a19e663a6058d6d3e276ba570883a2f6d3da63e43fd4ca3cbbd8e4348a056e8a

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ee42e39d7338dd56de0352f0abe9de2_JaffaCakes118.html
Size

2KB
MD5

7ee42e39d7338dd56de0352f0abe9de2
SHA1

647870c50680abd83173277991c927fc370de786
SHA256

a19e663a6058d6d3e276ba570883a2f6d3da63e43fd4ca3cbbd8e4348a056e8a
SHA512

6363be2a75b3c16f655c57f9dea777c62082139e69c4f288803b7c71d7434517ed2a9c9b0690721a4f6edcfb71993cb38cfd98110b98f04c616d6884ab74a6d0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423103487"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000681c2e1b26e0a048b6ae7f8c95525e8100000000020000000000106600000001000020000000a70e492b141a0a2e7661895f2ffe53c206cc798a82a8d4bc00790e0e523fadb2000000000e80000000020000200000003a2e1af20ddbafebde465e763098e6ad919910868b40114491cd33adb966544a20000000e83cbdac646b489cf4aa61ffe6e23deb3e96b71bb5e494957d4184ca3be6cacf4000000042c4794cf183ca00d51bb02b79884fbf5762ecfac2736fd1adc8ea730bb8c42f2d91cf86f6fe425194355fe243742fbd222a76478d19c6344e6e9911bd3f3f11	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000681c2e1b26e0a048b6ae7f8c95525e8100000000020000000000106600000001000020000000a8c951834c805663110bc738cd913f3727a4f508eea2eeb3d9c5181aca31323c000000000e80000000020000200000005d2c3f1cfd7486d97183b455fc920d9ee39e5d491ce6847d080afdbc550e0cca900000003ff4007a1ac3cf06154f9a2e09391582ac784c652f97f70c41e8fca41d6e065b8a6f92f0f1ae015bae92da4ed967ffd6d3e5562e9ffc2c82fbd22421bcc43110ddca65c9e634068b4bd4f43c3071e054a91db662d249cbd091d87d23c32dc4d83709ec0b5f77c84ed6bcc1f32dbab2c907fdd54cd9fcd47970e7007c63f448a5720f6c4afe88fa8669b01b7f040e84b940000000ae7df76f5ab8f15a9d76b0f242865959ffe48852aaa82521391a927aeaa4d18050a887dda28341af04fa7cd0c9482d67384e8a78e6687922185d175b1dab9fee	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CAF78A1-1D50-11EF-85B9-4A8427BA3DB8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0671b215db1da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28
PID 2360 wrote to memory of 2988	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ee42e39d7338dd56de0352f0abe9de2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d5359c138d83024d83ed1883ab4e11

SHA1
a9236ea3559b6fafb02168721cf0f5b7a9e8eae9

SHA256
f6e7911a60f694d5bec85a781f95134a9a174da381a4268772a047c34e85c24c

SHA512
e304efa39a7bbdc054c841a7035e58ead0f6d8f5a2063be5b1c08371e8f3d70a0a2dca1d5ab94d427aed0b040ba3d0e3d5c08d584fdde2b6aaebdd5d2bb53839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a204050eb72894a88d492714c6440c59

SHA1
727e355332e2680b49712f0a958c627390f0fb18

SHA256
62ce73461605227c2c0bb2723dad973afc8998a41517b7abd29bdf85df0ca58a

SHA512
f5fe3031973c2875bc49e51b50bff10bab4542a2afe686d3e17b30c5de25e78018ad43826b705b90cef2a7b6f29be7bd1e88582164d070e5a7913d6f2863462d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
456282dd108949d04b57b701f4d83f7e

SHA1
b85de09fa0af731ca590038c6ebf6062dd590538

SHA256
ad36dec74a49b8b38937c1d828396906fa861f6717c5518da8713ea1ea3b6ee2

SHA512
e97357f8605227ca40799be79ef66ad6a3c1ec5c4f6ce3d8f6299e0efbd8538315ccc822296b1097d8254950d115563b7a9f7afcce9ac2867104d53c3144de78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45c919acd01692498fd89a530007dbaf

SHA1
d561c33f6568d87a4ba929714eef2167cf5b2004

SHA256
d71d09a6a52bbc49be3dfbb3939a24d1b5092414b2ea560e8b82987bfe099344

SHA512
4d3fac439b9c0a9892a3cba9b9dec71b67d9a81525704a58d24d13f7c9ebd09a1265d1e1e9871143a77efce10a2cb89eab8478208258e95eb25ac27023af3154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91ff80caf71f22ce7941833e9929c0ab

SHA1
06f1104a059d30dbc2a439c5d411b7447c2294de

SHA256
3e18d92326574e90906cb411ad635bc1e5de5376ccf157dffa85b8eab1a8b618

SHA512
95fecfe1e787e49522e4654dccc417ac9fc649a5fcbbe3790070df5b8648f9cd48c6a0f3f09e9bb63ea0d6e3f5528897b07f5c56f81a74c1fa0e9e79b98cb03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3ccfa787936d5e07d111391bd43af87

SHA1
82d42921f3b010104e7d23209b85d2f85ed80668

SHA256
95243d967446e1a797e28c89e672a5bef87ac4afbdca9251d4c4656145475c6e

SHA512
1b6f8ec88191a042c3b47d994412b5e7f1dd7f159dfa13f2cb2c5d5bdfd3bc79795403420cdf14ead00d00ee0dd5bd99ecf5dadc7a479af43c9bfe09b273d4ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7a8c5bc7bc9e7135166eb22fa3298df

SHA1
62e25f4b442632168000f69dcdad129b5ac04a04

SHA256
be26c59564e600af03e3a74b1a5a2a69ba6c1ef81fe311257403325a177cf979

SHA512
29374a0abeef23ede7164fb9feebdaf59f0d41751942b05a471027dc0e5e64035b7745851beac6b2c2c1e64e35416b4f7d10a4f6198aa1abc099afee441d6694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a07b46cdffa27315aaeca3a6e116ee

SHA1
6b29ff6c2925fa2c953359dc9f1bbde2240d1a08

SHA256
985e421de43fbd6b4a3398b3b741b977f95536a598bea0088b282555d9bc19ee

SHA512
0ee6bc0bd9ac8ec2d3bc57b5d15b6f81171dde92907c19107888d4993cc24cf3961e3f774ae38421cea73b68d469871fb7f972fc187d315bca17cf7db4f37691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5738b8754d9fe2fe366dce30e0e56411

SHA1
a18eafc80814fa0c1ed42733396bcf6d4d5a6bd7

SHA256
4588369950a02ea42f069bbc20229153a39ed227512f86ab50e5ff9704e8597a

SHA512
dfe3de1b90fa0eea5f2cb5cc0dc3da75d83f836942331d54ca828a66521a4382d758294d85c5b4173902c74605c6f4d91951c79daa77388596cdb14c179ce3d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0704b72992cddf8dd299035a5030bc9c

SHA1
2b492f8f46bbde3e7897ebee248335f11479b6fa

SHA256
71687443f74a4ad569df7b624334d48fb4531ae9b6897091716fee68fd287cb8

SHA512
d270df1bc57b2fb3500c3ab4ab7117b4936d3c559fd2497f251d571308c99703305564869e8bcb17185b68ac98d5274e2d9cc08e6a30f8c9e6b593d2f8b02b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2749.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit