b3bcf82bc321d62ee0498572a04583477a837212c9f58293b61dcee16044778e

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

760a54917288e18dda9548f6e03780d7_JaffaCakes118.html
Size

371B
MD5

760a54917288e18dda9548f6e03780d7
SHA1

2ba0ce442090292ca4eb934e575632c49fe20785
SHA256

b3bcf82bc321d62ee0498572a04583477a837212c9f58293b61dcee16044778e
SHA512

7250dd1d9f0514d8fd46aadea5c64b00e192b93c1349c077a58ad07fad9cb671c0032bca0a28f0f777b5a22331ae9ac077693e9a1df4a0ddd584c8f6e3b608ad

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74E7A181-1B7A-11EF-B904-5A22F41CCA2C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422901690"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000019efa3b95bd5d8a83926813cd5e643e6f393d0ab74ec44c3386184bea511c376000000000e80000000020000200000007725fb6efbb221d6065cea6f602d2dc5b0b574ba2fb74a7a18ebd000a35aa4fa2000000035bdf7c54af3b311bca9e712a1b66f6e8c8c5e5bcda51e61708493396456683c40000000d4159d04b0ff9bb27fc898b9e3439500c1a01f50bd1dd5c4af8b9d500d75432f8a40328b5e0794a85face90dd98d338a3fffab9c39d0fbe3600d772119198820	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e96a4987afda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000eb484c91172ebfaa877b9cc17df4fd263461620483acf9b5ab8212d4ca54c0f4000000000e80000000020000200000002789cc3757382ff282b5428f831668de2ac9c04960bd0666e2f16bd29694b104900000007d4896c4531d0f7c75f8f21dec3abc5cffd542eea513a86f43d06e895297b69d1210a0587622cea43d3ef3acf1a88fe2b98d35008ba7afb7acadc3bc7ef6572a3e2dcd402c3e83c187a89be8ccbab5979ade597dd6f4eee2c493dc17d1e097536eb9ff7f1550ce9f39a1f8c3305c814c1d34bc44adcc15e2eb1b1cf18ec48581f726778a94a7b1381b219c76ddb63c5d40000000e2f5d7b8203aa60048b2815c5eccba9ba9ca3208ccd68fbc65ad99ec6aecd2cc848d7083546302d719d498b8b26db9c4009b442e52cd25cb3f66467a2e519160	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2628	2432	iexplore.exe	28
PID 2432 wrote to memory of 2628	2432	iexplore.exe	28
PID 2432 wrote to memory of 2628	2432	iexplore.exe	28
PID 2432 wrote to memory of 2628	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\760a54917288e18dda9548f6e03780d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd3ae94310109fc2c5464c94c76fd82

SHA1
8941d829db9bf84d14437c358cf2b779912f19ac

SHA256
28592b5dd59ca05db6d3684f8752780109ec9c64e9f9fe9cf9139107075aad31

SHA512
3ea41fe39cef2173fdb7f7ffb5a78762d6d858e0e0f6e2ee95c71bf10ad36041497f1dfe2bbae437d80771c3573ff0abf3c39e1404bed25fd412ca12e2e6ab03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
372752813dd26a4482fb76dcbc9462de

SHA1
f36fca9bd1b8500ee4b8d949b0d598ec75d0c137

SHA256
a7d4be30aa3a6f2dc0ca6f477409a9f66fc51bff968d143db2c841692a600708

SHA512
eb1336576761acf42c819e9daaefb0e68456e6391e0311247ba5013a6040e75e6d2fcabd7a424752c53b13b13b0fd1ec6a725438fd986dd4eceb7fd50babf433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f1f30b0a6013866e08221aa93786eb

SHA1
3d03a1b73d53f097a037d3657c24e228421908ec

SHA256
3535dd5c5927fe93710d151f513125f457791817aa82701362da967077e5f2b6

SHA512
cbe183c9d1f5f92c1951c37f8f67f01430adb3cff57d484fb8a6da73706af01da80bb3d63778dea5515af7a72983077735a2f3c6b740994d53d53121c6725513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87c8f72560931cc9f3b50a1a11e9ba15

SHA1
61a934bdd22f45ce85f11de9b637de1eec82e273

SHA256
ca7713324051efcf413ca5dfb36342f72eb0c7044ae96aac3343c4ec079afe43

SHA512
7f4e40a3ca21772fd1f469c023be4279deb60ed8a7ad9d684b0802d941d434118369bae7d3636328e2fcc567ba7efedef08c3af52d29656647445222eaeff6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d0db9c46d703b3c65bb351253899e85

SHA1
35164c66789575fb412a0b69151add6ec334c5a6

SHA256
de74c925321eb4bff88bc9c1ba4f297cab8fcf30cfd87789cc4f375349025889

SHA512
a936182d6e05b2a4e5fd57ca73eab1cd4e9ad5795edfd6016f14cfd560e0dcf6804195d76d316972df39d6f2003a7b50c17f0c2d8c7f0b9a8773e27218d5acd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42acfb6f97618adb4f61ab9266593015

SHA1
e85e5b303093c510de0d59a61c13837ab6f187a1

SHA256
0bc477f3986a97afc1ec61363415a240032eed31812c984339f219d08c5e04b1

SHA512
b98aa3570fa72b2eaba2d053e832b7f76684b659c455556ae2d3ee08774d5ecd2e1c956ee86c16a69fa99a4bf2f7de206c891e89cdda6a98294b10daa3869396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d16279f0f4401aca524c98ffda5f1e

SHA1
825e75046833ae70fc34ad126aa775a03454e213

SHA256
ebf2f46398c978b7b0a408de6570e92d2f745c8ac0f3b381de9d61c6a82d8de0

SHA512
f22b51190aa32c3c9176d1948e91a5605297b908a74fb77d85ad3d4e85f564c428127285619502fa3cb36a481f97cae035aeaddec83bfeea2236c1cb6b5e7a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef6b3a93f529af09726bbdb0ac70b167

SHA1
c60a9033e43d8bec778922a4487aaaa76a611762

SHA256
2e2674484475e881755028fcb9e4e8b99200c31026833f3d3f2f9caeec62a706

SHA512
92060abc641af755072accd3fbca4c543496bfef8b566e951c08b5d44fcdc9f856be264db06e52a6114f6c8ff8ed671200c59e0a944f6a67af1b0808b93491a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b26da0aeb68221d731c8c3429ab16654

SHA1
2353bc8596043e0e7643032b1d03bd93c51d2e47

SHA256
90e28351658c153115ec2546cb022cf02aed7d92b61794032fc037d7844a63d5

SHA512
1fef48982c5d4bd3f13235b845a9f9f7dc7d131a56e0ed9857c5ac15a1033919a7cec3acaa7fa735f5fe3d4f6da45b319b4a51f13dcfa1bc8370f11f0b5e660b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47495b1946c48aadb7087535ce89081d

SHA1
45255e0187ebf2a8a8f488ccebd7cfb86ecd65fc

SHA256
0857d7820c467d03bf1c7ea2a82f3f9049a51edbb745495514d4cc8d3f37b9c1

SHA512
d82238cec2f0c86583b9eec866ed2797c74fde2f0ce58bb4d35002c30167e0a8b8ab1400bef3c003553f4e74d5c430aacd7e0e8df8604e8716878d0be567dcdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581fc121faaa81a9cfc0611ab25f51ca

SHA1
3b91495713b31ad33abadb64fc4d6853df59ec6b

SHA256
9fcfee3150c3b486aaceee55c0fa22e1b84dc5801566ad848aaad6269b9a9529

SHA512
8359850962f6f3ecd58440bb0a82ce09d93c9aa4baa9af57bb55e20d909e7ef71dd09889a1a55993472af3ed4e4ea2064df97f00ffa84263c6100fad4c5f90a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2658.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26E8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit