425b9c21a9dfa4653c1ccdef4958e25385764350e37ea0d98c39178c17dccf6b

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17574ee110bf3bf5c316a1b79c50399f_JaffaCakes118.html
Size

53KB
MD5

17574ee110bf3bf5c316a1b79c50399f
SHA1

934f90305fd950331981f2e7dc281bf7aec32914
SHA256

425b9c21a9dfa4653c1ccdef4958e25385764350e37ea0d98c39178c17dccf6b
SHA512

8533592a88c47e84de3c7d2e309286e4253f2c8fc0f12a693ddc70ffd767a0cbb170a77394b65ccfff5d6f3ea4a5c4ab529f54976e3a9cddfb9433f9450df417
SSDEEP

1536:CkgUiIakTqGivi+PyU/runlYW63Nj+q5VyvR0w2AzTICbbPoH/t9M/dNwIUTDmDf:CkgUiIakTqGivi+PyU/runlYW63Nj+qM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f95e4d106bbae4ca6b9938be86da2eb00000000020000000000106600000001000020000000ef6211366cf42f046740ca563550d63595af881e392d0941ed6b42719e74b49e000000000e80000000020000200000005be7ec941e3966e9e668ee6d3edea9fdbbf3e32d29177b63b341960cca5cf44320000000b238a46eb24be35abe7b7cc3951360d0e7589611b39df2c36383663ea96f961340000000fc7f556ea29e0049c72996cf7e0781111f572c3532cbc88a421d3d2d6c97e1cb5e0122f2857ec377f4d9996492de933ad59c44896b4e695df6de39808bede776	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f95e4d106bbae4ca6b9938be86da2eb000000000200000000001066000000010000200000005bdfa814b9e119139bab8e2f53fe940a640182478ef1e8661ce48d520a2e6ea8000000000e8000000002000020000000adb63b0dccc3db8d0a82d9a3e2bf21240f0148a4c0306a295f0907b8a8ef31fa90000000bb6cafc18364d909bcafce36a87a13752eb71e21b66f2c116287bac3c9c8663424332fd98e93c681b071d9933308de87a19c9f466e1e1bbdba9c98acb2bfa40a126fd0bdcb7f0c934c5a3db38a9293b6dbf64ab84c2e2424515649e5d47e6023adc3a5b320e39544102ab9c42ed6074925248753011fe28f54eed2e786a62d3f09ec094a9fffa02dbfa93d6d38267ed14000000093607d4877fe929049e2375814b6d301f03d72924f8d2026ad4bdb2e68b689eb39a74ab9ab60fbd12d546d4792f2e85b606027f623cb4ab42f7d587d12fd9478	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425680433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30750FB1-34C0-11EF-9A72-56DE4A60B18F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10942906cdc8da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2464	iexplore.exe
2464	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2176	2464	iexplore.exe	28
PID 2464 wrote to memory of 2176	2464	iexplore.exe	28
PID 2464 wrote to memory of 2176	2464	iexplore.exe	28
PID 2464 wrote to memory of 2176	2464	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17574ee110bf3bf5c316a1b79c50399f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8140f38d6309b520f2d64d8242963ed9

SHA1
084d06a33d1cee948a7887c4f25c4c606f9e50c3

SHA256
d389269e14809447d02508f2832637dfcd4e42212145ed2f80cad3f110ed5904

SHA512
dc06cb8cbed9ae3d9f3a388dd8df81e09c99356c1255c3e58ef27be8def0b821d70f783fbadfd3cac192ba12779c0505e0fef57d3d1baf27a24bbe6f6d1d773c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
100437a3a79e9702db614d8357e0e254

SHA1
a35be3d87419e87db5b50bfaa8b577791cb92ea9

SHA256
2eddf5009603ef4924c053be7431091a2164b6c22f6fc78bec0faf5117810ca4

SHA512
3e8901c311913857a42d44790c0e8de0f68547e086c26225ecb9c1f60aa927adec48b06abcf5e059f29b56cfe3cbb89abd135ae09ef1ec559d40f64d8ea4f94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70c1dd6ee5df85746a9816262fdde364

SHA1
106cc765e79a13936b8ac495614a8bcb63d7c7c9

SHA256
e8797f3d1632d11fa08f73c9feff906ebbb4bff2094ced033d5d678a4d1daa58

SHA512
68e782d4c6a13278faf79040e49e55fdc0a463c6437a051798538b0117b1d8b1a9638e71cf0b8e50283000a1ed3d0ce391e688e1752534ece29fa9748427a456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7712474378ccaff6ac261f46bb211f30

SHA1
e3a34f3aa1e3bd5d9d3f4537f9cf242f8a59f11f

SHA256
2562c106dda4230dc8f1c44efce490c4eb0711d73d60eff63070324d9c116237

SHA512
eff25abb2d1c22f321f271fd8ce84e775e458084105f9047fc9d46fc119e387469417d5842062a93a6611a85a7e185667600b99b6fb241fdf94679ab271773ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7acf126f9e811b54f8f8066e4bac7813

SHA1
d480c039774c073a07b47cbe64f0e4dc84d68a08

SHA256
475b6913f7b607b1aabaf54ab5cac09bd49d182a4ee8a87623434a2b66092532

SHA512
ce919766109ae7a5a0d8001fa0ad9374b52f412a68631feee5c1df579121aa6df78cdc8f1778ac60cb7d3a7fc11c5762bf43ae18d606cbfd8d18a5cffe751745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4b381ed4bd2c45f2b6f6a843462782f

SHA1
e2d7912e3812b2442d8671fe3464e2a07de39f93

SHA256
0d58e8c06f0fc1de40b4c5b7a0bf88a3ac69e7b3559afd37ad829ffb3166395f

SHA512
7f2f6202079402b4fbe2b468cea00e08baa5325e071305fcaf2209df64526293e1e544d8df2f89be2e64ce107541122ce69cec624851be389d06b1d26d9954a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f731b94ee54b8430475084545904a36a

SHA1
1f5fecce4675db6a0ecba28103d9db0a091c2d22

SHA256
6299a07d5c6c8b04013b0867c0b00416ff73718ef23e9b8a5d670a9a6566d75f

SHA512
62add78d13977d40502ef46f294fb915cc3c6b2c13896a6745eb3ee525f58b8b29506a78a52ad6cf4142b12a0e26f16cba8e66f2c56b9af34d34af0cd9ae2832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aa5ee7f0e02b4611e874d8d5896b6fe

SHA1
7b2256a7ead84f7ca45925ba11dfbe808f151317

SHA256
47ff470a244cd8254001967680e3afbda3ad6e7603bfe3a4457654731a82337a

SHA512
4532b577f3c5041c9007ed32a5d09d48ad4a6fa9c683dcbaf14de6d6683feb0016a08e2cb756048000ae07af8e88047445bea818d7a4c3de20aef1f0a44d73a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a35abe6fb693b12bea814c788223cee5

SHA1
ae3b99c1f3bd47468c721c5267d3f70ba40cdd55

SHA256
d09c399f6e1cd6221db39e08dab74f8dd422f48ff60f09b4742c56a21b198db1

SHA512
c1260ee70663067e8e0b50c2cdbd6e0cee65256a46d4e82b625f0dac83fac58e4ed73bfb7c7c0027aff2a50e361379e2f3041b991a1050f522a482ee5daa0b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3045.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3148.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit