400c7ebbab1be01af9a160e26c0895627c5eb15704cd585e8d3b179461f9f241

Analysis

max time kernel
137s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

252d91725b389d89c914634e1bd89fd8_JaffaCakes118.html
Size

56KB
MD5

252d91725b389d89c914634e1bd89fd8
SHA1

70eb367b8a079abaffca350038425686776171ad
SHA256

400c7ebbab1be01af9a160e26c0895627c5eb15704cd585e8d3b179461f9f241
SHA512

15937e5b6b676ace63d25de5efd74a2568feb9ff422877f25a1ffbe5288331c702bc76b84e8f93d36f513034b83772bd9a9ee80cb839579769882237113c4869
SSDEEP

768:Zcd9QZBC7mOdM41pC5I9nC4Z0obKVi/HUtUPd:gQZBCCOdZ0IxCG1x/IUPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f09326e7cdda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000077981a2529aad90c743d55fd721c82344a31d370d54bd63b6531944da752d26f000000000e80000000020000200000002a274c089a8c3b134723613f4d536546f0835ad586df468e14fafc6a57295ad2900000007a5d5b81d123ea58640b732d2890cec879990ac96f129722cac68b07ddc14332400b9180ad9db908734b781427d653539955f5cfd67b0018f4b29c0e1464b59e0b6be60ce5c5d0b0d87c9037a296e5b322170b37b6b93e32bb3ea1555e2e0bbabc0d2ec3566416f05626c12c9cc560ceac672643aab860e746e10402c1444732cb4a9b3ebbe59109fd2619b8293795064000000010ba0bc52b6e4c3d96708af9e875df4e06e21b840d6ad54e375750fccb0d92c864cc9dcb8a978f612f0c8358d7a0f52d4eb8169f79cc87cb2346a85666d626be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ab6e6463f8469eba946268e125c0bae54ab4f7eea7a18f54b8df82c318c6376a000000000e8000000002000020000000c1a2c26bdf9541fb2c91f37aa2afcc106c60fd81b4fc74cf34bcf5a61c757550200000006867694a702ed970f7c7d534671d2c8c5e9c44bde0ffb2026c5d69b1ca1a42c4400000001beed2cd20cd57bc71f74a1134c6bef9e9518f1aa45488dad694f4601c4096ae531b93260504e1ee74d21044caa4c6437049ace77c229d28d774dc8d1ccc792d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426241395"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E6AC2C1-39DA-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28
PID 1860 wrote to memory of 2548	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\252d91725b389d89c914634e1bd89fd8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50294482490dd81be6f8651af7df63de

SHA1
594f7e0182680739e1a70827a3693e8cbcd6a0a3

SHA256
458e102998e42b608d14784ca348c1dba3ca33a10a93b301699ba342ba5eef2e

SHA512
6fa3b1087fd13849fc5da8054b9f4ba69be153341b57602f14dc37a3ef3cdca624675a64b9d319f05966c8e1280fec57d9a817b5667d04d2b2b666aa1aed6f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c57a2d6fe89fe38549de0db8a66c0d7

SHA1
3a19fa35f6299d01dedc1b684e8d502cc0d4db4d

SHA256
fcc83456cd0b9bd1772954bcc24c6f1ef8f01b76ee74a93f6ebc4872a0db20a7

SHA512
88ee52b28fb4131407e47dbea32c5b592103d8b00db123606efefbf8d5801256ccf7c49c2696fa6bcaf72101fd552f7f12404355f2acf118cc04fde039e2341c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7222c754bfab3fb877c319caf5e42d

SHA1
12d213d5572ef9fea34d73618beb331fb0799047

SHA256
0c8ff61d13885d25ff9656e8c40701a9ddca5b579fef05cc3e8658b8573b0994

SHA512
4502bf1654dd269561e07413c0c5f26e48f9b572991b19372610cf5fe027055db96256bfa8d60b1aa5882ee5b60ef40f1a88c0c3940c7b87a27833b983822940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93c4493906bfecf78b222f09effba0b

SHA1
f9a521e50734a67265a1942de35b98b5e1703792

SHA256
1ad8f2feffba7ef319e640fdea9e2f0cebc031534a1e05bb652299663c09deaf

SHA512
7b6b3bb9a53ed8191329af7ac34ba5661f365e654f34d49be86375cda0b8d8ea0323e66387abeb9aec13fe5950533c160448dca43de2763c2018a807ed224862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f4254923e78d5242ec6df64666de38f

SHA1
8d07278a849ea87f4cc5f50e6aebbe7411664962

SHA256
57354d8c39bda445fe4ff6a95a2ac157633174f4701ed3ce8c5a2a1f1d320c81

SHA512
a566c845e9e9e5fba09660d450a569ad7a55e0bbac83ab8b899b73e7a2c312747f225f6a37cf67d80ae7f6c0eb6e502d3c1b1a2a71fe5f47a589f0b475f8ff8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd9d62133e58b96a932ec43367736692

SHA1
72bbbcfc9cdefeb37253b3ee7e254f20f9256033

SHA256
056966f654bfa33bd56341e84e95822947d6da982c3fffbd0bddf592058686ee

SHA512
c540a14c114b0b54509fa026b8790073cb1f4ba3f3b88d86a29e378eea4925c802d20698c82582f55c35951eeac140035a5110f260fd0996276973125cf6c275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ca89bcfee351ebf9c07025a3f7eb201

SHA1
39cac1cf5ae25e63f41d7f332b75bca8c363de39

SHA256
d3f5bc35131d6cebc31456bb57c8c6593d29345d123ddc5d86fe777ffb0a522e

SHA512
bd34fa2ab055c1a93510ed3081afcb83556db8a7b5cd14b3bdad736658a657499e74b42d64f38acbbdc4a1af2a8197d39a49e767c7fb479a3ce25f76dba76fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5faa6f12d2a46a8b0603c73dbdee6a09

SHA1
3c13ccf209fa437fdbaf9ad88b7a9651b29fed55

SHA256
1803416e8ab023528bff471f5501f60a4b93b2deb04d6ae1261e321c011365e5

SHA512
bde719d8020f2f75c94399f547f9c6516daf09f82583b79e24f6187b774456ced0db32c3e0eed48b15ac639a00b5f770a6d06bdbb17e3536d1276d651d88304c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78d64af0df755b34e89197b315d8ec71

SHA1
db7afbb482baee3461a862949cb74dd1e9d0fda7

SHA256
f042967d88d9e1f9fa8fe58491d6e40ca14952c27c86668cf69c3ccd37e9c7d0

SHA512
e53f5a217c54fdadb92a5ae36ac0a30d7681dadbd4f34100e5c466953f730c5e6e0a49a1a8f3ccea7b01bee8dd82009cc666a845cfb15f4c6a4b01f763fe6cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3664.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit