a7ef314f7e6af26e5927d4b46a422cd42b558f537818cdc0310a46de26d66d67

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80975c04fc46cf5389124a860f682258_JaffaCakes118.html
Size

4KB
MD5

80975c04fc46cf5389124a860f682258
SHA1

0de240ca3656a5cbf090e234e34fb886e0987485
SHA256

a7ef314f7e6af26e5927d4b46a422cd42b558f537818cdc0310a46de26d66d67
SHA512

14ecd24a908340760d0ba6aec1f24380be63d577e6889f01eb34ec86f03d39739f89ecb8bc64f10ff018b7017edde3f595ca8af148af0413e203b4d43de30e55
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oYVPKLd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005fa37218b07454bb6b411f603143564093b4ded5c264cd474ad5ba0185a60ed0000000000e80000000020000200000005a5268d8e2c466f7c235ac8d746b042f79e7186361f4eeb66ef61930d1a89f81200000005425a3a28f70c579e0e0eb6b8d7db13f49f1c33f5e43a5c82aa9c3eb8ae190ff40000000a32b3da7767d6fb2025f162f62f63b696f5715ad8f322c8c9dfd39a35c236f1d65e0260cd913ca5a892ae3d8c09fec2626039e8a317d55bff1cba9db9a44cde1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423144055"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d92f96bbb1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009f66a2827dec0eb6ceba86f7c362fdf48bf69676ec02f0630edf0ab3e191429d000000000e80000000020000200000006fedbafc9a0472026eeb5ee17e1d950e0b9fa45f0feffcfee579a0480688547690000000f34d1f9847c1c8daf93fb155febe4ecaffc84f7576d577a427989cd0cf05b9927a2b339f7d088b0050d9121c6d8a245e611fc4ce319b70d87b7b09af50df02d543535d7f76260bfdf4853cda5105b87957f5efe7e707c43ae716569b6f710246280576094bc19029b626365c24c026b85c51e8f7b88680d451b7fa945dda8fc0c5a1917a59f6830c8d5b1542ef51529e40000000a58861b6d7887e4734bdcb5d60ac5ea4c064ffe8cb70367c57183a6c1a1c59d2b0f746465dfea5ed1fc651ca80af4853572f5040bd91353da3b19f5dc143cd99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1B2E341-1DAE-11EF-A4F7-5A451966104F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2092	2132	iexplore.exe	28
PID 2132 wrote to memory of 2092	2132	iexplore.exe	28
PID 2132 wrote to memory of 2092	2132	iexplore.exe	28
PID 2132 wrote to memory of 2092	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80975c04fc46cf5389124a860f682258_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09a6ab5bd0f3c9b173818ecf1d268f91

SHA1
a70b82886eda0e023434206e9469fc69e652cea1

SHA256
16bd2221c83591c63d5cfacb92a4c9f7580e6402ac8e68562822318209747ac7

SHA512
dadc9da2bdcd3a54f62091d0cb2db202e3f1a77d1d4cc11776f21a93d12fae5ce0d38c1e4f0b721690fee1f5d4fc3a00100907a1bba408c7305aefff1be7e43b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33870ddeb989ebf899222ea5adced6a7

SHA1
0997ac342062fa923bdfb10b3dcbd0fe893ba8d0

SHA256
de0c2f5243913479b908fd23068e800d2c70d8bcda4c7e8f85482e05b25ecf96

SHA512
111b803f92cc65032d3ca68e8618f8abcb1abdf1a1b651f22e242a615c412487048ee21797cf3bb2212c70497ef377ed8506cecda1b860b4c665e5d9121a4b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
131005493da535ae4e551d500b266022

SHA1
61a2fcb11aacde678e6091cadb3baeec0f16092e

SHA256
d756f02c49138f1d6123856f02c3530fc7fa760d45c7ef3c8b1368ab4f011d9c

SHA512
de9f9ecb879285e46d2b17bb04001fe4f26ca8e5297035f45036416717080a40afa836d8cbfe890bc699e4b5049c1c805ca6a6f78679408cd2c9b9e1a9bfeadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dc4f51817e268699cffc0b6cb7595b5

SHA1
e1ef0a5b507f7feac9cfc2b63eb1d4da4ee26523

SHA256
0ad09d3a8c1fb4df55d2fdde0ae4bdb22e33d9e7c9fd328b65bb9ba111733be5

SHA512
dfe1b05d8862a8d1c361d5dfa9ebc0b7548a64280998399191de6a71ec757ea8182ca12e39e76171f4665cef0db3219d708a975046b448e717db4d00d8ced2cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30a54ddc22d22b4c5caf4a16237407c5

SHA1
570648a95365a0e66ad60ea4b83fcd34b126cb9b

SHA256
4ff31e3bd5015a34a83bd24b3c4c2fd8317f671ae7916e276362bd31d75b1550

SHA512
f871b2f278debdcd6ff88b12d8a192bd65216777c3fc58f120fb2362d2fb88a50100e4030ca2633d6326b9051db28bf14f75e651bc9676d46aa97b72e8865c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62408981deddc687f88f4828c4158ede

SHA1
6994247271cf90e7b1a07d326c3e5804acb5c23f

SHA256
6e463a0a76df6ed1aec081fb8eaa0ae4be343d4540361580cfd1361197909f06

SHA512
905085c04d0f64c086c67053f98314ea43d750a6a450ca0bedf2a9443997973ca80b4816355d0a7789bf2ba5bccc80646dd20d964fbab64d7d7aee7340b752d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b5a213c44f4b2e232ec5eb4a26a1c9c

SHA1
8e311219a1f635920ea9d23f413fc29b5e6b9f1f

SHA256
fd5206e5643bc229ee4a1e4e8c999ca04405402df3c29b08cb4cd2bd6a95e0f1

SHA512
3b6bc48d51ea0fcf573b601c32d41f57034b39b9fea5dc0627d82483c62c51b3a96fdc48a5393f68ba78c69e75a2344db08b0d4285949df63835a1fc63e43b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0e22f3d7f7b7b5e26cfe00f926db377

SHA1
5a2894d07e5c7b0a9380a2520e46dced166ea4f7

SHA256
0bb623199a719e3a77d1e1da49aabaffa576b78034f5c88ba00ad7c7a782c6af

SHA512
7c28dbb5f4042a2584a7e82d48dcaf3deec236ff995a489cb3d0b97730ee10987e623d8c2e30de6e4df9626b4126a76eb14fa8dba2ab9286aeb9ac508d05a424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6408d79f7eb23b4c7f0131d605934e5

SHA1
01687bd8f3c2b627bec7c3197e0ac258b882e22e

SHA256
ca13f025f05a21562c57c9002a55e2d99a7b292972d2ebb438ecad828a9e2c47

SHA512
288b5948744ebd8d88aa0d301c72d5272facb8a4392747caf9b4386bccb0798eb1f1ca70eb9ae0d338809302e4211824c26dd868d20fbc2ae6e9b47a3af0104f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef524f753430f7a9ca34568b4ed5c0e8

SHA1
8ac704124fae6690bc1e4240567a11b96f4905c2

SHA256
82a30f871fa59479f1f9921097f0a1c21226003350c975f01616d90fc68b1a6d

SHA512
e329f6b72b33f56ceb5b43b6ecfffc07e527627a9a1b387891cacf4e2f2e731367dfc3145c0d834e911c81caf52af0ac55e7345d2cf90e8178b83dd2f009db0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f531a7d03267f5fbc1ae22349c65b1b

SHA1
8ee20f99e8a5fc633ae05ffcc2702c7258d97a6c

SHA256
651eca4d8b08097ed808d9897b246276f0ed8b2485f07d4c069fb85ec51e71d6

SHA512
710aa2d15f1941bf07b82378f85c5d1bac4a217fcc8422bf9a7b0545c494a7e05e1022d14a8bd0cdd82f4979a0e5a6e692d250b0c01ab09c41be2d8c1281d981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38F3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit