3d953327df4838fc0406fec9c084aa239a97944cf10a5ccff7fbe517b70e21ef

Analysis

max time kernel
149s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d1892ae54ab01c0e501e890e68539eb_JaffaCakes118.html
Size

16KB
MD5

7d1892ae54ab01c0e501e890e68539eb
SHA1

40f4ef8d5cfeae3f5d80fe99f693e96b8a247d63
SHA256

3d953327df4838fc0406fec9c084aa239a97944cf10a5ccff7fbe517b70e21ef
SHA512

447d009c636c4f1570218f2263d93b71040c72ca91dbfc2b369537dab313a8b4ee82765f7b03a8e65364fc78bd018aa825ab6625c75a75ceb42f4902238b67ca
SSDEEP

384:BT2bPXRtwI4yfIdCw+XUJ+gGPsJdPtSxOhd4v1A1gGUub/IzlD07mku0UuiJ:BSDwJ2I51gGUub/IzlgW0U/J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007678d37ea75b904e9ca4d1ab7abb142300000000020000000000106600000001000020000000eda9cfb4a3a597e35bea74ad266647075ab6fe3b634272e62ce95eb189c4f53e000000000e8000000002000020000000d5558b638b93679017bccbce129f9688f847e4216cb303d59b51477822fbe88d900000005d856e048f2f9bfd1bbb03de8350c0f7a63209df71a80b4824f59bbca6bdc3cf88b8404a9f987ff744d1aecfa450ee74f4f90223b67d9704789fe397cc3fd04dfcf9fe817f6483ac17aacef91bd3e28fdaca87d072bd5af0e02cd4541de18372f83ce004754077266b2237bfaba2506ad75a6d358709e1633c0318cbf5759ef7771372db6a7b88fa51f72f76babf0e8c4000000014934f3f65717a04d6eb895939d839ebdda44b8db1bfd1fc90c925224c8aae95b6a9f82e99f25cc6393a981816e0531c6ca6528f512e387e378ff0be61b259ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007678d37ea75b904e9ca4d1ab7abb1423000000000200000000001066000000010000200000007fb63a4fe7fa2b89c9d19cba2318f606a0b429810588e24192b3e2fab75907b6000000000e80000000020000200000005e9a1aaf1068570361a70943914196830312f08329b7854cee66b38247e65560200000002a2f0f9410a05005482e680f25efbb88deb7f1ef94a3f4bc623320185a896079400000001cecba481863980dabb5b5bc11e99dcfec91d48b3028311463156736a031feddde9ab06b3c8dc140ba6e70110ca6f73d66c4f42bf9f8d6110bfc1fe9cabfa0fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A28D6C1-1CF5-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ed953502b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423064321"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1756	iexplore.exe
1756	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2640	1756	iexplore.exe	28
PID 1756 wrote to memory of 2640	1756	iexplore.exe	28
PID 1756 wrote to memory of 2640	1756	iexplore.exe	28
PID 1756 wrote to memory of 2640	1756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d1892ae54ab01c0e501e890e68539eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e808c6f30589f190cb6788e31949c8

SHA1
5f09cb5af449810b3227f60ea1fc519495947a7d

SHA256
80c1dc06425ef9db9e22ab3661a5e1bd61efe4334c60c23a74aed056805d0ddb

SHA512
3dd3c2a294c15629eeb7af644c3f94649b17c358d0f7b4267a426f16d965f098772af1e0c272863504530f121d4fcdcacd0a44f8761a8348a978bd71dd02b131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cbcd8978b8c2b68cf7398e5895eca22

SHA1
84343584085803fbe0c3b837a00fa17145716d4f

SHA256
00c9aeb89c27ee2cc1aadd3d8d892d81d2056dd9a80216eaa14013e6d5c58549

SHA512
fa6dd0c213d36e341501e3dc4775a107760f164a056ba568bfd008de6273bf964eb94659c1fc981f733f174ccf47ee3ad82f2eb461f834e1a4dab749215d380d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b7dd0dea954a665a46433d184c7b1f

SHA1
2619a47d9060c4fb355f047bec70755f8d24c3e8

SHA256
57fd07ba2d3fea1ceeb9a49f08e946eb554a922f7ad7091424c1050ebbc40878

SHA512
81cb7589a32777e6a63431b9e1f5a35f5cc12e24a59a1226c506b405f01d4d1fa35a7000d77640a272c82a6737c55a85175f7b6878582de208da3140f5814bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe2fab37491ce78ef9dbb17b9bcee21

SHA1
f06adc12091f41f0e00eacc506b5ffb8247dad70

SHA256
af68a30c984442b12998d60e557d754ddd82858e72d998120aba2c42894ac794

SHA512
8d368ab9065489db96893b9b8c4bbc6b4c7e446faab56a5e4652e98ba825eea45f3bc28a4dba256206085ffe8de9184957732fafcc9e8ec0a0f6fe51f5760754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
065078d24ede7418df2f54508ca00059

SHA1
7de4c4e9adeb5fb9ed6605e68e3aefd21e939933

SHA256
37b5f90500a1cbf688bdfa20544335e31f6aaf19b371a5741f7d7d9ab05b10c2

SHA512
2acf21f26a3365dc4170226646ba975b11bcdb2bd435e8c3033c8289b8a341baefdfd2860795a13b0fa4f722bfa48ab2208dfe6a09de8a225fe38b064f2cddd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01a36920fe0ce5c81d2d0979a9a5a9ec

SHA1
890ac9b13d1a1cbfa184cf4ba41f830a989fa53b

SHA256
0c8e3fbbd44989f59c6f32818d9f0b8e1ca41d43a914ab3ae23f2e0cd0e9b48c

SHA512
b5049864d96eaad8d7b4627fefe600bf63d2dcccdf06d01ea7c4a6e05b55d3729e33cdf7d20d5c95cb6b82a1a1358a0e693b6fbbf70ea280096a9f973846e654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e012f52443ef21c26081b110982d41

SHA1
cfb9fbf54cc62e398ac04add2d60d19dd4691d52

SHA256
0a22e2b40af56a74e50bd7b1cc1f6f71ff947560496774bb1e03ee662e121c8e

SHA512
49475bf68d4722ee35d57f4cc141bee553c47b6058782856efc405c0399c0290791897432963c471ce0fedefd71b72ff6fafa01f7ab0898273103bad2030e73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcbfeabfae755f1838d4e2030865de7a

SHA1
a7fd29dd1ceb2e45496f4ad6941826a779c189d6

SHA256
92297d3a4a58d87a617dc7dbda48a75bf87d5521679155fe11ff1230505eb370

SHA512
10fd17d158eed163d5b316debe2f9c186ad7b29ae5a90b9bf3cb5ef86f295b34e85e9607d153a9e59657c690cff445c9224a47e7ea5b57041b5e31fe6ea61416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b8158c0fae02f54f81018207e4346a

SHA1
90791bdc97f0c6e347e77ef29135a50f2d3e35bc

SHA256
a72751ee0f9e0802b67f3c183417ba3021896e8025157b74913c9d37d000ccf6

SHA512
fa5c9b6410c7da84d4e55aff6a51015b09fa894b165f02b172ed00721d688a5884e5cf8177eb5931b2551cdbf386bba9662a1aea015fcd74371d2b490ad67d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fb5de110c3f80bd0e375b577e14905a

SHA1
b5bc4477e235cd8323403f94e5785c87332dfd9d

SHA256
146acabadf6a1cd23ba9229062562dc40957b3532f182e3135180ea4338dc5b4

SHA512
c2411d163a15fdf1047e5bcb06233dcb796734d27aa5804291a9ab7c011a7fc27d75deb10ba9f4935bb9fcb2b3df25c17c9e72185acc5d8d473ddd1bbffa7952

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2474.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2593.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit