538cfc7741d28d1efe3cc520d9e6e7bf1e05f4797b8bbb526ee38235396599f6

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0d462cdf5a2a72f2a277f1275d8283a_JaffaCakes118.html
Size

460KB
MD5

a0d462cdf5a2a72f2a277f1275d8283a
SHA1

1dac77e359dcbc0f0fb40a86fa8ee917853f69d5
SHA256

538cfc7741d28d1efe3cc520d9e6e7bf1e05f4797b8bbb526ee38235396599f6
SHA512

bd533d78a1d8bb4361325315e0652c36b5d09e9d49b4b02aa9dbc21b932db9d6360fad438cfb5ffc463fcb2b8272b8fb864c89862d9a6ce6309699db2b6c07e1
SSDEEP

6144:SRsMYod+X3oI+YisMYod+X3oI+YGsMYod+X3oI+YLsMYod+X3oI+YQ:25d+X3m5d+X3a5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006dcef1de5ef8d749bd4129d5a2daacb500000000020000000000106600000001000020000000677f304b7e65cd564371cd7311bdad9ad7f36d9d7871d0472def1c86788e3976000000000e80000000020000200000001cfe9507ac9dad457daa6da9453de277d58e2c079abf22ab7be449406defb03a90000000cbbc89a9f4ecee14e4dea15b58d3b628bd4e01a52341988f76b414f9d3971117b85b0ec394338923585f1b4b9e4705dfa736eb42ac07ae3d3c7a19e39496278183b7765f67eb39d1588743c1d378d6d205690fcbf214354aecb69302434c2c938b42ec21f9eab96a848c4e8d82dcb35c77d59b5e14f5f83858cce521504eef08c5ad43f7914c309fd6e5cae6532bd9dd40000000e875bc88b78e4f28bcf357af05b4040ba98a782b72b2c5a278caedb7b31635ba7d2b49dfe0bd94094b1d7aa654790b05aae6e04fc2951881d3e4e1c1d9f3b213	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006dcef1de5ef8d749bd4129d5a2daacb5000000000200000000001066000000010000200000004e57b288aa7c4c179f8ea984e7984bd1cd61ca3a76457d8563b9f08325d0a917000000000e8000000002000020000000a093b4bd35233f2ea7f619fd4c73ed78c747a2c4f80c0142dc743dcf838984d42000000055acd41ef861aaa645b865d41ec0445901e5cde157e3025dc9adb1c41171864c400000002069f4970e469d7000eecaa9a639615e38c13e0990be3b61a14433554bcc134e6f630b74d20e134682c0f708dfbd4c6792ca83d50f6294d492518d541d07ff57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0eaf98cccbcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B474D191-28BF-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424360798"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2204	2412	iexplore.exe	28
PID 2412 wrote to memory of 2204	2412	iexplore.exe	28
PID 2412 wrote to memory of 2204	2412	iexplore.exe	28
PID 2412 wrote to memory of 2204	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0d462cdf5a2a72f2a277f1275d8283a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234199cbfc0b356cde9e1958e65bbab1

SHA1
6302bbed77d5a1e83fca735d126435d2b4ccb567

SHA256
29f0b3b98d79bd1df3fdcc13011df0d8a4041ec5bc5fab0503f783820cb05059

SHA512
79ff850a2f8a9081bfcad85b2fcab63873e10c5d00b663b332bb3ca004d8d0393d313b19dbfe2d3a6843ef948ca469334d6869e19039e0a4cce08ea3945ee209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
becc706a72cb44a9329c5cce67c1d2ca

SHA1
f05594f3c7f7b61f80f2327028d486b792c3528b

SHA256
d0101e68eb3212f090c42612378ac0f347336d599de5e274d5b58ef248fa8130

SHA512
76355237dfb09cd9abfac639ce9b2f7b3b525f7c64a54a64e61b293f4fc9d9a77793d1fb9f4b931f7be7b66ef25a3522661ecc7e40a46ff699cd7bc6b3983734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ae7559382c1f09b7574c29afc513cbb

SHA1
9a60c68d4677c87d4902909a4c33f9fd0d94fe2b

SHA256
d47928ad3b037db1568bc824f7c7fed4269a5b19490f620862834e591a330754

SHA512
be30f5b98d77f08c6c8fa916382538ad322ed77b75c843a42084a30c5dd549175a39f3d2ac4a8f796d09476846061f999ffc980104ef67e544b86a4317f1ddb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
726f374a4c8e5e5672d8a5ead777d5fc

SHA1
42586f546636ece8705c16701dbdfd5cac17be3e

SHA256
a841781619dae67f2002cd2867d53deeb5aac1725ff0a0cd28f42b5252c512cf

SHA512
24d3645d76361c3de794fcec133e5a55953b065620d28740f8d5c1dddfb8acf7d025622d2b8644c7778317053c12a03210c6c2ccb25c392cf79d22406c5a7d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24d02e7f84bf899335f61f712ece40f0

SHA1
a489f7569da8e032786b19fcc3be608e098ae8ca

SHA256
7efcc20d8df08819cb2dc13a4065355ac55948bfc7daa2c48a25f81b7d3d59e5

SHA512
820634ba26781985f933037cb62351315b27114c4926cc457b3fc1becd1b3678e1908ba11bcfeaaa2c437ef48ae416e092cc80724e0ac1b76c7457848f1a659d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd6eb80e30db032780af8e7eecf0636f

SHA1
d42bae1a9beeeb8a1d9c6e249dd7b7b7e6c9bc04

SHA256
22dc43ff30530dda153a4fe7f2096b32d7656b594fd7017e618056bd3ea87473

SHA512
2b63ec4ec1b5e23fd3c73df4ed041a66856344c8a06bb0aa8a0efc19afb8608595697a695058b11848455dbcde1cbe90b14440c2ff78503193e6c50b30ef58ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e75e27221df48483acc1dd492476d1fa

SHA1
ac3ff1c109ee37c938772f6aac749db7303d4f29

SHA256
0127e8a68fd773f9562f0d5fb833768f826b2102686946219680b4e56077419a

SHA512
1241eea3620c1a3d94580a522c4b1b9c87117eb1c1a5746e0e982aaa2ea67ce4f8968d1fdba31b70e25ccbfd276c5e6148b2e8f680ae5593104f98612ce30335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2e9ae0f4b43795185696b993eff86ed

SHA1
5f107bbc28513268aab9a258e9a45854750c226d

SHA256
396a5b9a14cde803fdc02b661f2f1ba198f0c3034006abd3e172107c1a5e45a7

SHA512
bd3b662d5fcfb034f0f899f2114609955b41d305010e4c0bdd29ad93b2eec9030d10de50305f0c54425a954d24dd424f0d622c4ec4c7b42fafe830ceb7fa1f12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf1ede755a70bdac36c62d8f30698f3e

SHA1
d93a2683a0db24c2ab08ea1df81a145970f2609d

SHA256
122e6cdbce112eb97595c6c2a5fc386db6ce7b028ff379cfaa148ab597584ebb

SHA512
4e8dc50c803657b212eb86168d0af0908f036f0fc26d89bd25c173ceb3ba5feae60aaa5bb300be3b61686e21a6bd82216dcaa0075600cc2290dcfed01faf97ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b04bdaada787cd0e9371255e000249b8

SHA1
cb802ede9f93fae14243312fd009a246abf5249d

SHA256
f22bf65c47af8d7869b2022b28bd125854b436b22ce3ac2d55445c2789d5a797

SHA512
6be63e5600bacd06fbee1a8396f7d08439dceb45041e2d315955d81cc23edde727cb20f9679b30d735798896d05b4abedba6c218dc8c8c36637ff75e1de9f732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fadd20062739d67ffa530f8dbf8f2c92

SHA1
dc0b07027ae2272ac3dacc0f5a860a4e63a3863e

SHA256
abe0b6fa59e7cf4f78fbe46df8d3540960809ca81125d6b928215feafa04fafb

SHA512
b4efc752ccdad5bf279ab5e79a7630c0c8c8c38820373ea84f1b152ee4133475583b743d6b723b756bdb5a7ec3128de778b44123adbc8e2a8418f2b6c265e32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4120.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit