b12a9781a7ff759959c81019895785a9e6c3c7ae73e2fcfcee528abb6e8e5e16

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

756cc15621854063a5bcfbb3cf637b88_JaffaCakes118.html
Size

30KB
MD5

756cc15621854063a5bcfbb3cf637b88
SHA1

7f0f892205593bdc5d5b89ab7e8eb5d0b28aa1b4
SHA256

b12a9781a7ff759959c81019895785a9e6c3c7ae73e2fcfcee528abb6e8e5e16
SHA512

64dc24a7716bc178e668a4daf14a8c8cf3706268de273ec01f09cfdfba1a737d22f84995cf35ac932de674b98c8283fd51a864776e651754cc3edf2a91af5b43
SSDEEP

384:ShizAHAip7lVKP6BOK0qASV3GM8peYuxESuWA2HuzCWNVdEldnmT9LooM6gwMHhs:SrBx9ASV3GM8peFCO+TEST96wH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f00b9952f332d346852766564efb736b00000000020000000000106600000001000020000000be51ee06d87cb18123d5b98915eaa60ab2ada4251f70da09d666d23d1638bac2000000000e80000000020000200000009219d7e14c22fe9bfce0ecc557a74af2cec3909ad786d84e97e9c69b396c57449000000082b0079ea6e3bcfa7604a6cbe733f168d4d86e637a53a26cc89413f6d9b96cf5588eaf9993166f16fa9504b591626abedd42357fe7f8e0f6d9e7a52989c99a6ab28bd3a3f4ef132905c2ccba3ce83dfc28df283e7ee50cdef7b824e0f9038f7b2b7f757580c2deeb665ad7eefb6e90a8c87e478d0803b585630a2664dc7630d273ec0b244e5c4339d6686c79081ff624400000005de8f88c509534724b17433c804f1151c29daf493fca60facd89b1af3d2509f295956d29e40ddcd2dd6431a429467e048cfefa541be48e62d51109f559d886dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422887062"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e4ee3465afda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FF868D1-1B58-11EF-B5E8-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f00b9952f332d346852766564efb736b00000000020000000000106600000001000020000000e194a931690c11c8d557901b07d65291aa8962e163e6f89d51ac32c91e454571000000000e8000000002000020000000fc5342cca8d99b27d8c8814e73abb61615ec0b4331915fded4eafe97454d398920000000129b8475a435b4a04ebd76151b375b318027f268eb7ce95dcfc418f022121ee3400000008290ab5bfe1c225f95b51419e5cdb61e7f5204f14ff8d3187fb61c9e3b6d7a3c5200676144ffaf3478c7489fdb30dfbaabc18386f8718fc167816d460128c54e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2912	2940	iexplore.exe	28
PID 2940 wrote to memory of 2912	2940	iexplore.exe	28
PID 2940 wrote to memory of 2912	2940	iexplore.exe	28
PID 2940 wrote to memory of 2912	2940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\756cc15621854063a5bcfbb3cf637b88_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c3456c2952af5b36f8160ebd378136

SHA1
cc5ba4fb91ef237bc4146b8d20b10f2ab4e3c147

SHA256
95e77147eb7af76c3998c28ff476f74db392b66ff9a1e05a88bc89230779d12e

SHA512
74db3fc86ab61fc0f689d21a94cccff573e249fcf3803d4ea32517051d64bd0cee73cbdbceff328cc2affa010736dca0a6dfb6badfba87fdb36286d100cff449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0bcd8a88c1e700a32e474dd71b3a654

SHA1
ac27e10a3e72f5b7fd56a690773a88bcf57bc19f

SHA256
5bc47028fafc8edd49b0ebcb201d8084ff51d2e7f20e685814ee23c1f6ce46b9

SHA512
3dec93fac1d8017d601f4f05219ca15b54c862e547c3490dd713c6d51cf2d0beec276713721a747c0a31bf2e381101add8d2a850e3e141b2e49b4a6f206a9a03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b31d4d993da476132d8496d62a1cdc7

SHA1
d3bd52ec541a447b3422e34fc26fdc1208fdf3c6

SHA256
2eef6b5103ffe05a957a305c7000e852675bd0d9dc074b6c2ad1332d0e19f52f

SHA512
540c82ab72e3b4a948becb974888204f10f5c525fe5b8ac202a0a86f444f00a618bc8d0e6d5d032d936024d847912f632ceaabc495328fb4a73c48407c37ecf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
566fbf5eb637fc87289c8fdc24ca6dad

SHA1
d4d66129f348c278bfdc3b065a5bb4d31ece6167

SHA256
8df4029002107c7a934291b2876441a0a8be3820c1196ceb1d611862358e1726

SHA512
d02a18b937059dd3071ade17a7b973f30c6204714edb7e5bc7ea1567231e2b3a698426f15e234260d60a6c2b8c6fee76f5b677c8360f1a47bb337701f3af41de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cdf626613c5aa1e5303669362b44b25

SHA1
d0bb91cbb2aed94a7faafb38e2d41451f6525365

SHA256
14278c6c9e3733f230590e6fb982677974ce3d50e8c48f93b7bfd88eef2bb9a0

SHA512
5ed82bc6cb44eb648d5866a8d996592bd53d37fe0f081b883b3960c686a8610c1a0be8a2e0ad5a40712277839c666f3e8d997a45db27db2314c3084d8bdf5a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803f7067be9709ab559df8eb634d0bac

SHA1
c970e240615f37b8a1abd1048af3bc0ca1b180f7

SHA256
7261fea299c786441c56c7a8e055fae07ecbb761b08498c7e1ff7a5a4538bec1

SHA512
b10fb2ddbdb2ba1f6d93d68851a01412fa237acf8fa6ecc7ab25c7dbb121f6984e3d429c82ee193ab45b48db1b30792760388d623a2d7b901613723feec58d12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dab2d0cb9cc7154ee55e6a53d6113b5

SHA1
3713d8aba1f763a9a98ed09d9e636c5532460f48

SHA256
31abc9976639345ec1be8523bcf08ae095e57b337cca0832ea213ab7ab469248

SHA512
211a5048e0dd3a9a92424e852e2fcad9caf8b9f4ec0ce8a5aad758c7c814d70a0ef1464370df37ad87e1b4543c8c8a76b316156d9243eb1a2f22282a654b8e8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51cdadbd885a247756ad94697fc3a2de

SHA1
630920d04ecda95d1b0ca4a47dede5686f429e84

SHA256
553deb1965f9938cc60a0655f2bc23243f4d972dcd5f7f7782f6aadf095602ef

SHA512
13e1e7ae43b647554aa1359e0083f22f84f1a170ed536b45a1012c759beb331f735a6aa3b8c2e9adef6edea0907a07e57f676aad998fbbdbe8485790c4e7fd83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a105f083b2f618cf0f769f44a830eeb1

SHA1
0fb0190678085a96a0a8a96bb0c285331f56071e

SHA256
1145fc53a71a181bbd074163a9cf52e03b3bae331cc18d01d4b051aa2a4a5e39

SHA512
7aefdfe3444a553248c253f34eaf8e66043c0e831c22947e91b742e3ac75e3a6eab049cc48866251fd0174af860e6391438e3adc05e962995a9654034555544c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3112.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit