5e55374deea6a9dbacc5829b37451112e4853592a0911b18c789daa252fea161

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82a88e3d118f36ce155eb7d945cb083d_JaffaCakes118.html
Size

780B
MD5

82a88e3d118f36ce155eb7d945cb083d
SHA1

8a21ebe80dfe28a97402958fecd3056342935d7b
SHA256

5e55374deea6a9dbacc5829b37451112e4853592a0911b18c789daa252fea161
SHA512

4e36020c401b40fee1ea14248abeb74793870c13dcfc2b01d04969a50c246c7e65196930c837a2b4b0444af1f216171b555a1dc30f5007127e59a8afb9f23ab2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423194697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d26d26235e19884e83bc9fa3e8d5b4b200000000020000000000106600000001000020000000b280a14c726d3f918265c2489b9bd35369823fc41fdf1437f242781f7f23ffd4000000000e8000000002000020000000c90a3530cc32d78a0fb64f361d6a6bede6c11e8d4979719727a8e686fcd62324900000006fbc5ccabe3b7aa55c5c9c2a57439b2b2947d4ee4015dbcf2971203e099f9cbe59d930d5f9d93325b286b2ce18deaf62f8f2f04567a379b8f7a15982ba70b8dd6d0e22b94345b7462aa56e6042362e4aee2ca4025b7621246c6e5e52a04647a252d913dcba51c644bbd9a7b0494ac075619601dec45c8e8467c70f68fc3081d271e4e6391d65ea186ebd24bec18fcd3840000000756bb514040a3ba5e77a0cb37c1f824bc784c8b49a9c62dbf95b2b01cd2a7ced3b70b3be64fd86f4a0d0416c2839c7d47be24a1cd5a36150b821862372b49de3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80349f6e31b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAA8BDC1-1E24-11EF-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d26d26235e19884e83bc9fa3e8d5b4b2000000000200000000001066000000010000200000005e1cfe035a8350395421fe18d3896df238b931d7e7970c24209e66031066e893000000000e80000000020000200000009f0e33ca9c2916cb4c57becf07d8fa832ecbb0de715d14781a9c012e62dfdc2120000000484c2b6757cb05721fa08fa7f7663beb5955d5062750bb321ab23d1dd52d3f9940000000fa277ecbbc2477633833b77b9eee3a1d1161229aa68b76d1e27f3d8fc02640bd9e0c53c533319860d710e58ad44638bc7c1f6d64a9d6f8af57b05542f35a9883	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3052	1288	iexplore.exe	28
PID 1288 wrote to memory of 3052	1288	iexplore.exe	28
PID 1288 wrote to memory of 3052	1288	iexplore.exe	28
PID 1288 wrote to memory of 3052	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82a88e3d118f36ce155eb7d945cb083d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4d936d5f1b4e414fdf37ec0045240dc

SHA1
b1c28299024e7c12c968adb6ece368c22eae10c3

SHA256
eb2a9612c70630a7a55660afef2ebfa2b608085291c318262dcafcfae76223f5

SHA512
ff095e6c2ad4ef22dc12c570c33aa8008a59c9c2d1bc032e47ab1547ba80939df42f4ff8089f976fa1a25226f2fcc679ab6a1a518aae18dfcf9f50d59598f958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a73bf29fa289408af5bc829acbfb456b

SHA1
6ea6d0adfbedf124012e0ee1a7adc64bc5f5bc74

SHA256
2a99129523ee0a58834a8b6b5700deb38e6c0af21b2bd2c3f77cc7842e160d42

SHA512
576c7ca9bfd51823170dca3f7e57e0f81d861df44d799b26199fda49ee1fe1ff46e012a90ec8fd9059037f605879285a2fbd944623741334479b0f31f3b27316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3954cdf8d1af904c7f2287b005dcca39

SHA1
cdb08f09cb84a1486d688e3fb0256374f45cddf6

SHA256
77a3226894e8c3a91bfea4507a78552883d3f6af625d57a12561493f8f28eb71

SHA512
2da1bd58480b23fddebf92f521a211f2421cfe456b947a2003a4b5cd7a02b6f245bd2976bfaa54346726282c2ee122eec6dbbf99edf21c8673b55097f32d4743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb6ab769677c504580e2025ee83f6b23

SHA1
0ca9cdbeb91341095a433c3d82eaeda749484ab8

SHA256
a923f35963553d43e7ed9703c94e49cd675faaf972018b37094cfde50ef03d83

SHA512
018ee8885b951c9334e5a075e28256730ab69d1e7f7b98c09061009dddb26b99adc892c79f7b99313aca5e74ade7a5b1181ac3c6eb022a33061c4227059da4a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fd45d60e41acd0c22b9259c05b9a01a

SHA1
c37862b3a514bd48a5b25609d8be51189807bd3a

SHA256
026923be93599d46aff0ba40261ce7eee778221904d44f172270ac9e382da6d9

SHA512
b4e4f666860f3d9ea444e0fe2691f1c2d51c6057a813cf7e40ae87794a0e02ae6d8218443cfca6823cba596557f70d4b86b628f7372e47a6b334a2f14c9f4ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833727bd4f5e3e6b31df057904b3f1dc

SHA1
45369a10f02f0783b9bd25c9119114ee58b6dd45

SHA256
238fd55e196edecce5cf8ad13b4d47106de709f4efc859e8248f70226d3b1560

SHA512
111fa607d483c2981fcb6b0076f58671e3a03670ece6f8b131ae97f71da42afd3681db2215c5f5f8a9502f77b622d03121b71b1e8b6cb18079ef6cb0e5d94574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8155bbad24fb2fe6765eb3680da9fc91

SHA1
99fc350a455803b2125e2e4d5d1fa9acb940622c

SHA256
0f33cce7af4197190185da360dbc73fc5de878e774a6daa5bd0eecfed7c0040d

SHA512
a7aef7960984034a231e91aeb4fb6186410e679d3f8c07db607bb913972f9272fed92155891e75eb74b6b9a1d6affded9d564ff86b5e37f5f92407999ad4886f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c23d06e236a36535db357e4ad2cb23

SHA1
272b48e58701ca040b637363ab3d79e050a1f476

SHA256
bb63c8692afa71cbf50e9ed474b1255d7ea5b9f78b397b8a11dce1f457ea6ec8

SHA512
2e0cbaad0c6246c671f6c7afd11213f3f0befb95db44a597c439b290ecbf96f49be643d964e4ab7aeea532198e0252073a2109e90f004831f08c994c88f4c4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e1da11ec6c70c2bd4221781dbef08d

SHA1
ee4c93d3fa367c4bdddf0d140dc96950354acf6f

SHA256
7fc2a82527c7e57f37d3ec3ae4a877bbf9cfa8b6660a4391bd164fdb5c9712b0

SHA512
37138befe01892e96f44c12306081e97d0834bb7eb04420906cb865087a999a4d545e951a09140e45d0e9030fb7028472ea3d539eb0131d3b4d39097babbe4d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2624e087f5e1f27ebed19ddc68dae8d

SHA1
209043347a118bcd54ec3f1b028e26f28e8ebc39

SHA256
2716833ffb37bea4366d9c3c72f6a75808d0af26ed6f7e8a55d570b6a5e0ecba

SHA512
c569c32c5312a4956ef34d63b8e24d2e4ddcea0a8254f1fd0e7a4aa85132499891b5030681b4e3b9e7604ed265ce506e88032d8e6487fede61053e7ccfe665ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d7a7ff1e9e8c896a9ceddfdc8e11d70

SHA1
d5ccdd6d18960ce8122ff734d7143acbfb0b65c0

SHA256
410a1ca01385e2beedec730207fb49001909e2485daf999df73d589007ad17db

SHA512
c2cba4cb7557b12ec9727ae35cd3c0daeaeeee9c57610deed0c0986581e23d541d7b5ea848ccaa2e332d5b42796bbe4c0af57732f3d456dd631e14763b8a72a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab260A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E78.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit