8037d74284564462880d8d28c82ace73c5538c28e5cba68b6008e38386e813ec

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17d60776470703542367d5579bb71b2f_JaffaCakes118.html
Size

6KB
MD5

17d60776470703542367d5579bb71b2f
SHA1

5d4cf36e841205d21d9aa06deb70e041e4204756
SHA256

8037d74284564462880d8d28c82ace73c5538c28e5cba68b6008e38386e813ec
SHA512

3d1aec9b9fe35e681ee301bdd655caf6e87f1a9d4a084b6b66a0fff98ced875fd98671eb09b94309d8e45a0baa8c972c0d66a2a15e40fc63c527942745777bd0
SSDEEP

96:uzVs+ux7nYLLY1k9o84d12ef7CSTUaZcEZ7ru7f:csz7nYAYS/pb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e22ed468e9e3954ea4610b163ce2cc800000000002000000000010660000000100002000000098fb53cce1aba1135fb4e1c51a84ae081302313c39e4592b86e9cf56fd0d42c4000000000e8000000002000020000000fd085b95e397d78ecabc38e825b3d05f5a1af29c5e9823cfd406b777a7f3113020000000b7894a3461ffd5cfe003a7693cabf6af0cdf97091ad5e260085350ce2860c3974000000027f0c542a00724dfbbd40a084d9076083d6fd803f2b113cabf89402a1ce759abe560ed5dd53b7c219c03b193267a10d82bccc4f3a88af3215c19640c4601c49e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6890AED1-34DA-11EF-BB01-66D147C423DC} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425691682"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09b8a3fe7c8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e22ed468e9e3954ea4610b163ce2cc8000000000020000000000106600000001000020000000b1d968e3b3454454135e516dc5bab6d1a3a81cc24756a202dca46d44be40b5d7000000000e800000000200002000000074eb94fdca20ca9a6b3b944c8a5258dc2bc63fdbabcca8c20dfde84a138f446d90000000a687c37abe14f0dc3df452df6377cd589daf917fbc44eaa1c0804e2d1569e7e5575c89101221a06f62a06479201a1f09dcc0f225c2f652967e47402aab9a4d32942251db43c69466eb969a47d673c49ac234f5193ae23e92f946895ef3e418f150fec0a011ae97cdc428e7e7c3f5bc8f33f63008cef4975f5cf03f69efe544214058fa242e82f63485f797a2a1e5083340000000625099cde7d251a9bca5d5bff51206aff09325fb8fb4fad92deb108bd0ded1c2b5b66e55f2cd2fb8dcbfbbe6b955b258d0c7e84e73f06119890b76f1383516b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2192	1688	iexplore.exe	28
PID 1688 wrote to memory of 2192	1688	iexplore.exe	28
PID 1688 wrote to memory of 2192	1688	iexplore.exe	28
PID 1688 wrote to memory of 2192	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17d60776470703542367d5579bb71b2f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b5b89b14f54f31b039e34567ec01945

SHA1
925c30f1c5b357b2c2906b9b01a06f7b69b35c2d

SHA256
4b6415e8fe340819964d60ff144c690a022c4144b33caa76bfa0469e2a7ddb91

SHA512
e5aa7704fe4db89f70bb045d3089f487d6243f6079b274d012de6d7d8b9fe673efeb65c1c6a2f69df62dac567b655638f86e65fbd9fb3ade772da4edbbe05395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0ddc055ffa5a52afa92912099cb0c09

SHA1
deb4c0dc5a81e0819e1410423eeaac3aa4653a73

SHA256
99a336a7f012dda78e0956244735061e33ac578f9014b771cb4730b33f41959e

SHA512
d5e92e52e36c9ebb60fa6a1e47c458e754f4c8c1f69f0fc51158b32885f79391fef2d158c928437204bb26105b222fe103364d954ab5545e51c50cc99292a2d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c565f009e76b51e5e2f80d2f8e2177f1

SHA1
a380db586382ed6db88f7f7f65e87902531f1d4c

SHA256
a03d7ce55bf21d93597db44725ad2c53d1a57f77c5507f0ff9cb9ebfc4641202

SHA512
8ae72a983bee6322cbfbaf6043f88002e3ae7a2baed0e5817db08031a9d6017af5bbb25ed27bb822614da75362132a32c69825f8e42f109c48b43fd2aa488019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6d82382912a40605e10d6f9ffe981b1

SHA1
ab82c37297fba92e83b31ddfbecb45aea3587097

SHA256
2788341810dac5acef2a6959da7a53ad6e0b4b6e76fa54d1e5ecaa61d0c1397c

SHA512
3fb993b7eeba0141da0eb28cb92d73c6b9d3606d0552f7f402b5305103da885f037c0080cdc0afc361aa1a177d12e9e7b38f325ab3721059eda3e2e2ef3b0c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e725128b4b5f877f5ad73d5e0ea0dff1

SHA1
68a9a280dd6ab126a6744f19f20a9a89c07b35ea

SHA256
9630bddebfdeb2f491e6c62aef4e02e4eae94fc91ecaae3ec1c2b0d8f29c52fe

SHA512
477bf6907b3d738fe4a41c7a901b8d8c5b88e8619460bd30716d4da24992eccb6247ebd27e2ccdecc73b5657c688e83d7012f3391c3755900e42904457c01d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb9c056f547c3a3e5c7cd4067d8b602

SHA1
6a0f45c8ae70943257a3d7665255ee9f0f3b3df6

SHA256
5dd43423e676a49460c3d467f7b36224b79e2bdc7ef1b561452b8a6be8c35bce

SHA512
547b7e0470a2d7806cfa5f057614caa1b6a8dc24c11dbb44a404d0f4f3b19cb6e82b6c59ad015dc1d2213f506b6d571f657457ae10c439f1930ecadcd4b27dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97dab6c4799a931b34160b72fb21cbaf

SHA1
3aaecd28482f11da95542344687fbb25d1828560

SHA256
c0d01f90369c2447ef84a73aad80d3a4ee0f5f6e60913c5addcd8e2c580c9afb

SHA512
3e95f67f35fcbb7e5a5aa2bd5415598fe27a85ea5db11abbc0a00667ddd81dad5cb13de652354bfb46c6b370273c8b5b20c5f1d16835df69663baa8c2dbb4394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de806423af4c29ab0c5054414cec6cb7

SHA1
fedce7af2520dcba4dcf2c09e658f84031421836

SHA256
18fc32853614c39d1ce2e84aadb7121bcd1efadef3ec2eb62aeac04cb7f1be2d

SHA512
4f9de01caf9670270c05f5ff5bb2a01be7d212cf8354de1c0d51adab8601547f8882381530bc9dbab00a61e10b1fa58075719ee09575945fc5af19ab40322654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e774474d25c763af95013bf303cf529a

SHA1
5df2e19c102e84087e217fea78a9364354310adf

SHA256
c6ff022c50fe6ddfac04307af5a555d74fef91988f89c9ee264ca8fd413d5ede

SHA512
d146f039baaf6a44d9a4d53eaed9fe1c800e5940e9ffb8ad21e6dd0af3c56838c18fd742b6346b7b1a5051f29dffb11466b7f257d23b917f7461485fede7dc62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fcd96cd8e4b5fa380ea4a130d6e24cd

SHA1
459ac5ebe3f98be2f1db7dc41955d3354a193560

SHA256
1bbf1e6a923219fbab88b63bd34b8f1db8dc5133bf18c3694bd7c2b301c9e9d2

SHA512
fa8e060ae6a73e2eb9844dd1bd5528deea1bfbd314eadf3586d08d9c5ddc3a5a5af7ac5991aa5a6c225832e1da642fa71b6a2b2f7bd7642abe27badb52fded40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
148bfade0b16360e2356fdd240773a74

SHA1
0a9334635b3c816474ed5ec45e7dae5e375f113d

SHA256
32249f13865deb128bb2f085797e6d69cfb7ee22840efc7d113c9d253529ab08

SHA512
27faa1cb0b03a0907f12e399881cc22bb7f6d57041f66e3ff05f998246b6ddd070cefa3c8628c3d7bb68d4e526be10971bc52f98f9d5aef060f457a64afb0429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CE4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar577D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit