569dd82592ba82a349b3798001264cdb4c08c3b1083974cb9ae99a8b27a15413

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9caf4241913d737d066413016df84bea_JaffaCakes118.html
Size

4KB
MD5

9caf4241913d737d066413016df84bea
SHA1

e3ca04e3190305501f39a53feda269bf8ea90f68
SHA256

569dd82592ba82a349b3798001264cdb4c08c3b1083974cb9ae99a8b27a15413
SHA512

7cc53c172e3f517961af1629d8e9e68e091f2793cb04bdbc5ada3b4bba5149259bf24a94ba506d37f7d30557f5e440db66237a2e4ff6a71ee4c95fd54c1de26d
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o0/RKd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b460ad32e47fa84f816f2f68d586c08100000000020000000000106600000001000020000000501337fcd0e2d4222b3045249890c0409bc91b0107e0c13358147e3a24aec994000000000e8000000002000020000000ac6c87918c7619a354715b0d2bd1adebaea36fa5e94046e3905b1d03766e3f9490000000793db81a8eda00286c055500c92cbeeeacede56494c92ea87141bd20f9754799e4956bbfe2dcf5c8690495ae10926dbf35a5348ce2fb9e1f37c62be9fa30e1b847ef47c1ae90e4fb912600cb51a770bfc588ceac8d2f3e8e0c0b1485be1ac447496610445a734d21703e08e6b5712f45a147a74e9cc2096306867ffb2290364fa33b991bd4af0a34ad542af1cf35b88b4000000057394480d53d6986ac2f170a7ff7e468c1603d708d8358aa9dfa76263c9e4d13aa060103772174b6fd13be162506d5e1e08d7c1426a8715d7b63213079bc7057	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30385ddfa4bbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0AE67391-2798-11EF-815A-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424233812"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b460ad32e47fa84f816f2f68d586c08100000000020000000000106600000001000020000000a1a39f299455f4805228492a48eeb982aa83b31c48485e32be32cf1e1222007d000000000e80000000020000200000007cabcd271a059c22f9935dd019ac707635a99f056d2358a1b36a94bf87b0606b20000000e2ccc5c5e25ed43956e0f694fac79ee4bdc10ef2b75178cc34311f80863da17f4000000009906e710d3745a876f2986e301f2a9e45597223c2732b253ff520d52ef54d5687cf67c9c43f871bbdec0c3c856e867486cdce1c6f5d76aa03c5d9467767cb49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2628	2184	iexplore.exe	28
PID 2184 wrote to memory of 2628	2184	iexplore.exe	28
PID 2184 wrote to memory of 2628	2184	iexplore.exe	28
PID 2184 wrote to memory of 2628	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9caf4241913d737d066413016df84bea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c7d78aaf49b12a277064ecce44d610e

SHA1
30dd39cae979c8a5a478571bb14f9e09d56fc57e

SHA256
73fd6a9d09e3f740084387be231cb3f3a2cf29b0d956088ee95b45f6afe69679

SHA512
98dccd191b3833f0109109b086fae828665570b6863edab683c644829189687fe101aec2bb2d7212c82761c1264deb34a6e5ac1433b774ca12fb0a5360e21b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15e50706d2e15e13e3c543188248e61c

SHA1
e17fdda64cb94765fda87753388b038e22b9aa24

SHA256
8631cb3dbe6ad6148c60fb71f5994e74a53548649f27ef64ebb071171d1d1775

SHA512
7bd8c9a90dceb7015b1c641c2bb3754e5546c2c889fc943a72fc0b4b22f59e98cf3a5b263618623a9b244f9a4aa5228f80460cd77f54aecf42cd1d13f43a14b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eec88d54a3791910a3abd6f9b94f3669

SHA1
9027af9da06aa23c9aed5a65ee5bcfd6cf05a909

SHA256
da99733e02c85b28c2356bafac595cfdbdd3daadc8afd77ffbff060de94878c2

SHA512
446ec61e0113bae819d4dd919ede8df668bbe1f8f3e29c24bfc7a2f8c128a8e504c3b04fc26cbe9086b34264202349449eb48f5c07a9b78f4fb9fd0740999d55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6446677195172b5396ec4e4c59b0bbb

SHA1
ea5fcc06c9546ea3e73c3bef827c77d30518a7aa

SHA256
d44df70330327cbaaf875e218238473643a8ec981b008043d1d30cad646bc934

SHA512
a9d11421564d1420a0cdac5fbe477ec360a1b1065d8b79f3e2d695e33266f48d54078d43b968febb704028bd5cb3032cf74314091301d17c34f91bd52745a3c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc547d9eb84e174e9f13660e9220269b

SHA1
3612ac6d06673db53205ab2a9a0514d97ef16e13

SHA256
74ccdc1147f02cc4ce893f049fb4a58b123e1c8ce1fd9c8563ec4ee4e4cf07c6

SHA512
409241639bbde503189b049435d5f9deab9ffb1270d07b075c47a7b66ce99d7e01bf1ffa22722e314937427904268ff91ff698abd8d44d702f0d43a51fd7e5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fdd7aad3e020733fb0f6a3569af9c37

SHA1
373440b8f924e9347ef19c3b1b5d23b48f43717b

SHA256
5cbb020d6e9028c534a3c84bbbe4fcbe0152bce8ae672aadc530199e834a1b1c

SHA512
9a853a391e8aacb97e80ccf2ba943e3249bc861575977772a2f82f48f29e70e2f8de0ad492acd23c9ef93fd4079c8209a24374e53a073c4d9e27504f3de81b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4e9903635258daffbd598201ffff7bb

SHA1
067251b82c0d600b89430dbee79760836f9adff0

SHA256
80d0bbdfe2e20f9fb07703748e798445aa322848c0c152fd523d5d478d7145c2

SHA512
c114fdb2c893f60383c41bde2f6224c0191b027d6cc2150fccf111ce25e3990b3da1ffeea258272619d8575663c09be0378672d3b9055ab332a612a759dd2d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9b89a795b5fd839d4630326ffcb8cd1

SHA1
62490dbe1b821967fbdde173eff0ce36fb067961

SHA256
3f6ef5e0df1cc6674de963afac48317727a481e864da5cc9b22737b9150ebee1

SHA512
9e106f7db332b3fa5e02918bf01d25cfe778e9cbb85b524d673c4313f2ea3b79ba15139bd1177294bccf7a65c7196ba765bb00b70939249e0a7e54cdb30cf8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c0892c9d3b5b7fdb90aa3783a49a17

SHA1
d92327027b2d2b9609fa9a0771aa6f12633a75cc

SHA256
933dfc29d25b9bcc65eb18f7328c04ca0c08f117dbff869f03e172189f5b1003

SHA512
ccac2b5f567b346056d43c0a66872dd0f1d1acd2e02e93f171f8ee35de46cfcd58c11fcc4caacc453146720d96674c112543bbaa08294a7ed41f6c0b2b099611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95306369cf9b27af4aa4cad6c9e7f7d2

SHA1
9ac0202e8513454bca29bceec096781c17537b39

SHA256
5c5224bdea7d04d4dd9fedff690df1ceb1b93a8e776a5656c9aea342ca52040d

SHA512
cf85ec8520cc19e2e78a4d3a1dccb9f46262b52377b12c751b4f5ad67ac6b8915cda9dda51050156b5a725b0e7faa4fc0685fb44eaccc2a78f2861c240fae5d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb28b066c4be8e7fa97b686897aab517

SHA1
45acfbef6bdea4e509536ee774f4eb4b9fdb590c

SHA256
e27d00684766040aae0376ed11a8c94a85306f1a0bcb94810ffaa203c7464f87

SHA512
d8be494284bd04ab6b1de8dbc83fd960fd72ff83ad0d896a7dbed3a756d2e81b32e7d48f0859d7541e73e99c55af5646f39014e915ecfb89e9eb8f3dacf82592

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab368D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar379E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit