70a9fea7efd23e85bef855f3e1a72c4151abe9bd832c608ea7e2fefb65a4bd4d

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d9df1d51514c8e47e1bea664a2ab613_JaffaCakes118.html
Size

463KB
MD5

8d9df1d51514c8e47e1bea664a2ab613
SHA1

e3230e7214b2e6abe9ceaffdb749ebd03363303d
SHA256

70a9fea7efd23e85bef855f3e1a72c4151abe9bd832c608ea7e2fefb65a4bd4d
SHA512

cde8a8e48ecf494898096380a01de7d327d74d5d8cd5dbbf0f2d1237de3a94a7d73aec50b831b663c4b9d0a7e73627eff0af7493f860e202e7ca7153b8fe1351
SSDEEP

6144:SBsMYod+X3oI+YLsMYod+X3oI+YdsMYod+X3oI+YLsMYod+X3oI+YQ:s5d+X3d5d+X3j5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC860801-20C2-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846b931283a0dd4ba94b14f8ac77b2a0000000000200000000001066000000010000200000006f9a26d46c7d38fc851d53785713e91b4f747ee426587dbf1d96feef40507b6e000000000e8000000002000020000000080be3c466443f9b87e4904ef6b8cec3c9a264071cac63bb383fb1853ffd14c22000000066e5ed46a2aa705e32b0540fe7f2d0063302edb54f37f7cff639a392efed1b0f4000000071f3946c9d6491b7c6d41a66bba282bb6303769cd8f1043a9da3478d35ab826831349555018b290f90e82d79f7bc149b8d94041179b69099964f31903d02c392	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407f3285cfb4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846b931283a0dd4ba94b14f8ac77b2a00000000002000000000010660000000100002000000030c00d244f12aecbe577c529bdeb5ac2f933671327a2fb8cd20fc53127950888000000000e8000000002000020000000370490d474e960d4dc537778e4b0ca32520ba60d4c499de9c24eaae7be44cb5b90000000597040fa8bcbe7fc0b9d3600e8eeb555a13b2e499b22f8a89db12807e242a98b7b437ca0338e1bf8b9694999768f4cf9d53b832368f812c96f3cd3d36699733baa34b9e6e690717a0e924bcab6738929f4bad5d3eea56d34e6702cd93ede92ce113ad7dad055ae923675aa9728f2ab771e0b88b53068a3cb42bc92c50257a81791150179340fc2e6e3b3b44a50c127534000000090f9a3fa2c3d4dfd968c137b24495b86a800e548f886360461de3ffbb3016360db9c607d5d44a27d3e68140ac2870bfb9710a087d19a26461435dc07565d4641	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423482466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28
PID 2504 wrote to memory of 2892	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d9df1d51514c8e47e1bea664a2ab613_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
678881b2e8a36c3f9afa3ffde5ecb742

SHA1
bd363145d10c4597c169f785394362782b174de1

SHA256
cb70ecad198ac6284ec487b35591a5b6ec9718e6d804e8b01e2974e6c718de76

SHA512
38740c7daf6a807ae684946c05eb58741d6f4a54f587059d2bbeb495de94c1a90006baaf493fe8ab7141f3b3834814874ff8f447dac54a98c0c5ebd4fdc2e74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ab8288ec381a271cc0825b1baa00fe

SHA1
9f54a73f446b0329afd38841215f534e0453d4d0

SHA256
cdafe4c107b63d05d30e8aa3592aa36119718969cfbec3e31705ad4e3a6887e3

SHA512
048791f20eeaa2b676292cec8757145650e975d4337c19ca7454c8958526746ad1937f743274358bbc7384bc558862822e0b87d36d8669fafe0996d655cce234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8f0f20fbc862c30390bd53e98fd0a4d

SHA1
1ee19bc3ff4c9d97e54821a5cdacadb9ea48a13a

SHA256
13b5ef1174c2db80c3b9105f69674acb88d3479895592452f71c06c99acee84b

SHA512
46d3ca634b412173b60b934f59d78c1dd767e03af06b8b232aabff1e7db1896d65d757a921724ffeddb595773ccc26f29c92fc5c82ae94796eca6d6453e0e05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ec3513aa860379b4184eab47d5c9659

SHA1
0e22a71adb2d3ef49f3cc79e261f01f9bc9e6119

SHA256
842a500383c188320cdd881c9a9eb3c7c14adb7e3b0bfbb73cb8d248550dec3a

SHA512
d70ffbaa3f34c85d6862770c444fd4b05bd26712fa2ff9b4b3cc2a29ae7a52f964e48e39309dc952c436ab128fdf3cb70c5e46ca86eafec64bcc8d40919466a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
975cba09d91deca957538ef672ad6c41

SHA1
cd309f392423d9a29cf3c56e76a76a305293fcc7

SHA256
b829c838eb18eb02b44f6adc6f8e5ae2cd5069cf3bef184623e269af20e58497

SHA512
94468eb510bab72192662b25a5075e38374ee3c01e5c33e7a385f4a7038b05884b128dd5173b5a32d6e93cedba5e09279b08e51017faeb65e6fd35692c47c6be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9386c74ec34f33607acee4866d5aec8

SHA1
bb2ab2541974e4ca7e3da47b6f280023b3eb0ca0

SHA256
2b79cfc51c27769a80dfa27930138c2756e7ac42f8b493f2c29f52ce7949d017

SHA512
d9c2cf3cf99d4ae17aa88723e857abf874170f02865bafb4085713d227313705f3433ed71319bee008f68f555bd2257b1737c3952987ff1062285deea8ace4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6c8e84ade9b256703326d7a1f50b1e4

SHA1
489a2f14972c22195b9bc0c6fc89da02d69e64f8

SHA256
d0ec429cf4957ff7c3a75ca51d4158081fb2ee95c943b4d0e59c6701948164f1

SHA512
9189ba4dc5d53ee2001673aa3abf1295bf82b17ea3c04ba96577102d735fc97846dec6f8199354b93814b344e164be285d99dc57b6b7eaff76581c1899fcdaa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccd44cae2510739b623698f944742694

SHA1
3c340750242d82423b24497cd54a3bdbe94884c6

SHA256
be5b41d5d92e1d3d50b28d8e9f09d60b6edf2d063a1b97ecdd743bff0d0ea5e7

SHA512
6305a33cc140ba476d9610d3a5f84473944111b395102cf01ec1813caafb2ed95dbb5ba728852f78fa22a07bbcf9f004fc792af87e3e52fe43296f6984ad8aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f56fcab6f254d9e4f05bcfa38ea6cdb7

SHA1
2954ea22d6121f3367849da7bf21ec8d56842b23

SHA256
6e594174b946509b03ae67e65858cd74e6d74e234297be4390736dbc2a7343d9

SHA512
412571f5ecb94675cb108b2e4ff7edcda008b6080d2a17c1d0771b1223d0657ea7a047effa2567d69aa7c71a4314c76f383bb676c4d3db6d414f2a2655702e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCE3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD360.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit