a42096c520921fa601c3f90fffc1507ab856de0008c813222d1c3e5fc3511c2c

Analysis

max time kernel
136s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00144ff1e5156acd516ae169051da610_JaffaCakes118.html
Size

70KB
MD5

00144ff1e5156acd516ae169051da610
SHA1

08b817eb6808e1f5c628ecff5bc633d380d3167e
SHA256

a42096c520921fa601c3f90fffc1507ab856de0008c813222d1c3e5fc3511c2c
SHA512

4601772652e5d4b66f6dc5faea51abf7973c45359c82b11f29258df9e4d6f821421ce6587ee13c0da9ef087845af638ce238c21ae4e73d915d7cebe763cedbef
SSDEEP

768:JiXvFgcMiR3sI2PDDnX0g6se6ON2BW12BCFqDoTyS1wCZkoTyMdtbBnfBgN8/lb8:JU+7BfBCvTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000034f468fbbdc1191f3ce8de2b221f4dc474a63fcefebf71bee1462b2fb91b971e000000000e80000000020000200000005b02b0891b0619c3801c7c14f0edf36a22a26a4632163c217e1321d2009b8f0d9000000002b2ef73fbfbf5bf773c3075d6bfa92f8ba18e064b5bb8333aa3f375386074729ccb2e6f4a8fc5840bf1bc25b233d02a457b9805e3a190ddca1481fd7e1f9f974acdea42be48005e5ecbf64d339a1cc7331d88e6c48823e610a5a3e0545547ac989ba4bdce420490c1dd1b564715ca72675aa6e9692c4ef3bfe1ad249afd3fc1a85b471a2c7dbdd342c0a9b0b1d0087d40000000498b3777029f9f805e6f5c55fdcefa2e3676aaa92918bef975058fd147be575c2c930fa73d1f6f4d239c9f51788a416a4de6af4a812809f4033134b097bdb116	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC45FDD1-0347-11EF-8554-DE288D05BF47} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504702c15497da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009bd8e54174ffe722c61c4e6c07bfed8329e4a24365751f3cf8bdfeafa9c4b791000000000e80000000020000200000005db2c9bef8e57e5fdf4eefb26c529212dd62491e7e76b674f99636b9761a4b1e200000001e1a2291561a43254c5b3d177d8b94df6d0a2134f449a0d9760183ebd5a71c094000000020df82aef86027755328e311c348492da635470f19da4197f0299bed92f7b8cce3ebd419ff2bb9e854b637159cc57cc7668f3be053023102ddf1552c5335c341	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420241160"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2028	iexplore.exe
2028	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2144	2028	iexplore.exe	28
PID 2028 wrote to memory of 2144	2028	iexplore.exe	28
PID 2028 wrote to memory of 2144	2028	iexplore.exe	28
PID 2028 wrote to memory of 2144	2028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00144ff1e5156acd516ae169051da610_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbcb33a0d651a0f03c300b95530e0572

SHA1
8b95c66af058b801341125cebb0c03b27c51261f

SHA256
b0f232fa8a1751e486638161e4ea08eb074c9db1a52248d16fc0c15e3105e692

SHA512
9d569d6d73d69166189604ddee4d940cd7eea99e803dc2120cee7a259737fb125cdbaadb13e15e4052cc0ca71aed96c5bb4d23ea1bd69fcd4b3d901ff2d26912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
029c730e2529e30450defbf09399c258

SHA1
f26a069d96b2b8d2dea1fcc950b580a410c79b60

SHA256
f0ab79f9022f71c51adbc21f41038061628b173a72676e2d2f375c78dc86968e

SHA512
e88f16d085da2da2a4c8dcfe11a78441de9a363ec41b277333ee119a6271f7110a671d524c6eef90cf515c914865fe6cadad7e437347ce6e709b182dc7c8bbe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c53f92cd40bcc949268e589a48131066

SHA1
f1bd5690d26cce73eb8b95cbf6bb6a25f94ee9bb

SHA256
e6f29fa5fa4459f4e1231df1056c37b91cb912a22bfa4b04e91acff5e314e58d

SHA512
8e2df0b2293806ceb9dcf0fdf60e3fff17ddd559a9bd1b87e57a9d5c3f51fcc96a9f51f832a65479279537fb5fe471e3b762f9ab5a689b74957b38db785efc7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05042433008dcd59e11a8f99ee43bbe7

SHA1
c9163c96f080168739b5cbabb7ff3872b5f958ac

SHA256
7ec051aad2ce00512322936c258de0cbc87c135ba167663a98691519a1b31b73

SHA512
16350332ff2e4bfac1448429f25264615a86ad1fc57c59c9fb9c860274d4f4bf7bb6595edb5859e8ccf91b8bb550e3eeb6e32d370f2b1b75be4140cec6f0d6e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f1b181c2a08ac116708d0dc1ad05965

SHA1
b405f6fb48cd23f392fc3a83621c73d0de77c630

SHA256
98366954337bbd5845311e2a3f67d2b89e0a016085ebc1cc39fa0f0d8ba6c914

SHA512
fe38d0260120a0fa3a96a1df036fee4aa0e5dec76fa114e9d575130d4cf9938252a78606a4366e06f26c1dde8784721b7978dda30066947b86ac2949d3dec72f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a51fd500403c8030b6a88c44d275112a

SHA1
054eff08433c7383e6a1461fccb6d71bd94c3dbd

SHA256
c8f76f4dc6f61d09d65fa6c3d025154e543472687b9850580607784501f9b849

SHA512
d1639911c20d069f07299075b2bae7d39690faf5598b25c3fc5aeb20d51718e8465f16a5c6a74b867888d2128aa60b9c5698c62dcddd0905be01319eed00866f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
409c73f4c80aef039d8a00a8af8f8355

SHA1
42477805dcda9de61fc3e4be244358a4ccdd7a06

SHA256
19d5066e3b65d1972afb94d75e2df8fef26a7b32d49148126600874d3cc59052

SHA512
8a1ddaeccc5356724e4e735c84c04e7592d77153b47121c41623bddc651d26866991f035e3b0e19d097070c72cb71aeb3ba20e72dc68e03d33d45a09051ad25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f94bd87144ce04a9fefa0113dbe870e

SHA1
e4c2261ce752ca214850b609583f5fbde165b93d

SHA256
6db4d9400df744783e88f7feae7ea17d342bf87e20f7d1a67e01499ece5688cd

SHA512
62d4f559edcdf011fda0e8a21db8b03acad9ae437c54e0c82325c4b8fa6da6a5804a18f9e0559335b00c185cb02d4cbdb89dffe26511acac57b483a261408495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c429d5647e7062e52b86a95e837af322

SHA1
7f05245a0923ad799ffba60010c9b8cf3dcfbb86

SHA256
dd1d04bb32d259c9b75f2e65c5ba58555cc99d22d1073cdfb96ec8b59c9a9e5c

SHA512
caffbb4cfd03d2f01bc0867bf924e821519d0c6061069e18a1db6ab20241ed84ab587a21ec44f5c0bde9048900c183388dca60ce8b30f199c780fa3c35755ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab237B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar239F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit