6df6b43ef811a8ff8b316b413a0cf722e2f1d008c610848e364bee60a568c790

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac4202973a374d77c30a8e20ebcf192f_JaffaCakes118.html
Size

25KB
MD5

ac4202973a374d77c30a8e20ebcf192f
SHA1

77e726f8ae68666836d5ac8dc446deff853facdc
SHA256

6df6b43ef811a8ff8b316b413a0cf722e2f1d008c610848e364bee60a568c790
SHA512

7fd53cfc02f876fe23379e85c16b9a3fdf02a1f7dca5d7045fa864218049019deb60781d5ad1a9d7e58f0d160c85785d895e16a5cfbb9cde0dc1f95b9dc53ea3
SSDEEP

768:v4CEGqSTL+dTaHWdhlB69T+cO/iY2NhqZ5ZhJZ:v4PGvL+RKur69T+cvY/Z5ZhJZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d7f4a208b8185409105d9921cf748cf000000000200000000001066000000010000200000008117912def60cfece1260a36f07371e86ccbd8aa905900f4cb624730366fcd13000000000e8000000002000020000000b93419e254ee1546553cd749883f7addce7616f3a1e7ae7e40abcf316a485c96900000004a00956f2c797f816682ec28bf0fd4b6a54914e56b539b880131528c2cd343621d838dbd7b7ac996223d6c08a25a4aa3ae8a420cbebed3e1ddd1fac529f4a885ff39defa1cc94dd86c2e076eab7eb947655dbb7047e32c6aa2952b7e9ed199dcd74b19cbc6a3e9642dc42a8357e1ec39471137db97f742eeec86a6388ad40c79dbd6e3276283891326966a1c31a0f8e9400000003f2816a386b6da8e87b270ab11b76f05c7463c9db3a5ccd5659230f3cc7b6a3e9039328deb1dd8b508147ea8464b3d3a4fafc50f0cca39ec6947a2a8ac5b9c0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d7f4a208b8185409105d9921cf748cf000000000200000000001066000000010000200000005eba96f0482ad52101e58f43c89ab6397462f696b7a7f26cb00f0296245657fb000000000e80000000020000200000009f5064a3e73c9f9a3cc004499ebcb72a379d58ea3b83d51bec618d20c14b91da2000000004c1607a9760bc8641334488fef5429099dc4c4b2889b7df5a674f8e57a9839d4000000027035624152ae5277506c16b30378a38d63e3d896845492963aeb796e339beae366157d09f4086ff2c0b714093f0751e68c2a1db687afad75d62df34ffddd63c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c085393dbcbeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424573703"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68933D11-2AAF-11EF-9CE2-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2020	iexplore.exe
2020	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1936	2020	iexplore.exe	28
PID 2020 wrote to memory of 1936	2020	iexplore.exe	28
PID 2020 wrote to memory of 1936	2020	iexplore.exe	28
PID 2020 wrote to memory of 1936	2020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac4202973a374d77c30a8e20ebcf192f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb0141845a096891c00cb7cd08c09fd

SHA1
207649335cce961baebd9ce08637df509b03b3ef

SHA256
32e44d97b6f95aca3d466cab532f8716f1fea81346588adf6fea60a583e4871c

SHA512
fd5825a11c66d43ade607377663a50754a8429bd0d09a970bee65a8386e9e9094d869c1e6c0df944b17b09aab9979dfc7626c677f18a1b6d5c16ba0736527a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d1d577a4529368c99449795da9b5fed

SHA1
22ed870c2f11d9b33e7732b94758b371135fe9d4

SHA256
3b6f4280c92f6486698f610d8a7896bb1c64c208e55b7c5eb8faf6d5a486face

SHA512
6e7037c3d3cd88b9cc741a292645eb19e7bbf664b7390684f61891a6fa19614e08f014b628b4f463c24f1793ebffdcefa8792db1ef2aa88bcdc8b51a592e64bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c665852677daadec4156d7ccd99b70c

SHA1
1d2278f64bbcb79831c99f1a95f5f664a823537a

SHA256
dfbcad8b07e6ee2d047fe1746fceed81c7a5573b33ec60563ca72906bc9a8dc4

SHA512
6fdc45068723abe652f01be1983e9f9a5639a6a5832d85978709bdaa1a9e98427dea1d7d409ee67facad72c29ae1efc12e92f2c8e4ef1212afa7bab9b949c511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40e65825fbc4b5176a9f29abab7aff71

SHA1
6bd6edb6950d1a7c409a8ff4400aa9a4e3b7c41e

SHA256
a7073b9359b8ac51df62177a277f772b2db359d0958eddb2cbe8b6359553ac05

SHA512
ddfc12422889dbadcf5641dd63194756ae18214f55899a7857cd7292bc8100af7d5486b502cd780717f8003f8c25649cefea4275d8834964d33dabbfbe3c4e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af19f6434e625030d61ec607a5a0226b

SHA1
2db120f42e32a5a27fff219865341cfe621bd189

SHA256
a79e8242d63fc6bb26d1bfde99c2303ee7ea243df2f129b45c8b7e099c05b26b

SHA512
c397cba2c41b17d06c148a6415dbd93bff0dc3ecb2b6544e5cb4fe6d1526f51fba7741ef43aa383584331d9312e6629066ce3b870f9f56a29582fc94319f5176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6259807b30fa3b112500017fe312ed92

SHA1
f1a602d8bb4da3c9af4898daa97cced1ede0a2a4

SHA256
b2f6f4d0da0586b1eeb1a58e8e451a398a5c14d9d42a2cec289cec4ebf86de20

SHA512
cd4f2127583ac036044c254fa7afeb708f5c798b36a509c4c3a47ceb40c072140c63637530f6931e2adaf4293c3481bd35971761953559d23a3bac3258c19cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b36c3c45683e465dbf7bb701e558f240

SHA1
a16647046e8e660b9d0a7f67bdea1d739b095e3f

SHA256
5161700d8a76314ef053d027960da8e387b96e847d4f64206e6949998addd998

SHA512
830755a61ee8de4d56b648cf3ebf2ea379fff7139bb116618466f88dc26f1f0962113bca92613f10261f0186c78c4f1dde179b1e341891ccc05fa84b67b01f34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9b61ebb1464afc18499a4a49076433e

SHA1
7f04295604e903b2163f3a3fb3ca6e514da8c621

SHA256
3a7df0743c7ec8fc2f6558e40d8550ecd5949faf76fda656bc8b3cc37ea767fd

SHA512
7521a60e9158a078eb7281b2864626d4a05f1e1f50c8478aad3201b5a3ecb817e5781cb695c1497c15d931a550e9f28ed5d1cdcb6c5e164d8f04e0184e8782ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61dd4cf2506945c1a43859a4b0303e6

SHA1
dd362cab5582480c74fe83a0e3444369fdd6f75d

SHA256
aeb8d4ce0777736a48bf73c32e75139425e45642325e6db808b9563808190044

SHA512
4c8c6d839adcebd05f6910eb1b2badcc181c9c23b9fa50a9e3f4212049b31799830a2968b34c2a691e34b48048c36e0e0a4f4de5ac78cfc3271e0676f620934f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8e194a512ee5c218065d8452e2ecdc9

SHA1
7b6ca0d9d76b83839a0cbdb3066bbed69405d195

SHA256
d4f0ed4ffa82f4a5a00e4f6fd0f1983dd46d963aa6993330721780157b4fad70

SHA512
88c6fee8ba93b2e0757add49f71c4254bf2e82e61fa8a472720311cff9d160ff2bd4e6f278a37794022897b0985326a1a680d5fa5e7f3ad65964b812e30ca3ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59eb7d5f12db4e8fa67d57d3b265d442

SHA1
77c37f3a8ec17b083ad2f84cd8b0f8d61a8a27f2

SHA256
d0f53ecf2766b48900fea8c2d225fea0e7b181b0473c977eee9f7dca393798d3

SHA512
029255af76652fb88e811329442dc10e8e21923a1e5edd71002a0735974cbb22cce48012fe990437dd28fdf47ae897fff4e5fa4b8792575d5b6eed82d1f61fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc6f6ed5fd08e68e3d3016353aafd5ca

SHA1
cd3ecf6a0357364b72d391bcbe836a0e6d796636

SHA256
02fe41332391ead6a410edc59ad2b123a9a97f50b402c9888bcaef090da3278b

SHA512
324e8e3d09a12e08d9385cd456c97b640c56d6c15ca0f0d2652344fbe707cbee1cf2e18b429b9ae86d94835a58fa803ac356ceb8fb16b21d841aba7de14369c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3767.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3934.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit