5f245c9e6ffeb75305e72a6d060b144288b91efef836a61788e7f1c7c8af5749

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72c41ab66f945a8ab80797b0fe383a9f_JaffaCakes118.html
Size

70KB
MD5

72c41ab66f945a8ab80797b0fe383a9f
SHA1

e60ea274e6fc1ab42db7fb68becae6c550c771fe
SHA256

5f245c9e6ffeb75305e72a6d060b144288b91efef836a61788e7f1c7c8af5749
SHA512

2bc7cb684aa708e7dd2883c2d8cc37abc0ee3a98fe8f98df43caf75473a1afc628c5b4bd8c76c9c96e73b24a36d0aa2d08a63d678f5a6b833018b2b6bff177c9
SSDEEP

768:JibgcMiR3sI2PDDnX0g6sd6uLGLXKLVvoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcc:JXdQTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02FE80E1-1ABF-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f11199829c3607df7b371405f487a492dcf6f1d5e95b2578f30ac50421b63c71000000000e8000000002000020000000f633fcfa33adb064e35c9da9a43ae14082adf58a309647467cec7855651b2a2e90000000b54277eece24450d5fc1838c07048db4cc48f14b3b31a263e892e97d12b0553df71603850682a343f6c716771a5cfbbe5e6e181efee1d67c2fb4abaa4e5213ce48ab507fc7093db776d812971ddd20aff60f1d671952ed039b05c222c28f88d9bb0923c09898825819f1feee5d5e5ce154f9e22a8c403fc2530cfdd811ec3b81054bf78db9099cc25458217df3587e8a40000000cedd528da7ce11752c9be83b7c53c1adeba221f9679b20cabc4d50ac79674f1d0138259b7859b9ca13b420fac5a81e8186406560aa6e52ac4c816e6c2588abc7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422821183"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e7173eeddd7f33262bb4ce0d060bfbdc8c2eb7e94f9b57bc3ba0712f340f18d2000000000e80000000020000200000001a0072c485fc4e52c4ca0c59b22aa7dcba71b372c09bcb4a26f50e8baf47969a20000000effab3e1715ae008516347826d5caf1db4aa889eac60f6eb2943af1d8f915ff240000000d57feb81b62edf37c54abca6d361634b99531ca893e6ccf47a52acc0574c186d33123863c8ced722c4ff722ab6789d2208170f208fe04fe5f3b370e867e0c412	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9034a8d7cbaeda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28
PID 1796 wrote to memory of 2252	1796	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72c41ab66f945a8ab80797b0fe383a9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e35f4aef40fc3f5c05e68521c798f44

SHA1
d292a323e1cb40d83ef4bab6ecde09caa46e8511

SHA256
6c6e11c3074e5b408c60092fde584ada27e6026701413d06ca9bd3576e53dc12

SHA512
6522ca5e3084d29b5c6075d8519a3a8cfd513900e539fee58a3107551b16d6f4da3f47f355696aff207b7008e6b719fb753f35b724f0b3acbe41d51c855640a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dbe40737f8f97bf29240bdb8a72ea84

SHA1
b8c8971582d44c0ff87ccd1399c34a94f95b882a

SHA256
476bf85c1e9705f91057826686dd8c23ece80f9a11754685dcccc38b2f9e0beb

SHA512
ac75cc1130ac742ddddc0ec06d026e11532e8ed4c6385fc69db860629c1688fd747544db48b466987e9a11a529189e7675ccf0dd5aa021c5da5fb32e0bec9e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a94bff544d4d1ee46b6642470afca259

SHA1
5b1192bb9a2e5e9aca3ceda629d6f65dfc8f0650

SHA256
8836a2fc589a7fe300038d97597b2ed824498e1e5e4e8d4e46190ab3f6d53ac3

SHA512
7cd1742b97d9bc3f18d46be70862cf36914f97a0d2849fa59aabbb06870cba2cfa568d5121d6d375037f53d9d198267d99a416af50feaa6adc98d256cfa18838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a1cb5d6ed2145f4f7e8f75263c2469

SHA1
9013911fa46fa2dfdfd3e3d9a1d04a1fb223047a

SHA256
0d6863cc70a113356e3f41650b889f119b22f10434be44ddd699b199b1d6fa0c

SHA512
49dd8b6746957935ea5189e60d26d9e2dcd9f5d6ab2c116e003a0c6d48adda193f1edcd1bb3cf925dcbc763b66db5b0dc404bdf3fef92cf7094bf212cbdb734c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b67f9052f26f0057c408f50fa56b22b

SHA1
1319ab2e134f42f748c177c7f3e29e2a72e75d2f

SHA256
5ec601a1c077cf89525303b70cc4ce790401cbea49f09884e87d47e7c6fd3257

SHA512
4634544d5cb27b2fefc5f95e9dc379921fcf23831bd9215594428e413c0d383cf3e9d581793011198571cf2ec4a046dee9b3b2fbccbda52fd44a2763f3f5370e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
947c6e45e6c9a1f013e7c60c17906d9b

SHA1
6befb60b66afd74e27418a7d85e04ca3658625bf

SHA256
3c9c80b844bdbd86a0a9ed2d17429e87bd1ac6c0e85f728e6b0294ac6cc10eb8

SHA512
f213bb1df4f8097b024da8d8878d258f885f3f6dde6064bfa144cb02b9bc31e6cec0681f118bc8341e9dd2dfad431890f1a029a510f57d4c971cf878bbcce90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5383be0f73a5597c3bf21b6b6928a48c

SHA1
ef012c4a989ad2d48f14fcea71dcaa14f23748bd

SHA256
5ad2de6ca7c7523a8dbf95b994076bdb2e326b827ab76f516c52c58daf1098ae

SHA512
bf337e91980faa082e744f941703a4bed4682bb7f626bbe5cfbbbc26da40be328ed11b6deb94bd093ebf43d61b9591de626a303b4c3893eb4698532810c57a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790d711592f7ec5f1217d378b2715357

SHA1
afd2b8a2c512a459ea3a4d99c003049b8e97680c

SHA256
36415444c49f913dee3f890ab53f03cd9014f8e751c423ef97c8a055f764a302

SHA512
014779ea1d8479503c5dab37ec29ab86120756cc458f20a0a7ce8a9634ef94c3205ded5c714def92b2cfbd51ee6f6c9a590cdff74059964e358d160f289b03e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93c4f001b1019e0b06acee1225134a29

SHA1
bba728c9e7ee1e8863d39f749864da1a1655e89a

SHA256
23266cc4fcd6fba9a1dc61a779f104909229a4e2a0e0db933134596fc5fd1e1e

SHA512
6ded667a54f6ba1ac4b157654961297bd16480b615762c4fdfdac3cf9da3f48e7a63faa41f826436f4624e41473fd402a53981271e0bab43912572d290446ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b5d73450c62c3240d90999b6ab01294

SHA1
c552a30a871b2cd16c89d8bfcd16671c96e9a048

SHA256
8f2c897f8bc5612a1d686eea75e55f6c19eed4dbd50ccbcfafcadd1e24ae8e2b

SHA512
dfc5f1bdf381dd3d5c74ab2465c58adde59b345d531b6d48acb4c207513526fd855cb9ef8515bd95d606e3f087217c0b7001904eb5ab619b937839a498c17080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27987d4ea42f3dd3f27ee297f2fc2e7e

SHA1
55c66585264bb7941a366225f5efd676dc5689e1

SHA256
1bf92d202af6f582746a8ee15a15c38f31cdde3489132f6492f8549a1e55126a

SHA512
8fa88df834f98d21ba76e0da5f3329413ea0accd0fce85ec70b03f8b7fc2c0cb150f17174644fdc08fab837b6a1d04577a9cc263c943d67ca22e0d84b6bcb732

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A55.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E7D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit