5410a428a7403cfc5d67fa550387e38495cb5b6086841ab52fc25627077775b3

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89ade0a397e7d0c08bf805692a2fe506_JaffaCakes118.html
Size

68KB
MD5

89ade0a397e7d0c08bf805692a2fe506
SHA1

ee3722ccc5e29cf8daa3eb88970938a4a9a837dc
SHA256

5410a428a7403cfc5d67fa550387e38495cb5b6086841ab52fc25627077775b3
SHA512

8f1aa4822038148f9d14fedbcc449fb6b58461688afd357d86d053a1be054520b2a749017f75c7716eb8be0ba4ae7f694f0c25ad9e2f0589a1f5b81946e40f06
SSDEEP

768:JiXgcMWR3sI2PDDnd0g6vkTqoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:JnDTSNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{434412D1-1FE4-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8037f017f1b3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423386939"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ec36fab002c07e23b2f789fd3ccc1379564706be8a4c3329510d185185088f32000000000e80000000020000200000006d7698f097a3427f451ce206c4cda1ce0ea58d0f65af2bef8e9f2701688142b690000000aa21b6c75567e837c4567b1fd9331350146f822117fd5784c5c8d56464ac7bd07294397167ec28800b29b6a55a989e62bcf00aa516b17f9d99e83968ee6e94a4c5c8f78c0926500f359ac78c7ba921fd649a816a482d2d01546f2293d9ea3a57f88c3a5448879e15fd39e0966f13b0acbf48151a7e4cf9d5836eb48b102a839b51d38ee79d07bd8421fb0e10e85fb43740000000b1ab111012b3de4d6ae7b5a5183965c4e41067a0cc49cd17eb09c8e363f2766ed3dbf788dcc22f947293925901227d443353944998e6af793ecda27b025573cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ef7ded21b0b158e4d1973f193f0e335b1947d6e08cf0d7aaf63fb82553fdc8e4000000000e8000000002000020000000b2d0ec4dcac94c18d7b37f0ed0a38a6449a7ef6d45e60d8cbb16356c5346684320000000dc0ed2aa44a1a0e5743caa84dd5ccb787de50e2b0551bb4a61d4b24d7bc50834400000007a006a18dd62a3bdc5c8d561aece6de283ae836a0199ebe9d3f3c41933fb1cb8bd494493b132d5a8e852758dc39849d901f796c3e15645429bc4ab37a706891e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89ade0a397e7d0c08bf805692a2fe506_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
121834ec6c318fd412330e53bd97f7cc

SHA1
0c4d500df0cf6597a681a0dd1ab9ca07e6072c4c

SHA256
957d9a08dc4f09a1f64db7e9e02f692dc864d487f14d73f2758c0136aa0c8c91

SHA512
13f75ecf51c5c4116b314bef9bc52092180bf2380a0cb5ea75f8ceec3d15adc492bb576aef63b754615b232c7008f4b84e9014c6abd007b0658e74d79a78fc6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2510ad410c1eb5bbca3056499091b24e

SHA1
bf55e923a50265eb1b7bb5a2f2a6fff1fb4a7f94

SHA256
707e1848f7c6a61c24ea1c305d1069307cafa4a87a81c6e8e121b86f8a5b8a33

SHA512
93a2fe52aaebf874d6d168e82b6f6e8a92c938b5d6e13e542bd0da1fe4291230e465c4b9211727ca0280e98d043f4ab1563459b8fe3bffb20c7cd0a8f8caad96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2f89d944146afc5648abb12e2b56dfa

SHA1
0d1dc1e605370058584e80cbe85573659fb6fd6a

SHA256
937f259f25daee8cc3e0e24a9b6282a12414ee8b54dece13e6541192284f2771

SHA512
09695528e8ac153cb17997d7ad056723b258f043c8e7944d27580268223f7c250e8c5784050da425dbf49b03fe995eba447b709b096203c50bdf7f5465c66fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82998fa8fc39228ffb0e6210786a6c4a

SHA1
323631c37c89858cf64a199f3da7e1daaf5df021

SHA256
de1b33226c8c7285ae9dad9f8b7a7223ea3f781bd644b4547370d0d929bd68d9

SHA512
2978aeaccf77e4bb930c1fa80cccb1d0283735c6b030cf847b18d55e52609289f3af9b971e229b0f2c79195dff97e16833f2d2c9a4a9823746f5d1ee1baea846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f90e62801956b1fb2305eea4faadb584

SHA1
e7ed40a9d31b4297c4ea42a1fdfbf137c8fed36a

SHA256
38ab4d22cf9dadc4c885ab49de81c56b1c78b191dfb628701d77da4cd140fd4e

SHA512
d59edb2c4fe70be62550aced2f59a145fca61cdbaf5887d653a04e237ab70daa2a51da172a657339ccea9a51bade258c361b3d679a4331dea0b7b3f86581790c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
559431244a8bf6e1d972c94b0e8aa0f7

SHA1
211d9df5b628d82a3f2b502c66cc8eaabb95a9f0

SHA256
d4b824f940e452ae6d243e883fc2556077dfbb0e35ca58d87d435aaec3291c05

SHA512
9590dab8fb208bba5fc210470103ddee12e83e7b669fcd0624fb055502bbc5d18356a996c44e8fb6f4fdf681c79229c65bdadc15c8eac06948c9040a35655644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee910474106804f54d4ba440ce1a826d

SHA1
7c7a3a66fb7313d7346f27e425cb5f60e5c9a366

SHA256
06cc95e851a05984c8f8a099287fdd9b252078044ff3ec9e2fe73ec61d3c91da

SHA512
c1e971b7d36d89b4c2b37437be5917c09f3e8cbc13835b1a26faa92a319c847adf5c65f66f962ec26e3a88ac00918229110c21920e6885f3801f1d99476d3315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a551b068945ed51ed8da49725f2e9ed0

SHA1
4bb59dde5768502853f299ccdc02f3313868e82a

SHA256
d060493b7fed88f248ab9b3175749967db77dc885df4576a65711c3e7e2a8e8e

SHA512
9f355a9fa5aeeb1faa14fab4c4f339196daadbfea297beb818ee9f694aa019140e1477e9a2fd1b8018511959d04f17cb3a13e74881c338dd439a0b1483b2431d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b10957833c845233ab087026e72d2a9

SHA1
7c197017dcb055bd22eb9afd024f6862593bb18a

SHA256
3b8a97f2dc69c8448b2752f06ec2fe99e4395b4228612eb695898cb7e27c6aed

SHA512
6ca453ebdf519c5c6084759c30bd49040d61da99c5d8db0734e89e749c343248267ae39ac3cb8e4c94678179f375eb525f38fa2247b340f0646bfb8840fca10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d78ec33641535319bfd8f56ba7e8367

SHA1
043f5dcbebc19bc4d3e00b2d81bbe4b05476dfe1

SHA256
0e2794d7d6d5d95afe00b51a0099135bb9e19de2a27536081e2ca0ec44dbe3cc

SHA512
d955f7472cd98ada7c118d7beb2ee8665171eca125b6e76913d70028796bf0d7c75ca15a9835c77cab571bdf9c01b480c196d8a5240f8433753810b9a3a57548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24B3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25A4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit