351a4f5adc72933b4dfe555f79cc86068a2cd51a24eb297891d88fabf1088758

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html
Size

201KB
MD5

0027e6574e7dcf879fd4e31455c0bb40
SHA1

7fd1485eb340fb09e1b3c03c530aa57ceaa2e534
SHA256

351a4f5adc72933b4dfe555f79cc86068a2cd51a24eb297891d88fabf1088758
SHA512

982e57216657b320e43c33e835751f67feaf6bb2d16ed8db6a16985d97321d26968f9afd7d125c920e1713cc04c9992853fb0d002068afbf27f378d3e83fac52
SSDEEP

1536:kaGNYMHk6AO9mos1M/G4rlRiOpReFxe5FrKeXLPyOGvM:dG3u47

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01c9e535b97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000641961168508331ed45f9a7b59cbcc42774dcf0046c2180ae7ef28536ca6698b000000000e800000000200002000000082621177f31de4002dba2e68810887e62e9d79f548921ee863eef9631ff43bed900000001c1b28783e3df36ea485a711adf36c8abe184e4de1ae97d660a428da4ef4a2e4cfad836f6ff8910adfb38724a6181f21272fbad7ade6e4166b189eb831f783234a387e399d7112847e0b8c2334b4a5b2d6699cc5803e83e9651b1096998a98179206e5db0fe02a3499cb5f936e95685f3c42e9c073e0292aa5edeb12e4bf7c45af27e96120220094314f43d122255203400000002628c56c18d463e0f2fcb32cec9248bc7cf257845e02e501d6911568c870b7524586439c0772cdaa2cc2235c78cd3dfb137ad66b0ec8c5e5a869b54abe884633	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{654D64B1-034E-11EF-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b878845bff834d1515eec7c95b0a81e68ccbdc1007ab6175bf6f7f0048ee9bf0000000000e8000000002000020000000ef6e6f20a15defd23b5c63ef94dec659d000f159e3152ff58b1e85a3b2b143182000000004cce2f7f6c055e8978fb57cb65b0a2fbe7116f3d55ac6747dbeb7ebd7e40ad540000000ea3986be15fa3daf83b4ebaa1e5a6a46ca4c849d6253a63fac8e65408dbea87bfa11b566ecd3948e0f0ea135e19fdb3970ee52ce3a1227df8832d356403522d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420243940"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28
PID 2932 wrote to memory of 2760	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
26c7bc76a8ad62fc496f88bf34fc9698

SHA1
6c3fd613036210c3dac8b0e61cc1347b90594a54

SHA256
fe5aa234e906a04a59dc52ce14631df7f5b76206d9b7f404b0c42680bd116b6b

SHA512
1dbf2314d1a985bdcfcb7c91cf890be4b93121b31a85db1a776734de1ef2ba01e3b93e512d8f4379e6a3d70c986c599f2aebce1035b5f0d9e451726763179e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48f2d9c41643da8ca606ca7eec1614e3

SHA1
f0bdea25160705c9d5173c7094a7d0278098af19

SHA256
3f44f234ca06ce3ea2aeacd45b326669615111183363384e429a5c29439d5f82

SHA512
00e00ce82fcfb4099b3d5e2a369c4e201729d7b6c1b6e5c680575b32eec0016e669015befee0e16069d525794a1ffc5b94717607d6a97057c49ba302f0ae7d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d9ebc321d6596cc07e6e963999ba53

SHA1
d61f4bffa8882c7f51513111d07e78b33d9e48b7

SHA256
3470c91747fb86fa4f51b7c94bdfe6fa453f8d073b9548d0198f9dff1be55faf

SHA512
3f3bd77be1b50e47f399fdefac58a474d869cb6df4d0d5254321ebf0e5d9d82ecd249a8c3a8462efe3d053a932a923c21aeaaf1f2a4b1c57633c9c80eed23163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a671ea9e68a0265a810653050fd1c4af

SHA1
736686969803caefe414c025c70cc2ac785f4a66

SHA256
902689f9e558a07486ac185b1f4df60c103891c27e2dcc951da9b3fa9e933c88

SHA512
1d867c73557dbe3fe5656dcf44b7b7efc8a81fb33422fff56186efea1228b9f499bbcc0a893b8946369190670a8d95e58acfb90009dd9586bd08ef5ea02fd84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
229cd5d3bc88430729e442b6dc2a8867

SHA1
7e020d4289e8cf69d1ad0346e310d6317fbfecdb

SHA256
efff83fdf6155464166a7cf8abd0f6065fdd6ef7640bac9851d20937b5675c38

SHA512
11540ad14bdb402d57f1742ab3a77065a2c1cd67676d89179954344dc23ccf1d6cdf9d0b6d7db22a0da407ed3d4de897506a8a1960d2c6df379e3191d484a926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c6592e9cf8461516e2ea2d1aa2421f

SHA1
e6197fe1a43ca835203f4a5a2b5dca38c79a320b

SHA256
7afad8fcd6c182691cd9e5d98963adeb6de8bbf07a5a8245684e33b49bc866ae

SHA512
9d43e11fe983f515b9b6117e933752308abd04481696218345c850983006ea9491680c58de524872cc2bdcc269d62f97f4599e9f1c3adba042052220fac97094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
69c23f5f7f7f8b32b7202577b11136eb

SHA1
d17c05b05046f6d314f83b8464b339ec5c3a2a45

SHA256
49b9e335bfa16d2c3cba4a116f4f818f1962582bea0ac50ef7ebaf1d4266242e

SHA512
07e85905660e7632b4ea0eff1d49e8bee68cdd497beb5740e8f497cdac9f6e74a1dd38fc81f0bd1c9f1ceb5384d01646d2b2470b67d7a9f4ad38d6b993dc9d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f8e93a81dce2641aa1ab732e88bd2603

SHA1
43df8fee5a55d157f9118595b426a09d8f450ab0

SHA256
bebb6090847ca2a633989c19c0514258be51584ac9fe0a3440cc236f031755cb

SHA512
8c0c9fd906526b4a9995e5f2208a934c684dd9fddcd170c814a2de3abfbc7c52a4cc3e04b21162b2000c2fd64aafff559e009d2010673eb897325740def3a757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12BD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit