db303f2d3d382724f0b716f685d3636467e25884af61a3a341b195b58893f96b

Analysis

max time kernel
138s
max time network
138s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687b72b2262691a18241a4a7eafa484a_JaffaCakes118.html
Size

8KB
MD5

687b72b2262691a18241a4a7eafa484a
SHA1

ee36a9ae21065f1a2c9e9e0f93b08239c2fcbf03
SHA256

db303f2d3d382724f0b716f685d3636467e25884af61a3a341b195b58893f96b
SHA512

a5e04cb56bdc8f6850a70b3fdf8d9d5fc0ded25049b96e08345a846b0268fee914fe5a2d460cf35a91796b2ed6747014fd0b08be9cfd9c11de3ec6a1815e1207
SSDEEP

192:4dR/GA3wBVNOl0VLPIDaxjnHZeIL3LGQEuw:4dR/73aVNOCj5e0LGQEuw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000269a495fe341518008cb62b7e80a029bf7864601b4e8c5481c2fbf16810edf7a000000000e8000000002000020000000d9a5f572e092e7feab25b49358ca78be79cf063934543d9a45144d47f83345b120000000b27400a089a13d66fc6b2b0c1634a157d56ff0cd89f639cb7937a9ab1c84d650400000009742262e0ba1e8318450f4017ea46120da661ad3fb1d7aee03e1cdbc14b1ee5a6c54476c1b8d6bf0c4fe9458cc4094be920d8e63f961d8e6401912984a9243ba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05c3cd384acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000072c7e10396f518f5786f94b4396c6e6d850a923d6915132b204475fc67008436000000000e8000000002000020000000b182005d22568b4a01212ec2ac35b740bd330daee50ba863a958016634eb3ade9000000032f53f2df1bedc83da6e5f43373bfa41ddeabeae70ce84c962a80008681cafc89fc5b856b04c70a1b0eeae6e88e3d6c0f8eb0882f648ef54e3e80186843d567982845a3c1f2deae7c18259517f1b7ea4e772c66fdc26ba1050227a062531f0f6472a6b4dcf954c27c54755b06d7470e873e071caf08e156d19039637a89ff07591df20f472f3afb8a0a4e0b2ddd4a2ae400000005f56a89d0cc612f00c579fbc72aaf530e65f7e0018dad1ab4b13f57fd5d7df693a789161a54382e61aeccf6b5dcebe28f84d1a63e035f4ee22697183effe2efa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570784"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE9DFBA1-1877-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1340	iexplore.exe
1340	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28
PID 1340 wrote to memory of 2260	1340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687b72b2262691a18241a4a7eafa484a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99d3b504b207b58797258246aca247d9

SHA1
fc597a46f45e7c79e58b728ab042ba50ade7c2aa

SHA256
6f90c876ef382baf675895a5dd384eeb1c79f54291723d3e4763f3c560eb5b63

SHA512
0724dd63d78ba37aad39d949b6dfff5fc569e93f18bc11399682954b72cc1c49e3888ec8d12b66bbdc936e12b661bf1a1acb29c78d54e954fa1bc706e4265963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b8f4beaa0559f1f9f89e8b5888a4908

SHA1
afe214c25a390579890fea06b7b5ccdc3e1f0db3

SHA256
784d6b7a71f1eafbdac813695eed25d92cf7de8e2d4a07ff18f3124b13962be7

SHA512
bd4987e4b0c5f2e1435c107c5167696fa7d47343a07b2db3cad09f32430a6415fa1d46f2203f4c15d08f67c07a9e1c6d80ff16b492ecbd4904fcf8d93fef3392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b5535621f2d37649a986bf1c1dd04c

SHA1
d5c9aa789cea1faa7d69da89b5d5063db5e9ec49

SHA256
ac4a5ccf7eeb49cc7c24b135343fc4a2c037e81c33820a364a5fce72e981c988

SHA512
fb52ce9ba9b1d52fec68f51f58a5bba01d3458189b84de5c75d548c7273d29ca6dc069ddd1b21258f561bb1043a09ab83098b5f542f87375121ea37ea836d690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c09da1198cccae1926586ff55e7aa5c

SHA1
f1f8d3fc20ce531787b18088e4aacc69c8731922

SHA256
7965cde1767617ccb91ba3f69e03df94f5273b1908e682b12aa9ffb8ae0456c8

SHA512
9bc956ad160bc25fdb1b2fb14123eb2a89063d0b6c681c92199d9231f49d496834b255249527229558e86d1fb9ff07217af4e2a8c710603ad0cd41707c138fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae4f12b43d488348ca6b0a9371993580

SHA1
3d5f66897c32734e052a8a9ecb8dff50e86df59b

SHA256
26570420f71f092422c04a5e4f75ab54ca67be20b4d2f731a4ab6a51773eec10

SHA512
05c570906051776a86b489c8c7be3aa4c8110acec88cae463ab70cd9ca8f7f40ca360b8565009e0546a704335dc7f1064d7c09b61beacebcce6244763dc744f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36d04d750216911c4a0edc8d06987e0

SHA1
bd9d3133f108f1e08ed6aa04e662069535f796ef

SHA256
a19c952213893bd713ad0f0f9940ee2cbc75f559fd109f14310507e0e6cff001

SHA512
09f2694fe963fb4a7140cf6d96b2208e8f056093a601b401cff18180fb5b37a0fd4697df51d152cd519511ef2ad5fc80c69e582c0a48a8a09c85c2dfa159c263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619b3150f27684356aef4c7a203d8e35

SHA1
aad327b85d4e4f925710690f2dbeb7d9b60a3a03

SHA256
0481d12c5a5df04a7a5d1d0584e48cba822fc50341a05bddb8b146683fa0fa83

SHA512
3571c802b5b3e66a567975cd8ae25d4fd33694d211225ac742032b68aaa70a30734cab49b71f598f8de87e4682cfb82732fdcc0c529e4108e6a8a1bd39c70901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
312b7858d60a5e7184e994fd8007cae6

SHA1
b35bac728c0935b1dd81a83da587e094b4ea69ac

SHA256
cffce81c838720696ce11681b2a90d3f9c8c2b32def19629e7a597bc9f8ad9d0

SHA512
7bd92b3a7b0ddc23fa8b74b68305a476e8b61fae7d5a0d8e8b68bbd20f5e52372747c06492f195569da9c8c3da57147cc524f103b0c021dbd16f62f126f6d7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a185fc385f87c1e15437fb02f91eb4

SHA1
ed9446cfb806399f2a49803d6deb9b7b7b9fbdac

SHA256
517f9c6456c81df4f8fdbdc86c3f154cbdd4cb931b2ac951aff75c6f98969a79

SHA512
2e8087f69145e796d94fe2b76804a06c81c00c9a764b536d68aa29eea2e610968ba4a26b5e55306badf1b262d6392ecadf1e46a91f645f154c15e43cb13702a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48dd8bcc1441dca276e433ab6d17fc7e

SHA1
f7b8603294d0e1bb7857ffc5f29bb54751ac67e8

SHA256
476bec7cc5f8a1b4d1bec2625d079ff364f6e7d42c003f92f345b59c2af94289

SHA512
e20f4ae20daf3f2d26e6af3fcfaf97aa4d0512e2580927e8c65f06d25448b3a7b7a1536734d49e9a560bef17a98441210ae8c004874efe89680bca0496e1394f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
441e21d6c38f2e2adb4ed914d5bc58d2

SHA1
1bdf852481d0cb74eb699b75db83e046e7818ebe

SHA256
32556def11e6ee467fe760e903f88634f72486c2073b61f8063cb7f79a562dee

SHA512
9c9864d5b70aaf3cc0cb290268470326ed8cef84ea34a51aed0183e09b82b43ae12201b15dbd13a9bba27ee8821ba31fe529ce1b2d86eb77eb0c7f1dc1f30665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0042c35aa54d8fcf4d3a81de752e67c0

SHA1
b5c681e86844bdec8f0a6431e6119d324c4ceab2

SHA256
599e8b16d036b82f2151378f3e435206a494131839472a9cb3e26b5daf75086f

SHA512
7022ac38f992967ba4e52bf565b81b78e0803e91c30ed60c68cea9637af54888def3a94542260bef56040f2b7d6b310203d58045e2b62f9754b95076101e56f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0169820c341932b0e01c72112e72836f

SHA1
019be76b9b21d915231c689fb7a090a58ae6b3e5

SHA256
d10d633c0a9fb5d8ca61bd94073548f9d81ef157b4ee469dea8b0f60b2761931

SHA512
b3e79688e379e31c0b4948817d3fbbc3b34b0bcf55f3a65005f969f46acdd7a3f03efc8dfe4e9b226d2f09d71d44007401beff09ebd44a70c2a2835aec196a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2417.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2533.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit