7a82340ec83d4d667787303b5dc244e97335d369756d839f6a6dde4095ab37fd

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7586bb7048ee9575ee67a5d9063fab8_JaffaCakes118.html
Size

28KB
MD5

a7586bb7048ee9575ee67a5d9063fab8
SHA1

a7a2f8d44ef475bb86130590706a749269d5e944
SHA256

7a82340ec83d4d667787303b5dc244e97335d369756d839f6a6dde4095ab37fd
SHA512

70f776e7856cf545411962456add9dd2da7d0568e182586715db340573e6de7d29539e246546a57cffd2c1a14f02cf8f49935a3a213c9c3e3ce1607ac0963598
SSDEEP

384:L887XR/T6fji/oO603X7CgEQawnwj/5b+KzbVKjbCKQbWLKpbE7KjbbrOMW:zufmQO603X7CgEQaXLb0lZWvfW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000008f1afa9769ac254327565429f778a810b04c7cdcf254b61e6ab59d1c3e710de0000000000e800000000200002000000098e4a1fb76b395ee87125ef92d31d66febd28cf67362224839977b6e43d5882e90000000c5100249f8bec997e8e805d3fb0f3a840efbfb5e7086a870ea6601dcbdfbf6b94296b9087351146d229d3e2b5d8561107caef437d7ccc7d9aed3c072e04db250751bb5d8f3c6633e316d719d68667f674e4d0daff8147817b7088d304a1544fcdec2bdb2818d38d009b28018aafee89d1b171aed941eac929c012ee24840ea829210e14e79c073fc3fc1968adda140cc40000000aea9b48c597e65aad50eea87891d7e9a3c4fb103eed29fd2c0ab8637b1adc9e70b25a1ee47dc5c8b396f85a9ae62dac6dfcbdebeb06ab7fb8eb717313a508cba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000e9508bb50be8bb7c4676425656b068496b20e03dfe7122f1f1e43f5de2c41bc1000000000e80000000020000200000008af5736c5ee743b627e01f3cef368c1d8dc749f891bdf8731d3502c79243cb192000000087d16e4bf9734deb493b455f0690f1f692ab2e23f5972f0f117dc1e772eb5ac54000000018e40a0e7c451d317610372b7c44a66bc89ab8340ac816e88fb5a8ca4f78add4a94fe99d947de558353230e1583c0f7e1ab3ba550dece36582c2233025c31f28	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424487357"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307c1c36f3bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60284721-29E6-11EF-AAA1-627D7EE66EFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1936	2372	iexplore.exe	28
PID 2372 wrote to memory of 1936	2372	iexplore.exe	28
PID 2372 wrote to memory of 1936	2372	iexplore.exe	28
PID 2372 wrote to memory of 1936	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7586bb7048ee9575ee67a5d9063fab8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641364cef5678260088e5d3b407eba89

SHA1
a1543550bd1d084aaf395d74f6af4ecd7eb9757a

SHA256
2e432fdc140f903c773d526ede249e450d94ab7e3dd85291cb6b3d85f920491f

SHA512
37f9daab7d42cd82f57885e9dda231c8f575ddcb8b4aab6517774f5145e573b8b45fcc23717e4d6a77cf6a60e885d3a863a81305e08313a6ea7cff4be077b043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b3668b4678ca5d9b16005e423ff1b7a

SHA1
973bc1fe0749acd0c3871377764bb052c1cb321c

SHA256
4be9f574480582c0ea3622f497d29e7c7430b53fa22234e4bcb0b6ca4999a7e7

SHA512
97b4d57490e9becb0bc768d7df3e84757f49d4fc3d56e0cc48c199dcc8e4bfe0ba24ad78dda789e1363c6c7257a31fd6afa46045904910f9952ea23ca0e7856f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0585f93fbbdfedc3a6b2a5197021f15

SHA1
6ab3199b2385b0ff7385a21d14095a1188388550

SHA256
57920e3cc7daf6af1e88c3c408f347ce032bd72456e8901972ae737862183b05

SHA512
63737ec1a388ea311ac897be97863b166eb022ebf42a55be6daaf3dcbeb96d5909e5345d70c9e2d432e60efbba430bac5ef2bc8d210f6050572d5bbb70b6d2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6306ab2194542b494ff606b9122b2e6d

SHA1
e4332b435c722b0a3c57b57182366487a4649cb8

SHA256
31be9a858dc476ca0a1e28d8fd21bc89e5be3c59e80331748921d493cf786ccc

SHA512
395d9b5fed53ee0dccf03055330d236f4fa00d9f5f035007d36cfd348bb8d298e35962b2e6fa7ae3f772d94ec778b49d755765f63bc28a31f2c96af095d9f88b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caeb28b9a351ac424c018869b952929e

SHA1
9d1c364787698424d72b2030a629c14aee01e4ba

SHA256
80b2f5d67bf8c52fa516b22d93654726d70121ef99113a61a5173d53ee2594c2

SHA512
01bc3e075c55da867da043cdc020a351bcd92608cb1356982565d877a77ca3b063471be68bd21bde1795d060bc829ea2f30c592826cdf698ee86be144758f215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57150516e7e9b961c2c90b5a039e9b5c

SHA1
da324fe17140b35ee57c39d760d67e000cb4a0f9

SHA256
d3f8cdcb67babbf4cf425236b4e590a7d1390b751b9e86a0a9598f605496729d

SHA512
a22c1e56bce1ccdc61a39c7b02f87bb2437e26a39ecbb8fac0af8f7905d3f13731eb08bdf73817839838fb59ff46851c3ad16b79d8b44db336c84e8157f8ed58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9bcbfcb199c9251fc53ec31d260a452

SHA1
02e2d904de4a9109c1cda34b8384d94848dad624

SHA256
0529e80b89debbb19c3e52b0236e2d35e4153a90ebab0715b884f6d748fa2648

SHA512
02ef3558d2260c5b587757dd1270a200e261942d6f9801d90a9a21e5ea63a3fac2491ce20cd1e789f80453bb1bf66f764defb7cbb1fc16957ec6a03a9066b033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c98f46abc9ac330d08c32b8e6e95319f

SHA1
63af369d7ac53c9d3523b5d6ff028d087b27e1e8

SHA256
ecb24a42380b9ffe13de0a9565f3773903a16c8d2e1a2f7e78e064fa6dc3d780

SHA512
463a67e8dcc56c8f21592b628c9abf2eeef4a395752fbff4c6b026450795c8a7acf66dce9b6b693cbd7190439988c2ccd530ef7c4cd5a9bb5d85ba8d88afa5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
123ab0a32cc0309fcecf6beb8c77e4c3

SHA1
787664cbb05f1fb34bba8156d8726576534ef964

SHA256
653804225f35fbea88e7051b1567d22cdff105cc785b8893f8f91dbfe9b1e5df

SHA512
244d66a9932497ddbdb016fd730e8e5b16c31d327e93bb15b6cc62d6c1310dd97aa1e082cc574da9f6a97429b921b92c49bc92bbb1fa6d3114a39affe0054bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
837d5ccac8e000cb5ee34c2fec091ba3

SHA1
8b049c1c842ee2d7d781423921dc132c568c3c96

SHA256
b3e86b1811b322e824c3dfbecbad8913477702a9a94d1cc39129ca6d0b4da31f

SHA512
cd101cc05b3add421925b7450f65bc1f2f24d34883918efcb20827d415f4e87badf5fa36127b3b6b7c6204eb60d73ea59f303fae9771e515cb2c732b7e6e1de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5ef962d4d56c5fc79b398c6f3fb231a

SHA1
6d096274033af282fc0c23777d01b26178dd5cdc

SHA256
d94856979cd7bf5bc84e4f7124b1a60e6a0eb4049ad9a11243a2ea865cd41e1c

SHA512
9d021b02c13c9f763eb67936faaf18060651cbfea47eae0992b286bdd78b851136df122da625eaebb6ab7e710a89ccd6d757cf63aeb02a1f8c7ad66103d8f459

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E62.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F14.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit