a80b181b891d2a10f14da822ba09f9704a4e420abbe3396a11f169dba38fda34

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

238dd22a885ce2ba04c7e3ebb7fac50d_JaffaCakes118.html
Size

17KB
MD5

238dd22a885ce2ba04c7e3ebb7fac50d
SHA1

29293820679208ca3d41f68131f679bc7a2359d5
SHA256

a80b181b891d2a10f14da822ba09f9704a4e420abbe3396a11f169dba38fda34
SHA512

5228e7a69f37e43134dafd7fdc2c8de59fe7489a24e1c2452182b463db68213ab0d8180e33375dc49edadc7f27e98dd0c201fc1e78d2f7516ab8b18a23020eb1
SSDEEP

384:xk9u0nhb3pp4Wjgv6sfOl86zB3E6502ajcPtyPQ:xklnh1p4Wj06v+er0XjcPkPQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7E3D7B1-3975-11EF-AC4C-424EC277AA72} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ab4c8f82cdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005c07203fc07a5deac8e90e54680da1002c8a25bb3f977cede53d8e0247b5d1fa000000000e80000000020000200000003f2001653c05ca42eee9938d6aae40cbf7a846393de3baacf299875d7867f92490000000e56504a705835ed0189957a274cb4ec716d8fac2b7a28aaf35d5dddafbaca1add79d07f8a7781a8e88db86907c2b4365063be825723644a3d70128918a6517ce64ee32fb84084b9476e993f2309c97f373dff54d6f9e6f2440d61f26f20bc1f51aa9314c58861fe9c1b246e8b601a751ed4fe00df4b2e06a36150581549d1191f7182a25d1712fd8134d0d4132f4a73e4000000050181b86c5fbcca0b9a73b4d355f345a1d15a66ae795a63eaef9e26729da841fcd3c50c915ca6461e8a58f2287b2670443f736159dcbcc3fd6c14d086ed50f9d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426198193"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000eada4e6720792369fdb58f8629a2d3925c647bc920c25f20585da89294724a00000000000e8000000002000020000000646bad53f7d3b4f931ff79edd0dbb1f150ef3978a16726f241ad177d772a34dc200000000df710b786365722d3b9aaba1d6787612e73c0c17b3cc098df5a46c49cb437ff40000000b29657f958c5480384f57a2b0f18719ab9155259e25d02fdba1a18c8350cee659a007e61b092e28c0e26f94e3532943170c72f00ff0f02fb5673923002dcf515	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2592	2436	iexplore.exe	28
PID 2436 wrote to memory of 2592	2436	iexplore.exe	28
PID 2436 wrote to memory of 2592	2436	iexplore.exe	28
PID 2436 wrote to memory of 2592	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\238dd22a885ce2ba04c7e3ebb7fac50d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d6ff6b735f9788fa4ba47614fc4612a

SHA1
12d55d68ebd7f040c487a2a9cd715e5b2e19dc2d

SHA256
cb40515683ea4549f5c63e2925c6311905d00185b8ef1d958695694c2e57268d

SHA512
a6be0516b0b16d7069681e6636bd7874714ee495952fd6efb58b5b2c84ffc6dcd2b5d5a4ff14409d33985d87c6a9189027deac229f7fee0a888de340ac6fe8af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8cb4b5dbc45c73491d27633efb98d19

SHA1
ce9759de4af6bc23e263827cb8f7bfe0ec6ba40f

SHA256
d7df5302dd2a12749ca83c014ea055d40a7289d1b5d1385c4f566c76f697ca5d

SHA512
a110a6b06d7910081410fad17536c7da4f479368b03062e3dbb6e0caf9ab6eed8a9cbf9a748093654206542addf8d17e6e11e1d9e9df79622e1245222df8bef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
603e8f8495ada56f57c465bde00d38f0

SHA1
98834469f98d6eda7e298fb191e3cb082abf4433

SHA256
9b94c68e959d7ba6835ac50414828b6e2121cc70cd701d918d13b0d55fc334db

SHA512
046623a9653bff6dbfa30fb528875a61e48b00546ebe4211fbe78b71ff4537915b5a26d0938861a6192961d40072d19283a5ce30d90b40e7669c4585d8e46711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5446c605a018aba4a4b91bee837d24f

SHA1
99f1773ec2f203df5d673eb797661b3ceddd21da

SHA256
3b993a4a97e3c2f02ec8cb7c3a53d593a33a3659b18218b49c73735e90e095d1

SHA512
70000b605c40f39c86a281220a366ac8b906ce2c7bc5a268c2c917c15bacc63d3ffc46d591b6830aa7d36558d923f0017a42f651571668f5b6e14bf05f6125c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89cbccabaed2d277cd1862b4bb3e49ed

SHA1
2257113db5650ecaf3207a9af22a45a791164d5f

SHA256
282fd4a99b70eaba81e3f42c800887f85d336958e1c6ae820eb9a1c63beee7c5

SHA512
92e93604e5bd90043020e5eaf0d218cbd3f947ffabb9ea9fb4234906741e77d108fd6548403438ae1e170e40cf17a65d4a9dabedb2e6dc5f746b554424b613fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66db596f9136a4b144f4cee55ebf0689

SHA1
04cdc0debe1f4e3d354672dba79fc0f9dc65555d

SHA256
9992220d6ab60603901362a2d2a8a841360bb487a6ce9b0d365f8f1b4a28cd44

SHA512
897bb6109b4b188391ea7e2740b5c661b8fbf42c5a5405e4c949ec3998838200afa7cc8debc8a4aa74cdb1c433b6b9aeaaeb9c7b16a6ae1079401b0d402518a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d226625bcd9c630feb2d0c5fc3480ff7

SHA1
32107f46458c6e4b9d2cd488518698728a975bc8

SHA256
bd302e2f191f6fba5afa51788464c64c8c60be8069de9f785cde6089442e2c8d

SHA512
d0e1687b6205775aba84de3baa696cdedc61621b3f52210ab08881da1454692df53e95f8ce6cb82b79082342726926c69c534af100a70b58995e432f647a8d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a57a13d62085d7222786e7856c46728b

SHA1
409debeceb60222390e2465356d06cabcd385226

SHA256
f73cd32b128826d5045b32742ca9d3f1819a3e52048174aecd660f1c1cdb74ef

SHA512
bb7628667499c2cf4067e784a60bd8a823991e3dd601dbad3ce3beecd0ecc079ae0737d8f6c97278ef698af4af1ff562f403c389e031160278cddc3030145454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77cc40d75b0884f373a787d567d6dad3

SHA1
fe24887950fedf2145a00fe0e9eeffb91f807d7c

SHA256
45ac718f7ec0efdae1ac8dea5acbac049d528558a5c5e531c60306cb4298c121

SHA512
a6835bf17a915c5c3889deeadeced547046aa6f212a718496c3bbe1cf3f72409196b69fd7ef0ce2cf65855441fa8d2c65635efa750c27452d9e00e43a83d94a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9841a85009ca0f2a4d777feb33fc1296

SHA1
58c412eb58f31698e6e7c06660f52f5777fbc7be

SHA256
cf02374db6359b73af20919f11f8863aeae9447f1fdcd101a1f45c93891d5edd

SHA512
fecb42a219a935a83ce72586d36dc691c00bccfbaf410a12bd95f2ae2923ce4c8f26300f8c3fea66b62ce55707186d98c9c65cfada68bf3af2ee955a9c02a406

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD52.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit