76ceeb7d967148741ef96d0b14ac23e9d15d33ad6cfb204c245d7c9713c55078

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f624d0ff9bc0f466f17994f3ab16467_JaffaCakes118.html
Size

16KB
MD5

9f624d0ff9bc0f466f17994f3ab16467
SHA1

4145a9dbf2fe8ae776f376af80aab7e95cd3fcae
SHA256

76ceeb7d967148741ef96d0b14ac23e9d15d33ad6cfb204c245d7c9713c55078
SHA512

28675b8da78af262f6566ef3bd1d798160d0941a864052456b4e88fb6d449e7c7d99ef65a53b8504994fd3d8c33a83c72f83e7c04f5bd3131d45841f8de16082
SSDEEP

192:RdCHhx17FHlrlUHdWqllJvpDT/AatwORK4EP2iyslDMUYJBdZgQCsxh07JSIOMTi:8pUNNbqOE9PzyslDMUKPZpCHOMXNxk/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4752C4A1-282E-11EF-AFF6-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424298339"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004d67befea4c064389a28b57ab8de27e000000000200000000001066000000010000200000009b469b4d6ba60b726747e47bcc29db4895fd7d084cf020cd99c77ccbf4c535de000000000e800000000200002000000060f162aa746df05f1fe8eb1ad49246d4f863edfb85f73309f04d4e9c487f067d90000000c33b726dd9d11d20645fe1d6b44fd83a29f5ee335bfff717c5de834199bea790fb794bbe9462767404127f6b608a980b39047bfd3b5b88dcb8b73b9e36cec5bb8c8bace405bf74ceafa4c59d6011cdd622d32da1a242162a6a334c6b919146f44e7361b71bb40f07cf9ecebf00576eccafca72ac6e317f36473ac097df995f1a9ad7e68cc56ff285eb7c918a27b7c42e40000000c5ac5204c0415dc1e48907aa0a277948e8e9dc75f4b5124e985b1f34270d8e57eeb3c00194f84d28a1f88eb9a89f25097eb45afb0fcb16241dad6c0a070b0fd8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903a4a1c3bbcda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004d67befea4c064389a28b57ab8de27e0000000002000000000010660000000100002000000070647678ecd46894b6e40312d332e325911ca12e9ad99cd3e6b3e0a61fcd9534000000000e800000000200002000000087c60d4781ca4e710056a8870c2e09db450a3175060a4e704b4afa2e1e8f74ff2000000079e1ffa8e031778d1029655d7ed8d0c55a711eaae8093d5bc2b1250348f5cc61400000005b1e736ba0320dd87487cd50bb8a2d9568481cf47780cc2207956dd84e23cd08c53d4a302e511198ed7a29111c1f83c4d9ea75933de8164bac36d75a5a31b79d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2252	2312	iexplore.exe	28
PID 2312 wrote to memory of 2252	2312	iexplore.exe	28
PID 2312 wrote to memory of 2252	2312	iexplore.exe	28
PID 2312 wrote to memory of 2252	2312	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f624d0ff9bc0f466f17994f3ab16467_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c565f08c2f2124274c954ba775e91535

SHA1
22a58e519706c08862e0dbc19ccb4e6d940e679f

SHA256
8b69bf42682c30fac4e090e9f0c0ed135e00b751d2f79dff80aa591b6a7990d7

SHA512
7de331d40bcb5e532fe221c5957a7ffacf05f7041a2749a2d7ed98e4da8ef6853c75bd36ff454d0a59d2e2257b4fbb1edd6479b19190b332d81b943d0249894f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a491344b2cdda9fa1e128bcfe578857

SHA1
cb9a611758568fd9d3b1c8e1f208ba2c0e998016

SHA256
1d3575f7a1d85837c0a00510445a46b640902e4426616cf7f7b6cb9638e789bf

SHA512
18e07951aa8cc388b2f71418ebe380dd8878c555ae4973ffc7f8f33c952469bd8db872569630aa848ee8d8d329d698697adf91f84d20cbe321a3ad8b5345306a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bb9829f9770016ccd1d1615d6f57c37

SHA1
5b8349c24d583831fa276ea518a61749f1bb53e7

SHA256
6363035409951e3be02c56f35c35c5bf5ba7c8e228fac6dbf219d632bde4a1bc

SHA512
871134a962e8cc1d57455bd473bb84bb571980ca430034861d5474971dd32cb66b3c66e85e0dac6871557b2f33cdbcc9d34c48fb72470ac28041493aea106cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee15e6e6ed18a56fe83195dbde2d0865

SHA1
39d5f0eeffdba7bafea471b3d99d17ecc5b954ae

SHA256
38c51e9a07a6c1edd2986adb7b0adb8dff3539e0826277911562142eab6b27fd

SHA512
45af8afc0a15418e03faf01606a69391603050fc2be80d07c1fdc6349d4c6a139128eae962b5fdcfb298f60a5b367040df6a5a9ad6a0303357123e6b5829c700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c0f306c827fb64b9bdae823ce6db7a2

SHA1
b3c43940687f105876831d687087beff318b8981

SHA256
6048e2b9f016a73f23481748516c141078f99d564f8e3b11fb8ceb41eb8b4219

SHA512
e7e83e389d27b1e199965d30df8976fd2711d976657fda26ac6afc9d14f1abce6b951eee7af51e376b7580d2474df1ebb343109b8f031a292f9aafa9b56e38b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3cd9727fd4926ef5a230a8cd92dc816

SHA1
f7104b55d201d3d6a4173d6a0b230b3724e3a713

SHA256
d5cb21495e60c26b87cc69566719cb97ce66cfc0b364422e372df4370eb20966

SHA512
32a7265dfc5c023be5987f14a28198ee6abe172e10b32cfc030044939630b5b0b33c62d907f738bc3d25d73a37bb2f605331c55745c40210f6284bf0ed43bc2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b33e1f93d192b0930b06839489a5ab9

SHA1
26ced27a26e85faf9750e6d0b33b4982a265fc54

SHA256
1b49b315de1109b840052c022af5a87e925125708e23c11c67114c150ffd8019

SHA512
8cfe70ddc86b06f11a8df61f387d900f4233f7d73244ecabed34189c3cdaffbd0d229cce77859e114eb51316d30d6d29b950a19bff4ec45a00816b440e4ef5e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14c72c7015168571ff942e3aa304fe18

SHA1
fbea431323e3f2f7e440f54ef3596ab29ef2f27c

SHA256
6011a27e669ae9c3bf74e556ec040a82493f95d1e10478e8ca5c716211b7b6c2

SHA512
06704567a1b7a5bd1380f48839e9a0e716afb27f90c21bd1c6d77ceb9047d5a55f40b4da3ec1ceef4d9f5380e2758bce87fbec7f5daae15aeec4af2723e2e46c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68678c602658179f8eeeee400a331e10

SHA1
c36c8953918c0ece8773346bed1e6565dd2da3c2

SHA256
8ffd8529ff5eb234b3f07041cfe7391c04933604a67ddd0e8a5f80b0731115ab

SHA512
dc520a1289c38e392d6e12863328c3a284b6a2ad2a001072243999474bd2ee5bcebb4a9820b9e031e8cce6adaba3ddebc7a3769f7b816b5db1fc3ac95a487c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15dbb491e8b98e63ddcf59170be6a8f2

SHA1
2cddb2603cd43a72213ef86fec1529a197469ee1

SHA256
61fbd941ea8be7b2ed4c0adbda0f704cd7cf535a3ab942036b60dbe9217f3de3

SHA512
9f4eb53bbf8f58bdb605835fa2386ed7954c3a79ffb3a87af9df9d487b4e493872125d31c56d13f25bba91db6c806c71b91a741edb30b5fe42ee9a18a81051d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F0E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA271.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit