d9d279b8dc55daf1018ff37adeb0fbe25080f075badc2a2f8f8ebc1e5bc1c7e6

Analysis

max time kernel
142s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

891999d6360ea4e226e7d91d05720c49_JaffaCakes118.html
Size

4KB
MD5

891999d6360ea4e226e7d91d05720c49
SHA1

c9e1e55185ff4ada83aff51f38fe08e0ee03e212
SHA256

d9d279b8dc55daf1018ff37adeb0fbe25080f075badc2a2f8f8ebc1e5bc1c7e6
SHA512

d5d018b307f01a60ebf2ad944204bf5469071a1777cb05662a9c9b186714ab752fb4452a4669c76808109eed5634c4cd7139007cac0535ab67aa8c7cd13cfe92
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o4O33cd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F312F61-1FBD-11EF-AB84-52AF0AAB4D51} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ae6685e8c10a44b1e1ea1e9436b41ca2483dbe316af38794be3360fd9b8636f7000000000e8000000002000020000000a836553396fb75747eb89dae41fb59273b5e7032393691588d2e93e7b77944f390000000211e58d191a9bffbd5838080402bf9a5137c236fa3eb004a65e422815ce29c21b502a039e76c3a32ba81859de808e0b0b5c4077df35eee733d0e98da7041ccf884cdd94500dccc460cfbf88dbf434cf3077b1289dddab1990332484af6bd4ce792ffe476cfe7f54678fda8fce6a05550ceed2dad99634b5ae92a71462a8ec8c45e693d4602ec5806e66d2a44371f3a8c40000000ef139b1e80b4f0ce12d1a346bcaf8988f3f85a58a198c13d5252f489ed5e646cf79989c51ed422771984b388c25b2a25e966e3915253cb31cd05ca01af00ff31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423370324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a82478ed4df5c1bcdae49c5899fd32fc64db2e13125b826ae9832e2eed8e5935000000000e8000000002000020000000fb00b6c63b4c3a2cc05b51f0fa0b4d1c54a6c480ff6d05238483031f7a4839cc2000000003a2c903f88ce76b764f4719285364a5c135bfa9b2cdafbc2ea9da1ea77040e240000000fe550ffb1b0d6f4d65e6f0b3c6e2c665dd4b200ee0a3a55f6c8925c3610c27f9f219da8e8b459e68f7f2f78bdb23a5572e91380d710cd0239ef2672f9e927680	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e075af63cab3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28
PID 2020 wrote to memory of 2168	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\891999d6360ea4e226e7d91d05720c49_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
136f873b9325127568a9f7942bfe8dd0

SHA1
c7bc6b868494eda6c57cd29cac87c5ae16f373f3

SHA256
e758c67d7819e2dc27f618ded8867b2b0ace2551321b75932f33da26f3585282

SHA512
f2e0f99c39c73f5aa570c9336b836b8dbf36bcacebee0c5da3e843dd85c5cbc3d0707956437ec9bb4c1941c6c3f2fb0a0b1707025caf036def10a7400d177e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff205526b5ee7f62377a137cb46a0dde

SHA1
6f022c2a675ff407e9adaa273daed9c792944cb6

SHA256
be81b9fedeafdaa00fc3c1f373f073c92f4d661eadc612f7606a6e79ac2d3a60

SHA512
e34eb1d13b3630b1f01ca6d46b3b224b5f9c3ea865b24228da704522e998b6c074860b0e0020bb969a4cbe4f5e4592886fe353dbceee913b3741bd8788751006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8904db163ccc8f1e10d9558cd14c1be9

SHA1
af776df80d8fe6d49ebeb105d5df607a1e17b6d9

SHA256
78da5086fbf983abc6ed23ca3b8b76288a3b6d79cc58801cac7468f399432522

SHA512
0cc00d584d4bb0659fb1e2be5194bc4b2a3fcf46d6166982b83dd1ea6c157628b9eb492b5cfeb4623ef6f20f4df4abe6bf51cbd1f5d07211797b693995ec0a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0edb9cef636e0525bc35f08d3f7a6562

SHA1
55a7fc4b0222ae9cf5cd3ec70d16d47b2fdd47c6

SHA256
9b87725ba925715c733e579e5b1f38c7ccf9e964200c4bff48dfbcc747a7368e

SHA512
cbfdb7dd6017ee458e0a82b80649aef9e6bf66ff2284d85ea1db293da720f336f5eb6043136649a4795d7b4ff4ba9f4b061f3b895bef942cbc410b7bf8228158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eccc26b08b87655a8ca53f6038c9ab0d

SHA1
d633a173989bf83bca21e91a5882412dac557d8b

SHA256
63f329f8a52fef6a863f7132a10677bb4d083275f99c0f6283a1706378d9d3e4

SHA512
2ae2fa375ef7630be110e8b205c81f58a630a8d661998b9c5be970b3a7f678c8b6038cf41eb688583e28f6bfa01a96ca7ab32ccbb85b320291f88ccf1b6278d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c022c501e77a18064e0467b2cb74de1b

SHA1
4e4facfb01a70e60bdac61ea6f50c2fa72a7088c

SHA256
6ed80b761954c104e9e214963ec8328779d8c373283139aeecd7431817e9894c

SHA512
06e1f1066c5fd101a3dce19de3df7dcda6b3cc17853a17b6b73ef61453850688b09f7df8b20a051d6bf6324af0cf0155e1f96380ddc42a5952a09e6b8dfe20b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0a593d0d63e0b12b8c23e5b2d58a195

SHA1
1c5520b2d64f72d51fdc3a5f55f7572746bc1503

SHA256
adbcfa27a0eb21c2b11483092f19a1937110f864655eeeae3c855e963d35b2a7

SHA512
f4b25368297628a8c81c02a7f78a5369164ff34bc870738b5aaabdfe1e4b125cac911ad4c911508db98b51c87b8968f80f37a830391fa772c5afe08f0201e537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69093dd0807882c823d4cc5b724f0504

SHA1
5951f8f871d9a633d3ce9cd8c79566dafe84228c

SHA256
01d8ddba1d87ff0809053e4a2b7fcb8d9f8c670525a4c517e82986556e9a2503

SHA512
6eeed66e86348da5c09eea50119074046a6032984c047d07c2b17d71029811f567939e1857a6abc3ba9ad9758704723a682c0d1be352fea630f8bf578860bfb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94aab8f66689c2adc5b3abdb7d490bab

SHA1
c9910ab3c049a510b99f3a02117b1d37e522e546

SHA256
7f45380fa600fac340bb0f9a1f40c5651cca1ff024d5541c129b4545ea7a72f8

SHA512
9ce7c99c458c102f3dd789daf91f43c008c98038744bcd5dad623073b96fe64e11cee096608ffcb0f56071453b80cc16e60d152d57191652cd76644a51202134

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D6F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E14.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit