456a551fe4e17169045cadf83a83e9e3ac8677b5eca3247b9b5d331e15683a3a

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007917ce305a851169ae09252a6861cf_JaffaCakes118.html
Size

39KB
MD5

007917ce305a851169ae09252a6861cf
SHA1

b8abc1cc87cc21aedfae67447d826d1a5a5a8e54
SHA256

456a551fe4e17169045cadf83a83e9e3ac8677b5eca3247b9b5d331e15683a3a
SHA512

da7439645151e8919b41fca1ebc1856b2ccd23ed5e54dc375a0b507e5060d6cc0cb704ab4c8e54e22262fdcaada3d3e8bae368889eac59f4ce6dff2dab4a61f4
SSDEEP

192:uwzdb5nUynQjxn5Q/QnQieDNn7nQOkEntQynQTbnlnQmSlxWUmsxhCAGjNhrDbLN:0Q/oGxvDCBcyJRN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36127491-03AF-11EF-9EA5-C6F68EB94A83} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000009bead40064ddf0fb1022f080cb5aaba9024c72df72dd60718d8c3d9859a42671000000000e80000000020000200000000cd9e0fb50bcf475c0e4b11472357c1936acd9b74ca559f588ed6f16254d285020000000a768412b034be38ed54367d03e06b2e6931aca2bf06dd75bd01b9ab36c98b136400000004b162f6f928fdc08ecaa916c036cd9470ac3980ca0cca3217d61d1b0863a46424ebeffdf9efc58a35aee1d86a2e68cbce46b77bdbf1920dc595cc26db9818a33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420285521"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a6310bbc97da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000061d54ae12fa42b6fd29a1f5abb614021abba4e0b1958d25beac1dbfe48bce393000000000e8000000002000020000000ecce2ed3461eb7255c06b85bba99b840e92d8e68a74cfbdde816bf42ab0aa47a900000002b8a6653b56c001cfce6d725a1f7aaf75fae8c9d4030c89534c1cb5082da39e5907d1352d0e3b9dfd0771e1ae124998be52c4729908c758ef45165fb50b85e52fcffe89071f9f373798a23358ec1ebff600edc32028e6b4fb348eff67691fe070757f0849eb0f93cb49206e5493b7b9917407a283d66d675382b2bf1893a890d49fdfb8c77608c51982083347c642a0d40000000eb94da5aa97731e4eb20debcbbef6222249b9d855f5893bde5c8d8738839ef174324f0eb343c48708b884c25a305c00be0468adf138346dbd0eb3d7daf65e55f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2920	2200	iexplore.exe	28
PID 2200 wrote to memory of 2920	2200	iexplore.exe	28
PID 2200 wrote to memory of 2920	2200	iexplore.exe	28
PID 2200 wrote to memory of 2920	2200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\007917ce305a851169ae09252a6861cf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e96cfb911865462c87594b7f783305c1

SHA1
273c12feb67cbc46685673bbba1617ab1ab93b2e

SHA256
20438385a553f7af538018f5da15f6c0dc73727fb91495015379818f09da7c0b

SHA512
72eef1f00f81f5ccbb161c7de85a206911e41614749cef6a01545adecf84570d6079e447387f80e95a8c0568ca2e08eabe90194c6852661daa3ce1317725014b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27199c5665c6a021c122ae4d61781f5c

SHA1
346e1c50b5c62b697900d2ff4b8756aae1706ec2

SHA256
1f55742091fde8cbfe7cf397c205c8fa14fd7f640272324344a18d11aef403b4

SHA512
bf9906ee6119fb30f22598ae3e62351a8931484dfb99ff0b644d4611f6ed7f4f7d036668913ba43a757bf8595affc460213c7f6bc107cc3cb2e653d0f94aec47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab525523254c0ebdf41b6fd9994453e0

SHA1
014ca7348ccf7d83770b4d57234ddf1f8cdc3356

SHA256
75fc51d62adb242eb1c484501aa949286ad5050d32bcfc6bed6a524c65fce9e5

SHA512
e84d5dda37d0aa35d9baaadb01b21a2486fb0e10716f581fc8879f37ab09151d97e75a639e1989c2cbf56f673c793d248ed4fc287ebc0fab4ccdc901801051f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497efa561cf02aaf87903382d6840b32

SHA1
e8dd311d44f876efd5d409faa1a545ce1a983490

SHA256
64ff4142c201dce462837a957431190f170af09fad818a15301aa12efff44a54

SHA512
1f93fd21f2ea7b51a59fd0f96c3de7f7f4c739781eabb4164a0083ed698742242f23fd4daa1d4a6da693237c346bfa40a7f0086b9793836ff0eae1950bedd252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1437b22c121c71c97de9adb09e8ec4f

SHA1
42a8f0ab44b20901d025ea21f752e9e94133c7bc

SHA256
d64eb9d63e69e7ffab2bc1741b087dc286163dba2d62d1736ac7a9e424dc9f98

SHA512
f93f75903246b0129c97239bdc439914bf831aec0f760c7f2fff7da1cee129af2ec3bbc1ae14dd93678f3c36e0f3d8a58c859a0408c2e39d763fb522737f200e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e050c12ddbed4f25a411d30e55be12b7

SHA1
ec15136c7fbda506fc09f511f88096e926524d7b

SHA256
0356489f52b88f161842c248204568d7170625a4a67583c4f9cfb58141777d46

SHA512
d4865ae35c26a3a5ac329b7df603001fc0f6697483f44d5414c9b6eea3671a7a354dc152269b05a1b74583d32c2d3702df401fdb3248d539e9742d67405b0b3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f98c544a49c5b350ae697d2ced9083a

SHA1
26600873294d2152c5f1fea7278ef4e5987d05bc

SHA256
6b52bed66f7a14b234fec1e03d1ea57b66b93f39ca4e91c2d83eefc527eac9f5

SHA512
0bdd4bd20da02d0ace3d205e1962d33db97cbb228a43d18bb22ebf7e6415cd9d91acab83413cd191df14b6e4b9f25233617317006ec3d2a850114f1ade916cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E12.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit