02c2ef650d489e35e6d3dd84db725f118f87e26b8d260537f788b40d067ca496

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4fde6b0fdbdfd598008881269ca598c_JaffaCakes118.html
Size

788B
MD5

b4fde6b0fdbdfd598008881269ca598c
SHA1

e9c322478cd7f187dab956b436046c6a59b036d0
SHA256

02c2ef650d489e35e6d3dd84db725f118f87e26b8d260537f788b40d067ca496
SHA512

f683a7a44743af7abc7c9391998c3418a8eb081ca36a0d460127ea65e7d86f1dcf8b61a05bbf27e669d2d47160594eece3e96075653a351d938011a127a38c8e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c2758d4526511f47f247ed3b923fe8f85e8186c95d7b8124a79fcebe4976b68f000000000e8000000002000020000000b5888f98564eef90d57cf84b2a689cc777e1e645a705c04c71eb1730b7a1120890000000b6cff8bb751a054687e6d8ace2b3b17ef9826d0da61b0ea409914bcb5d45945c324637f13f0efae1c8854a6e2c783522478dd3c0e9ccc90af1bcd92adc532847c1215e61bbc9942c8eaad25fe1e62cfae894ced9bfba396f690feecc113d01edb511c4431e6de904ca7819c6828d7927ea5eef8dfa3d26ddee4eb966c936fa05e964a1f3b2151590afee17248f47f3c84000000029fd9f4ab725b9ee9a910089f9434b3af6e1a077fb23cf75ad3c7a9051cc3bdb3815af511daf56e7d06337ea0e1a876d947428368783c5bfe865a0a22c396059	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC8B95E1-2C1C-11EF-9BF5-F6C75F509EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405c8fb329c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b3eb5ec776be9b94b388e42897da19ac53c55aa9149b122305fd25d616f665e0000000000e8000000002000020000000e57608a7543a18ec62582bd4c0fa6124e8d5c92e011641def20cabc5766a68a320000000cfa60c29c0dc3872fc0aa293e89f3635e8351e39739296bd4df961dcb1ed8e5e40000000d01d93d72b26e7b36e023b2b52b15942cb4bae8d95165e8c1abdbf81e0e960ca2a4bd4e2226ea743e709ef7f25e199d2bb47fdb6a0ca5b685dbdbf4a18864095	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424730690"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE
1164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1164	1900	iexplore.exe	28
PID 1900 wrote to memory of 1164	1900	iexplore.exe	28
PID 1900 wrote to memory of 1164	1900	iexplore.exe	28
PID 1900 wrote to memory of 1164	1900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4fde6b0fdbdfd598008881269ca598c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d60016a80e6597e5b5ae05399c4fc5a6

SHA1
2766e7c93627db64315f4faed7f280e22c12647f

SHA256
d4133d9f5c68f09433fd719d9dfb3d8bbda2f2ccb66b855f5cc7017c584768c8

SHA512
788093bab1d848e7ddbd3194519a1aeb242def06b6c1876ff834ed0aea251294aa1b314d01bf32abff1a81d7f44bdfb364844910a86f3ec1d07c8f44a9176785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c793b4cd8bb9c4c0b2f3a15db4ce8289

SHA1
d515eb3f844b1a2837b6f243f674d6deeac6b153

SHA256
e378d6c9b56646146f83c0a97ff047d0644c910efda816be56d70bd3936b5bc6

SHA512
ae8f9da9681ba2c4cb6949c80356758bad3451bae2b642a0b8f135fd81b4ec17b7c0fb920b6ccf8fd6438433a89bf4cb817cc1c95ccdd9dc53bba7eda5b4e3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
accab64e49074d75eb39e37570b87954

SHA1
b15ea3af3896b19b61bb11ef718074c4d209ffcb

SHA256
1252cf661486625b99a3cbec1e2fce7c12117fa581dd2763117899e027110f5f

SHA512
ca86c6a6e485fb4ad6e78cc9d203d1248b0c2ab4bbda7c59cd374f2973c34f6ddbdc087f9b32cf9d5fa91a84f752064ed2054388f42d693001f051e35d046d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d31a16e5468de68f57eed91e591598b

SHA1
9cec425de81624b8e8dfeb48c1303a386f639df2

SHA256
a4e87dc8597597ca1f35421726bc627fbe6c359487ca94a0e07ee698db87030c

SHA512
09f36f6a8e58af2ceba2609b360c9bf94dc10e844f25c89fdeab28342e13c6da37a33035dbfbc17f787ddd72d4e48d148520bf40beda1848227ac4caa1ee1aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
797d394dd4681bd4b9907d6b2142152e

SHA1
2d49fc633b897c99aca3b0d8668a23000cac0cb0

SHA256
ef0c0fead5f1086ec87ae1bd80ebe6c8a3477b35ddc2f0035471013f198706a0

SHA512
e0556ec85b568120f2caba672f6e8cd42ad3014e2fcc5b7c81d0923c61e47231ab2410e7abdfd41d6768f65cbcf561132d93862a55c7613a764f8325d68ace5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ba4ac4d2a4d4b20d9282f22b57c3f67

SHA1
4a331473e063a1dc12457c13735a28cc7b65b5c4

SHA256
f977b4e9d601e8f1e1b71973fbcb49f0e12041b1333cf3a214e8c05ea3bc4f14

SHA512
11127bb66e8920bd1d11b2643540dbdae35efb59c3c6eedd0f287e52719c7c128fec6eb7a315ac49200517b21112d7900f0840f59d7cc23142329b723686beab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a04cc226d1d8136c21c371b3e465950

SHA1
eeb1b58c70598b407514ef6eafb1a4e22def5835

SHA256
8d10c83bf322b101662b0ebd3984848351d34751f3d4f482f643623f230e5815

SHA512
084eba73e826c51e4ce3c92f2cff66e7efff54d60c123aa08e1a4616a33fc10ce80cd0181bf151861663471b3b3bbd92c892dc8df72488162644f61587585f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8161.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8231.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit