110c5b07b425c8fa51a0d7448eebc245424013f9c5964d82ea4512e318aa0651

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc5f6dabc0296f97efb17dffeca609c_JaffaCakes118.html
Size

62KB
MD5

4fc5f6dabc0296f97efb17dffeca609c
SHA1

3549cae3be93c559b4276459082698b9e954bfdd
SHA256

110c5b07b425c8fa51a0d7448eebc245424013f9c5964d82ea4512e318aa0651
SHA512

1028f747db9d2ee667e394e5b2507d79edb07089779592f39f5d11b488a52203a3db8587fdb3d1da0bbdcb122e2a7fb5a4eec1b51007ce9cc650d4d724f94a70
SSDEEP

384:SfwllFFN99N9i/T348dE+S8O61MlWUCetAAjWJw/RGtHMcetjPeB7/pQxHFPtYw3:Svr4b8O62sG801u7QxH4fVKhi5CVjl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102eaf2e55a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59875181-1448-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422110512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000075fb26eb49cd89b9b47da194c51407bb4941891ea7851523cf058354c2dfbedc000000000e8000000002000020000000737a486f74e1123a1d26f6c7f5f4ab8e7bd9a92eac96f3e56372ab2eba049c5b90000000467df820fefa859006b5c9c27b7047532fbeadbdca701f9d6e656b5f0d7e296fd64605a3c50dd1b0dc61f838cf4f7adfb6f7d4d98585cf257d3e0cad9ed3f29f7dfbf69eae22dcfeb1f01b128757e89491135c106b28e13d43bc4ec738159326578295808cf9f7366d7ecd3f9b76ad289b9c2853fe12de4cae346c8c8ccd6a859f712500b2e2705393940acb03d7fb5f40000000b8ba3e5ddffc8f7e185f37526948b8e289bbccda2d1a60bdc98fc3e1566cd091e47aa6d759de4895a4b36bcf01cefe42ec91c1cb56cd7d8136cc8e80e007f107	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c2ff11b7e1675a258e4890a82f41ba50f907b1e2b15b568277bcb7775518ffda000000000e80000000020000200000006a2e012874f88de94480b5939f07cfbebb4ce8be7259c481fce0db2d001fe91220000000a024e5e1e82b346bb4c31b40bdf1853499b2038f8800a51915ebc94fa8980df2400000000515177604dbb2c300f720739e5643e91f5845a0684f77b030ae7524ebad2dabb095c2529567d57e55bd48dcbddbee45cb9f85c1208b2cda1f0e1478ca174275	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28
PID 1636 wrote to memory of 2028	1636	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4fc5f6dabc0296f97efb17dffeca609c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d49598d5b77078d9602cb7148510ac23

SHA1
8927a2f577e38b470006e59c5c2450ea749b69af

SHA256
e073fcca607b561fd8b9ea132d5f9bba54e6b5b0319348da66ad585555f1614a

SHA512
5ddd78ed5fd3cbda232949e415bd2db53edf0bab6145157c136d36876c3b7e9efab98a2fd19670aafd182de818860e6f5017e7a526287374e8da073a9d0ec8e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
974e66f2975e6dd34c79187a5d13011b

SHA1
92dc461c16b1b50d04f3b620a7f89817b7ee6ec3

SHA256
261d8d6dd84f146ed4ec5892c1157363f609efff0e6fe0487e4c3938e7a432a5

SHA512
0c01dfbc1272616fb4683e1a7fda24a6b62f7fa7f539b2807b98ae7b683f26e9e4d54d9a2cd5517940f6a83a44207bfc1bec794cb140e1557812137789d00417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8615023a9fee15631da09c0ad0f3784d

SHA1
2efc74e67c149d35775779f11bea404d812cf3bb

SHA256
a650cf247fd81dd6a824a9feeae43ad3e2d48ef47982e6629f8439875397b609

SHA512
5ed18c6fe808da9f126580e49a71d1ed654b7dffbe0ce513eaea1c80e8dfd18822d81ad8f5ca03a04d6dcb0ce8a27f1485cca2a47d8398507cf0e7ba23a78d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
091d7be36eefa07696addbc97b885a9d

SHA1
d01c78f13c78bc0c448427068f265952da029146

SHA256
6d2e213142e6b459804f23907103cfecf0826f42c43c148b0be5c8e0aeb7b01b

SHA512
83998844d3257921ff6c159db34e693778410ebe4c1379c8c92dbfd70a97b26d3f72fc02be6ab115785f5017dc6424d3fc16a86cbac583f4a4dcc7fd458b8bba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5ca54fde046833ab9e06695a831b77

SHA1
f8ebf819ad8e5582f3c6c1af59a86f5b0802b397

SHA256
1c662588f40992e330f7bbe70b2afa22f733c491e30e4edd10de7da7949a7c2d

SHA512
6dccc7c63371c5f4686209cc9721129f4718d581abac63568058e07209b8bfcc303521be1d446337268c84ce10e5f76efe7097fd9e075fac507758c7c427cb88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
380d9c53e4336c8bc93ebafcab61f49e

SHA1
99716949a3060d7ce917d0858bbaa2a4ccc52210

SHA256
560c871086f73cb2d0197cc1a5ce78832b66581c8603365e8f3e824e549e4937

SHA512
ca24cf6b8c9d2150d0dd34d870759cf397dfb273bb6901fd62a2c368f44790ee9e46b556b74bb354ab8c06e55dca63a91bfcaef6421e607628c6cf6887faaf6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c3b0ffd146051588afb1403de52ea3

SHA1
e05764dee944254af006bf186d4c912ef64ae5b1

SHA256
202665b3290b25d8c8c972509886e3cad2bd91ad61f06ef18a4c25264368f7c3

SHA512
61fb11ed191651cc418c1274cb799d5fe2e839d41524229f2c5563e92393b08ff994c29c6db0000bc36052a438d3430381fc7fd63800d7d3bca10722b5bb4928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a48a55b3fc1565e66429cbe127f9e5e

SHA1
26989b1177d4c2c024b1d2835c8df08311493fec

SHA256
8dc997276d9bca47799710fbb6bb421ad3744f997b8d556090df5d346e8442cf

SHA512
ab2d08803a55661da959eaf8c6708226fab88f4262ccb64992b6dfaf48f7942bce124ac5e29c06e244cdad5a5ee4d63b319c19ba16fe960e841c7dc3e70813b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3fa3bdfa0f30d1c9ff54b93a908e95

SHA1
20bf9fc92eef7acbb86321318e16d948a670d521

SHA256
d03725bade1d2fe4554807a303d9f5840ba17d40d59ff52cc73a16b326a2acb2

SHA512
f98c751cec579c61920aa8d1ecfeadf1eb14d0222bd9cac1a60a10aa42de077c6b332871063fbb0e5992798f68cdb48ba6c9321887998275098a76a69eb6a7ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4119.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4179.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit