78c0a315fcd35f8fc752af9c001ea4dc6ca0bd8458784b844cf32010242309b7

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b331aabc8fe495fde408db5a5fe407a3_JaffaCakes118.html
Size

563KB
MD5

b331aabc8fe495fde408db5a5fe407a3
SHA1

606cdcb7eed023e828713f8409cadad828c92dac
SHA256

78c0a315fcd35f8fc752af9c001ea4dc6ca0bd8458784b844cf32010242309b7
SHA512

3d72b408350c460086f7227a4e8886476f32553fb9f43297360e24336783a9e5569fca1532e26541a52c204f73d61aec43991ade45294d4de1c4a685893b7db6
SSDEEP

3072:SjITPyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SjkasMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424698020"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA109331-2BD0-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607eb7c7ddbfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052ba278b8adf43419ea1264108be680700000000020000000000106600000001000020000000e0bd6bd8b6bc858b4f5885d7215d38210bcb9283a0d433bbe09f108f7634ee7c000000000e8000000002000020000000d4777e65c1518a597a6e9355c3066423047cc8e9be2f7baedf47577d22664bdd20000000baec1b43bd632ce8a6a6ad0a5f60562cabc0c87ef13459a41fe4e68978321a2740000000b0a0198ffd69bad34d752b703ff7134d026c47453239ba8b8fb7d385801bdef52382a48399e00d1534b75b96b42385586955ff2c2efeae50814fa9b5f4e9ec8f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052ba278b8adf43419ea1264108be680700000000020000000000106600000001000020000000a4d87801563fad6cf3ca4f8c94a77cb53b96dceb1629ec934af734c0c29027ce000000000e8000000002000020000000ccd6604382c7ff308715a07b01b99749ae8935f11a1e450960d07fc73b1bbdbe90000000c584e433207415f62b8d54775d4c3a3b2fdc5aa4735bd0fdc1c3c33d88fd703930b3a93e7135cbc8df64db8c07b7ae3b439012d0d9c2fa71ee55108277462e91e8cf5d52ffc9564e52e80472d63a0e702be971a73a8c7cb36244d1d6e40fff55498c6a9d47dc6fbf9b6e39094c0d8b2dccb8d4dd9666aaa70c272f978c634faa82682ba2e7cb098b8e0d3342aeed5a3a40000000c229a28349875fefac6ce303214d8597796f063e75faa465e4a96a228f5d7907d0b961e8dbdec19d85c2bac39440a1896478bc647511ac7d5303dad97b9b0c0e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28
PID 2860 wrote to memory of 2952	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b331aabc8fe495fde408db5a5fe407a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
244e271188d5f4985f490aff5b33ae76

SHA1
47a9b6416140e421372cc39a0bc1a04d6826f12a

SHA256
12282d3d3a322a74dec382bca9ce35e62388495b74b69b468625705edfd3c59c

SHA512
dbacfdb15d632aedd4b2126f92306491f9362199d6bdcde734560dbbccf957d9c70649b3813e065cf35f5d644305b271625685e6dd4354a162a5f2207cfc0a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27c7e2508eb9bcb774ffd7709f3bd4a9

SHA1
940434b5923db1a1311d2d8e6849cf73423026f6

SHA256
da3b2fca628ed28426b765c912cabf4663b0ae05a4427f5ef13bed0270e58093

SHA512
f5128f52b78576e6631f1a5695111b790b928ab3a5d17e789b791a08f383858becf233cb559a6353b57bb4fccb88c4acec50efbdb8474a824ff13b0e2fc2d2ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5482f5f4589b10c2809d18a19e6be20f

SHA1
7c447e492ff809d26359f76083d4e9b467bca400

SHA256
8344ada9c0128ff342cbe73260667ec8e499aa910328525e359c1537a6f213a8

SHA512
1fea36c3f785b01491c0cf61dda5b80ae6659bc7064385c7ea9846c0f978c34d4d8cb0157e89483c7bbf4667af18ba418abd1dd7f240cd5b8947e639f0f4e6b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be2f25e822087e69288dc450f79b72b

SHA1
863ba8897da31f9b58748887023fb412055c0002

SHA256
b8c8d7eeb767039342e8533375528ea784822e10689e2a5606e43a99ee98526d

SHA512
d9df0c174491656e6d2e2e0ef857f4f8ce515fc7bd314e53e36efb57a1796c773a524600300a67574726bb040e78a74e177841e718b8b3d6a280ade0cac281df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac63809342bb03e20b95d6cef085c444

SHA1
d67a00ec06542198d814a0791efb6ce277623d46

SHA256
578965989549619edf475fd5dfc9a8bd635bace384d0dc0fe3e042a866cdac4d

SHA512
4e5a4e59399c75ee95f73e6aaab17ea54bd1b027bb7863b4fdd7ea95acd12546a29c5e2c0bcab4e84cbae427682a598bc3f153e0db552584426e9e485a7b5f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cda965a7344682c6033ce0ed9fcfc1ee

SHA1
b0febb6cfbfce5b519a168ddf56390dabf10f364

SHA256
3532003c2036268a5a4d1e056bdb3fbd5216a44a7ef536df512e36fbe51790fd

SHA512
090a41b1be40166f2570283b24d4eb0a861c0cbba9ccdd68bf30b64add23150f3df52b20eec8e0da82ac4f45311f71d7647caf595066f0c4b63e7e8f10625f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5960c16a0ddffe9811a9d371523ab83d

SHA1
135d52b1a7f1c973bcea14f0e184c6f2645b1987

SHA256
3b278494803280cb138ebf09fc901c9dfdbed7058d97064dc10c5317660a156e

SHA512
f6e8541a72aaf714ca9f1a9a535d5680eca7801dc561af2cda4168dfcf93b845084b58a740a60f309079d856cc774b5f58bf1b9a1c7448f86b3d10519e4ebeb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf22122029188f9f4fff4aa09f4ff18

SHA1
c2827a713054ef87435227e1b4d838709c3d07b2

SHA256
30b2f80b70640e870dc8bd997da4e91eb5b4e94b6bad63661fef7d40053d94cc

SHA512
4687aa04081d7b5219279c5677aece79419aae1fb2d68b5681f029c7d320e1a73b9bbd2d033792db294c8f31fde149c6c4d4a452c098fe5b325cefd698c9ff70

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFB0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0B1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit