822b429eae03a0e3b48757768515947f8a680366d31d86f8aa4287117f47db45

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5008544f6ff66d2014255ab5a744be8a_JaffaCakes118.html
Size

3KB
MD5

5008544f6ff66d2014255ab5a744be8a
SHA1

3d9ffac3f5ba6ce20e500669e964703058ed218b
SHA256

822b429eae03a0e3b48757768515947f8a680366d31d86f8aa4287117f47db45
SHA512

cbc8e23ba038f4ca38295765ef7b9696c62495c58d4bf1fbc001f51e3d30b041a4ba7a2386a6f4c201b49c361e63406951a0c965ed91c9178469e0b0d917d068

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F2DFEA1-145B-11EF-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000064240c8ae53b790c07bc495ce7873be613faa08f836b133c110dbce496fe2f1f000000000e8000000002000020000000c217806be1cf8c931c05ce09272c42b22b4a7dd3e236047094cea84e53d581a690000000e14af37eb2b723511f9d2d61c7f0e15ee246ee99830f702f7784b64c7b2b4c959c125c9a7da80330daa9db1169c2992250890beaa175369f39d3ef1b19ed60874402b1bff5f94307044a81265121667e2b0f38a82e8ddb8d7a40eb0ab696bed625fc9d495a7a1f855b70c996f020af1423fa127bb2c2235829c4b9bbf097f3b381caf1db79bf6273aa79d8abd7740ffc4000000086655cc4e0d6adfc5e8875e080e8fd4aa0f565427cfe8cd046cd973e8647c564f39af3be8fbc04800145aa0514fc887ebd1c13d9d57db402a64f4af380bc2e10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422118683"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d0de6d0c566dc50a75c87738b0839b5222c972adcdad34a1d8e5442be770ab93000000000e8000000002000020000000b6530c6b9052143351a42b2da2dfd5003ba56b569f01f6c56da1d427e4af050120000000e5622d10d8e6e7ab16f3a7183508eaaee063e79a2724ab9ee8c9fa36f41fea82400000003d599070b4d10bb2f85cb9efb398984dc94b915b86ac06175d0ecef31e4db0c45c17adbf26673a5c433c6143671dad2651788ae51ed632fcaa02723b71e20f51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9030dd3368a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2536	2208	iexplore.exe	28
PID 2208 wrote to memory of 2536	2208	iexplore.exe	28
PID 2208 wrote to memory of 2536	2208	iexplore.exe	28
PID 2208 wrote to memory of 2536	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5008544f6ff66d2014255ab5a744be8a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6186083de2096eeead07addd79423c8

SHA1
3a02464d38b28a56605829c8010557355d8ae299

SHA256
44306243aa7f66e013137155e56df255bdf6d587a6fb85ebb76e9109c04c1160

SHA512
2372296a1cea2da977ee95a5cbca4c05a2768b11f845a805cf2a04c5b2aaf19d5aa2171e164f22d99cc933dc42f8ff705378ddaea6659aaafd5fba7a6489a611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb4b411a193a7eec6df986dd6340860e

SHA1
579c44933178953fc0c7a6a73ab4da03647e9161

SHA256
87a00ad088f1004e409176af8ce62e2f7629d04d730a8c6f10dc5db933797113

SHA512
6376e83a9be3e6532408a2a32a82dfef4c6e1aab5e0402c2e4cc9ed3b0100e507f1987542eb5894f61fe92fec294e5b8528aea5ee479ab35f5bf0e193ed3d843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2b0de2acb47d9f36921a819ca308c9f

SHA1
8eb5b32bdf6097df1ec28747a93d2bd4fd2d6d7a

SHA256
5dedbc272e483148dfa9ce05bcdaff8edf1f45a845ce04541a1f1f557b1d61a2

SHA512
01bbc7f9f129d1f3b656a8c0e6e563edfe6c2afc15e1ed7a44f0f833a0cc6bbf6a69f079eac8b2f62b50ea9a71fe734e60507072f57ed8f2d4ecc3b1116f1edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c37e7ef6ad1cb20d947c173186fa68e9

SHA1
69aa2a1ead75fe9b7f0c6e0b34034ea489667a40

SHA256
1ee53c9ae719bd72a79f749f473122798ca827a83221d3340bcaa3de92728ac5

SHA512
3cc241ca7024f96ea5b6d4c76b310d3900647dd968b332c2931a18864e8c5023cfcd163e5349511974f03696f8e86f69bc96829e31911f154e429a519c5d0f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f27a5b42171db23e183cbe0007e7ac6

SHA1
f81b8bcf89c2748915781f11b30f0f9003ae5b6e

SHA256
019db5cb9bce8abb562ba6db06c2b43ebf8f1bc7951466f2ede9934a3cf3e3ff

SHA512
bf8bbfffd6dcdc6a41951a27531b487b0dc85ebe9f46afb8f58014b554566ef7994e9f55f1e97eb343653e56e2bc83d3c43915211ac581348dfbad457cc1914c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c2eb4f99337678c7f08e6cfb6831a3a

SHA1
aadbb96239ae4a48ddd29970ab960e0fe7f4940d

SHA256
d2976130a16c99c8552b5d33da4b18ad4ef36e3dd9b262dbcb646fb36d0656d9

SHA512
c28483f48c81ab1a12a8a24a91b9b1012cf443f91a70d6ca2edcda57c8a87dec5e8bace78bbe674debc874ef46a7313f1eaa7eea2afec617aedb1fe83a84b2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b006ff9203ea007b33441d03b3f3b32

SHA1
fe061cf87b939d5c8b7480186be18445e6d90e1c

SHA256
b330934041be2f389dc7402baf470db08377cc26a6d9a87281519430b86733a2

SHA512
172f0bc410004087e3184ef3f33aceb7ecd2b2a857f80c73345f4101ca23d73d414a62290f9150bc4fd760aa6c92439fc64c1556d11291570b03cecb71d817eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8657ac73fe6459d8846f3eecf1c611

SHA1
75c5bd0a9e2d6415c5d623bef1006f4b44355d86

SHA256
3f76fefe39c68f47e6890d0ec75fbe26e1ba8c3594391f862fcf39512b7dab6c

SHA512
8e9dbd9da78863bda881e144df5073f4e47bde34e21d0c439bcd6e638716537efc6042f84994b5b8d655c30e9f59b5982c439bfc7029ad94b819987e2e49b769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5890a5af58d63404be8ee74aa9faa021

SHA1
f6ad586a6ce9a80f54b777dff8d6fa6abca2089a

SHA256
d945fc524e0b4b8dc6df79a5c2dcfd26c47c9a3c99e89c65396bf967fb71cc73

SHA512
f853acac01172150007bc5a2821554b89363833311d3e186061b46f86b1cc853e5027798314bd7daa300507c85ae83a9dafa9a6ecd7ffd1bc6317bf7cf94c37b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a71216a95212b4e1a1e13822801fd1e0

SHA1
b948c8da2f3211aac34d04fed6d56d87c4182b09

SHA256
4a32eb8f050a0e7a33c23be62b1ab283502addf5dd3116667480a3629c244d8f

SHA512
b9272ad0463661f012bcc1622e87eab1ff98e4a1eb5b979787de4aaa60993ac45053edc2aae447d4c5a840304c001cdd433744a8c4cae6797d908f9ea00d9c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FD3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2122.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit