06b54cd3001e2933b3b40237f7af06dad7e2aca141f5ad83d60b90634d9c8019

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e2b89d17005f15bfcd4afbc85456c5f_JaffaCakes118.html
Size

7KB
MD5

4e2b89d17005f15bfcd4afbc85456c5f
SHA1

35476e96205eb908cfdf907c94053c6489d3ceac
SHA256

06b54cd3001e2933b3b40237f7af06dad7e2aca141f5ad83d60b90634d9c8019
SHA512

f086f08e6cb52d31c2477373872c01472ca4ab765f94b953e68444962ae4bbca385322d2cd0a0c754f2187286a1f864576d3e38ead0421209f000891ca156358
SSDEEP

96:zIe0ooaC8LAY173BGYNC2QbQYnJQ2Hap96iPCA2s96dddddddddddddddddddddl:Eooa1LdPv2ztsyhwhXLg4m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b096b507a8da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422077233"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000007df30e1a51983f57ad5fc5738ac1ba85c78fb32f913520a49963b27f821c1ace000000000e800000000200002000000066e7570690c991c92ecf17851d96972b9be2dd5ebf2c80496b46597f1e8ce6952000000025b5e292d535b7cc827bd37dc7ef411df6bddb0c15c521a86237c9729ca7f00040000000984838912b002f08e2b9c34b3dc6e129eaf53e9eb8710987e329fa82847b5b51e6904a674167f93f613cac4a2bf39820d71693c87f456d0ccc5f55bb276ddeb3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE3CB941-13FA-11EF-9340-6EAD7206CC74} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a600d7b4eef711906b4e5fb91f2733cee7ffc2c0191d90b94d9edfe81cf3b066000000000e8000000002000020000000923a3f93a8f09539fcd1d457a28d5e7552ab495839b0d76f0494d24a9001b840900000003331999729841e023d745a1af73e8bb5aab230f9af688a6c026ab22039e760fb5c6737a00d11af48bcb47525dceb35c1b5a1c131eff287877f08eb9bd8294f55aa5923082d34109946c3386e249e40ebcb6087790254c754433f7fbd98af32cb51478d6e73fc82c1247c77676f84b94b435f14e81c33fdb442bab936a9ddb77ed1b4eec1c966d274318552eafd4a69b04000000001ba1f376d8e1521ae7dca27876f83777a62e699194765ecc741eeb3fbccd3c78ff86feca4fd306a60c76bf975030546e15d0bde38dbda13f493b4e83f1974b0	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1812	iexplore.exe
1812	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3056	1812	iexplore.exe	28
PID 1812 wrote to memory of 3056	1812	iexplore.exe	28
PID 1812 wrote to memory of 3056	1812	iexplore.exe	28
PID 1812 wrote to memory of 3056	1812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e2b89d17005f15bfcd4afbc85456c5f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae7c07fb988c8a1d4de01d81e647458

SHA1
a7aea01dd719787266cacf86bc0b2140c229fbf4

SHA256
35c2e64a48ca3d819652d04db5dfde568f6807bb270b62ad73450fd49935231c

SHA512
90998fba2d57fa4d9c5041ca76294dde0791b24049623a9da61ddc71ecb0ca05d952ce2c4c4151cca4076a06b671973be2d808668a1769113edc24453732585f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf54a57ba6d3d6694fe429441256dcdc

SHA1
131617b682765c15a6e745f747501b1f2fb8b0b3

SHA256
4f703fb35a1585a09d490b618126d2ab7f3c39874dc49de8109b161e1ecfa451

SHA512
0bbc34f4758a95670037e1c76778a0db9a91c4cab730792a3244d42311ad6824222574227d32106f80389eb95964ff718f3200f6391b3e61794150786905ce1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b0e3a1304d818828bef485153d64795

SHA1
800bddbf53268a52f937db6103ad8fdbe9841f35

SHA256
43a8339920a2b0ab85467bf32f51c61cfc282abf709fb2ab56fd768b74970c41

SHA512
dcbc9f41e734e1c8a438ff2a7fcc16f576a7dbd39fbfcbca357ec68aaddeff3793ea073c8bd1e79b79505ff922bd29ed13661d70aa166cac42ee6d318ef197bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46e88fb7e4282f5db237da9d94a81319

SHA1
cc42891a3d8e4499a3ee7c5b9770c55a198c7186

SHA256
c76d8e69b88a4211121c04c739a1ba29998fc32082beee61f516e5f054394aeb

SHA512
2a92c0b33627f268b764e3f430a1a8b248b4c2719b075371fef145ec84e9b5fa157a0e9c19bb8ca41cee940e5a59c6d306164062ab8b4fa4e1d1941a67bc4c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
980ba4c2eff2a442e4c921e8d90c859d

SHA1
f633b3095596297a541bf441fa32494589fdcd70

SHA256
b595e34de85a9c177dc95c64d431f6b9731fbf688c66a942090f12dd42325a2d

SHA512
52392c8558413b9de4dd7fb5832083c8d4ce8ca53738f9f872be3e793adc1fae33c880b25860af518cadeed787a5a3fe6680a737eba57bfc35812dfe073b3cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4872851c30ffc1e56681fef6d17fa282

SHA1
2d7a71bc1cb41c7980a94c545d22953a78b649d5

SHA256
46e2870e2b1121c20f1d58a9211cc107f34af77d39c3f82ffb0c4ada9e637480

SHA512
5f1e1be55d56e661f53fa5d04aa9c574bc4541842fb762d564e8eb731d936a22062db873a4eb905156c8e81cdcbdc3ee4fc783605e6e1355e128966e95071fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9959f17c334ea70abf7fb3ea4e01b083

SHA1
b995fced318057aec2185c334ce6efd6d49225d6

SHA256
5c2103ac44a2271d63125176ced7790727d9ef6d29df25e704ea74114a5e6827

SHA512
999b04cc57a6bcab3eae5fecbab5680470fdd63ebc12a4c1304bdbe52ab79e55a108a77be472f590d44bb4385e5d66e41711e600e2076f522e3e81cd1324b19e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b64719ed3e8f07df29d03f4d7d15883

SHA1
4ab2b31cf2d04cbf93da31c62f0240e03602ca71

SHA256
34bac1b42b5eabbac1297ced5c17c97a303a94ef3fd43020eeeb969ecf0f8f5e

SHA512
d87f68c636c1e82465d83f8bfaecaf908078ab258a027a9f765afe751796dacfaa43531b4ec4659b27dfcf0e02f051f4f39d86ffdedf9bea9b7a916ae9fa2e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
579a0ecfee4f07c0c5600a6f2c8d041b

SHA1
35d7ed413708c9eed94d3796006c47db492b5087

SHA256
f654f767ff928cc8b46d900bbc262a472bf8b7e306e94dabb0f3d978536c99e8

SHA512
d501de6bfaa7a61956d4b4cc249ebda4bc236a3a12573226c66ad87d958a9d79d8bba664e6d2bb248da11a350336bfeb2a292c216e130c1454674768c49bfd0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2d87c51e51214606a81389dfee1dda

SHA1
17e2702fd3f3bf043a74b1c9d7564d58d69a45bd

SHA256
90028e8fbeae605843b92a13b89e2c68e4fee4a1a5e304ac6c16ce51da2e28fd

SHA512
a73ea05ac50319ec6fe0e52b151b45f3b80f0df5388d9090724259800abb9747c5a5c9989beae3852dc2ca40daad719273de9d6f95235fb83b579dfab91917f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CD5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E14.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit