742aef850babb91471d55daf1a2b5b25baa2ab094a30a5234eb3cbde16b42de5

Analysis

max time kernel
143s
max time network
156s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a4161ea3c5638b2f4ca07aeff82d74d_JaffaCakes118.html
Size

7KB
MD5

1a4161ea3c5638b2f4ca07aeff82d74d
SHA1

e63847a4148de313d69e62682a187ee101a73c4b
SHA256

742aef850babb91471d55daf1a2b5b25baa2ab094a30a5234eb3cbde16b42de5
SHA512

962e6b14d64225f7f967f0c72ee1c4d6ecb711122fb842b22b67ca8ffac1f42230d8f1c81b718abfef7ff1af247c6bf3865d077cb781d6d7759f5ebc82a88569
SSDEEP

192:ufu7cRvIWm4NuXBSLPURl1+mza8fmrlEaYC5:xGvKf+lim

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000dcd9c101b48326a4e9809ab0c21388bd5e387f67597d56968a2be199540ed149000000000e8000000002000020000000682dedf3dfb0b781fa4da2b52284a932ab4aa2154b1ecd52a15b847bef01ec8f20000000a59b921c52fe1b97bb77f315e7ad4d6b77a6a6aa5b6f9f2225cddc6a9c496b394000000069f2936ba8fe7a870b59ef2328f83553670098369f876e86b5d3aaab4911941446a1b115399dc30a83eb2f4aa7b325bce4f09aabcd8793d8d40fc8bd5fddbcf6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A143621-3550-11EF-BE23-DE271FC37611} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6052f63f5dc9da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000000f1cb4ac4576933ce181e05b4e61f41b92bad9be763e70de956bb4361855bbad000000000e8000000002000020000000322bed8c296368514926a0345f580f29c25051c123db1bfcebdb569fd1780bf890000000a9397698e68cfcd6e30a7ebfa3358586090ae6bc814bb79927cce8a7b3454b5f5569e98cc7273237c5465c65a3d4fdd9fd216e57649b98d7b3fe5150f36b9b40e854bda2f3c477eea67dd6e4410630ca7200d90253d839c5eb56b29b9fbfe10584fd776f9e3505f23121c5b2d641c4b3ae19439fb9e4921fe2aade9a9246340aa899e06f5563ab53bebf7143941502804000000009d45636c94679d296e3c21ab3696b4dfbe87e41ec6aa89a3e029dbd04811c1655cc7e55e5f6b12da8190456215bf42d92926e2a73d9a90b1820e65e65ab32b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425742399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2320	1916	iexplore.exe	28
PID 1916 wrote to memory of 2320	1916	iexplore.exe	28
PID 1916 wrote to memory of 2320	1916	iexplore.exe	28
PID 1916 wrote to memory of 2320	1916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a4161ea3c5638b2f4ca07aeff82d74d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a24159fb9c860a62d2bc96f5df1a683

SHA1
0a38bcf980dea00f91995095a9885d177d276594

SHA256
2b3bb3de1e160d829e95495bca2021e345983eb0583a2c44c022186aedd38043

SHA512
02ae7b481dfc42b495668d0dc9389c950a22cfcb33aaf6b673af5e409085d0584a7da12bb41873552a305210d817e7067e16c8150c1cc2f05e3a3a7f31c58312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6864045f75f353ba84642a225ef7b9ee

SHA1
7a92cb7b21043e58e1060901de6c65c9d9cb8c10

SHA256
519683f025129a46f0e414a0f101e50f8d8675597f776006e88967f9ba40737d

SHA512
07f4dba1dbf98bbf7dfea7b586f3b1b200421bc481a44bb6eb50e6db1073eaf17c7b9abd84d691c328b7efc890a7e5750e374033601d790b24748e48ed82e30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f2dabc3608c52b3e630c8a95f81fd1c

SHA1
deb0ed8496917be142915a7d8579efdc23b0737a

SHA256
a9a38908c1f4cc57d96783e5b1006ee5b8ba79d2147b38dc9bcf3eac16f901ae

SHA512
2eeb4df0ba703eec22932747b0373f5c4f7640746aa4618d077e154fa667d7801b663d8053d044d89a927a63b891befa6c3ed2be13e193b6e42162bb5a55f6e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4d6fdba4bb07d678026afe1c7e0b40e

SHA1
b92df8201efcc6cf2260076f851734ce0946db47

SHA256
fc4ad10d0119aac777709d252924e772d2b49296f399ee74c20bd891c15610f6

SHA512
b591e301477eb5fe2d1e9b1e932bb9bd951b4434eef498d1a9953226359d0269dcc70f2416bf7a4b4d23f0828f94a7c46393bb0cb8201181e937dc1bec0b7a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c31e879d75064c5887d36e545fc580a

SHA1
2437573efe8dd5c85d55f576abb399af17d9a0d9

SHA256
0af8d90ab24ddc8147a96c2df73090c3901054c170ad1fb10a1980e28cfa34ff

SHA512
a048dd662982314e269c49e7c2326ff95831316f44c7394f0e59f1675add19c80d9d72f4c9997fd657878df8ce9fe96f4fdc3ba0bde6ae9ac61661b6a31da17e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5401a1ac3e05c50580f2b0e9d1b81547

SHA1
f9a80ebd18a2a53034321816d207ee2f0923fece

SHA256
be974b48b76b3b1cdc42d0691ba12087bcb146c93c20aea19dea555dcd8028cb

SHA512
4abcd3bcae0a724d6056404a5883d09ad408f96e5556c47d4fe07dc7d12b4f531bc5ea402b6c80bcb4d34617070582aad55bee934fdc510603dd7e7a829ee069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c61f03db1da863e08d6fb6d1f1b21f

SHA1
24fb42a97b520d6b620d35d421f35aaa6b24b893

SHA256
769058af09122522dabaddb641cd6be7d502267bd7dfb47aad8811a7deb1af08

SHA512
fab7c42dd8483754e40e7b0f5381a926af7bfa25ab58600af16d9762f0c6bf358fac24829ba1ab497d4c08d9f462a0e51175ef39d352ae3b4d821eaa851742cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d73fe2f861a2b25d25976b6f5074f5ad

SHA1
00d14c6d39f95b8848debe1545a48f20104d37a1

SHA256
dfe8e9cb7f48c324ce7c1864ecb5a2d9a5e8e84b709887b85a972ad43e345b63

SHA512
a4a4531692b035c5651f67ea0c1e1f6108d1137aef44c3fa416a129c028bfb023dceaa3984a349eebf6d03e9bf2662cee8dced5ec166cd3fc338d58dd566e966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bafc2187a9d6823e5e239e0d1604c2e8

SHA1
349c316e367db6d578bfae217e97e20b4972b4ea

SHA256
aad9305f50882a4fb810434353cdd8c9144ec39a1ddb3f901ae817b8a20e1e81

SHA512
1fea1e1e8c921a899bfac5c3d5f5f7b9539abffc2f5f123c73d1ca54e2e29de5dd9d5cedd7a3ccc89bb139bbf5041c5cbac2e85af2761c15a0e1425f8e69886e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e687230596f7028664b7f65bc01c676

SHA1
f699382f73d3e27a32fb21f156cf0d3f8d05aa47

SHA256
ead1df7732d12b18d225a2db4f1e7fb13e7bd7fd990a6deaf129cf73628e3c73

SHA512
169f7e3b092484ab050ce481c888e15990e9d38ee250500e4addba1a49bf7d24b6756f93df6e91128a651d0ea63ec0076bd044e90fc97a7d0b2f639301e99475

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA258.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA319.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit