72b9838d038ca6a3d9d62e10d09db55b89cdd641943d2c61656f385638a0a420

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687ac29b7b813876ed03ac0120178e6f_JaffaCakes118.html
Size

71KB
MD5

687ac29b7b813876ed03ac0120178e6f
SHA1

058c29ab47f9d8bde9b4e93a4093671519c1591b
SHA256

72b9838d038ca6a3d9d62e10d09db55b89cdd641943d2c61656f385638a0a420
SHA512

769d7ad9d4a69f1e93ed26f986ecce6d6283f05f20acf6e7591d18a527f6d512426ca824399acbbf364ae20d3609a78ded6f1e3dadc43db2e0849fbf44d48dab
SSDEEP

768:JiQVgcMiR3sI2PDDnX0g6s+6ADmXoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JkGmYTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000025c6a7050f3068cd2ef202385a1cdb15071b1c8f605e8ce5f1bd6bbdf4c4d77b000000000e8000000002000020000000d9631e2ca9ca331271806e9831f5ac616d26de04b3335834bbc814d27fda75dc2000000005b1afed709c7c4dabac8e68ff9fefbf25c318ec4552e1c4a19dd947f69692b240000000ac00595f37e58c69a094f4eb52b511503f31714c8108ce0790d39d688a26ee29ce6e33eb851e16c36945be52ce328c50eef43bba3fcc55bfd8f1d7837d40657e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570720"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DADCC8E1-1877-11EF-A1BA-6AD47596CE83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1006b9af84acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ffcb6e03f11617c55b96a0060854ec93f5d0b111557aa7871a5a3de3920e6d74000000000e8000000002000020000000913b3b61934097d55ec0a3afa8cb41d5345f2de9c33426bbf144c58b158484ba900000007e87515b7e5a8a7315f6cf014c62c90773cab0e84706abe2f4e031d3ce45a5b633ee4e5c0cc67dee7073150b91210728ffc18717dac464a99ec4691b80cf0aef495ea7506ca4bcf321cb523a8ffd99eeabbcc9f1dde0707bacf1a08f88ab2c4ca28da136509e03b2569465298bc643f1d5420d2187fad5668fb452f39fd2af6bbbfe9138283d331b6b34a884d7c27ffb40000000b8bb43a8cd4ea70bd63ec849484b5fa2be7df707e3b2385245a715498c22010be1f8e0227d79699b8559eb14989dbbbb002a7213cc52d8c659485ace8cabe81c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2716	2904	iexplore.exe	28
PID 2904 wrote to memory of 2716	2904	iexplore.exe	28
PID 2904 wrote to memory of 2716	2904	iexplore.exe	28
PID 2904 wrote to memory of 2716	2904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687ac29b7b813876ed03ac0120178e6f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
680cdffeaa008d7953b08f2e919e3ad5

SHA1
292c427d73f5dbe72493961d8d48000fc0163399

SHA256
08c93b7fc596f26c036532e16026078d90e299547cf756b4cc232b95c3277114

SHA512
b9e38e222ce7c3935a09bdb7e0b9d080fe6417a814ac6e02a1a3f76fd9b4dac51ae5de0cf2711a08cbd6fd88fddfd0608bb4aa78873451ad6e6c03d351adeae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9266232195b9a7632859b5aeaabc36f8

SHA1
299d77109cab08dca776bb4e9e6f2b4f8489fe15

SHA256
99a259e8ff2ae04aa2a058cc36929ec0aaf61212137f372ef14fcd7c2eb6c18b

SHA512
c4a2386556d9ea2d920dc5b5f5dbc25946807c982ce76a9f9b5a29782533867c576f41c142d8692d64471c2545d1be011d6d7ff6ceb8f0341d56c9df36c554ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd2aa5738ceb9f0ae532de684d1d0ad0

SHA1
6b5b98452096c2777fe35d89c72c5ea4beb84baa

SHA256
521b9fba7b5ab20caf8a99cc723d2d6648d92d603d224400d94357b36fcd47d9

SHA512
62221bf4f6202f92f54bec54e62a63e5f8858c16c133bf17152eed46edda3700350bb058695b557468c476b37e28c17b9a8e30885c421634ca8f06a77f7c6bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
158c58a82a86cb05a7d60e1aec99ca30

SHA1
f7dfd678dc3569a2d9e3dde0c165007971d1a7e9

SHA256
beb4167c2cd58e0a2b7ecb1761ad7663634c84483bffe427e16f4f73ee3ec6e8

SHA512
38c87686c7a4f2d73da34d05a54aed1a6240fc3acfd7fe267b8165f8975a4abc604eb47ebc4baa5fd6db41c74d25db7811cc134c1a051dab1b332353b2a6826b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af96cb96c72781301320a079a80d87a5

SHA1
541d35f4d276935747766d58f3cf92d943cc2f02

SHA256
44be7383ff0c416219155b12065d3278d2e69623c9ee4c1ce6f1fd19dc7f69d6

SHA512
1157166fb30fa9f6c46d3514e6483a6f9ac7238041c3b58a54622960f655bc34f960f7dfcf59912bdf064bc49e54342cff98d37283b921a047bfd5c43a644ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d535ba6223ac3b8229ff43613dfb2d3

SHA1
bb46c3bb77d48f9ce3d620f89aa5e8899e9900a7

SHA256
96c2c357badaedde8a7fcab4d522955cf7e62bb7ebcef1edf11e3798c64753da

SHA512
531269fbf6d832e6890199b5cbc6956a0afcd3bc603764e2d9ff5aef83b92292420b918d01cb54749451a7a9ca25bc41924695a6c0ff80be666fa80b30235560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52736b3f5ce9f5d5bfff3422c9c904e5

SHA1
79ee3d5e93910c4d790da81aa66a19c6de62aad8

SHA256
19d01be8d5ddb3670505f78740a99f6d9da8fb53d38efa986f908346534997de

SHA512
c2ff80ff6e247a7b3a636957bdbca5cc6c2cf6002e7848f5d25bb57903a9716db1c4ebf0849365a4ae69f146182ef8ae5b7acf9fcaa64517ccc97c59d4506b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a4e89447d342a6c3b785276b68a6d2

SHA1
77d34a17c2fb07f9dcbdca7e28140ac7b6bef359

SHA256
abf414f44315740e17330ce05613d981dc7a08ab4654937abcce8fbd0fd0425f

SHA512
04871f3e691c5b4fc9055fe0b5506916b66e512ea94bf0898d41cf3984e2c9f61ae774f39d71ccdc45cf6cf625c0b5d6ae6dda9915ce0a749805a144c0c2fa44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df5835cc098b4fb36bf2178e179efe20

SHA1
fdcdcd5615c5766eaf5fe471e19f3620192f53e6

SHA256
d1b23c06976b39874a69f0a29bebf7ed95449da1095199e27c7f1b0e90af5111

SHA512
3143d90867596abc98dc9912162c886d9bfb776f3dec6fcc6e0f57888926c7ff30f1263260312c0da35bf6d1223d4b000a431d6315781a60d26037745b7f19e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46B4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B68.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit