7916ce749d6e7fd76d764fe8486d6d3fd578bf44d8c7f2d3aa3a820ffeb5fbe7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80fe427fb6e2679f5586229db987908f_JaffaCakes118.html
Size

4KB
MD5

80fe427fb6e2679f5586229db987908f
SHA1

4e978d776706e38cd155af1f077c2eea7e8c0966
SHA256

7916ce749d6e7fd76d764fe8486d6d3fd578bf44d8c7f2d3aa3a820ffeb5fbe7
SHA512

d12a8363e4276ff85d6a7bf6d4eeecd1522e4e8de0bca5b5bcbadd803bac0e7c0c93d171f758a9af62e0a566179b02f84fd9242128d95feb93dda6f8d4ada11b
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oD707fd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e4cf6b699c21dc45984e5c34f9a952de0000000002000000000010660000000100002000000001f94cf93af7ff6d873beadfd744ade6db9d9a8287e8b2cd9d3cddcfe5647f81000000000e80000000020000200000009dd6c8f8eecf425513af747b9dd0e1c2e3d18f1f64a949647a7a9126c3287ce29000000091ad075704ce627872d2eb6c9e3631024fb6c4dbc63c923fc2990492e99fd276ae73b27cc0fc43e117ee492283b25eece90683f0e6792a45e89712e4569494107255ed0a235306b60589d63204e23f37ef32d8aaabf88de9cee4a79942a7d9af31451adae5dde7a4102be382f297b3060410b664c7ecb752b224d8124d0d2b91f962bc69ab9a9a35efcc99e81ff773fe40000000d6997ebe81751afefa0130debc6383c10442b2a77365930c78b6d5cac80b65dbfffb6f1890a1a7fa463eec6f76afd4dfb7716861257c92ac08dc0e875b8b8e00	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423153423"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b8c753d1b1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e4cf6b699c21dc45984e5c34f9a952de00000000020000000000106600000001000020000000cd331e4c7424023d05e460ae583cbddd1b9ac75cb49195306a967b51a344d891000000000e80000000020000200000001a2db78156ef6fe8955f27836dbe5db5cfc14b0b1dd499911b4ae51eb975ef58200000005a38e744d7f25e4487ebdf58b00a3b30f6b23e5a56bb3ddc1ca21cc133d2e77840000000f21ab3d9e4a91df6b501353bd4ed3e30fd61fa656d60f507931c5501974f5051a1e5712ec37ffb433c038682492eb7febc3322f1069af283a95bea75c6eb1154	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EE2C8D1-1DC4-11EF-8706-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1184	iexplore.exe
1184	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2072	1184	iexplore.exe	28
PID 1184 wrote to memory of 2072	1184	iexplore.exe	28
PID 1184 wrote to memory of 2072	1184	iexplore.exe	28
PID 1184 wrote to memory of 2072	1184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\80fe427fb6e2679f5586229db987908f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3464fa4e0fe7eaa8a15a32cc7457513

SHA1
0bfdba6ad13b5f46526de851ce03948f867d76ee

SHA256
61d02332b5f379a32ba671f00504c89c1c5c165c60e93e952975f3903441b216

SHA512
cec07fdafb1ab8fde2d38c3b2880529d079c05541d542851d66127c16aab5648876917457ff4b2f3bcddc5e0b91efc342cf2b69de3c5506290e51c8a227df8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
446601a667c4790bca4e3de015ed6d39

SHA1
00f1b0ff3bf015c643946711d3079901555ab8b7

SHA256
026fcdd6800d00628b0c892a48b5a77febaa264a3a1743da919cfa7671ead8f2

SHA512
d4096cdfd31ba140b49a783df649cf02efd6ce231ac380f45c9cd2122e4a556841548e45f491cbe80256be0385324a5fa95d0aa2168f3ede4223528185529b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68f77ec31919430750f2d36950f60a3e

SHA1
cce8f7f9d6bfa6f7c33cdc1404ce31a2c1cc71d4

SHA256
9aa0cdf29595dc44e90cd9ad232dfd30d2fd4cdb3b19bfbcc98fafe9de03cf00

SHA512
194d92070bb8483261713b170ba4c1bd5161ceb5fbccec0fb43df67cb392cbd0a1cbccab306339b8052f79b64b26f92ef30224bb55ab371266163f4774b8e0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c594c90031fdc7360c91724aea7748a

SHA1
49ca2f4ab82fbe18169d9fec3b8d95cd6d66fc38

SHA256
effd3daf43162b36961945ffe8658b540b329b69a6488e9702d96a232d2b5ec8

SHA512
930c40ed1e2fa509649869b6fb6bf87ebaea90717e3367ae50b5e5e2fb5973149634126263b35fb144b4e9782a487a8efb4cf7c96de5d05d9ab399057c96bff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97bd2eeb7368fc45a67fe8b3a733604c

SHA1
ce0e0191ecdb256cb8e4f12533eba010d667c157

SHA256
6afb4f51fa05624b8514561b9b67972f1b2083be551785475c2fb08220bfddd9

SHA512
804612ddf172b9cbb869e643c9baa9a9f2fbd6d91d5158edeca15103997e837845d9a7564c94ca5fbf742e0a98746d987cc4caec4262de3b41c07164c7becdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68c041ba6ef0ac4ad795c4fa2041a1a5

SHA1
cbc75255ca8e826839e7c8afa5c7e2cc42393bcb

SHA256
3c696a672a3c410692ad5b08a062ba829494b7a3cf390db606a2d65509f90cff

SHA512
7364dc845bd15899f60325cbadb175dc627e3130cf12e7233771f5d372cf77ed9db7b3b51e6d2fb23c1cab80df9d3c64ceb7fbee7b16bcf05aefba1acce7e965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b29335f1744666bf84407a085685a4ca

SHA1
38bc8b91409b350d3b100842b89ac890972e2773

SHA256
cf6573a4ce5f5db091d3eca34b9a370c3a6d19c5e8579a6ed2b17d2eddbaa148

SHA512
3f04673d934c9b8e5577ef715ed786f9af00b71697dd44bd69fd48e50c94eeb1f24a4b1915412262d267a9cdb8f77f9e773a45a0c3f029b636b2ff6211b000f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb750df59fdc047b09163da6eb8ca68

SHA1
39523256cbbfbd00c615b20950070e1d135f3a12

SHA256
2477b35d8c2eef9f9835071a9bd4b4d745c7c62d4e73c0ce2bf9fe673b86e05e

SHA512
07338b191a6dc24012ecc8c8f46600ed4aa7fdb136eb3a623dc126d15a73d747da5842a628062580f34eb094921b875f02aa85bc6684e1933fcca190614a1079

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab911B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBF1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit