8325478c1f0e446a7f6716467aa89ec0a9c15df27141a7a34810031b11f8f373

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

174062cd7ef596c76bf825d6291292fe_JaffaCakes118.html
Size

53KB
MD5

174062cd7ef596c76bf825d6291292fe
SHA1

00cb075c2e101e3290cb1b9757cc65e2c7a88c95
SHA256

8325478c1f0e446a7f6716467aa89ec0a9c15df27141a7a34810031b11f8f373
SHA512

9dce15c475588c83801a14f72e8345b9c90ab25940cc6f7091772be2c8e0bf200f898c7bc6cef5f0ff028d2f29ffccdb0525c066a5f5012271a296858b2109cb
SSDEEP

1536:CkgUiIakTqGivi+PyUzrunlYI63Nj+q5VyvR0w2AzTICbbnoh/t9M/dNwIUTDmD6:CkgUiIakTqGivi+PyUzrunlYI63Nj+qh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a44101ae3dfc744a222e43123e479d400000000020000000000106600000001000020000000ed1d6aef7274dc8f2a20e962fe053eea640c24af47d14b327d1ef2edfe33d349000000000e80000000020000200000008175da3874627074d873db4f0bd5a3be0764367a26bfe9aabff29b96636a5d0b900000000a5dbe6786f9d9edf8cf82a837029dd7dc751661bcc62b1ba0dda2041c9269a228605d73986aae3edf75748651d48cd6ba149b517dd3b117f11410bfb9e01091bec965eefe50ba450818dafe6afbf8933a650d9f2e2bbd96a9675a820af887aad4c9da37d96c117cb2d6b74e7eac935b5c2b166ea74a6919c41655ef23301cd9aad0a69cd37935f64d6ea13389a5607e40000000df51514fdae6d28d8d5b83d67d0aa53aa596dd6a5e4655931f04e8ee1352b38388a5344613a72290a370b0830e57d7d6838ddcd7dac10bdbe5343d451b4e49e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a44101ae3dfc744a222e43123e479d40000000002000000000010660000000100002000000060ce09fb77d3e7cfdfa75c9ff75fae76661ef22bfdc8e212a6a24095b73ba834000000000e800000000200002000000046c84c6ac52778779ea61400d3ce1aa777e941d2000494193929cfa3b4c5802320000000d8bdabdee5fdd168634b401fd68d82c5e7bb6f8a17927c7b38275690d170b95940000000ac1a0aae7dd4f6b6d17f30f8100d6d2cf43e9e5308874d82ba9876b7d49caa8d2438778776289401dbd0e885f29d1af725384694b9ba9cd2fef4c0b527118e17	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80cb29aec8c8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425678513"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF3745B1-34BB-11EF-9A4D-7A846B3196C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\174062cd7ef596c76bf825d6291292fe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e5f49c33d7c5caa8011a810982faf9

SHA1
ab564839f8062a7b094a9de36a58e26339da8fa2

SHA256
17e1030bbaae7c3e47ead260fd44efd9ee714edf2ddcba1846fe0fdcdc7ce5d2

SHA512
56882d0bc9d65b2353137650bb1ab22583bb773ee1ec509c7ae898fb87716fdec4b24f5f843bba0c5a0ea7b4cb984d993fe9c63252240e93a141d33df756a480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef14777cd6fcaab01e02ad7b14adb631

SHA1
0a5f04cd6d091feabf722a6691d27a9828940f96

SHA256
64c4df14c062641c185bc3c0ecfaafec6a592fb49292be97de214418203b794d

SHA512
c953340519a8473e39da9e13eda5ef433f8484231a9de6a575b2a7d4268b3d860609304ba69645148a52c19c1d40ff3ba375d21a4ca222bfc61d0e5528d37093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c28c96a6524eb877cf2bf2e5122a85f

SHA1
e7f7180c1f835f9e3b9a0338bc825e5bed401942

SHA256
6072f4258bd9160edd3667bb24ba11b36059c7b0eb76776fca45e26fc36a02fa

SHA512
59f67676e663d1fc36f3cb84bdfd23324e3ac3867720fd04c3960347e14bf31b382643b0fec9a3bc06858550bf4d15a4e0cdeb2c97b8aa6767ac612095239bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4875f9e5c1420393d7fb76c4c6f8e59

SHA1
e8e75497b10c0d882f3b5c0d1fd66df504bce128

SHA256
2af167bc4973c84140a4a78ca21b7ff704519cda6cbb7c9d9e02ab80bf927d74

SHA512
4daad1b449742cd4fcddb44ff3098f476b5d5c456bf3a7b5c9f2008cf4ec8c25413e32fac2d65813854422bee45ede617c4ca0fb247d3b7209ba22a17ba8dee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bd7c49f701987388911e995cc3b96b9

SHA1
62a29cc758f2cc482b3b45ec21c39ce1fb51decf

SHA256
d102a02db769dc1602ce6930f56bf98e137358440d6e0ba2c8600473d6c8fe3e

SHA512
0077571b66ccb632c07a8a0f4b481ea86150d791775ae45635e9ea701fcf94fa3527c3573565763e9d921c2d4434508b19a6cbde02d9deedf35e5af5ba8e8700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d40779528e189a8688ce54b8cdb10aaa

SHA1
1729d3d9ebb8890573813a041a11181cbac59b33

SHA256
c1b1727a701265580a9d5ad6ad47db9b5e2829287e9add577c632f379445861d

SHA512
7a575e649e569f3c062d60625f391510dc469f541b89337433dae98a96cd8163fbc0d12d7cea8df9deee4265ee7ffba0a4f751989a21f0e29441e8584febc22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
379dc207c5f35274b633626dae86eb70

SHA1
94411cf9a5e5784c88a62e232b62accfb0def7c4

SHA256
489b2cdeeaf9ca873e47b3ec6ce455fddf6da876e730d92d9ae733545ba28bd9

SHA512
541633102c6116f1735154ed06f6c7a86fdf32afbca3159eb0454e981b0dd4350fbaa500e9fb6edd222674e0b57e23bf6c30b2f4efe9fe606ffcbc0bc074a33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a999ece5ec74428b171a76bc2c83e67

SHA1
3be0244f307335e5362cd5d97fa6f2dc1649df9e

SHA256
02ae06f1f500a4eb92354bed2579643b31083b62e48fdd1c3254c2a287e5281b

SHA512
44a64f47082740874bbebd4dff30ed7064fea85213eb2c75fcaf6d2affe9eae5e8d6faba0994abaeae8a32ef5a4e16a674f51f83e73244583cddd7dfae1dd544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635881e5ce5a8141c459caa41ffed9b4

SHA1
3b23cb16486ba51d21cd8a53a8499d1be32aa5ca

SHA256
c15982fa345bbf8d5cb45b09c36ae9a0b1f83c6a71afd45d9a40137eb2f2d85c

SHA512
3e0070ae616ea21489e14f11b7baf83a4759ccf046b83dd1edf5e12b65ef7c7fb7265947b3bd713d884581e5680e6001928bc4a9c4233d16313255b873d2d33f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
149829d3087c6cb0b1d1e4d9dbd5ffba

SHA1
cbdfae0b8393e2899bb952e036e887ba99b4f7e9

SHA256
2174d6f5f052b026c4024ef560d137ae2a5603ac02be9efa117e49349492ba32

SHA512
c9fa5db131adb17aa5207b74ec0baef7ced976f3679a44d74c30275775425a4a92a3750dfaa2e7b47f10a390832705bc0d1ead942e8309c06f014ea762f13b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC39E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC942.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit