97f5a72cf8797fa221a4b12b2fe1ff4dde3c04eaffa4aed907d0ed641c1b26c3

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ae23a27f15d491fec9fa253633f0b92_JaffaCakes118.html
Size

25KB
MD5

6ae23a27f15d491fec9fa253633f0b92
SHA1

2858dbcc6ad184737ff952169128c881660aac32
SHA256

97f5a72cf8797fa221a4b12b2fe1ff4dde3c04eaffa4aed907d0ed641c1b26c3
SHA512

63caf2737078dd415311685e2d99fee36737273cfdda4a9ebb0b171dcd5772b1ba280ae522fc1395fa05b1e2327c4ae8e6daba320f443c1614a04904aa094053
SSDEEP

384:foNvbFKbHngom0tZiE6HLGvCseVcggQl4/8Ewgb/A4DCNhrbaH/KZN:EvbYL3ME66vZeVcPUNFbaH/KZN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09C7FAA1-18FD-11EF-A1FB-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b679f0527d29d44a157d4685f8f187a0000000002000000000010660000000100002000000043f44686f75b0f6662053e1ad61f11241a495d50b7a15b2327814b0e19cc7190000000000e800000000200002000000063f4a52b39b05f147730b0091b26143af5080b27c783cd8a0329ba0e10f8e8fb90000000aba250c171a92bd5d34497b67a21d4ea06f0899f7a9c02d111b111ec83a896603e4580ab5d3634ad652ef7138b9db1b4f508c7526631849a41e95458397f82682c5588f917c5931df3ef4857f5f96c5d150c56d55e590441a1adeb3d55f9e014ef2ae28ac83c713d02d1de9c152aa7c75f1db4909795c58a4065ed1bed80a80fca98be6d0f81187a9b047b544db26926400000001f2ad2b4d50aaa319784f164c556a49a13c286bdb7528a930579e75e2913cd184374531e151433f3f76c2556f8baaca5928ca7404ec5cd3899cf752ab60db697	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9087d0de09adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422627923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b679f0527d29d44a157d4685f8f187a000000000200000000001066000000010000200000005d4f8194b9f73eaf96d7531987709126ccd867978c344de7708b88171c6da172000000000e800000000200002000000013a49d04452e41c19cf8056be94541653c083eae54563fe0eaeed293e6ae969820000000f341d7238866ed358721ad84ff5c2f2da74ad8c5780ceb709338e569e73aaf344000000015a8eac697be5cd60dd1214de1b8f94c121837fb116b0b99c7009b128a27bd7fd33b5bece92c145de66e2e10fbdc900a25c06c994f01c1d651ae7a93e71bbfdf	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3016	2744	iexplore.exe	28
PID 2744 wrote to memory of 3016	2744	iexplore.exe	28
PID 2744 wrote to memory of 3016	2744	iexplore.exe	28
PID 2744 wrote to memory of 3016	2744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6ae23a27f15d491fec9fa253633f0b92_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb450490983784cdc99768c546ce163c

SHA1
ac94319405fe96afea2ac992e883b72b0edd7652

SHA256
5d3f1bcd459192c604b29d97f478391a3dcbaff7a05377d7e779a58726e28d0d

SHA512
d3baee4b015477f313e7019d02be293ee354a3ef6600ea6ee93a455be9f6aff72b7c7dc6df19c7b3761cc47d582b2bb15783fe55b33a1240e74a1aeb3092d88e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d3ad36739059fecc312899eb6e5728

SHA1
cf8e02e49e1c396a86aac90305b9555d48169026

SHA256
725b3feca6273462ce05180ca4116494093127ee5ba21e86e484999ebb19bb69

SHA512
7024d6007d153ef253f1dc37b45370973eea1e57f975138574583f9cbcc60ae32722978ee90ce74cfbbee24d727ec6947cfac6ad31ea55c9c35af59aa0880e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a04c1998895b2fce8c18f54d88ed3b9d

SHA1
7ea4592ce387f8580c3c70696977edb6f0399246

SHA256
65328387f619b0659a38066886c01944cd0b55c999004cfee04170b4af8a771a

SHA512
6fc7af5107eae5eecab44da1ebac7b26c0b1629c0961f16cd13ff7ecea557777668b6c0d8d84e811ca3df9ef1e46c0d08fa47fc88cacbc321509b87aee9ca7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7cc0dc478513980dfe2754322ed8ba4

SHA1
d1dc2e5538b767f14b7cf31aaaec55099da9526b

SHA256
8852697efc7f4eeba590787bbac2f137407776b453cb91b4df1cdb4ccddcfb2c

SHA512
710736fca8c3e3c75b0893588985961657adab817b22e7d508b68f7adbf244b0a49acbc8eec6ffc549837648796d52bb35fa485bfa979c257591db464cd69a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce419349871a7fd4a3e00137557c6a5a

SHA1
3c4e449db714665955ae3639db2c99ffe5cb2634

SHA256
31e6bbeb4df7117e99c517078598e03e832122e05121a30d174ca43608a4790e

SHA512
fb83ce1928d46fea1de65603125ada04c40380127d510d264b9c1f30be81f29dcd1b82683636c32c36697360a24b15293fba1ecc5bcfe6a7503797b3c52114b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
886ab18673052f6725ba07ad43300006

SHA1
67e4ace710e9d9511ff04c0ada984475bf9fa66f

SHA256
25e6f07ffd5d03024c8c3b3f4e7168f78ad002542808ca206cb407f5a8c7ff2e

SHA512
a720df941197c0c766778fed9e26fd2940084886047007dc1de01ac59f1e136551ae35370c96453d91a4c93144f589349fb55bffcfc1d03ba33bc3ba4a0cf269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
699c8dfc2244be3483b270391b66292f

SHA1
2ac41f8af264f63751eae5fc6f2aa1cc74f8abe8

SHA256
9861516d619c8d4ca5ecd8472db6a74c82dc2f3137c62b3e78a773881402f303

SHA512
c9655a141dbb44417dc51694d3ac03a47957524fd8c1c556a6ca8636dce1620ac62208fa6499027426129174b7e47498a5b07527ab368b4be24dd23044e0f30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
140c19b93fd0700cba9572d7be8a7128

SHA1
9581194b13fc6cf5a61dfbcf048361e136b8339b

SHA256
97dc84d1095ead647487f84c923e29196b434a0ebc32050db33dc6577ab74b13

SHA512
41ac5169a85b8d29c8aa00f6904d75eb990da672f70ab629c5ccaee0d1ead9656ce25182661f0fa4d090d8d79a2f4794d04bf1f6072d0651d83ce681494de0cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f762846fa0f5b37a628d454484d55ae

SHA1
661d731b7e7ecefe043668bc1caa0669819876f3

SHA256
d0b506198c90ff0fe1e50acdf43b4d5e48c3b77bd541da87f91ade774a3680d2

SHA512
a1a48266f29c54f6b28245c2576bad9edd392310b5dc473486931f027cc8984630b58d41d0cbed06834d8db55bbae39b1fd47d69a663160281eed175140360ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36701fc90bf238bc0c2bf0253933bc70

SHA1
d90538dad3971c2e3fbc4caac98017075b80b3ac

SHA256
d82bc854918fd39e4da8fb5328c4b94a8300b8fb49a0aec3b0305a0929f87b8a

SHA512
caa2f0e92a547fb277cb93d67eb462d368bbdf5695c1cc57c4e61472ccdef49c6e5ec205d77dc619f97814c7f9e158112f6947abfddfdc46961b28886e6ac093

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9282.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9383.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit