1cbe3acc34bf2e60cc59a3452d9866996a8fe0f8b9b6e36a2d20c715d4cd5788

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73df0d537532257d3e1ff447f1e0e26f_JaffaCakes118.html
Size

824B
MD5

73df0d537532257d3e1ff447f1e0e26f
SHA1

f9ca299c41fdf739a2926edf572c642ed26fa017
SHA256

1cbe3acc34bf2e60cc59a3452d9866996a8fe0f8b9b6e36a2d20c715d4cd5788
SHA512

29229b1602a75ad751d2c2ce36ce0d8e0927a046725e331f23709801427c2c5832b9652245dea5ce1b982f8dd0d3e28ac6cfbd8efbe384f8efc0a0156fc0d127

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422847862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2059C1C1-1AFD-11EF-A41C-62A1B34EBED1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c4a4e75e263f647938ac43e136018cb000000000200000000001066000000010000200000007faa2a483ab082e681e448baa06231caf7f8b32bd04c934d2344c846a83b072c000000000e80000000020000200000001b4f52486826f041c804740b01f435503af48ca3f9a6060c5e7a94554a932c5090000000f034577c1ff7fc4ae2f8376556096f52d1b846edde78bd2ecf8ca5ed9395f2a8c46b7cf75222a29501853d7a3347715e3e7ebcfff2fa8a24d5bdc4a4b0a3d36dd8a7234bedcadf247e7e9747b899acfa159cc97ffffb9c99840b897d5dbd28e0cb5f963dc66ef7da409f77e6882569ba393f6512cce096b5ef855bd4ad131c5b2b102949689e76dee8fedac8e288ca46400000003ed8704d2a1e068fbfa84419ecff1f9f528be76aa6d1f541e915821cc81f2f7151491d8bfabbe1b1c29f1bcd07f9acb1faf2355f32f86a906843a15e9fd24a68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f2d2e309afda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c4a4e75e263f647938ac43e136018cb0000000002000000000010660000000100002000000089ce7b78419b06102d8e2cf0a18b5addc7a6d96ea00c49cee05b6d68bc41111b000000000e8000000002000020000000215da98f397eeba51ab188de3e583b9d7b0376cc12ece1902a4d8d3d36a0d02a20000000b4509f5f80b08f281329179e45d80160bd67305e07608b8545be6fbbbfd683fa40000000242d27bdab58470ca720aa183500dba0422c50490db73bbeb5a15b8890f8e9731802a089603ab3665f68dd0c332108aada9f9f388b089561691bfbf2aa112d98	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2052	2084	iexplore.exe	28
PID 2084 wrote to memory of 2052	2084	iexplore.exe	28
PID 2084 wrote to memory of 2052	2084	iexplore.exe	28
PID 2084 wrote to memory of 2052	2084	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73df0d537532257d3e1ff447f1e0e26f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40be991baff95b7d51d83afd8884dbde

SHA1
c25377d68a5a3aba145bb8acb122d4f3c0d75297

SHA256
d435b52b6c78d988a75b11082d82c3ce3b79f67ab0f0dc4e0ce0d11a8b43dc8b

SHA512
f7d71b495daf597549447df366c4ae9dfc3d885509a149db4073000729b83f7dbda7cec8f042365fbc264d7dca52a68224f308c4906df7aebc1c195f8068bbed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad333b79bd4e8b8333b2f4a687a61b3a

SHA1
55abc7d0764e8beb17cd926fef2b1bb7216278c7

SHA256
b8d8248e86b3041e64d47385004ba2e39b47ba7c27b9dcdeb782baa80e920c66

SHA512
32e9d3c694a1c3175cf16d6f4b578f9af7e4831a0987d2703fc6f1fd31bcd408109545f412dca33bbf515b2665bb44216ffc8d4b061cf2c33814c6eaadfa98ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
049c787929420cc02e3e91673b9269d7

SHA1
de4351548f6b9bd07061604391bebafd4c4164b3

SHA256
36b7345d125b19d27d0b0c38d79f50aee2a8b3043dcc73b55b7f530559360fdb

SHA512
9d7c788f9fb6471f093daf2242a5206c66f434b0efc9e614e43e30e760a4487f9f8febf9c2ef0ad697722324ceeb656f916cb1fa5dd1f210ae7ffd9502ec316c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef1e3e1bf0b53096126149ab4cdcbf0

SHA1
180b0c7664b69cd4edcc1f3db4e3e0f68c47e470

SHA256
eae5f445e16cc7f2e47c581947b6e7acb7b51e2f1d32dabb4b675bf13993f9f8

SHA512
6c8721c47f51c9dacb1cbf54a15f067205284ca11416791ae1b63035fbf4a713d2dfe14fe2390d1f4510f19730c64365628e8415e201f8692a1bc8e1a5d3794f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f1973d3cfad0ff63729596152e084e7

SHA1
75f93a69b253c8a2c7c39d356e70c7bd74b7e8eb

SHA256
5c26c74686b086a08951b4e178bb43fc289cbb0a96209f5def960ed9dc61dd46

SHA512
4d77092b67414062828ed5b151945f9757d44907dd5b176d926902c8351a160606193d20bea1cc7b1b740b5b847a1893ec69c63afb37adaaadb1fe66e07e6859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dedc0ef036ac0f98b487e832cf48a6fd

SHA1
27137d670f4acf5f19a484db3c66a4690a45a568

SHA256
e60228343344d3ae313052ecf9e9d8790604a54a567b8a2f44213f4ca9660c4d

SHA512
ccda56a1a4cc6c0a7ec6824febc96f29fc7f819dd347a21fb13f46a30f3296eadfd4768a029ecb55fb004fd251dbcbeadff0bacc2e49e0ef66c0e3a9f1394c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd5c97f556c95d6f256b91cbd48ce29

SHA1
fe1a81629b212f49b0b149893c63342a1157b032

SHA256
549a579ef76c930d8a73bf72beee3ad4452d0a371249dc0f1b556477bf9ca03d

SHA512
81a3ffb9bf6613acc8609fd8e5d4ed6164130dfd172f75f6df23e2a8efa885e53ac9434329f6c96dad92d664eaf10a042883fe9486500c35375c38499f31a467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9e9bd9be39991b5a14d0bf8bae1df5f

SHA1
8a9f6688405bc22cacd0389c2739c14b04f07d82

SHA256
fa1a62bb54061bc4d0012e7e5cee32b7109aca1efb2affc3642930880f0d685f

SHA512
3829ceab421726854c541a1debc4ba167d266420eb25afcdd80c0803177ae6529b3e477b398ff530b83ea89bc04d8f17a308efc23da0dedde99f11dd6e21aa10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df44f7fd055d6d216cd61f5d8e6ca43c

SHA1
781228c04ca8fa45a872c05280e8ebe845c14dd8

SHA256
e37ee3249a50625ae6de4ab214643a49ea3e1c3a2d7a87210eaeb4f82fc1f010

SHA512
4b72f46a9be67a52fa474b27b9cc69ae4f6dea12dbeac50c4982d9f55cee108600b9c7b43281940e9cf9dbddabe07e8f7e545703a4c075b84d8d0f83bd85eff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a06cda72dbfd3cf270ad66b8ee4ae75

SHA1
b9a233aa262546f6c35ef678c91a4cdc4694e08f

SHA256
8cd269d27cc8e594b3a6fcfdce4405ad6207b61b4967f7f68ca3748a3ff832a3

SHA512
576ea493ab9da75766dbe1f139fa6d4b21a7f2a1a5d5f6141e5779bca475108d22b9787c2cb6994f119e9a7135aab754d1c446f55db4c1dcaebdd33a65994094

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E43.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F74.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit