897b7108f253f9b70717f1c51a065f76da6785b8b9e1bc7d5e3b33356b4c7e0c

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e1a47efb060965b6aebb22c82b81d9b_JaffaCakes118.html
Size

461KB
MD5

7e1a47efb060965b6aebb22c82b81d9b
SHA1

2dff88e662724976764506482b4cecb92a2282be
SHA256

897b7108f253f9b70717f1c51a065f76da6785b8b9e1bc7d5e3b33356b4c7e0c
SHA512

27045bb3f412658f9a55158da5ea85c4774b93954163eb63d8fe9dc593019a0f7251506d98b01cc7cac85b8b46052740420c1e3db4f92b136b91a5d6eff1a2f3
SSDEEP

6144:SzsMYod+X3oI+YZzbUuQZsMYod+X3oI+YosMYod+X3oI+YLsMYod+X3oI+YQ:g5d+X3u5d+X3E5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008d59a64d11792b8042a9f4a80e5f709864be57caa78dc0558789fd5ef1ecb301000000000e80000000020000200000005b1e32137e29e01da0a133d7ed78b7492b05ca0090645db273dcf18173aa957b90000000af81916a47270a7e2c09cb9b448bad55e15f403959900c2bbc69a5401ed937ddb02fa5a3b2e9eeb1e81a454a5593aa09df335ea239b24567d220be68997d4ec6bc74227ba214c9ef70c7dd6b6f10a3159a6aa3f78e11f83cc774e97a11d382c6603cabd0e0f11f9251719a9190f8a66541757fe291b74c771e4e8bed8683d5ccfc280e03ea2d09ede2dd740ae13acdab40000000ab34708c49e80417d52fdcecb46672f639a7b6289c297577b829a37d2d24456f4069c56b803053ca8e8eadece91a13d6ed848a3572cf4e412e8516aa1c4275a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA15FF41-1D27-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006924ae6c46cf135bd5d4c5b0b4629cc88cec05d487b32c91d44a6bc326e6cb96000000000e8000000002000020000000ea81a448d9c9394dd8889f3f1b8ef033a4d45c110eaa70d50227c94e436cf613200000001786e9455fabe5e59988ed21ff1508e561ef79434b95edc8ef90f77cb1be179940000000e87651b2b5d0badd51fdfdbe4d8c1e714536ef3a1d3c3da1a93ce11b329f0ba05f913568c205deb883a6cc8040e60ac8041318cd00087b06f9ebbc2fa7e432c8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e067ada234b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423086089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2456	1708	iexplore.exe	28
PID 1708 wrote to memory of 2456	1708	iexplore.exe	28
PID 1708 wrote to memory of 2456	1708	iexplore.exe	28
PID 1708 wrote to memory of 2456	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e1a47efb060965b6aebb22c82b81d9b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
214ea14da89fde86cb8ee0ee98b42f6d

SHA1
8ba0a3664e54835fa85bf6c06f2590057fb016a6

SHA256
fbcfaf034b60a2e78ebb0c4acfea08a4b3c0499cac2f4559521140f9fa029a28

SHA512
8a8879949a0d3637b5c7e1b9e223e84cb39402c78e21a4545c8f23aa0202225993ca61e6cacda0ba5649236e6728ec37226293fcd40d0e01ed3920bfc8f112ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a74fd7dba2ed52c781f9180fa234da3c

SHA1
ce009974035209e3e08edf812c95e64f1e724a74

SHA256
e016f2ad4b3962d1c4b239bb48eecbe7ae71dd3628a8e3e120fdbc76b3529a01

SHA512
f4ac965511a4e440e0de0c52dfdacba2d6ae1362e49d08aa21f369230332ab7d282a0226ef91578100df283e76ed5792be01fbba081340d16d2b20130da3e9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd69078fa6bb62afd678d7d4947c5653

SHA1
26d23797978bdc3a170d80b74f74e24fb03d7cf4

SHA256
b26975c5d4fb0871c8e072cb678192104bd6c4b6d3e31d73b29c1d91278c4fce

SHA512
ce51e43736f3ae047755cdc23099283c6b379ea133fdf98fea3972aa035c2197b14159bae4bf7c7c58119defae647c1147643d5c11a3a93fcdf8b8a46fb1dfac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27bf662234caa06dfbcb5982be483d08

SHA1
5a99d60adb92e27ad2684e2eea91e0f80f49dcbe

SHA256
a699169c64b4e3eb31fc245f85f1dfe9718a556546499c5e08a9422f4f8385f6

SHA512
3c2df6cf6d141e28c1eb57314c390ab52a4992a7232f3e16315f7a4b65be0dac135bcc3c825e9fb125b7351d82b973c6bb635c57b211911fc7d22bd9c1ec1cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d515bd76a62dcdd4977dd93fa7a3813a

SHA1
67b702ac1c8016c3107e6ae2654a92cd4cfcb15c

SHA256
012236b69db70e68b748c48f79acdfcceb5abd00db16953b8894d36c04ac8098

SHA512
7040a085e8e6cab5e4a0e68499b4be096c165f3ce9f3d3fb3fd03600ff17dfc600a326b451b510cd1faa7989cfa664937df72fc0731b5445f1765c646ac8bd48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20043f885d37be7c068ebb6e421cbd89

SHA1
0799bfb503d92123ed6ba15d9e1a1adef8963a8f

SHA256
50087518b9bae118b86e06b83fc724877ae89054833ec3be89de2307f49faa7b

SHA512
431fa3af3958fedd4f3c3a770cc500d26cd78700c2f9fd2dba3bdefaa2f3e7eec74fd12090820f1222d5f8fee4cde17ef9befc72eca299e3644149d785204387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd7d8009f4fd699654503844588744a

SHA1
45195789c1fe8de5152f09763e5624a98817eb0d

SHA256
37ae10d3dfb2595470c96edbca13ae0adfd41727d7a2eb6f151b0a9b16de662e

SHA512
263d3285e2f96e2d337312ab38048de812efab62835ca743c18181b92f45154a7f86acfaef9a7829d94a03825db3c423e34359ae22d669f1e2d25538cbfecfcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78da7520bdd7acbf44aac319a46610ac

SHA1
e76a484a9bd26f3536a8a4a31f68d4e33cab5fba

SHA256
f507101e8afe2c49dc3db2911ed0eec699b383830f527834820a8acafb39461e

SHA512
94133a5bf7738a8e59067c74110892165eabbbe194748ea5c5d1f69d9d0a55a206a20e5508b7ccee19162fe81ecad55fc6ac9eb8af6569bf8fde18506b75feeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a74e00d34dd766329af595674386574e

SHA1
f080d7f76c0f79a96fc0c93df136409d146ec719

SHA256
2a90033f7811a0f409ef8fea55775842d0f806b6957c47b6b68ead7fe00b3a8b

SHA512
ce480f2b2628e18f96615867da3bec2212d4129e529cff67d327f5d2a57323a8df8f11fb5485cd1aaaa079f00a4d410eb03cc49fd2c5f67ccf57a17fe4c78781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311bc8c7d19401e4fa7c57fa94ab89bf

SHA1
c72b7644a1421d4b57806aca18becc609748683e

SHA256
e59ecea86ae48e934b9a9271fc2f9f2d4c467f24afc55ee9571f1eadd2262dd7

SHA512
0af968f0521744d6334105776da9e8222a6e52804c5d6901924798eb863718772822df5327fba834cb94d6a8afdeb863db810d462d1f9ed3c4f879d8b516aca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f11e6cc3db9e29556d4d22fbd1fbc13

SHA1
26df974648f3ff476ea42a8c3ba1ae76e12c5b53

SHA256
17dc7e643461836364d0a3f4f7336cd8df257a086f55192ed304d89117090ac3

SHA512
ff9357ffa5826cca76034c4e91958b418b25fb057c7063875f6a8d13fe9e7f12ba36d4d7d5ca473f4e4e4e9ec721bfc7fbac61785f17198665d47023170020c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165db80d95210a9911ff0c52012e1803

SHA1
4ad970d68a3d82dbac486742d124a618f81b76ad

SHA256
2477e096f507e8310795dad12798ac31215d78aef132c11c7de482293abde2f2

SHA512
050e41df04d172250276932facd43d83af2fb773069404640b78c2ed5338d5c3b5dc65b8747352223359c4733913b2d693c76d08853fd7927748f72260815c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4e17acfe9215151ff73abb5149d660

SHA1
6bd696d92cf6c5a4c3aa8ebb8ffc4fc5ca5ede47

SHA256
8c8ba3e31ef6f250fb6abee8000f0a0bd17d191669b1264d4bc6eaeb2ee75cec

SHA512
13af41a80f58e709c90af4535b8f2e156b6e97cb3ba7a4584248c4b4be677b8f6c3e373d06ebb2da451138f0183b27e6c7ccc8d03fb418f7786afa472697a72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5350.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar53C1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit