654445071decbfa842a96fcaaab032ad1df9c7ab84f6413154388c003e0da4ed

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6880233e612125ebeaedbf4a25e182f2_JaffaCakes118.html
Size

68KB
MD5

6880233e612125ebeaedbf4a25e182f2
SHA1

6d004cbd045bf8433ab5bce971fc61113b315e6a
SHA256

654445071decbfa842a96fcaaab032ad1df9c7ab84f6413154388c003e0da4ed
SHA512

862628f5264821fff9d96b62e581c77780db4de81a265df19240a8c9359530d77b83e54db2ba8d2946c8c079a3292335ba03ffc11c23362e755c0ae3bc20b3c8
SSDEEP

768:JitgcMWR3sI2PDDnd0g6Wh6AqHAoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVu:JF9idTSNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c932af85acda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000006cf230286740d02ed7920618b2b87fb9625db1eb7908fb636ba286b8d8260961000000000e8000000002000020000000aef716d7d7dfa19f88574736a360808a839dbabf6a9e65c1ec12d98ded93aefe900000007ae4415090d06bb667961ea4942917f4e408bd126a371899f9c049108e19392f2d6201a48a49accf5e0b55845b9726564d7aeb33a4effcb9e2b7c4de21c4e5dad48798b43bfeda5c5eae75ce6a98fb8adaae7c262f5f486a37580843c83946290adc2b384a5bd3304f79a6647fda01745a2b6b396fe728667ae1ea8eaa3e08cba19821558a4612c3c33b72daafb1f5364000000078ffe8a5d517daef9a163c431d7990724c02b39a700826663b7ea7b2d65793b038b605c1fc87ba57b4a324a72810a46cbaeea2e0134ff3c53c02737b973e7f58	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f0891fd6f7aca62333469ffa50341105e03f3dc52ace86757b639b0a2b645b16000000000e8000000002000020000000cad51e6fe05f24aa62785574c8041418c48900c98055711388a69c1d9479fa442000000007d8cd80dd9a8465c98cb8db52b8416bc62e6459cc12ecb4796f3fa90f195d1d4000000002f078a784b388a63edecc20810bb0c302441ce8f21fd33388c586c6cdd4c242f064dd42834407cc2ac43f29a31c062e194c95644666d7b2a99cc42c21303c2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571156"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA8750D1-1878-11EF-A759-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2028	1700	iexplore.exe	28
PID 1700 wrote to memory of 2028	1700	iexplore.exe	28
PID 1700 wrote to memory of 2028	1700	iexplore.exe	28
PID 1700 wrote to memory of 2028	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6880233e612125ebeaedbf4a25e182f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c31d3cacb6dc9614a455f3630d8038b6

SHA1
e02df1592ee03fa78cf028fa88f63707de4dc85e

SHA256
104947673b38767b5ae6ff9b7967f355a2708165938a37749b2a64a1f787b026

SHA512
9a070bf72b4704d4381902d90dba2247f1045182eed35c6be086c4db04f82dc3bf16596420267ee8e3ae55e8252be833892dc746cd3f0090e27ed8137f26debd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404e080bfd4b310986218270788b8931

SHA1
7e7b5cbdc08719734b38686e62d563f4b92a0619

SHA256
c4ea2541dc8ea441d572af3a04056177208051a871c5c131c0680eb3ab713908

SHA512
993e05dca6ba757f233a2191d7f119effc25a213d73d130620264ad146637f8b3808bbe1b1487a0d406abf76b290d67ae22d2382805504359bf52e888173d662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a0b1d93b9d9f6411fb5261daa46bc1

SHA1
e06fd38ddea7654a624b24a183287478beddf8ca

SHA256
b2a6842252636507262219729c2d7bb83f64831e2bdec73d921d3e15478bc7ce

SHA512
3ee82e1b1d332ca4bbc37d9ff5c19fc5f8cd92bb5944c337d562b3a88af421d0bab5555380a50032320753dab33c59d675c420bbddfce069dc96f53a88a067ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a561411f3610ddd7d514acbeb53664a

SHA1
52c6c652cb555ae8d52e7ece3ebdc3f2560ce16a

SHA256
c6adcce0af7990d6edf8e415344e4985aa7b6081aa6dccdfd55e5929cb00e06a

SHA512
f5aca14b71f087f89698c504ab7586faa10cfb2cddc715f22554b6aa73491d2b9ec8989d5f5af15ea717aeca8ace9d62786748036491e5901005359f664c571c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d93c349c95478eeba0c34f746181a18d

SHA1
1a3a36756a35f0cfd9036f9eed7de6e2120c0753

SHA256
4dc87d04c19b859bcb1764183e4592df2949f5b45c0d5aa8411e826a2b38d037

SHA512
583cf1d9551edccd8dc468ef34bbbcb079d637fa1cbdceda739df11c53328c6a3b97ef438f369bc074facf4c6bb77aca4778d3f08bd32e9c5aa819b0f32e6453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7b1d26ebe37d7cccbe1d797b64d8bfb

SHA1
1912474b8c02b422b2eeb1ac131f1c109d09b957

SHA256
6e7df2e45eb78e840ba95ea177846fd581dfe8ab400337e2b88a106015880f8f

SHA512
60ffaa576aeeb2ff66b9873f603a52b960022e7316c04e69986599bff7c2c8f2e3e93dc99a951666390709523b5e9a8010ffd28b04fbb8d1b367358e69d69f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a57ac625dd116ef99fd4c61982b7d99

SHA1
9f4da75137c4e1d7cd6cbef53a87dac5efc7d7bb

SHA256
a46019bc2a44d3c41b59ea82892d5856836977c0fc6d4e02063bb08086bb6a61

SHA512
ea25b42a3ed6db3ecb96501463615a1511ebbeda3c5b6e4ef0208bed594c3b7b8232e67cc47e33e2796b2c35f0e5dfa009aa0fcbfafc9f5ca553bbb0db76badc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E7A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F09.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit