d9725be5ee370f671686aaea6e69028d258c97ac6e258683813c3e4380cb38ea

Analysis

max time kernel
133s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1baf0b0ec5ee51767eb615f24e34c9d8_JaffaCakes118.html
Size

5KB
MD5

1baf0b0ec5ee51767eb615f24e34c9d8
SHA1

bd52fcfcb1f884d67fb409dc40acb16b913c6114
SHA256

d9725be5ee370f671686aaea6e69028d258c97ac6e258683813c3e4380cb38ea
SHA512

8e44f2dfafe98c94738eec0d3e25aaa2c1adc12c31e67510e9a0803f5945378a183bc86a9e9d3fb7570029c9f66ca6801a9220b35eee234e5e8a3cdb29b15e82
SSDEEP

96:xe4NxEEUHYtGGB7W+CLX175c3H3cxoNvVZRkwf:TNuyJJ5rf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9950A31-37B7-11EF-A759-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000014265d881e88232e7db3b46145609fbe714a93980111847f447d11892df93cb4000000000e80000000020000200000004bfdc780026f931ed46045627cd9c25f8ae9daed00af88610b36d0b7794df16a2000000099db5d7c7747b7b59ff2088603290ec4fac3e6f9d598d0f5b2b89d45633d485240000000d5f36c14ba2018f74c071ef2b138eaae75de3531e367c2e1dfecddd341934632538a2c12c72308177d74bda135ab43c88cd6095212b3019ecacfc8b02f75cac6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d7c690c4cbda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426006637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000cad7d2e0f8505ddaf25bd70c1239a8d3c2a1c0ef289993c52232aee1d064937a000000000e8000000002000020000000156ee3e73b7272aa0717b009073b25b9d64be894db49e8bdee518b1786ec6a8c90000000dbc15d4a2300b7b1b64914abdc5cb53b9e77a18ff3fd6e25289172f68ff29e6b1cb95fe84a4046eae3df2fed3073f124d9e7eff1a1e4ee298296b8bbb9b99130bc64f40f206e9ac31bde7806149b20d7f2f8f4df4da499302926a268d8135c2fdfc8e96c69aa90b24651ccaa572e0d7534fddf126362796d62c08aa7834ed85c57a034da1c0615b4223cb16263965d2240000000999c9fe52959730de4b1b5bc92fe14c4344cd8f790f3dbd0db59894918ab6ac41cf49d27399ac5673eaaa8724b4f6304be47ed4b9b2b5f27c236763a3609811c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28
PID 1936 wrote to memory of 2016	1936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1baf0b0ec5ee51767eb615f24e34c9d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44e7bb050c6a9930ceb9a429baf0e6ed

SHA1
0bf7f7b28a617d35ec9ce33384a1df3099e8b976

SHA256
990bc793c153170ed36be96678e6f191bd21fd32b7d37a58ff808a01bb4c354f

SHA512
aca2e29b44bc9b9722a15300881493d2e37924d97bc505ad3610c97ae0e1c960547de04031f6e3cb63014836228de37ba1dacb84a334c01cb1fceb13d9acd1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f928be6a8a622625f35837b5f1e3ee4f

SHA1
95c93b50abdcd432f643f74eed3c7509877893f7

SHA256
0cc40f6101b2cacda23756d2a9b7bdbf74666d4d75b492159171c34ae12888f1

SHA512
e100000ea5d409662c76e4e86b7b3936d561ce31252aa3a15c7e14d8c5e2e263636f97b77a6bc68211134a150f3bb8e2a3b982a97e71103ce4ba764d84080907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf14d586f966140596a3f53a90ae717c

SHA1
497fdef382b8d0e65a7b662835b1525fbd0fd8ef

SHA256
3372bed7283f5aa59a194694c280ae29e92169890752b6959e440d45aaa3f049

SHA512
7c24a4950d08b4e1714f4a7329adb6539e1e7cc1be248abb68f7e85b238743fe0fe8007b353357e44fea52ff07af690df55fc8cc5cdd35c0bfd7e1dd58684c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a1b795b2f2807c3a2014108056f342b

SHA1
6a0300797eab78a92db478294a46e07a064640f5

SHA256
8c35e09895cf5f4f54e2157b35d59d40d8427ef799ebc43474ea3d5633fb319d

SHA512
21e9c4f22c03a8c4ba8847f2e18778d08382d8436fb67753b1f821f9e2423555fa7001dadc4cb1af72d4b7f0da6deee1fc242f12b0da97e3a1254315e60d9eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
012bb6abcfa46eb0e3eea706322a04eb

SHA1
0902ccafb9b3baf78de800bcf825a9043554a006

SHA256
42c5a9fa4ee0871b20bf76748177826d3255103ca9d2a277fca8cfe2c50f29bd

SHA512
751c2aeb85674623ba3d3cb9ac201b7e7b3bf1e552e72969144ff11c32bef788d145398dcc78d459e4cacfff856c45b28ab694e9f126a5b8daeffe47e571eba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5f2d364a423f0387bb4f4dadb36437c

SHA1
09b1f188828032f4490829600cbc9cd2412f071b

SHA256
5e6c1eb45bb8b458169b178ed02800e3777c989ad8f2f05ceb19649e63b212e5

SHA512
708f67ddfe025268fb0cd94f6864810a1d2fbb82a9079436d89cc701ec62663406e104694e088e1841a2226169492ca85588b2fecf72ba2e54d873184d048731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fd2cd3d96967417dbeb5149e6f0b1f6

SHA1
bb005ebcac563534e8e14c9c5d567bd9c78e6698

SHA256
e9baa34422a3ac5c54e43583bdcfb749a7da50bbd65b85fe87975b242f42ea6e

SHA512
269c83d98b7248e800e9260ce47a2016ec91b826d10fecb1fb9e15c74ca7c5b4b6a2d5c09a9d3fd69c61a972d7683fa0d4f087871dd935d1404a72f46ddb4760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deef7e7a2bdce022d8afbadcfd7b0187

SHA1
06a908d69881a80b2ceba8652260e09cd813d7f6

SHA256
4d359a7dc31e48e8a570d87636ffc2d28c01cdb55969c3e8f440080103c3b697

SHA512
ee8dd3f4aaa4b639b8b1ed83a356a9397b1ebe7111a2e5e17771f12bace0f0eb2133a87d01b72511cd922d4fb49ff353a89abdd83585a1abc9fb248ea715a7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84449ab2017353db85d9faf3de637d30

SHA1
4d5a7ecde6d676db843ff7bda356d689b89b4151

SHA256
c5471e7658747c2eb6c7ca1cc40eb0336a3100469a45646974cbd73689eb703a

SHA512
e619ad40198578029e1ff06539a5d61cde06379cc0d0d03c473721326b436d1e5634c468f7be26986b6d25232b7adf68958fa4e364b6437b4d1898c2a04f9146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21da5e88323f5ec56b308d6343bb8341

SHA1
7a7be00c91f0e0a3a1d8174d837d46c409beae1f

SHA256
c1474f6fe64f140aa761ba0ce3536af864c1ac0cd6e882ada4edc5897f73a094

SHA512
d122eec1621788e45c0adc9f70ce220273ed13b69406bcb7bb262f5ba646dd0cbae948b6145bf15d7e2e8f09d26fbf4970751f30dd06460b1b4673019cd085c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3828.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit