9f1a42eee310bbc998ea4d21923893d25b8116be5ff2fc646d4df2230ddba483

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

723b2bf2af51a7201e54f4d0fb3dcad8_JaffaCakes118.html
Size

70KB
MD5

723b2bf2af51a7201e54f4d0fb3dcad8
SHA1

1eec70d29ea5065df84e4a776e0ea67a812442df
SHA256

9f1a42eee310bbc998ea4d21923893d25b8116be5ff2fc646d4df2230ddba483
SHA512

b22355441b3c8143d27e11843923407257bf2b673accb5b0b0ab6cf4be353f059f5865e451a0d20efe96c3c1dc319ee68cecd5b73ae9a215214bff8580a4380b
SSDEEP

768:JiPpgcMiR3sI2PDDnX0g6sJ6OxLxGwoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JxBVWTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01e682fb4aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422811028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073dacf0c89cd9640a8fdedbb7081308000000000020000000000106600000001000020000000c910f38680aae8b050d7fc9ed1172720278e9ec589f8e8dc5b140655953cc885000000000e8000000002000020000000b19aaa888a78e016257ead61be5e40e832ead2cc81dea72457a0db5913117af190000000a2583f8c3df819e7d874fafd3257186498310ffe3cad055835bef5a1a4a025c2a293751f60a8b63aeae81856b20c0c14baf7b5472c58d4c0e14b63d2602ef956612af377e6bb278ca22acee95727f2eb416bdb6db4b6332af35b15178e0b902b33961aa47923b96f571ab1642a93659938ef73d69d28e5631d4d9244f2391ac9289cfd00caa139e40a41b946dfbf5c9440000000c067fb9f84821e5be4021c3f8809a805d9fa04cdd837000653be353754463d8d9904a4670d54248d299c0270e7cbc95ef863717c3cc0b9cd28dc49c46fc7dc5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A98AAF1-1AA7-11EF-A6AA-4E798A8644E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073dacf0c89cd9640a8fdedbb7081308000000000020000000000106600000001000020000000215fd460c12bdc5f2b9529fb5ff29f14d25c8273d9c528a0c56c5f3002ef7a06000000000e800000000200002000000042938a726401ed4eca506fecec2c2c64c9699516c94690ea4340389b03841862200000006629b9227fedea08d8887368f011b6257dc850067b3955d832f180e69616fead40000000c30c402ddb2fcd41fe72978094e1adc4c6e677571bd93ebf831fb751bce8cfc295702ec0ede6693441bf8a79933ad2c397e0b909bfa76df2a6e3ee15cc22c14b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1756	iexplore.exe
1756	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2856	1756	iexplore.exe	28
PID 1756 wrote to memory of 2856	1756	iexplore.exe	28
PID 1756 wrote to memory of 2856	1756	iexplore.exe	28
PID 1756 wrote to memory of 2856	1756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\723b2bf2af51a7201e54f4d0fb3dcad8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
948e8a22efd6ce58450f0c7b680eaa81

SHA1
8b95fd9a5dd7518e61ee48a25cafcb579c45271d

SHA256
55564f96190bdaf8ac37ce8806181597b608c88e29a04827cc2dcffb444b2b28

SHA512
291355241462dcc043b40cc2acbb6118a9923121c4d04eeb8f4ca3f15d9a88804f894b28361d3126240b14793860b0e0abad1f422a97cee7e1d10fc9d01fa846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4ad7ac4cfcc3405a8c8f0635b32288a

SHA1
cf2024a2a44bb89ccf0145a4ea866392576da157

SHA256
2f649816b180eb17ea74b844fec82ddbe0141b000e871697aa3861d02f5e639d

SHA512
40bc2f9a0edb479d477c822b4151be563d1eb6079ff60f4e1c933b4027cea5b5ad10889497ae5cffea11196d9dd2f01e6a228693219db6b7d0351ec069fb2e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc18a5073f683dd7ea7f84746a7cfc1

SHA1
4041419d30b3a30499bffa0112c8b6fdf3e9653e

SHA256
fc52f4f78de5ac49a55f3eaf8f520b241b6074da55c94a3d91d18427f9b45f3f

SHA512
23a94a7cc1780b3e49d18babefc7d982fef1df40813bd1504cb9fec089d7603355f437a4ee1412c0ba2e31b4f8f803678715e821d344cc1ca23649551b61d8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77ef82e1c0b705360715ac8a360b3ab8

SHA1
982aa2b87b642677e8ae9fc2d7ab59992c4c6ad9

SHA256
bb5e9cadba62529a84d4a817031bf1c386cb70f2630cadea1826f4fbc2ae91b1

SHA512
cc3563512d9a23d588527454a9ae8c256a06c21af37261e94eea7b6abd4e3bf15e385dd9bf11b082f0f03bd36b696fda58dfd3afefb8ee351661916243212156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ea0fa8f6788157835bd261947919c4

SHA1
8dcf5175e53fa6bc8d0ea16e3158db72e8573dc9

SHA256
b5b02424885ef815fecd04f41313d7da075cbd8d20185dcaefa4838f9aebc654

SHA512
bb5fd86f7941c56121dbfeb1c0211cef4a4257353f1164726d924c4335f36c577c537dee030985a1005ad7d976e27c0aa1fe2217964906e25425abf2a49eda0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09203292165d09fabc95231c05b06caa

SHA1
18b6af3c57ce6afcf37e4e51ba92bfa06f588f4b

SHA256
e737bc01e3810901023de9532df87366557a1bcbe10e960ba9eb064e6064c296

SHA512
b434d0be4ee4999e67711c184927ed122fc9f129c72cbd5bf6a60ed89e159c75f1a9550ef87a4de496eec0fb35155af95aa963d73aac2cb13363310d6d5dea58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c314444f119f179c28640eebdf6824ec

SHA1
b0d0c50617e6f95ec401d61da98fec7fc2cf16c2

SHA256
f7d3125730c9978f026f4f4a008d7e872ab7c0646f25329d5e14050e82d07b74

SHA512
8286426319be4b48d96782f434584fab4df9f788aec8b841d49d1a044d7e0ebdd0e6c36fbf18345eda4b14bf5bf7a6a674a61ab72d1c9e346bcaaeff964922b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0296d227fcfac650fdc74ec62a26e6d

SHA1
939609eb636ec894fccf0500179c0abcf50786b5

SHA256
f2f9aa423cd8a5f3c65dbaa87cb6a9c00561b66192bcb8c3e3f8cccc0ddd3faf

SHA512
0e48ce4c60183f1000b6af997cf07ac24cff07948a8649b9b7b7e85515b774041bc568218555fcdbc79e225b4adab59d985390139fee0afde45b160f5d18c20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f031b6f224115f4e8c713116e3f4e9b7

SHA1
8b8da84faec7650ca60f08300698f67d0d8b0324

SHA256
2bdb6d8a449cf27a92a09e7cabc3f473e8d32186c069d4918fe2847f7f6de153

SHA512
a22414a558b8250e01cb16e92feaf0d87eefbd39686e4840da930989167a7e298ba9bc96b154a4f6feadd54433858d9ce4287e4fe217d8d836e7dd70fcd0c093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12d9069775f6bddd181bee94298facc

SHA1
6c962a09c4690f069ffd7372e47108a0f74fbc4c

SHA256
4ebe4c45993bc9a89bf5631f7915b0658d81bbae1dd85b48a8ca57cf346f3b5f

SHA512
c5f536843257f4cb936490f79f2e6c8a408b000a07544ebfbadde59fccd102045f55d13360c18b2ad7be5f6ea8c92b9becf47299f343694425852943ce04bb6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd57fd4170c9be6d1c27010d2b53266

SHA1
599933b95467462efcca8aaec40f3fb024d5a357

SHA256
9b38e0fe52d0586d9d3c5650166fa0b5988c1923d1e29069aedab3672e11f044

SHA512
d25a3c69a40c8fa64237b43d6841e777b20e14d660fa6f7b9e33a3bf5f9b040b2d23fa84970f29f36bd8753c88b3c9091d73ea0d60c009c24dad9c896289b54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22AE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab238D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23B1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit