7a7fcb4ac372e4b86b0a68e948427ccffdb8dc2cfb3ef9bce2fa8861331845dd

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

233ea1ff6fb25b29f51f7ba48e83b7d6_JaffaCakes118.html
Size

8KB
MD5

233ea1ff6fb25b29f51f7ba48e83b7d6
SHA1

020d21793004e280e4de7388a733128c9fd0e218
SHA256

7a7fcb4ac372e4b86b0a68e948427ccffdb8dc2cfb3ef9bce2fa8861331845dd
SHA512

3d2eac9840875639225a965e2d1cc63ebc45ea358c5208d8dfaf7a6c2075c4374073921fefaefc468ce9ba3bfcebc9be5bfd823fb918e303ec8bbe5a6dda3ba6
SSDEEP

192:leHtdRsj+mT8bZuDlVky7G7nAj6AKP+HrnHQQtPuyM:MHtdWjnTOk3OAj6pP+HrnbtmyM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426190872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b01ef1ca00bca61890006ffd14f32bba40c18eb4185e5016b5f9d596a50bfbb1000000000e80000000020000200000002a63f3de32958e48d96cf98ed68062c5059e61c7ebdf0f5ca155c35aa4051592900000003dac642d50379f74ff9d1343fcbda8fe88aec65c64e26f972cae47a9b1b6d7781dec803911e0d0b83f0cb787fec8757477b400e9d50cb781f58358e272c4736adba75e37a59f181f7c2e8c8aca3ae3341ce2d3f182453c0b737a0954716e52573d814aff85d89bef6c3386d22f5ddf031d5e2245b1774c65e86522982108fb478094b58c5b00fb2e89040229efe659da40000000733048588654ca7619ef98098663e4d1e688eb0f04dffea83fad65a12f77c87a32e2ad74fe333c2bedec05d73025dee397f0b178494cc6d2953c39a700fe903b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB348F21-3964-11EF-A72C-767D26DA5D32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000cd93ef16f7d4753c3df0582cab2189a4f9c8a5049ec98841ca44bcc9655d1588000000000e8000000002000020000000bd9d428948a915b8034e33ae3e44bcce0c0480a77f9de9a0d334905bceb53dc520000000f5aecd1f98027418a0be41073a9e4815f2a40aed0e56d26b1090174e05441c5440000000d38dc2fd14bf42c09a0164ce802db046b0a83689a44df20531a8b0e00f8d9a958520fc1f8ed9689a31dc6ad013c935aa349bc7efd3db5bba55565f0a7d415765	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0077d47f71cdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1848	iexplore.exe
1848	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2788	1848	iexplore.exe	28
PID 1848 wrote to memory of 2788	1848	iexplore.exe	28
PID 1848 wrote to memory of 2788	1848	iexplore.exe	28
PID 1848 wrote to memory of 2788	1848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\233ea1ff6fb25b29f51f7ba48e83b7d6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5ac9c6bca9b69babc7cb2f4e4bcb47a

SHA1
20feedac5f3707b70416ad70e52cd6703c6bda13

SHA256
fc3ce646d358bc1bf12a134546e330f3dab53dd89f56d78eab829a1e69eaa27b

SHA512
035ee9ddd769fcd97a1d47617a0c905657a5da128b04b67ee3edf8d66fccecddef6d12b05b67655b883436039c4cdf1aef46ebabd98dad0b2b5fba8ece32a690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6c199051bdb6bb88f78c28d0acba049

SHA1
3026cd171aa60a18eea7b69d28197b89e3cae244

SHA256
37ed4cf982dbd7d53637f422c3d9f6f53bb35c008819cde36b51c73d589a72d5

SHA512
fdd76159b4a1cb6991b88ad8da9e6af51114e76ba44374c814f3d0ac7ee9ce2ef4f7d95cb4ffea4a49d4a4e013a9b6829cd5c310bb8ed0ebf853b2172e1c6f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ed00a70b7557358289bdd16a01a750d

SHA1
a13d4ddaf3a968be5eb56701164ad8caec182811

SHA256
343dd7884db5a5ea64295bc13a81119fe245db77bb8375f7da34ac69b9f21ceb

SHA512
89ec6f5eaa92cb7beba65e0a4b06361dd43c485d225e51858f5bbc5e92a5265e8331331d17d32afee9b67995b4b7ed14c7fa2be871121e2836c156a6f40db9d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc22f3f2af08ebbd4a9e229266b40ab4

SHA1
ae71ed26541d59ba519a8ffadb824a2d872ac8f3

SHA256
c58ab7e8ffeb32948adc489dcf4ba5da0f2d764fc2ab8998d7caf0d62cc75e40

SHA512
991dfc5820c912979da8587a609592a39ab84f11312295a78b295c2cb0745517afef25a5b65ad5a66474215e1960b62cc1105239066a697cdbb0d601fa04b973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bbab98ac106597b7002bc601b06d118

SHA1
c5da6b8e95988a85b2ddbe44a5ebaccd957020f5

SHA256
b1eb04c4ba75c97189f78e4f4eb6642fbde7c302a52009c59c171dc999fe29df

SHA512
9773ee9a3a53724894aac0ff52e19029aca793c11093487e47ab3bfe7e9fd89d8e5c4cb0fc20a020c9bb5d0421f96476c1c4bbb62d83667bea61fdf550d8bd7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d476ccacaa6c5b4ca2783a526b77bb85

SHA1
58d3dea7eab43fe04bfcddd86bd8311f5aa1b95b

SHA256
2e5196fbd23e90e7e85b175e8ad19e3437396d8bc2d2681f873ce87dca8ff8bb

SHA512
cfaa11b39e3f9e34e539b011c014e40c17ea8b0cb087dca6199f80a6397f704e248e393c4e7c83df7ee63d82631e1ecf130948fa3732df2e92553b062b21d41d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c89caee75d329aa154103839b31bcff7

SHA1
63fc36948112cc7894668fc38fceb42b5b47d81b

SHA256
842476242d0a459b08976ea62eb223893574d64c970eecaa8e9a625d5f56fa47

SHA512
f11e9932f02344304c77654d60873ac3a325885c80ffaace63ba1ee446d919b68097acfc4ee465dddfb80b0e1b31b88d894ddbb94573546ca4e5e8895aad64a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ff1184632baf25ff4830f4baf993af0

SHA1
baae11fd65e60e9d991867a69722ca64bd63a5be

SHA256
37513ec6d6f05fa0a8a514777edc5f0eb76bf6a83a3a6108182a744929b646d6

SHA512
92d1c74f92ded2815b627a055cccee9a12ebbcc99e259388224fb676ca845509d538a003f981bd19c49b8e4a3310c10ab22c0567019c2b9351597326f97868c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b696f10d55488b5b089f24d94a8bb9c3

SHA1
b73574f720c432a856cd8eaeba830082eefdb722

SHA256
ba2ddef2991f7923da00e9ea08f7ab29d25b39f73b5efeed4eacf2c1fe0598c1

SHA512
124f171bf511c5526334a22cdf1d6162016ed44873657b89956dda45172164043173b4e714f7a5a389ed4b428c7ae16b253e0d7943a3d4b23133523baa949b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb7521ce6c6e7c87f06c0309a6e2a999

SHA1
02a411f4dcdda7cc28ab123433a4f5f4b93935ef

SHA256
3dcf66a7ea475a9b5197ef8a1babfa931cbed70c7d3135e9a05ed7b77b383d94

SHA512
72cbc1941c6eb51dc904c679c11d18a7c1cc0512a2e4e2263498d66cf16cb9c8ed792e3349665104a5f47ed50b935356e88c3f2a5efca6f3f6f5b2b038e92dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2732.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2744.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit