ae243281649ed1ca5e727c91e186eb91a616bd56c6cb03ed1f26acd1d8715558

Analysis

max time kernel
144s
max time network
154s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68797587b8329a55bb955516c84aaad5_JaffaCakes118.html
Size

27KB
MD5

68797587b8329a55bb955516c84aaad5
SHA1

0938469de5bf16dd8716c198e3f610670387d086
SHA256

ae243281649ed1ca5e727c91e186eb91a616bd56c6cb03ed1f26acd1d8715558
SHA512

04d13ccfb25e8c1a1aafee20d0d99800f57218a2d9f99a04e999c48383c31c0a73ca264d76ef8a5b0eb8aead9d9a6fbdddd4c0d0be0fcdd4933d858b83531f62
SSDEEP

384:zilKnZHb7IRhUr9DuyVBD8cG3RMMjpomEfP4ycbp5hzVcrFDJZTOfuZH:zisb0fUr9DlgcG3l1omGP4ymUJZTOfIH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FB97E81-1877-11EF-A0CE-F6A29408B575} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000003e0916b2c66fc1c810605ec06556b8eb77f19d3b32841a79fa6ca2f0f0e2dea000000000e80000000020000200000005b2eeb9849b2e647794e47d2de23b65578ceb39b3f044016d3344b8e9c8f56ef20000000a1877e179011b00811683547b4a4b1cd8f595b39f49093e114a6e3db1bf8da22400000002358996518eebc2461a51f4ec691c1a33ad035e2137fcca6f3a3be8db873a427443ef993a4bb000aab620ea27001f775f18a4a7503c88e99cbb9dd220f3ec6ae	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9086f36584acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a8683b263f30b5e566f71f69d1e00ec2af8ee15ef07ff843aa7aab7bf72bf01d000000000e8000000002000020000000bb38890f8125a0dd106fc9770feb2f429db1635a5d528355ddf8c42eeac0adb99000000044fd926df26ea3cc3ba3e34a7aec55fa55379348bafd0d7a3a48b60a0822355f197c71f927fb790c3c023d292b9985b39c5c7dd5a6d38e3496a4652074a89e461b721e4ed7960834211fd45ba666a97e8e38d20901661c8391f76d3e87c4de1a29e2b2ef46d13cab0599b5754350a37d0a46e7d30e0d3552af4353e29b24d9e5736c40adcbb3d6606bc077fb77a5968f40000000c8e1865a6d42f63fbd3af1acd0ad552613e48c1ff2fd21297b8644b014782f8f4c38815987da6668086ca0fc5baca5b05eacb0f4e922ff6bb81ad35acb71285d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2952 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2952 iexplore.exe
2952 iexplore.exe
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE
2892 IEXPLORE.EXE

pid	process
2952	iexplore.exe

pid	process
2952	iexplore.exe
2952	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2952 wrote to memory of 2892	2952	iexplore.exe	IEXPLORE.EXE
PID 2952 wrote to memory of 2892	2952	iexplore.exe	IEXPLORE.EXE
PID 2952 wrote to memory of 2892	2952	iexplore.exe	IEXPLORE.EXE
PID 2952 wrote to memory of 2892	2952	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68797587b8329a55bb955516c84aaad5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7b019f655308a9e0b4a3298fa9ea349

SHA1
f373313241ffcb3caad9eeb114d48e409c49bbc4

SHA256
3ceaec2f1b8e2653bd0ec04adc956d46eb1ffd76b4fd5f44e4d7e795e61f27c3

SHA512
fa76ede9b408fc4ee18e9a15095f57aa12df9254587c524274e3007e86646f59c799084cdd45bfbfa02795804061f33b89398d38ad025fa01cdf1cf6182282bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243842fc0256643fbab9bb55c639e376

SHA1
d74c24d8bff1eb80714cca0409894bc8871ad00e

SHA256
071e52910a3f606ac4ec0963886d823ff77a53266a1827378c43d21426e68c42

SHA512
eb978c564cf81430433fd9c04ae04f7baaf4dfadc11c41186d5468e0e22a38ea700cea86be8b719e932a2b6a9c814a50104f7604acd10548af6d3bf938665795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b6dddfd5779246238928490edf9cbe

SHA1
9d42f27677f750fb704f89517bc278b199ed9b9a

SHA256
b8627d6b59963bcf6a770ebaf3d1610a787ee0f10643cca6a48b0f2cf42e152f

SHA512
d306b5c453d2a929e738db40a6c3fa01d42430debebe546bfcac5a2372dae40cb0a70605c3e81d8aaa3baff66f7220e5baa179fa9cbd6470ce43f47e204942f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28bb658f1e62b3ef0ecc75e6b8f648a

SHA1
c831e195e9dc0d59da95364dd80ecdd5368f46b0

SHA256
1cc8e08882e53b7c66cbe6da4ff2e21f95f231b6ea8f958a349172c66757d499

SHA512
a0206c7bcc447771046d5babbc70d54cc732a24c772388e1df507c6fe81c328a8b70fb44ce1a20e908db34cc0b32798f416386e73fea87ce6db7066cf3ddf77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
313d77a6c2d348df07e05c56b305df1b

SHA1
3753a9b602f2259090601c36072a3da189bb4349

SHA256
faee9208b221e5a709420557372369ccdf688642a698e21cf4600cfce6a9ee2d

SHA512
9b3cec0b2b2f7663c808dfc122b5d52e157ed037d094ec22dc00a091f71683ef179ea5a727f5952ad0345d9859049cd474802754344175ee09a245f98cf58369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
501d31db8253807608ec093683ec29fe

SHA1
a9a576fc56c4d9e3870462a87c3601121bf5bcfb

SHA256
9286bfc6eb7bd2824d9dcc398a3b648117332dd05800238e4c5fb06966f011af

SHA512
0f60344622eb95a3871ea4fc29aa077721e9ec9d4aa96bbb1a792f3c790dcd64a1d0e0edf9eb0327f288e63609e49e807b83ef3bd020bf9e155b4c2f5a85440c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
992cc28a6d9db2f672889eaee843bc42

SHA1
8b6b54970c6759e82e025d55ff69d2412f3decce

SHA256
e0f1fbe3632dac3562b17c7c2da779e79f01fd9dd9e4d2d8456133e39b622e65

SHA512
a6a3ead356cd4000abd2a42ea4eaeacdcc525ee1120435f6506acbb199e9ba2f0b249538c4a6e8ed0a6367e9e99e1d307bd040b4d3750c19bab35c3e45b5dfb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
303eb86edae9ec0bae20afc5414e0aea

SHA1
0695757f03627504a618e8bdc0a6716493a50156

SHA256
2444961bfae92f87e7ec6e5a1e3ed1fab03be94d72c43cd16a9e69794385fde2

SHA512
0305e2a03845ce995dc1ea51862603f5b880148a0e39ee7fefb4759b0e3f055892f2e64275df4484d1a85513af5ee693272857fbf91f2e79d2b671603fcb9231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd63e93c7596037bb6f6bfae5b34b74f

SHA1
b64243fefea28a29fb4d00b430bf5eb7116ad98b

SHA256
9ef05de4fc6a149f0403d4e0f5365fd4005c77657868d10dacb963439082f6db

SHA512
ba431c846d193f2685e508cdec4e289ef523da853c95f698befc1c542134d9a815d4cb17c30f0682e8c22e658425fe8694a913bb0468e23e80f80fde122d3b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab428F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar436C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit