860390484f03ab2339381c173497b6bce2e6b4c180f7eac678db124d833ac48c

Analysis

max time kernel
136s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7acb9b74cce4bcf24e14f3bf47f705b6_JaffaCakes118.html
Size

11KB
MD5

7acb9b74cce4bcf24e14f3bf47f705b6
SHA1

df476e187c64e4f567f8f4669a5aedd8c5f9688d
SHA256

860390484f03ab2339381c173497b6bce2e6b4c180f7eac678db124d833ac48c
SHA512

c06930663180a551bd5cec56aaa1c7219f4fa9a8dcc80c4e9baf6d3de474b46825dd366c13784196957dc0da8ab79af055d90d7425260a601dd4420b128527e7
SSDEEP

192:/UkzIFJ2mUlprFkIdf2uffq7C07p7sCPwKwwzs2kIIbKiPwysqKfQyZorY0e5q/K:0IdFCPBvC/wSq1CsCsv3tNWWpMqf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9017914987b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1e0719c4f023446876b114de6ecada00000000002000000000010660000000100002000000034e85b9ca1fdd2c50a867b16f03f5f63bd44be30e5a1fb916c831b56b4083e69000000000e8000000002000020000000b97d864da50b644cf4b07679955f0c56724135c92693b6de70e3b4da0c5a6cdf900000004ed8cb250ca6c708a7df3c819a7fcfb0a129bed9946ecd16ae3a8a3c3f704ca0c27342ec17a15902db95f2d59c6a2a5453a33d759a278cff2eab940fcfa3a1b7e7c9db77592e6c6d3a670e76004e53adde8d3165b43943ca9d31b7b4f86ea8512c78cce1bc43809f617a07b3a5354881d6200f9b6d74ffac5c11184af34b7d4b52b8abe015e08834b6b968baa661dd4840000000616432190e9a30d9db4ddb42954b650782b42c72dc5bcff857e4bf33da30f899f1a2d375406d4ebd2bb8a662d5db55398a8b8e6c473d9fcac4fc87b2b62c9510	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74CFCCD1-1C7A-11EF-8554-DE288D05BF47} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1e0719c4f023446876b114de6ecada00000000002000000000010660000000100002000000010e459dfa85730e79ca9ce5a388158abe6609e605fb0b3c78044fcd87a832ea5000000000e8000000002000020000000214dc02a9c792a736984470078f93594b656960222c076ba2c32b15b6009ecf920000000a4875afb008e9031bed6a01f4150084ef42360afeb8620572f2bf489af576378400000006e77f2e6525e9cbd633d9a14cc9880e2d20aaaaff372665be25d3f160cc4593f0db4de6dbfa06a3047fabce412d41df70a2c3a7b65878663f83eec99bec230df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423011642"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2804	2364	iexplore.exe	28
PID 2364 wrote to memory of 2804	2364	iexplore.exe	28
PID 2364 wrote to memory of 2804	2364	iexplore.exe	28
PID 2364 wrote to memory of 2804	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7acb9b74cce4bcf24e14f3bf47f705b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f183964282c7c7e9850240b2b19448b

SHA1
3b1330c783da9b6f282f299650d1d0c3a691f9fd

SHA256
9191e14dae06fe8233a6f1d4522e4531aee15d59f796d1a8f7826478232a4eeb

SHA512
342a737ed295603efc064870dcd33464ae0c52609e2b188a3d4d0a97ba449fffdd44a05ed9718b101cb20e988b37e3ee5c81973aac411152e42c60cadbb781fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6de249c32dc65d4bb49065dc3f9b37c0

SHA1
a1374580c52afb1ed03c029d2e127cee521126e3

SHA256
6b34131bfa819f601d7cc1302d54777de0f471af611a3d66f48ba364068694ff

SHA512
1683295dd352289bfff3b3dfd704bf4410f4003265cb5926f3cf0db46f903e0dad6c72bca8968f431127699a2e8156484ac8b3ab26132e5b1236d59002c0fd16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41bfd69e27864a2743831ca4d1dea96a

SHA1
f421d90b1b00e56f26d4b5f4d25ea6e5103951b8

SHA256
9f38c6f554c0f2fadb657df75bf5829c70308a5fb0e1f0ecc5a00fb253432035

SHA512
4fd1a9bfe1688c043e01f9152d1aa4477454ae9f16410faa071b90b7e445a52c19fccb54869ee90a97db63d631de13e7e3af4167cec797dc38856922744d94f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58d2c4c525531584650d96f7f0c72a90

SHA1
c886060d9349b86169198e0d4d99f2f1ada4a5c7

SHA256
8dc53eb1430f4ed9609fa8d246f4f8ed9fa1180da9864fe2a150274055b1caa9

SHA512
2f5f06db0da14fbc9f3cd6ce9fccd1860780ce0a6ca51d4ec3e5883aa7e04566603354d0782f32af5a91672e6f45cd434824efecf1adb71cf8dd951ad6d3b87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e78e160ed6a55ab4a9583c1407dc86b2

SHA1
22ea1cacf572c3cddb411e32b3f07a74dc3fc624

SHA256
9017388891bee5dc47c5beaff535c18f5d2eeb5e26a15a3543453c5624194715

SHA512
dd2ec6301f1d978e5b708ba4c16d56a1bb8a704c1030f1aa0d4de83aeeb16286f85645f67bd81e0c7637f3f4516e4b4a3f82eb7c6b21803a129fc147b3ba6b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00209fdda410539b74a2a6fd63d958f2

SHA1
c7a91eb5be05f2893881b8678221ecffba1bda70

SHA256
b568c02ca31458dc43027d9dff03214bc862c9703e8a7bb3a541afb5292a3451

SHA512
71e03b82047a264ae7c043f863c25ad4cdfd4716560fba1e9e668478d94f5ad046c7cf294707a20e96da1ec34ec18e614e2f043d4263b23156cf97e3bd9897c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9db0f1047efc932c48da14a7125b7091

SHA1
d0a6b5d1004e1e631854810cd7d14bab6cd868ca

SHA256
9e1344ebc49a86ff0b7ccdfe6afb5c34283744420e60aa7137a30691643bdccc

SHA512
89da75c39e26357d2f764b23b786651908037a38927383cf50e81ecf6823eaad7a3620a0dc4fde67dcbc121dad42b5d57f9b4655881f060b7c54e849f39976c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25ed6b90e92b2e48f03593105729c70

SHA1
5c02924cde16bf4306d230c3d3be8707b166e630

SHA256
3f724bec33cf40e07219570511073abe034684e86b865dd7f85e902cfc620607

SHA512
5ff8cecafab9ec8ffc02f50a66d4f1875e0393ac71f8f1fc3d1057d081868174e3fcbcc9a5a94cad5c612221db9d5afc59faacad6e4d5dca65a9bf06a14a3510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22a6744ba6dc18efdc4436a411cab216

SHA1
a61ef1e15bc4f4b9485e1078df1fa249917d823a

SHA256
3fadeae438764c3ec048e2dff460f5ed73c1b12529a2cae7a1402e3f800a5c9f

SHA512
2f74bcba45df965e56086b71cb5e0a54db089afee74e822a1616dbf4109d368b5ab3745c164f0b51bb124eab00621eb28b9536d9a6bf7c241bcdba2fc6560d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar241C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit