7ef2b9c106f2622daae894013f750368524b036e6e5a185b9cd2b651b565a2fb

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f823521552e17618d5330020c8ef5da_JaffaCakes118.html
Size

6KB
MD5

4f823521552e17618d5330020c8ef5da
SHA1

c23e5db25122fd30eaafa2992e1b30b26b3a5768
SHA256

7ef2b9c106f2622daae894013f750368524b036e6e5a185b9cd2b651b565a2fb
SHA512

4ce942ae9b855357b04c07e24e5701893563e7540c2dec3ae5153b898aaeeba11574f11801c5e1bd61944ecad88e8a264449cbb9e359402ada038958cd8b4276
SSDEEP

96:UhM3sHfMRIRlMfDTl3j07HGfvVGeWhWJQ0whzgx0qvk:UhM32HCd4KfNGeWo6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422102898"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E6A8041-1436-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004f1a2805c8812aebb78be0f441d58422e52a3e47f73926edbf1d31e002108380000000000e800000000200002000000072f5f7e8323096ee92a698159fb94306614b151f1ad9df3a7b839fd9dc34724690000000dea8a4738a9121b39403318bd2eaafb6fc3b81c4a0d10edef98b7d9c8e6867a1110f32e503fa9a899a4e5063b08a729b8267f128253a89e4d046ae9f9befa0f7331b2d36985472d2c564627b2893aa5f812776ac98c96563c076d459cf38fb5deb9e5c4956790e38d4b288f641b18d6d40af7a3ddb834e9603c2b2a7a3a4fb15843d8a8b391a4c2e1fb53f3e894428c04000000054ded8883cfa5e01fc02e82032375825570305bcf25d178ae95eb81d1c7623dd6c9f2f4d7eabe46527d4a612015f9316332db13b9819421edd0714a736334375	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40278a7343a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000db77bc46d5174d574b198fb48e7a6e9559c96062b4b26986d17069eaa0956068000000000e8000000002000020000000bf0cfe14d4205f5797f203d836492dd3fad1cf754131bf946e66a70f02a09013200000004c6780611a7d86caf17e60a674cf576d86087b0282b03af03bf7b51aa0ebcabc40000000f529b41024ce02c96b46661609fa831d3a46994f025aefc9b45fb08d8066ef8240f29fbfebf440d6f7f7f27ebd6e82480a7ad4296bb4bda645d6de961b3e2fea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1176	iexplore.exe
1176	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2700	1176	iexplore.exe	28
PID 1176 wrote to memory of 2700	1176	iexplore.exe	28
PID 1176 wrote to memory of 2700	1176	iexplore.exe	28
PID 1176 wrote to memory of 2700	1176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f823521552e17618d5330020c8ef5da_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e1e51ebdd1df26900f6040cb5525c7

SHA1
2b980487363a525be86b867d73a8293b06adc44c

SHA256
70f72c2e176acb188431664de78912a78023d4033e145a4ea3af31dd9adaf424

SHA512
4ffb0730fe523fd14cc2fb1c865bc2fd0a655fff9eb39f7bb41c8462d36b83b7ce47e55822dbd10b9c158b3d3fbd5431ce344c260eb4173f0ff40ee4b3d1f07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a0902e9761538e83ce371b46bb7a84d

SHA1
e54a42615244b223d39f4d1ec759d52361fb129b

SHA256
86a5d493ce7e0fcad600506b6b106f7d647899ec59ea5ec69d8aec4b6d0e3d6c

SHA512
713afcca9082fd10c7c92c9f72268e72d9c5b6ebe4b8953cb5932ff51ca6990667bcebd52b19ef10d2ded4681f6c91bc292861fa759db96bc2c6390b4b8d7579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
723a2a65c4b09b7da3b3f6e0a8516ecb

SHA1
313bc74f102f714f0c569fbaed5437f27a15dd1e

SHA256
3d4741f8f2aaf97d6356b6c0c3838dcf1181fcab932c7f443848d33218a16dfd

SHA512
eda760be57e9c7e2a8e01e0c713169376303bc6a6230e4dbaa286f028efa902a35894093c265c19f85c18204f2d5c64ffce55538e745115b90d3908bc9bf3f3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eea1c52ee5f9cd8aca843aa83cdf199

SHA1
94153418b7439756d21b935402cbab5307484a21

SHA256
6f4eb96d7e2731d08ea48c331e09025ef6e3247ce520d4adda6a5c9f25f0b666

SHA512
09e656ff33d44fd2c43a43b8d918f7e69aa9391d12e1e5154a0f446e6b4909671ac6d50915de7ee7abbf3a5e5c146467221e04b0d792835198af11fa1dc621c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a3f12d9a6be776ebfda4684e4b5fbc1

SHA1
bfda01f4af0bd169d7af10ac303f990b95041b69

SHA256
ef2d3e11603bed8a36bc6f8847973bc0ab2483965076bdd86492731a94c12b6a

SHA512
f7146eab402411bb628e9973721bdc4b0f4a69560b5af49271332d0c0c662b40839c864f72f3c8cceff99f8c7f162ad852585b97c9fe2c9765b598c5007b7ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627b8e8ec1a9c8541b486df00d143b3c

SHA1
e72cfc48565a97a15dff555d383c99c6f8fc973c

SHA256
b5a561a6ee2e7a120e2bb5c64bdb44faa6861c7763ab80f12d70fc3b035e091a

SHA512
cc780cbda4583c76beeb6ca1714e97648568c261011bc1e65458c2d4fc6505f8348fcb7892ba18a935e3c2576a881eeaccbe7a95cadac96c63ddcda640998af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca5dcc3a5e6446b3c110647620f189a

SHA1
aa7e4c58fd5370754752bacbdfaedaf9259d55a3

SHA256
eccdd35c29bf52487e544c3863a63b02643607f280ab151012735a49c76a22cf

SHA512
5c623870954868ea8a9daedba81c6e6c782edbe85ebe6c758d2f5ee5519d56123665596e9b26cf3d63f717f6ec819784fa95e04a592c88b6b41fa4340f7d48bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c16474a64c2429109d4be09c00f650c8

SHA1
fa50d36d795ba50d7e3fef6875aabad12e627758

SHA256
5633169584ce8509a69477a37cee071e6aa97d1379bb86813a5f904bd95eb955

SHA512
e0313df5f2498a7a540b0764f9967d1f80d841d9233e12935a123e5443f271c3fa1c638fb7085e85ac5b30661b2df01363304b1125b1775a43bc68e8870e4e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757a066ec94834b4b231b6c5c42f6288

SHA1
2278d877fd20e9fdfcaabc270310b8f59082c6c8

SHA256
44193eb114ecaf34a55aa1c77103c6ae0f8f3c69a4059269331f4460f29c0a9e

SHA512
288dac69aede8ececd6f94e2da8778d9c7f57394f58b03b42e7217bf40595c949f0933d45d720101dede4acc5144ae1dfab6bc2c24b37ca1fe80c8e1c95f3bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADFD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAEDF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit