e287d51ed659e8b18a3b913f1c3bde9401cf78e56f3495d7b8c310ba81a47a41

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6aafffc449a0b2ccf66412031dd3cc21_JaffaCakes118.html
Size

41KB
MD5

6aafffc449a0b2ccf66412031dd3cc21
SHA1

3bae2c66d49f70e5ff91c9d9ced90cf16c497892
SHA256

e287d51ed659e8b18a3b913f1c3bde9401cf78e56f3495d7b8c310ba81a47a41
SHA512

9c16a53dc0be0b9cc7e8357ec04c437268fe3eb7ea3c22392449a5670f48782ec4a8e50e30b7aabc0d627165c052016af693e726272aa47f5abf1b8d92ba8903
SSDEEP

768:290qJGRcC3jILa5CuUnnRp0CthhN7EoJ4uz4JqWEFz+tsAY5IC1Xyd5jOcHS5300:2ZGRcC3jIu5vUnnk0UwMcObR1E3jEjFW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000254eca823b4e2439e3e4174648a80ef00000000020000000000106600000001000020000000272f362831b2ac561fc1d7776bc1a1d11d93d9c02a901d9311d4573cf24e6d15000000000e8000000002000020000000a43789f2b4cf027a55b2b8a351b4d533dfd19f17c5bde930c8cc2e5bd3d3adcb9000000085772bfcd4f362e08b1b5af8893f9047a5d27c047b100713f83b62beb0a66aa6cd3391f2d5094c3e8a06c46cde1a4bf452edcc8c0fd9395d1c3744952ef5f82071c62decf2efe32334aadb56e51dee2c99a37fcb58c4e632af8289fe34dd48db64e819c31a70b8cba554cc4489a0f4fffe29948f26ebc4668abf6182052c1c950d02ff5e3aef2a883f49bd6a7eff81e840000000fc8a962296f7876a908696552abcf1ab23806c7b8e76654b75df31fcd225142124faf7ca2348099f80c15bb7d2b26ebac2c2179f34463da44fdc569d61a245d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50df99d6feacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422623134"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000254eca823b4e2439e3e4174648a80ef00000000020000000000106600000001000020000000423501326c3cad36317c36d28dda800428ce7660e4029e8e71a2b0fd696d562a000000000e8000000002000020000000d8f62d94fbb824d525fd360d5fa503d57ef3e9b6c37399c27595137bb51128312000000001326bb0ebf904ce8491dc02a140ea7d5c5de27fdbcfe20e1fb2c93c87e2aba040000000f80ddacebe23812e4cdefce840a6fa306e07f10bb31abbbb3bdceb392f951b084a62792b418ff83132a1357efb5ea33fe12d51a74bee1ea7e0f88144a78f2ab9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4927091-18F1-11EF-82B1-CE167E742B8D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2540	2092	iexplore.exe	28
PID 2092 wrote to memory of 2540	2092	iexplore.exe	28
PID 2092 wrote to memory of 2540	2092	iexplore.exe	28
PID 2092 wrote to memory of 2540	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6aafffc449a0b2ccf66412031dd3cc21_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52157453653d85bcba8e7fafa88f2ac1

SHA1
30205051d4284185d3b4a68157e71ef1e93b9064

SHA256
f10a6ccfec3fffaedc4c755c77501058afaf6aba3d5d5de6d038174ea3b3b657

SHA512
05c67d00fc1a59d67ca6326c2ee4c44ab189c126a50e3bb7d6a2d39dfa94779ea196fb23d75073418600504b4c74213b93031ae1b2176bf3f8eaffdc814b0a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2471c3f1dd4959216b55a145d1e7301a

SHA1
9c3c4c7c0026772ca08ee7301e13aaed24aa99c2

SHA256
9bcd37d8748f059c120500cbd5608d6c91635a9e50529f29db7278c54cf15913

SHA512
a4aeda3fad3e803affcfd76d8495dc04d0d2ec5494e5fd96d41fe12b5e548a0e018a3d4064f297160bca3a44f8e89792dcb71799bd04f12818f0bdb499fa425e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
116464fb88eadfa98ad9fc8feebf57e2

SHA1
ccfe1367cc85844b7fe508e1a93caa775bece824

SHA256
975e6e61357f795f57a85f9c13c584cb8d1ea1edb169a4cdee653960c9334e05

SHA512
9ca0dc15c2c209e4ed0aa33b10cd25ed2f3616b488a8d091053c26cd3c1ae5ef59eb50595bf4be326f9e1604ac761dae4e7f27ac2dae772fa702cfb12c638d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a9710b0802cecbdefa71dc75b9bba8

SHA1
e653b9a7a8cfcc8f89d6d4c39c807b996efc1b81

SHA256
849ef48a387b1be0df28cf695556995e0f38726884e99c58a4143ee7308a07b9

SHA512
79bb9aa936c559893a0bde5c8513d8461909482877c52d751836a6c01b39557b0c03034beb9d12d2b52e1af336ed4557ab06b43d3d1321ba4bf02d7cdc217142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f37574f64a5bd378abe7285346ebb761

SHA1
7ec8cf309a792de3634a95113274926c47590f30

SHA256
1e3eb16fdc63d193fee1979122b6451c0637a4a4977f679d7772ab51d4c2e99e

SHA512
aba87092eacb0d368e86ed53dd95dae2e4ec7d7fb1b4227a3b20c490084d2db3ed33937166f99374e04041c1fbd1c6435e199d679351d957feeba0747917ba7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3fbac33984eb19d7dccb329b508d5bb

SHA1
8dc3abc7f22e02e5792cc4bf986f175fa8a3f9db

SHA256
fa43712d2670580db786a34892e3efa57bee6d02d94ee0850638b9a9fe1e6dee

SHA512
d1032a34d76a25dd9e292d3ae85480533691620a8b8466f71350d771e3f7b591ffe19f1dffc6c853016e1a1dc7d3869be5680968f2d5441dd9564e3ae2671da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70368afc91d0b2dbf640430f58bb5823

SHA1
5ab30feb4c863322a29304a77df9802e6d564e23

SHA256
bd3066982ebd7ff7262c906cfc3a3b89737addb2023b44709abe71d831593bc1

SHA512
a0072791d1664abcab5035d70480f658b77f2fdf356752f7d55df0f9a8e4b259e593f39dc1f976802ab0838d8fec6fbeba51f7239cd49fefcf400343590eea96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8ae177e3b00e2bd0fe874e7acd3671b

SHA1
ae358a8d840f9c75fe957e1666277bd4d63940d8

SHA256
77634a17f96ed99504ed0d1912b8219cfcd9b144764cc3662fe3ec919e563e01

SHA512
fb1fff06655ea869fb7a8414ebdedb65ba796d3e28871a58613c0504bcfbbde132d20cbf8d10ce50e8aafe2da47a007ff74a98520dff48ccf9b267dca33a0230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f39f3ab9e213820ef76bd3b91a7f24d

SHA1
0166b77bfb317a53bf73c2a39183ef57642aeaff

SHA256
cfd105cd83e71a54e9e8022f7a20b86fe7a4188ca2f56ffcc7e558b92b9436e4

SHA512
4f615918b06f623d1eb8060ebe6493dece59f03fc9c04d4e0eac9ecbc2d9b24c589f4d8c298246abf70efbad3b54d74f9a0ddcf0812cb665328c4917ef5fd41c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81c0689bf71b9c49a2eaa6ca6f5c0b3f

SHA1
38b27c5a4c1aef9aaabd27541827feb6227e8793

SHA256
c5cdc09e1919e8f066680a585e23abfab4a35bc6b7a17f6e2b50eb5f211cb7cf

SHA512
69d677f1a985bfff2d42b5e8b89a9fdac2b2ea2cb497e8570453f2fcebaeb87aea0c513d8aec7a1349fa8823054a5222dcae6441cc966663ceb32333e7ef0cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA88.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit