c05748d32fc7ed5178b7db54bcf3c09219f694261320a2f4c6b33c80855fb166

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67727e7914b061f793d2a6fc5d210a2c_JaffaCakes118.html
Size

6KB
MD5

67727e7914b061f793d2a6fc5d210a2c
SHA1

8f2c9bf85c82dfc03467d98fa6ee6d335dcd4861
SHA256

c05748d32fc7ed5178b7db54bcf3c09219f694261320a2f4c6b33c80855fb166
SHA512

ce206ddf253f95d07d4591fb4dc84cf9a812e52f7023f0208047f985326e057c3b4827417b20b369f8fa0ec70b0a6982f2b90cd5805b86f6079f1677d8003e1b
SSDEEP

96:uzVs+ux7X3lXLLY1k9o84d12ef7CSTUVZcEZ7ru7f:csz7X3FAYS/kb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001a590f8d41faa6b8b7aa1bb658173deb95e5f4c958fed9cb0fc83ec89f371d3f000000000e80000000020000200000009e9fe784dce087aba63331f33c08bbe70b70897d11fcfeb73bc6d71888948a34200000008fda19879ad383b370690d0faa7c58d82b9449b93be412e3cec8f785d433b348400000008a19b2d198365693b59aabe99d10bb2ab833cea1f4361960eaad4d3612d67dd80ca46fd93ce5a803cf1b25dea212ade1e7df071fde114b2c888f41a8436f9b8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a40a13d42b79f44c1f023e7c2f797c0657d262cf59170200c63fe40769a6d432000000000e8000000002000020000000a3e9f19a15d76b3015512c262ff2d2f77c1f1bb14fb20b11706367a88a711bf9900000002eb48ce83c6f93e59180a3007d6ff51e839be5aec5dd7f4d5177c2d039889e225b279993138b9c36c3b1a7c721472742e6d53cdb1da019d2f0ef43c6a7619b8aa152977c8ff04e6d448ffcfb86d11d6c3fa9a911a17ac1bb02a8e5212b03967e4b1dccd4ddc388ed834045a61fe5f95e4093ac2e22b0513eb743ad1d0b7521d426fb55eeef0cde1a765bee803b4462e340000000c9758c3f2c270cf1681e6de8355873b4e693a6dc5edec8b71925b48319deef8b16a494c193fe13733abcefcba2185f5d38e5f9df91c7543868e4cbaf58c3440d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427897851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CFA0101-48EB-11EF-BBC5-7ED57E6FAC85} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f70de2f7dcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2840	iexplore.exe
2840	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2776	2840	iexplore.exe	30
PID 2840 wrote to memory of 2776	2840	iexplore.exe	30
PID 2840 wrote to memory of 2776	2840	iexplore.exe	30
PID 2840 wrote to memory of 2776	2840	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67727e7914b061f793d2a6fc5d210a2c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0645e4dbc288ed204be5473d55535b9

SHA1
ecf20cf855ac5c8334652eb7532d21ccc264b38c

SHA256
dc4398e322a5310b07eb414ed563e6730cb2710c2cee7e634b377ce3fa540fee

SHA512
becba813812a075d8371d51553be6cf93c5992b0ee477adab5a3f8bfe7fee59127ed08257e748bae7db99cabe3de004c426e518e504b42be3c47b372ac89e0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c25dfac17dc6ca0e5fcc96a6e758598

SHA1
04e40bb25da88351fa4fed4bb4d6d46c23b1577c

SHA256
11b7b35b83d72b406632c1dcd296bceb4b8030c17c6f5ec21bfd316a53f564ac

SHA512
ef33728b52e4e41c0626a896c73372615467fe0cd4166c4dc29983afbaa95498d9f848b632e69926a781820e790a998d5ebcc31f390fa67bd4621f7876f73ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39ebdc49b5fdda25a5b6215d2d44c61a

SHA1
7930b592332653f716c177474e8c895167b81964

SHA256
83a1fb6077d797185f4466af781369ecc3c8a15747f672bfb45b24e3ec217125

SHA512
2a5a2262f96d64e3b724f4a08ce4d3daaa2674de450faf33b177c9291584b053b2c19770d9f114c40559bcf2566e0b290113275fbdd95c91fd3bec531a13ccf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6439af128e7b8d09aff9894f4f922043

SHA1
2e0abe6aa54e591b4eb767c321c6c6797443e01e

SHA256
856cac6adaad9367e86c3b148b3b2b909263df68e90dba2ed34485881e4904d3

SHA512
c1af6d4b030b34f24f0aba87575c37e07fd2aa39562406beff38dbba9dc58a29268f5264d28c41f5d09f528cb881779f15d1fb19bd0ac364412d63b2dc2d1b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8631b97b0fea5054ff3fccdd3e85ff1b

SHA1
15f962717886b17ae856b8238620570993de6ba9

SHA256
e0e3125656920f8770c944043f97cfb1e9ce9562e7371ebe2ef8732f201ca99b

SHA512
19e80bc9fa704a98fdc2e5489701b74e67865fa5a44c0d48dcabbf9b1725e1eb8c9a1df0b6a582c22e1ce016a4a1456d791e0b48fd6f8ae257cc26787b3ec721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
876e11da63303ecce7114f5257d928ca

SHA1
439be81dd57950560a39e3bdc279dfcedaeb0207

SHA256
cc5a99c2a08663f87b8a4a0d437d7e1e4d0cf641d582bd7fc17fda992b4eda81

SHA512
7ca47106411e9dc90ca99861bb11058903f5b2ff1d433bb672fd2c81b6d7b96926881de2c8fb6f9131b7962c8099ee04c14ca8ac15a0db9195d846e83db0b234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36a0597363f61397876c9f33f46fae44

SHA1
078fc04fe738af93d27ccd66a397b74a8c44207d

SHA256
fafc23cd164142be0bc67d3459844daa72bfc8268b35b61f96be7f4df34948e3

SHA512
a219357e5b0f2413169375c3a0c05e52f381a91c40598c194bfde4433248c592667fa0d13f617fd252b726d94e0a9b1074707ae1d5d352214d7ab9cfdf048556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88b477f144b8facd1bf6e6e7323c7ed0

SHA1
8d97968040c714360e25f5cc7efa6c1fb2cbdd88

SHA256
8fcbacabdc8b39d0a8010e230830f09c4c9a1c5b2d0ca2a07e34614c69fd3014

SHA512
df32a5734b576a0a04422324f156e81b4b815455961b8906ca94a896c83b2bb4b8c9a6c9c10cf111fbb72d4be7e904daa4684165d103ebcb8e0b80f1b89abf09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f251d18ce3736a5e5d77b9523316784

SHA1
b6c30222c5884c20747675ae618eb345f859b4ca

SHA256
98be98304862497ff2c19ae5720159ee0a6faf6bae9163ae4b4fbd1fa0665169

SHA512
f24780f9a02f2efabb15816fd47ab3b6177e8128edc50644591ca8fe3ffe4b8bf78714254560dbef0193f0cdca91dda5878c4f2ab05f65b9b363a696d7dd1e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e767d991e542fcb9e705e0e3bf25d6fd

SHA1
bb55a2a1bb784179f23e11afd80f030b29e7fc2f

SHA256
42c7d150f7339f0bea590182f6224c44b04d0589c63182aa433235c142216604

SHA512
813364314ad20731111965147fbecf588107ff9a0857325a58d9bc2912274a0b3524f270ce71192d27587f9d973c838989dcb98b9257a1554ed97e8398b61358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
771cc68a44619d355b543771782afe43

SHA1
4292fc8a76364aa8fe25feb02a74795855a9046d

SHA256
b7fcbea48dfe8fa255f7d56550e6fa7b706d85c306a4a17e6f958a38d84a0848

SHA512
f92183dd1d156ebcf46fa3f2df5208ad9c5088b0b714212fa6633d0f0ea7e57f2480db587dd7e48816c33fac8af6bab8de9d8c99c0c9224c2ed465c48a0c7d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E34.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit