e01b517c885b54227084ef2cbc60e72ec85a67e3c8c7a7eea1b8b71ef825b998

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5e238523e781005effdcb0e27218b8f_JaffaCakes118.html
Size

53KB
MD5

f5e238523e781005effdcb0e27218b8f
SHA1

394aab32f80d6478076402f2b7d54d6f13aca7e9
SHA256

e01b517c885b54227084ef2cbc60e72ec85a67e3c8c7a7eea1b8b71ef825b998
SHA512

db998518e5d7cfa56cf23a7d076e42182865db1c9f8e84bccf209d7178317de1896d8d482252fe4393e42c407fa699bbb8067fc0672d976939cd8a8ec5b06bb1
SSDEEP

1536:9kgUiIakTqGivi+PyUprunlY863Nj+q5VyvR0w2AzTICbbnoB/t9M/dNwIUTDmDi:9kgUiIakTqGivi+PyUprunlY863Nj+qx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000b49be3fd0b3f47f089da67a58715304698e8f0204a2ac566bba7063fd3a550a3000000000e80000000020000200000004c3a900a830d808ea80976a09618b171a6cec41cf7dbeb5b41e8d81710fc12932000000036230d24d4005f468acc2cda8bd738a615ac01617cefe320697b1a5d6d1275fb400000003e7bf2152a6a71f13176575dce61eaddb5eacee1fb21659e559b603871f06bc335ecd1ae3b2316a604c18cb93280a51517f608c5d858a83bdefbf3dd3ada54a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40225c4ecc90da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419522742"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37F869A1-FCBF-11EE-A296-4A24C526E2E4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c5f55091ff6021231d7b194bb4afc5c4ba54201ca0b9373aa898234c9781d533000000000e8000000002000020000000ab3d95e766ddba6eb5a57d06a8b7cd0873c72987cc596c1a9b56bfa79298cdc5900000002893f106dd59c8c4b00db3e73e8aafcb8f391a08fd6994473f73739cf1c85353ab0920b2da60866ee08c587a69695565b7bf9851e08561ce10f1926049cd2acc1c22ace9645b400e2651b3ab6a0d5a28c4df2dbdfdd9bbd965ce0c2e11da2afce82d10739f22f90637c6189d2a6e1fbb52fd15711ff605944acbbc43516844b19c294600b888e65a5915a238492b4b8140000000b9909eebac1a8b5321ae331f10e1befb2796421bc2e822862dcaf0ccac77ae739c2072fa7b61fed36a29886d251799f01e24e10ccf5e796130ea534f2a8a6b4f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2100	2904	iexplore.exe	28
PID 2904 wrote to memory of 2100	2904	iexplore.exe	28
PID 2904 wrote to memory of 2100	2904	iexplore.exe	28
PID 2904 wrote to memory of 2100	2904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5e238523e781005effdcb0e27218b8f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf972f5163f101d0777de46548f1728

SHA1
aa7bb4533e3dae03074012d22108b58150160e42

SHA256
f7d4c6e4a4d8f02a2d1bc32c5d59332b6352b5f4a5c5fb38cbfc89eaaea5e021

SHA512
aafdffe29dbdc9e9ca7f6745c4958bb1df8926db12c78cbacfa398fb7d375dd8ea63acbc88745f6c13e64cd9495f23ab1ea59d489fa497c9491ab2bdaaea1189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4c88d3708756f4973fb8effbe3d9e5d

SHA1
96a4b358eb8d1820d113e79d4b5f82df5659824f

SHA256
771c52202d438c20725e18a82705646f6078d8903bc7cebcfda78078f0ea5104

SHA512
6fbc65bc1cabd232a882bbd86f7812d170cdc25288119574f494037457ed8b0620d3b3e553a5cc49473196ee05bfae2c53349ed3aa7a0240d44dd041bc28eed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4a9b9ee61c1de5d09595c192a63829

SHA1
13bf1cf423e7d1e224e34728bce86ec007f5c93b

SHA256
1c53ffd17a4106732e7c5fbdc71d3bbda201d1af11b2fdee35a948e0a860181a

SHA512
97bfaaa97cfda1f02448d7567c86c79fe4e0c222ef0c9bf01f9ccbed264a0e01cfc8d2ca8e9d9810381b83d8612d2207c46bd5f4a3c0626c730fc4271de597cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
658c1f566c9efaafd6bafb14d7daf609

SHA1
6fa606dec3db95304f895b0755853edd282e593c

SHA256
bbc3f16997730c2c96473c199d2070be56062d130e9b929aed30a32fd759ed34

SHA512
5142e6bd8811f75130835a18680657cd0a99165c0986c57a667b3ce3fcdcbca309f53bcb68cf333c8e5e901efa80e21765e821f91fb8ec7dfae67d4f293046cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c494fda25311686d16352f20535379cc

SHA1
46405702ecdec67eaad22cd1bea6530de918d201

SHA256
16f172ccf882c565a1d61847802d1839a72c9827450de72ad3f9210b75634c1e

SHA512
6f81c87d8b53191b344c172b3dad012e483806145d87402a7af5dc606490ea6dd42efc15a9fe8c831324fa1c519eca281ea6d0ff1a520cfbe727fb5bae129e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ef725d4f9c94739898f0a8da61f0585

SHA1
6a9b41ee40298fa86f42d2021a48c1de7ef89bd1

SHA256
bfbf42d6c2c1a721df107e9cd6cd453dee4c11b9a1e3abe2cc4fe962af1e3044

SHA512
f6e34ffce70901c1401aa6021d20e77b51b3e6659b172fcbf1d3c1e79c4e4ee71a7d2c0f3b8bbf0af226ca8c286451da40a5c25e13fa373d09dcd60b7000ba31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
604ce59f15bb77bd0f33875a7780daa8

SHA1
7d5122bc7921425c1210862bf51a71b3b90d1d1d

SHA256
e42f418213c660a8feebfcdb1bbff43e33210d49bd380f18bf1cfd120efe5c4d

SHA512
ebd2cce8be1f9ea64c56b109e05575a6e4f0137158d3dc040421f23257e3e38f09f63c3eb791d03e7d0c0749544d541f38c55c803bb4265acb50b54912d8058a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc3c3024f3eb695cf259855b15d582b

SHA1
008d1aecdc4f6362e0d219a402e7026cda664d78

SHA256
0d8366ee596016e8e838f25ffb0a102f9e0f2bc0df3580c8e500023e1dd8731e

SHA512
d96c2060f715a7a3808beb41dfce596d660053d2256966310897c574d465e55c221a69407f1b76b453aac4cf557c1ee9f2b1fade4fced93ab9780824064586be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\star[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1630.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar183B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit