c28ea676e281eae2fbc3678abc0da3d093f86d37ec50af2ab6e4be82d139195e2eec1e56d52a6f3f6c557f
SSDEEP

1536:S2eopuV8EIfyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:Soe8E6yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bddcd78f14362da6e6bd982ba1fec670834c3b18b05ef39b6430b49b4034b3b6000000000e800000000200002000000060d0452c0a8ce7275adb1d4a188e7db7d35184b87ac4c6dfec04e5c37126c7959000000093b9386a84b075f288be442ce9ee300f05d4308f45dc1109a1e32af51401f16817ac73b7191cef032d23ef6e94a2e254c7ee0e1d72bc711671cc6d11ad816a633ecc5487d5779a1c2ea06b0bf7be60738c2d79aba5f85de3502184bf8f02d13d61e31038c469ec0c90049daa769a30613a959b64e3d274e5c697a7c37715406350bc5a994d4c76b3c50b4e240458b1fa4000000098d4cd6f36100e218fb4632d856279388a0e8312d6f9a7cfa8236c1393c747d1c12e6159c214517c0062e899d1e7a6944c6df5ba8c32e80ed8e12139df2a1e81	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422015875"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f076cfea78a7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC92F2E1-136B-11EF-A1FB-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000016a0c2ce5e3ad6d24932287212feac41ffe17dff9e11ac088c60913fc646e9dd000000000e8000000002000020000000bf4be356cc483125210210fc8161a981d0c633cce4cc54d1c75c509a0c15de0020000000ee6cbb7eb872118a8a41136c7b6c40b9b0a68e45379a48aa00ab75ecb2361c6140000000739d953c353ec5570a7ff7635fff2037ede4532212c707e1b7e45dbf09928c26663977bcefd27801be06dc8212f83710bd4cc657f30538208fee6cb2a93b0000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2492	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2492	iexplore.exe
2492	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28
PID 2492 wrote to memory of 2264	2492	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a89dc911285878153da32c2d3c2dc8b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8737755244b715557ad6ede2ef8cdcdc

SHA1
7eba057fdec4e46bd7b66635307993ec35377053

SHA256
3c985d4406b173e33d40a75f532420118afb265f2ebc2ffa8b803cd90fd2a8a6

SHA512
154822908a043a169c180afb9baea61579d9bf0d676d22f7309ab64c69ed4db68cbe5a3a604aae7c90da0dfbdf152a1f67e88ac13203d9fb96fd0b3efea29c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21c4414d50390d89ffe3acf7c6c3ba72

SHA1
5e11be47df308418762096f54f93b40873f36ae1

SHA256
b9e8d356b99711706793892c51e139aac56ed33fd977fe91436b8f870b13359c

SHA512
cd7abc8593f5f4d00b4b8e13e2b62d6910de628d44640dc4db70ffe5048e0bfcb7387a972a3a7373276aa651e0ae03f8261c433786045c75e11550e90b870b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6238c73d46557cb1d272cd2725d0ba5

SHA1
15cbb9392ac72e2bb98fdcd523441a114e76ab50

SHA256
72b74381e3f49f6b3bc47de1bc488076f9aa42d141e7edc0a38923b5c8b868d7

SHA512
e511ea28aa6e3007e848504a1e6a0deb9f81b157374bef49dbb53e195f27a6d61ecb0828ccbb289f8892093e4a0f534d7c829dda37e658c85dab24db934dae97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69a497afdc2d10267219e2488ecf58c3

SHA1
95c6c113d38f5d755e25e3e5253ba9d0abebd5d6

SHA256
0b056bb5be4b6a655baa5361b1c7be299ddd6bab2a292bccd8425609effda322

SHA512
fb5fbc422617ef958296fead2cb2407852b51cea73d38bb57b9055ec368bea404b528c150b75824c24e59e85b63c2a0bfe4d21fcbf780fc390b3f92b3cca090f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1200ad3e0dbb570fecb55d72f40e66a

SHA1
24f611ad238dc36dbd092b2c4148caa538d181a8

SHA256
0e9f3439389f5fd0151b04204505a9df4119dab32f57de7ed28a3804361b5f6d

SHA512
ee4af142f600307489cc01bdac65248971b563fa9f6f8cb3aa5340682d0df62f74faee42ba42c4ba8745acc3619e7f5c1b71b3609313d8fe80e12bafc8d12d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5ea5c21fab87a594991c8b9132549c8

SHA1
3d1e135a571b590f21af614ac2102676fae1925b

SHA256
c716f997c0ee8ddb0dc894f37a434183d76780a8e9afd1a3d536a367acfb3b15

SHA512
4feda6eb459e6456ee3630544bfab7610640bd935c5fb57f7bcde44bc4c62b33026d773f1e926f25d9bc7b95a757d5577a0d0fd0c6f52029a9b1d0d4efa05591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a60538f75950d1150fe77b65b938379

SHA1
c34aae2f9985e10110bf38f16af150b7e4626244

SHA256
f53e75754fd5dd64827aeea9076683704fcc14d392e92f9ce5b7b36817ad9cfd

SHA512
d44a11aef56e64f221c63afdf0c2dbc29f4909c6cc96945afded027e5d511e805d9ce7814b19144b73eb806a6d2de49177210aa950a3bfda207014c6d8778bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b12e0ce16107898729f46abdb344dc2c

SHA1
3e1b902fa7d15e2dcdb932eb75b851eb02b22c28

SHA256
107b7a8d8a6c2836b87964bac562ceff4119eaa535347b84be6ce5e0925a466e

SHA512
058c2ab7628aaab2417cc550b87d65a4d7a99a93ec41fbb0e9fe2174a65e6af334d49bbe33a90d9a9c307086dedec4992cc45f9d63dfd1be1606fa9b61fc761f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27bd8132d6bb3af9502947f56af38b2d

SHA1
47e4f2aa27c607be73da1241c96f7ed26c5f00b1

SHA256
cc7d6558fe2fc70f049cee918ad5b2d6bf8ec98685c81df9f753207e5f193fe8

SHA512
d0af076882d1ff668e11bc59142934157f6e6c8b4cb3e98fc8120dc388c56b65180be1f70c98e85dc18162bcbc8386a7b690ba66abbe9d06a8813a8f6864c237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
386697c440052cb36c7bf19bfb175970

SHA1
48f54e44b3ba770f467f5625030d239100c4e215

SHA256
b7d42a3089a7bfc181a9c7b7c38bca3837ce9549a145e6aba14e61e7535ca6ea

SHA512
b9834c4b2ab4d92100d3e162f012270156bb5f9d8fef1822080f9c9476cda9454a81d8399d6b269ce57ab16cfd7803ebabfad3e99cd8cf101b45c1232484e044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42f25937c9d036a50dd49b2eff4fd827

SHA1
3862a97cd6fc576461225cfdcea41a245a43868c

SHA256
0906d850ec312731b12f820cc7a60b5f664dcf8711018d30a37c22c9b49e025e

SHA512
3cb860eb4ae92c9c1a9e8626549812d93b8fd07c937e83342649397eb1204d1169093d802917160ec90f8e24be09ec7dfc9ac773059750187052d1a519adbb8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8971f80af6f0fcdf738c1581e533181

SHA1
3f0473c513e07422193be55866822f4a717cef7a

SHA256
d91477b2f8930dd9ddb6d285437b90f0e3a8400f9d87ed003159c750a45af785

SHA512
c3531109135f712a6a13cb84fde7a59ccc097167e76e24c9ba7b4933539f97fa59363ec38aa7b976e8fba8cb2998b93b71c24064972733c9b4418545d21415c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff80868523407eab072595a1dcb94c8

SHA1
986f8b168786f763f601530f884953e8056225a6

SHA256
ac336ffcd615a17a79c1fef0bcfa01ca1e21c1aae7791237fadb0f651c246a60

SHA512
b1e0fecf0c3f9b998949c0a2dc880b7d9f9cc733e494320737e0ca3e8359f3a158254e616d9a61c6c4f030a02d2f083ebf723cac176b8913f04ab69ed538ddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit