465124a5b618ec58aedabc77ef69f87a10c75015e087d5ccbfffedf07f1d8979

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73e9cd108207bdf770c3fb79d19f80aa_JaffaCakes118.html
Size

125KB
MD5

73e9cd108207bdf770c3fb79d19f80aa
SHA1

ac0907ba6e94a5dfc984f9b465026ae6a6d13bbe
SHA256

465124a5b618ec58aedabc77ef69f87a10c75015e087d5ccbfffedf07f1d8979
SHA512

4ca302e6dba08d92eb55f5fb2d861ae48bc44f3de8284c493688af952964733cef049b529c4f27470f8ea9f1b229b3dcabe2215e8d63978431eb385b4252d919
SSDEEP

1536:JQKH5+w1p4NuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:Z91KuyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C578CC1-1AFF-11EF-AD96-EAF6CDD7B231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f3bd656387280b6ee3d84f87fcf202afd04490b72dc424d01ec71e7d3572c203000000000e8000000002000020000000ce40aeca0738ddf4f40bd43b4b95d3745ba2ac6ccde1fc4eaea9505392bf458f200000002adce18eb41cf11112cc8c32b98f5962d2de94120d907cc6fa05ff789c84eb7f40000000c007abda51cd4a7fdf4eaead66cdddfb2172167516bd0086114073147a5ba5e074d076c264df48344eb36fe8d5a73064defd9c20ff785e4c02cd1c332bb18185	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b30d110cafda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422848767"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ba645e0cf166ba9f3e2cb6a98badcd85d57ccf16102e83865c1e0aed6e821748000000000e80000000020000200000006008be59e23e43087713f89001428236dd2acdac770c3463a7c7f75849d6774290000000b9ddada528e2bd9c64354270df9285905fd5fc0e9b48892d07fcebd42f9c61ba740da202221bb1e05e0df9c8e4f55ac39bb4bd8f676f75aac50cb3e6b6fa4bdbbf92b5e3de8ecb7167f41293cb3fcd33735f1aae670b5e30ce7d0c19d0de8b0525ad8fd3d9c5a3997d86368e3df1f1fbd38b2f61dbd25284a1a7690ea51bfbe834ced716a9467dd52fe5eb06f0075df040000000036c4f5fb64c8cee3dddafbe061d4a2fe217c0b1541b7808f1603bbc24c096b4e3c62bf50a8dce131e3d4263bee9d06106723e8657a80245e4758b6078279509	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28
PID 1280 wrote to memory of 3020	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73e9cd108207bdf770c3fb79d19f80aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53d1b06c2c5fa6b3dc26e91d4557f296

SHA1
97ae7bb7a1cad8960b2761de07cd150fff9adbfd

SHA256
505f95b5c3620050c883f4127f235bcb76d5be76f233fd792f2af203205d18cb

SHA512
336c037c008d4cdb3564e2b746661240a32a743a3debc023a663b88851172e3cd16097a1f5d9e4f38b7970f3b7a326394184fea5b0356a277995341c5e01aebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3a602ea6a27aba05974a391bc4e731

SHA1
45f80cb82d2a15e12eea9e2f0e80c96032d8c004

SHA256
e8391d48793cb96478192be282e13c0452f3990234066c96a623f5d84452362c

SHA512
9a69e534332bfb3cd10b5d84366f8f81b6474533991e62016f9c8cce67993d61d094dd5580d755287fb3792ac1761696d85d787a1a233fbe3d62bd2efb23dacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b7011c17bea97678e2b4a64104fcef2

SHA1
674c1725ae6a697e878d88cd9eec4f71fe98ff10

SHA256
c12993ef6a2b2aab0cade8a153d4070875bc3301f6d6b6b1f2eec7c1ff3d93d4

SHA512
78130e023afadf907fe593408e26054b2d2310a6af8a3b1101b46a3644a88887a7edb4af954999d1ed8bdc018e9a10dc4a09a5e2ea4272f7f7b136092829361f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58766d50e5468f0f68232811b5bafb39

SHA1
095549f303fa3c264e9d02eab0d5a52844baca52

SHA256
50dd84e3cbe0722b51198370d82ef6ba85a374d8c9af704718191f5666850806

SHA512
bef45398d49455876912b65c3fd38ff62a33dbf3236035ca82cd0b627e10d5c05ed69a51bbbea1738c589663b707ba18cc32a002f4d21e202dc05fc2dd77baa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3987ff9da30248a5923ef3271ae1a4d4

SHA1
2b277f27eba774ca128d0be3d0ebcba4ca4addc0

SHA256
136a8b260791ee56c58d6f60cede420f702c4aea8a2cd167fe9162167614be43

SHA512
7d6e02d55f2915e162e00d10203b5123a14b189168bda1904fad658c10419a3347d25d6579ad9f2c5d34eb2fd3e4cb7f39e41094e3dcbd2a86cba2923de1c389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1133310936d5a2db51ca4905832d38d

SHA1
d25f708e406892b21488bffbd928e63302cdfeb0

SHA256
35c07ba8e59823deb343618160b1faca94851d19ad9589f7e44a2d28a6feb62f

SHA512
51d32805200fc940d59e19923414fb82170d9b5894d00fb21480aef5d0787422fc48c14ed7c2cb76e2be3304a7ef428be1e9c1390719c4f75c5c72df35b48d4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
779f7356d8b4d54292c0e1519788a4f3

SHA1
6b134f71b40ade76dff1b3ca622ac67893cc10bd

SHA256
154a981e3d6795bc5208578d8cef7ad759273cc716c73c6909f01634c1fb6d28

SHA512
b32156654dec138a23d88ade9c5c6b92b8b86b2d6ae7c27bfcaa8a06223b2b60381d1976bcf018c2ccb041b911bc585870bd45052dc2f500e9771551a3a8e0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3972b83309e6dfd4dc10967796f565

SHA1
1015408c802e49394be4344238edf3ba5f1d68fd

SHA256
9b1ff51efa23e368abf3fb1136ebe363714bd0aa4a2c40531c5550b5c869846a

SHA512
35c6b7e86ff453285f37c8234fcefb6563e7878b161968f4a0730b780a48fbe7bb5b67e794fa0792068ca4ec842254489e72fb80d59c02ce0b73f17d401b365b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19eb38f238df2af0ad23ba6f79afc64d

SHA1
ad0371df147c2902fe50b33d9b3affca30d2c797

SHA256
1caac3aa4101b5736e42fecae09fa2cef9574694de7932346583cc6bd633d676

SHA512
d6dcb5a1b25212e1dbb4e34cf149f792aee914f106dd2e51387a4c7486a4a0e241fcf71b17dd6a9d29dc8bf9395623a696c0d7d6a902d558320ba5bf58746602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b09ba04ba37d0d1726745d4c8a6619

SHA1
e7804e4afc41c033fa4c608f4fb13005307d4527

SHA256
e9c70f8738c5f77daa02f30143cb7cabb983e717df2c2d9a319b49034e98c6e2

SHA512
f81f3f0943e0ab26e7644123c7567ed7208eed36781192d26199681bdfdbeb4471510ba63a039d10a98eac712073831dc9500bb8b4985798bdddcb6d0d3d0f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59636ddfa797e67a8d7993d1e1b42b5f

SHA1
229097bda2caf73ca09198e6dfe4570b7ab11c72

SHA256
7ce0a2d69cea2140b48f3e6f68e3dd78d0992f030d29f5eb47b5a51291fc9d30

SHA512
d98ee149ec6f0408caa8ec60d12c255a998a77ef3a8250bc063207516e64f2964c760ee3c7f18b3b077f94477ac90cebc8cc5af1744401689ece0760f36045ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab368D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36EE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit