3cebc46514066d994fced644b6e7e75df5e8b2d9f22b3295f75151d661e0cb03

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70dcfe8e758249b5414fbccdb7f3550f_JaffaCakes118.html
Size

461KB
MD5

70dcfe8e758249b5414fbccdb7f3550f
SHA1

3514687abf559f81d0716f0e68f26314ccab2969
SHA256

3cebc46514066d994fced644b6e7e75df5e8b2d9f22b3295f75151d661e0cb03
SHA512

a2626b4b6a2ec192be2ccbfebc920f646c00126ec79c87e57d462060af12297f03c90bfe1a2ffc4e5c6bec769a0f2a6a233895db25e2a66f5b9694661a38e02f
SSDEEP

6144:SBsMYod+X3oI+Y+sMYod+X3oI+YrsMYod+X3oI+YLsMYod+X3oI+YQ:m5d+X3u5d+X355d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5090e7415caeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422773252"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{695724C1-1A4F-11EF-A2CF-6EE901CCE9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000044b5c4a5665b7c439413510ecf6767f100000000020000000000106600000001000020000000a97099d6a80845a95a189a79f06432f9c530773ae2affe79985bc43245e9c1a7000000000e800000000200002000000049d0245e5f66e0b7f35bf865a618d32c7b642fe73ac323f0a24942ae20c2c04620000000e5ce0e193bb58096fa6578192f00002268377440f5cbc8beea22e91fd623955c40000000900e19786f48aa823150e70418f617fa1c53fc4cf341ee6e41d6ba5b3291f99e7fcd0203ae7445edb360398399c6987b130d03bcb04d25f336acda3676ad9052	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000044b5c4a5665b7c439413510ecf6767f100000000020000000000106600000001000020000000cdb4e4f8407c2b5c605c42487b02e69050dc4fa166fea3f3355dcb6ff3e25336000000000e8000000002000020000000d012ca7bbeff9b8cef30a2544ffb8e02ca1cad5a81701f3a586681a32425549a900000000935fbcc933b95accbf38c9b9627b71e624e6b8d0ce61763ecabd07d3dd4078598416849f24b0604612d1eaa22e574fd77f438e16e86a9339409585cd33e3e619443b98a3fda224be8bc6bcb3cb184d4d7fa924fd4ce8a09ed98134d0245ea3f002d8b8798551d6dff20cd726ea9055261b1d901cdc37048533576587dba637211d1fd18aa9698e898a104c8cc5c3ff540000000f3c5fb1b536f47e2c1db180eb627fa0530e60b922a865bc543ed4a4b3c4103b63bf0a084550e799c3e5f96c223b62e7a1a6890122caf75ae5236639c0927de94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2692	2328	iexplore.exe	28
PID 2328 wrote to memory of 2692	2328	iexplore.exe	28
PID 2328 wrote to memory of 2692	2328	iexplore.exe	28
PID 2328 wrote to memory of 2692	2328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70dcfe8e758249b5414fbccdb7f3550f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae4d4c4856feec81e338a6ca6110fd79

SHA1
500a0fbd1b4c5272b5e60b2c2245ebaa62c6f76e

SHA256
754239b6d74070864b9f55c0d954bfb49785a41f8ffbfde458694e6c51e184cc

SHA512
2beedb0f85d422a02385898e2a55caf17c7fbce91aadfae976d5ba3e809a6b838ec18e1db24c07d76519cfca44e71f6a4133e2b62016a4fddd116a5849536bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e9744b39064a2e95cebff9231269f42

SHA1
899f9d150d1bd411ab896a13f38937988c6c02e3

SHA256
1d7a15922f315a1083849129c602b6512faec0cf4033c2c0d7bfd6b3b12dfab6

SHA512
07881d0c7f66b725db1b657ee36c0e1f9b351e539e9b7f1d07393a7128d547f00441f6f773e4c5ef14b359d5a9f0822d15aa9d470c1f5bf4824f690eb9d714de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c412f55b6df5dcddd21cf40beaf37d8e

SHA1
13facd5c2f9063dc50632189a2d805c4a5c0ecff

SHA256
61ce2cc8dff8d5f49f829150a02ebd583eaf78a4472d2477a2dfdfd9cd89ab37

SHA512
ccfbc2aea5bd7ca0985e961b29653f9fa0e86e6a03f28012a426f3d6e2dbea7a5775279907f2f40e4f421261be7976be09eb820781b3617d3dfa6e95418aac7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e9b9a91deafc703eceae7b56ae68db5

SHA1
3fe0fef166c14708bf04ce5afc5670b74cb09d04

SHA256
8da43355cb75d0a3d45ed90f2e756604c87aef19326dd677c580977133fc9ccf

SHA512
2ca1aa47599372fbb9eb19832e8569d97f8ab42e5ef1d07453c62c6a7dd01f75fcfbadbcaf0f318e96b9e4a5da5811282b237f0028ab1f2b25a624bbb7c0d302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2183ed9da7fad2367a2068333b397f09

SHA1
8530fc1ac4cc17c83c4fb2cef4eca10082270ad9

SHA256
800a566542044e058f4daeb86841a66611c16afcbbcd05f0f82a4ccc8e9311d1

SHA512
7c0ab349c8fab4ae4316e6d88103281fdca14dc3cc17d5de629436e3243cec73a507308d539e1d0da4299fbd73e6c4e82eea12906ca9100d590cd8ba344fe545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe0f9883aa90a1a413e94fc2d4479fa1

SHA1
c27808492a7d8a372edc18e7ce3c2e78b05c65d0

SHA256
3c245ea36680e2d4c62a7c361d74bb21d5fd38857bb5182de5cc32204abae710

SHA512
73cafe363d92c024d57b35933c051a3c54793e2b0730e5e841c7a815831d18c0d676eef43c1b161561280e7217d52b3978e1c4d07bf8df0563d857e082ba60ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
758a7c2f5c4fa9bdeb2c375f144d678d

SHA1
1c3bb9b7c14991fedbe63e18533418401379d615

SHA256
11632a2ab73fae302fec37dbab1111dc761aeea06b9e8c6270ab66dcc96e4801

SHA512
b143a8a06f1b8ad4bc1e1aab9f163f8988888eeb415eec8478a7c716ba3d7c9ee8953684f2c8e186b576054fe3b378a29b524ee338fa4ab5e994ba6c75417746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47d8a8a144e216cdda30747d8bfb1df2

SHA1
276c21f1c38b9231fd5619ce4987acbc3c37894b

SHA256
5bba9284d8d5e09791c872441b886d337865bd7200983b8f39683c5562dc4106

SHA512
3878fddc2cf1bba45ce098ee8c64f39969677e776ee11f5e10d95366fec7a766ffae8d8b63ebdcdef03a759c7494e55f42110864f0c45fb958a198ec4ee55ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a957bec911a6b7cbf657859689927eb6

SHA1
5e4df908d75e5cb7f99c9b0151f10bcd04317f20

SHA256
fe91386b31c593339db03a86cfb500b84bfa6f46547b4a207e100247d31b2c8c

SHA512
215a57406c3fb1bdf68ee895ea81fbe8402dca6a26feed505be951cd2bb8ace549a41fa7cb92aaba0001e99920d88868b4d099ebb4bdf03d9b76f30724b32d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90bad87128719c3528cb44a6f265e83d

SHA1
b420c3a623ab79a8993d604049da4e889562621b

SHA256
b83a937543f84293a5d9d5474a8d21779611b327d276f0a23ccf7e3e0ac3b2d6

SHA512
819850de0c78a8ada8dcd3cacc8e86fa3ede2a42d27d27222b2ecfc088343aefd7cde0d91bfa07f92951bd38b2b040fe068fa4adaff8c74cb6764f36d8912163

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab432B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar445A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit