c0a92b8aa6116d2733f8773b6c872677c08b44205ac44131f65e17b4804b6cc8

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

725f090d07edb9ba55d88cf33d9dde12_JaffaCakes118.html
Size

70KB
MD5

725f090d07edb9ba55d88cf33d9dde12
SHA1

c5a05e16313e1dd6fc63d80e3a6afa53b2ab0cb9
SHA256

c0a92b8aa6116d2733f8773b6c872677c08b44205ac44131f65e17b4804b6cc8
SHA512

dc3dc75916e700904338f6ca4e9c4670eb81a9bee46dc868121390102bab20a58fa3af1f6a66d503743c4163553fdd4fc30e17f78dece1f59bea1d251fdc4a9a
SSDEEP

768:Ji2gcMiR3sI2PDDnX0g6sU63RRl/oTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JGYTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70F1EC01-1AAA-11EF-8F47-7A4B76010719} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009b84b8cb4101b1a1c4895d269ea9b09d668c09a434112043cc2d0400145c9e0d000000000e8000000002000020000000b3da833bc96c2cd682d3f9e524159ff0c83faa85c7417f3c87dd59d13fb783eb9000000049c33b1bc9841c2e981b88ad33eb4686708bd6c91117be1cf8834509c221ec9c251b02f882e98bb250d4e4e22e0552241721500af97a82699954aab71f6411ce7771c16e6d0848609bde7296cad79f185fe03e7922b07204351a099d693444944bfa9aaa27455b64c7daa320b8ccfeac8ae2a1c930ae844f1741bf94d0a82b371df386629345fd291487d78d5c472a764000000098f6b916c6f77ebd432736d4056eb23ab914db09344a1f333658e3a903a55df94c9c93b21d7e2f7d14f99c45f2d7724e5c343f9c19f79284e499123997bc8389	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006f05d93b66431125e306b41a87ddc119ebb61835873ad0950a25df0359d7dd7e000000000e8000000002000020000000d7fecca8074792ff296850831eab47daa635a62144b21a849c822bef6d338a482000000028798f6b901694b16c840e0437fb453faf86dec8ffbf87b77627ff5085230f14400000001074550b242d8ad295b860cc7184a7901df800886a79ebdd28f9d8da0e88635d824b933f1738e1ced7bba37830fd9cee8a1d789452ec29b9db0abf539c7471ab	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422812348"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f9a645b7aeda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28
PID 1688 wrote to memory of 2144	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\725f090d07edb9ba55d88cf33d9dde12_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfc4a0a9c19eae1deb46b9b087d61d9c

SHA1
edb21aa5649298b932a2e4e159cf1331282e0b48

SHA256
4bd22ca7402c46ad86e6ec76da00d76edf86ce734676c843c2c62bf9ac91cf90

SHA512
d7d5b4744e2f087cf923b253e8c8902ecb1b4c93a3461cc60d30db0635ac48e59b79c705dc557c90a7dfd0e3a67a73e8c65c070032d1dc9fd86b52967bb89259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5f3a655a3b32d1b0e71e19ff2a740e0

SHA1
bf2b9364faa721feb7f10cdacb4535bc2aca23aa

SHA256
7e03e630d0e0f0bb3482f9ef89f3a8f81b8614f781c2e25c04388a16abff75a9

SHA512
c96ad9419368dde1f273b43f01a80ba0d6c147abefc8dbbc0964bb4db686fa04244c70d2fedb75752ed821cda918fbfd518f82901efcb65c34f73ac51e58250c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d43db6b9b1e6789030bf9c0d3059236

SHA1
5b9d7f278b4f26f955d9cc64a670779551ce4732

SHA256
2bb03c519e6264ebfe33088f5ca357d78ec91b5ba199b1b6553cc34d0e5748a0

SHA512
4aa0284b50f6975f6bf2f56dcb253ae677f7af17eb075a2a997dea016c3e8e5cc3a703b65c8cdda7867e6972eae06ad9e077bcb24014d1d9887af4c596dc4502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8923e6e8016fbe50d40d51b21889cd2

SHA1
d2a83b622ee13ec7adea2ebe54319093a28df501

SHA256
146c625697a6e0ec3e1faf86352ca14907c4a16df824f0b5347b4c222f3c54dc

SHA512
5dd77e3a7850dc0056ab0e2fd5719dfc1c172f2fc96c953804cdf63f25cfb897e4801d812e9b46a59b0b8f5bb09bcf5095e4e50e319f64ec1c64dafe1b4708f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da3103c641c1247b6d4ea911becd5aa3

SHA1
2419700df7793cb5f548ab56e717dff96a1072cb

SHA256
e6aecd658fa6db3c1d112fee94732b92e49044af881759b46b575411f9760500

SHA512
0f6cd2690e599ce137a62884025e627086cbb94b902c8811665625947c537768c56efb819ff189f29aa51170778dcf729d99e84d4732f691d22d030dc46fe404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfef57c803156528ea5f43a282396eb2

SHA1
35b8a3a84206c3407b78ebf42d388f5f3c582965

SHA256
dd69e11e18c546f4d551beefd8191a882b4e57efba72d17382e1d376508b2626

SHA512
5347898731528f74874c95f92a2b69d9018d5d388ec31ae821028eaf120e9ea31c969baea98f1a9c1ed8358dc37ceb0143083882e590e7b3182d0adee2ee27cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f77c038465ed3faa97301449e9727c

SHA1
3697d8c151e2b52b3e97ca9c4a8fd31b39f194e2

SHA256
20d0ccf2c61c6d6cd9aa14e334b3e2a0a20ab4ed3dba78e4203122b6ab908755

SHA512
71a77b50b7358b5b3f7c002bec0b32db59b05614666ae82e0c4215f07252a88fd75f65e3975e0d85ccbbb7c074b963841f611bd391f3a9691221ad56df16e03c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69020149f17f921e2edb29818c9a71a

SHA1
433c7b1898f1bef2e69934eff16081182b7e234a

SHA256
b6ed10e6f98fefb66d87e1db14bea40409871af3e46ecbaa4ecd12acb94edb7d

SHA512
5519ae70590abd83bdb09991b31a2c164cbb8664186db2338ce4a2fc41a416ac153edfc36e7c4c6acecabf44794be9a0f21e845904d0b14761dbb40da36dbdb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9654fe10eefd42f4c5628293c2c9ab09

SHA1
278b65024462b419bcf672da2a2b1637c52c0578

SHA256
7cb24feeffbd6e188a3ee3b4a05e238147db52b8ae6610275e33e45fed5f8368

SHA512
680d08e6a9e30a120d926ba96e843ec718e1ad2a4bd71fcd4ead7c662627b534da9e7d31859b9718a5bdd2012b8f5c266667d9bf1ac39cb4f88301b3f526cfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f77aa1900fcf0c0d5a137cb2c99b6f2

SHA1
8c4a88c12de36996e84a0e7fc053a16adbb2fdce

SHA256
e90a1420eec5d1f7033bbeba259dc2a8d39d392ae6737c03e8786d64893acc4c

SHA512
1bc816a0119a1238a350497b19b797df2fafa250dfe61bb2859d1921655524b24af632078b7b6155f09f2d68eb7f570cd2f8e69eb8de35e04651af8789a6026b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e991ff4576d4113410ba081fa244e572

SHA1
9c7291e3cd9e6e52b8c474d99449ff5ecd8a7288

SHA256
6fb81d3e43f447288c28e969e84b9304c37b93df16defb264615256537016afc

SHA512
7c39621fb0f7941fa91995bc18e8391067158e20a6453b841e36c7ab12386fae28357bf959d79bdc65c50289eceb5031599a348c4f3c627be4c6a10d5ad16c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4405.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45BD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit