5b8b25e376e086afe1556838d98d2e9f510283cfe8cb35597b4622a267638e93

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

927e8ea6e40c3f70936dab8f58ef6cac_JaffaCakes118.html
Size

17KB
MD5

927e8ea6e40c3f70936dab8f58ef6cac
SHA1

db1d233db5802ee6b26840abb4d2341964535d69
SHA256

5b8b25e376e086afe1556838d98d2e9f510283cfe8cb35597b4622a267638e93
SHA512

04e2713124efb6cfc7be98f47f16e5a1d5b26004336dae92732b48a4a87f2c2f83571e7c43f96d434fcd1f492036a6454106e27753ff16b108bba3fc42db2ded
SSDEEP

384:hnWXC13xsawG/MUmyo06yiea8Py5D+Sdll57d:913xsc/y5D+Sp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD187DF1-21C8-11EF-906B-FA9381F5F0AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c36300ef88d81b0b1ba82e28039cc3a9c2405b5c09bfe662647cba799a258bd0000000000e800000000200002000000078f186b1eacaa19a87a3c2e9b2697e0bced29ff8c8591de39cebc8e8ed7e24d02000000032ce41533548584d9bddf8282e7ab65487a589537f681aeaa7d8a45e325a5b06400000008c5538be2522e914d3b52f08ee5968c986012922962b4dca94d503bada214bb75647021e700afb32ad0c16a5d26261830e805d480671b6a628b9205c9d1026f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423594992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d7d0a8d08c3551def432e54619f9579c0a41e5160b5a8c5b8a737756f1e965d2000000000e80000000020000200000006c8cd9cab5a7d9502e3ef807879e3140a2ed67a2674d3c904712040919af555190000000931954321396cb05a90e8ea4d202768968c24c00b9bfbe502aacd348309bac267b5745b3511a45cda02795ff79969248f497ffb306840fe676d70de3cd202b95cb8ff98879e4f411d83d2169b8dab36bc7b6a1425a6f021e58aac8895ad024bfa24a536b18896117cb212037f9873291230f4b372c62890e453a1db106c7fc7b56fa29b0d2e1c8377ba555a1e1374e3540000000aa0f051602efa299b7b72ac188b8996646786fafc272546bd75c40915e582d72cfe8c48c67f30d0c7f9e16a84c0782b6b6b8f11ec816a6d8cf5118b730b8db15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1088f681d5b5da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2252	1692	iexplore.exe	28
PID 1692 wrote to memory of 2252	1692	iexplore.exe	28
PID 1692 wrote to memory of 2252	1692	iexplore.exe	28
PID 1692 wrote to memory of 2252	1692	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\927e8ea6e40c3f70936dab8f58ef6cac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98281c48ad7f4171401a6c53d30300a2

SHA1
c50e3377b0cfa62a4a5cacfef15f343fff3c50c2

SHA256
ff1c664ed3327e2c9f4178a8cfb4b0f2976fd68d122f7a07e800f9d692b82063

SHA512
bf6d502a74c42a160e2b1fdb0aa6af2c47f3ba5b889bdd04233fe90e50be3dc01a8bd5843f950eb8b47893e6698de95dd83688c8807d84ca41e22836118d144f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1085ddacc35a84588d11bb04d4dca8dc

SHA1
0f341a391ffd60339543322af3fb42af47939f87

SHA256
144ad7abdf2a9f495ca4efa114c40605bb3944effc2c70f205981b0bf76d91fb

SHA512
5c35d6ab668b026fba084a7dac3746c7652ad6587ca99dad0a7c4d62ca02c0005ab3d181257116ea6c58cead21af11d303972ffd882362f1eb22fd119250ede2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ed501d0141a0339f332d334668a64c3

SHA1
b2ea772107393f8266b64c0f83b2cd93d4373501

SHA256
59cf2b5bfa95a4161fcbb95d179d4c16334e249d71adca0df391a325f63ba421

SHA512
5f4a7393388401bb3d26c0019d48d8e8d8ed3a6ab3ab0b8d6c5f6e8ced02f011c7e77ecf5f583496843c112001022e930e9cda7d5b531a4e5901144cd355ac93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc316911676a9fdba092b800700c68a0

SHA1
ba39e6a87e06cd10a87e92dae1b8b2d4f079130c

SHA256
eff719afbb46d4a67b35233d347fdb96e7115dde5b65a7b38d5606d02a1961c0

SHA512
6e1c2d1ae2294b1b164453dbc6c308f84c98aa97a40caaa639b1f1ec63d8129a946fdd244e450df2f35b704353f139af9235c4c06f2f36a7001595d373ab093e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eb3ace9499966522e640054d37f19e3

SHA1
444799954fd4bc273bdd7e2c0989a393453b8a7c

SHA256
a453124aad1a8d3725a226e93931101619b799c00f51d8b1ab27800bb9dfa461

SHA512
2c7ee258fa74777068c227ab54ebc27ac96a82ead944afde3df71e801ab92fa96e2b3e22692c9665d35ec4ed030cb451993f4d75943830804ceb12bee3fdc4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1348611f40cdfba6b40623cab71a3354

SHA1
b7cd432c08d3237e6c5206299cfdca7f78636f71

SHA256
f2c1bc4746f8ffa719a0114ccf84758f6ae6dcbbe732cc83d054165ff905d2af

SHA512
b3bd77ab578d2a22d8585ca173c33c19a27e1597415cb8e6d0ed28e394223d51112bd484e9b9acf977aee4004761557dc20dca1c6dee76f767b8499825dbf14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50b9a0ed44c44928216b7dc9a5351259

SHA1
c8d0f04c8cfc4ec1098fa0d9204d4ff16a3b4b7c

SHA256
94b5d823d3416132eeb611e32a8d52b12514f4fd85725c95f9ff0818239a0cb8

SHA512
7b621afa78c2ba1a9bf94798c0480eb5d7d2c211c52fa284b99c0f8b057e3b80b5f65e0757b52bffb656e105b9ad87de264256e9f33b188af8dcd4df628e42be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63780397e64f29072f0815b2c921b772

SHA1
76a2ca90623c0aab8a40934c6209622152d49b93

SHA256
628ac4897765faec14739031bd2ee34174e750ec2269c935cac4d585252649db

SHA512
585aa29427f88e3326b8148435252e214406313e8679302168a56dbafc12ae9e9e14a56a0049f20da143cc8682193dc3c1a03debae94e2d8b3afcede11fef5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e19cc788b60530636c08a8bd2e3c8411

SHA1
90dbc01ca8a99d33d9075731fdc9b56faa20fbcc

SHA256
016ec09c20a0aaaf204b2fc476693166723cce83ce58da59b38d38d40c9df73a

SHA512
c0065366f4baf58b1421af09bd5c94351e805dedfa2265a428fe33a862abe783e322685a179ae8fba222bc65c576afca2ac2bbf186dd6205e8b567de2dc12e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8abace20ade2111ad8948d73fbdb040a

SHA1
dad4991bca289b9b7ea37bce2b0f1a6fd78c5142

SHA256
bc0cff236119a1e64b50e7624aafee554f46e58bb8dc74f963185415304f2ab5

SHA512
62079fc58dd64d030a55f66990737e21146a6d68caddfaba622af2aeb6aa195725de1fe82d73535b9f5ad29e57f9d6bcce760e50c0629de6eaf34b68b389ca67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
505bf0a6df9e44fd5cf044afab6bf6f3

SHA1
d04123402d5fff8daf0fb41e8b03728d1c33e32c

SHA256
f346c25690ba2c4448172997300940f885e940123c2f42b7beda5e89e8083821

SHA512
41df89445052a8c8e0db9e965c5fa1667a4bd3a38e6afa3a46b6bbe99fc8a616c71afa2f1df764cd44a1d4c659f6f271db6a7a4962b5eaaf73578974686cc36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A05.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A08.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B46.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit