7c64f482ec0324fd0cf23ced3f6e13e373f7274f600c1837ae3da3ac975e8ce1

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74cf1bcb9bc3348b0bea2a5cf7ee5247_JaffaCakes118.html
Size

861KB
MD5

74cf1bcb9bc3348b0bea2a5cf7ee5247
SHA1

bb3bcc76cc5fb8180a58121d4229e6641cfa768d
SHA256

7c64f482ec0324fd0cf23ced3f6e13e373f7274f600c1837ae3da3ac975e8ce1
SHA512

16cb2da13261d447178cc4b4c9d624d46a80c52ea78eb058388a6cecfde4f954a2b6bb771f5b1ee9043bfbc97e058a84ce904796e396e7d85b0f210fd49fb33a
SSDEEP

12288:V5d+X3ZrscWy9dHv5d+X3ZrscWy9dHt5d+X3ZrscWy9dHX:5+1jT+1j1+1jL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b006458b42afda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000195c3c2ba1c94041a0cf947e5c1a6d5700000000020000000000106600000001000020000000dc7df022742758de2790a01c92f5f2b2cf3965a583b66639ac102edb92b0a238000000000e8000000002000020000000bca065953336d7eb28c0aba5bcb83c43a05ebeb205fcbe80739b611b7a71dcb4900000003442b0fd6cb5d0ae15d8bd82505b353b41c7b8d4fb940fba2e7f3da18eaca74a315658f33f7a660c8a79a47bc76e9e4f5cd158f8fc149b35bce20b14e180e4b037c185977e29662788d3778db80cfea99113118405dd2d4faf52919ba8992bc7987efefe10562fdb18b8ca22e2c7f7ef1d23ba8246ccee512188a644adabe7031713a05f4d176f47a73702052e52b69b400000000c79886252b5561ae52b5f8bc41d2b2e7a4fae4dbdafb0b43b104ec48207cae1df4f7c961fba6d63efa2e2c2dfb67f0e7966c4f9325b08ad8d994f034a0e5697	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000195c3c2ba1c94041a0cf947e5c1a6d57000000000200000000001066000000010000200000008d3590f9e71c0d29d336fb6fdd0522e64e4b1f8baaab6de2ce8b0e1c11732dc1000000000e800000000200002000000083851c90d1033e4ecac9d27ec3aa3b36f81fa3af8484152bd22f700b3ae8492e20000000cf843a39be4a51a73d0576b15897c00bc9b278795613d799b998a498c3f738ff4000000005e14c101d237d0f69bb515b383b40371ab744e5099dfc5183da692db680525fccbaeeeb34215df10a25229fd0c001ceb9575c83216852a827b72db1b5a7e343	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FF167D1-1B35-11EF-8A46-EA263619F6CB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422872101"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2172	2336	iexplore.exe	28
PID 2336 wrote to memory of 2172	2336	iexplore.exe	28
PID 2336 wrote to memory of 2172	2336	iexplore.exe	28
PID 2336 wrote to memory of 2172	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74cf1bcb9bc3348b0bea2a5cf7ee5247_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67eb309aeecbe3ee5f2db071c85c3cee

SHA1
728bb077a206d1fffa461d618195fb722cf12c0c

SHA256
6403c572c6e91729d9b69444605ab6d6023bcabc7740117daf11dcc2dfb169ad

SHA512
50b68896673d1c1883de4b3253d7b7ec6506ae403ad9333c2e8705b297fdb8d711ea57b1a1057b5a4597ca60d10c221fd7b3e841c78f06f24c9b4abce617ca5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdaccb47788c3f88abcb59999f3f7c7

SHA1
6b0660c5b2e2b6f9100e1ddc91dafbcb290bbded

SHA256
f787d28c185665e144de373d11e55caeeb3c19f71cd04e40b03cec162d7358a1

SHA512
8b0ad505e5e1a1accece5686fa7266c51c6e2a8a13c41634d7e97ba5a6cd41d097f90baa67d76323a620541bc3849533d5df4d962547194e93cead8cea966539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cc7480ad512ef675285fff8220772aa

SHA1
1c6a677cd0cdfd17ae88280a8b49637693c3318f

SHA256
706de87c454a4c4d736a6b41c0acbd8f6ae83d1134c6253f0dcda43ecd6f9584

SHA512
50033059458451143aab9288a66c166df5d1061b9c61f9b4c9b3f9d35bd3df53709eb25f1ff8e4283b6b73db091d767e061850ef76eae7783094d6fa827853e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04de73fd515aa5af24faa75c1792ce4f

SHA1
ebc57525921d60595e1282a2057a3c2024015bae

SHA256
1ba7e48b6e3c861d43d5d72caae4e542652ead7e2adb5fb41d00b070284e3fa8

SHA512
7b5d99bd2a3b7ad01ab807c902e7f10207615210c3c1b793b2e04ac305eff99ee2297779df57d73c8b2f273691fabd5bc86c4317289ac50e7073e85d0916e453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de6a24bbcbf795c3506dd84f297f4b3c

SHA1
7fac827422586a0a522e277d2ed49d2a3d39350d

SHA256
191cdb0702ab87ca78882d84c018963d182f6e9c88b28974926526bca3cdadc3

SHA512
d529a28a3e850df89163a8cd1c8589a3455890dafac799cca340614acf540ad7f2914e27e1177db95f82bca12737d1c9f874fa0b7e6a51f2fb94ad94f158a089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae1ca8612247eae2fb29626b714a10cd

SHA1
935950add16fca64d0813fc49f907b31dbba2a9c

SHA256
4c935a9d907f2c0e840c182d6234627a74739d695a501f363a72f7ffbbdb9f4c

SHA512
015c2e83de6760152dfdc6b50db7e9e30e9ad6e6a4f35f4b9f1bc6f7dc18267673c716f3dff8217932c654868f976c745d585c4936a9b550a45d04710d291401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff83424e6fb9f0aaa8c40b4505b7314

SHA1
7a3e0a512081128537b08ae52a46be01c3b85085

SHA256
31a6f7937297f1297d91fa3d73afe23aab0bf19f225b062923eabe81d74e4ca8

SHA512
936e110dbb929da3eeaa75ad90d7d34c05152d233685eda5a034fe42e2511aec0e05939e078faa38dda26082214c26df3d95000e33fda2673302c586c2ea2ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde7b8c3eaca9071117848115ec82c7e

SHA1
30ccfa2de6eaa5f25eaf53d7e7cd5b749e6a2a2b

SHA256
d92f844e12f8ede25e0ce53ad34272d457bfae340f1bd4eeedac5d79495242be

SHA512
3cc9d8492a1ce866746d195685ef29f5a24801aa7c1ab24e5e38e647135462aa0f5227297f2960e13bdbaf0a15ffda3d52aab6aa7837ea9a5c2b27ee1ee8d30d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92beb76874c691847555cbbe38f694b9

SHA1
57464e302235668a3398b02f41eeeb7fc446fa1a

SHA256
323aeabf1f4a04b199414804c5947f9203c429bd9735218d17dae889d61a8238

SHA512
ab694fd33c750bef8c537957233a06b8bac787b04e4ed63e89e40214378baa27e88b2d9f5ad0e46c2fea938da6f10427e8eb9ac94505e643fe584d33f79347e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30ee87435d66ed2e2ec955ea6d399d6

SHA1
441b7fc72aeb12fa770e7413155b2cd1cb3f9549

SHA256
fefb425e9818484f55fc87997ff8b1f16428b3d656bf7578fc8ba2bcc1768de4

SHA512
4e11ff9641433612d2f154c1028a63cb5982a7cbd13078fe0548643832a5e7e612e770d97410724b6ec9f05a505342ded27a42e977d178c3edd00bba9bf4ff71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab205D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar219D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit