0b45b11e39a57d468c5c6e07fecdad2f2f821a864599bbee476fc6876d939764

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1255af127d542eed7f3b56c9c9aa1606_JaffaCakes118.html
Size

138KB
MD5

1255af127d542eed7f3b56c9c9aa1606
SHA1

cdb51b940b2e522048a11690292cd8485ea4f136
SHA256

0b45b11e39a57d468c5c6e07fecdad2f2f821a864599bbee476fc6876d939764
SHA512

f9b0165037ab12eb74d24605312437aa6b947be09f9cffe866d13fd92b19bc09bd116f647e144141335eb6304eac77bb321ff192384f0912b7fc5509600ce2ae
SSDEEP

1536:x2rIO1jBmdwpQwyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrt:xAIO1pyfkMY+BES09JXAnyrZalI+YJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECA52651-0A01-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420980752"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000df5d1154ccafa38c846a658fd4010649b0c0854170510bd3b590a6fb8e7bbf70000000000e80000000020000200000001c80815ac4478755c0f11a576d5f245eedac13d7fb7e8fbec216988c80a4bc1d2000000075d67f8514c641b43158a36905b05a117a8e1adf8255186729494fd0d11c32ed40000000db30abacb55a0358182220c4dd38c09bdf016e7926f0f5c1d2d23d5678b457783cddc6369b1ebaa23570092052b4fa70630167475d078efb6509d1af3d53fdf7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fa28c10e9eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000007da61f88f21b77b986aa9820f3746e7ce664fcd4f65842ca0369cb2dd08cea17000000000e8000000002000020000000db2021cba7b7a14764e5b172e8f11cd050cd4bd2c651bf1cd070d2ab66ca08e190000000a14882b8c3b545aec8d5a137627d7c819df7f424267e513b5ac21edb8157b1e5d6f2381cccb5df66100710b8dedf74550c38a868b04aaa7a3a1729b295b3bd91dd8a434d2e2936c1942670a1a3517b6325a7de14df6ae1bc3539f6cef4a5b31cd1d81702be9e119a3396afa4ea127d33def5942f1ee888b032bb67e13883942d48e99fe37e7698a5edb5bf645bfe78d34000000011d7353ab7877cc82691a74fcc93b446ae8165f7cf8419998145e82b4b749a6fb3c83c044e5972f1161779347ddf79f0e43d182d9f22265f1adddda1047aa90f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2496	2908	iexplore.exe	28
PID 2908 wrote to memory of 2496	2908	iexplore.exe	28
PID 2908 wrote to memory of 2496	2908	iexplore.exe	28
PID 2908 wrote to memory of 2496	2908	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1255af127d542eed7f3b56c9c9aa1606_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd3714860fce3348b8cc207bddfc59dc

SHA1
ccd5e32c47e7914203501417e2904974abe09b0a

SHA256
dfe9dc08f1a1dd508478f1be2b79c11db18c38322410a45e1970437f62a773dc

SHA512
d4c04c0c1b7eed8eb7a36281b3020b585898cfa5ee02c715398f1587e21dcc24c4e2292f4419acb414259388bf36b37ad2e7f7aca21525b1e93f94cc5a8fe8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d5c0395fcd393276f53ee78376cbcc

SHA1
f871ecbf11dd88ed36588ddbee3ecee9267517ee

SHA256
5ffd16f071ba5b41f105b673a600e3133240e85cbe8322def03ae8ccaa012cc4

SHA512
0a7737161674f786620b087542f8ab4735bab1e837ab60fc8a993d36e38def3d76955849d0dbcaa6a47351fab9b3a60882f5d903117d58eadf96d2a77389e117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a85dfc6ac9993412ceed5c80d4ad4db8

SHA1
3b945b99bbd449f4f9d33e4c1943e50fcd9de0e3

SHA256
c9d6caf5511bcf66fc552215f2db2c7f548035594285975976050b0d571721de

SHA512
fd2ee1fb912fd3b30728ce09f7346b5f7757d39ec8c266288e81c9869fbe6e4057afa71b07e557d5b11287ac66e13042113f04ea8d199b3322d3ac304b36423e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
878c5f804f7f2ec7c96003fc3bbe9c00

SHA1
dc8f9bec0f2fbf0cf490def993f258efd2956640

SHA256
79220a909f4ff621beddbb89cb24342b765b6e335eeae42c279d2ee586c18b41

SHA512
93918feef2e615b207cc66c7d5eaae2a067caea9c57e85be83d61f847cdd7077abbebf0dcf9eddd3dcb311495e91da8fedd7eaa200c4fedae5c6bf2cfbcaece5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
883b261884a955ce889fa80216faf9e0

SHA1
090c2cefc2776cf1d6b03e5cb454a7679dba7aaa

SHA256
593e76219bdd631ef6da9e6ca4d26c6a7535ddc95a92b1edb4976b07cb459d26

SHA512
7a4f35af6a2b8c16be17921ed0d2245b814f4499abd5fad1b9058b43b402cf4008aa26b9eca5fc476726bb718c87c8190e2313a65dd2985e154c5baf43c28f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b90a9f0b4f4e066a31540eca7888f044

SHA1
f293683da034d5174b21307bdcbf2c3052e16738

SHA256
6a02e57bc12c9cd8c9c9197d7a513f6825e74d9c81642d6ea8dcfc300a94c46d

SHA512
ff04c510d0372fba266e0a4f6dd0370c7b57056d6920c577fc3dd5f97c7272c1dbd395c3a37809a48aa62eeccf1edf8e5af0b9f95e1a96e18cb846702b7ce55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4de937f829d106cbe4f9a58c8d44e4fc

SHA1
690a841a9a3982547b68aeaac6561555e0896223

SHA256
8957c5a028aea0f84b76f0a4e985804ff755a1e336227bb14384fc11f1c67341

SHA512
191fc5de8919c9959d74d2f0aa4f0af27ee4ca05ae13ae59d08649c0f1b7014b28d78fcd0042b4df355ed5ce72f3609fb482b25c1fa63a65060600d2eaf8cf4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e51cdca08c195aad4eebf39703fb6ad

SHA1
b0a904ea42141b75a5ea5df5d16e9a32a5a35d68

SHA256
d6b400b3e62f062b9790cbde80ca4845b7b68e1e392afa209326dc521cfdba8d

SHA512
bcf29a555aa143990c8620608ebcce5bc17c24ffcbc33ed0607a0305c164e6a88d29c4fa3ed2e9cdf3d9f624793996bc89eed968acea72cbbf92f251d9f7b6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
847187b42401d038b79bcf05ff386e09

SHA1
dbfbaa4e584e763a5e001fd857e5a880136e6687

SHA256
5f64226e770a66cbaa763c2bd57b444f7517c8b98edc30dab4b838c5450cf259

SHA512
7b15bf1e5b917f5d8ec0d9f136d519d69f17e00c32c84c23a1d851050a47ada3c1f7e64dcc43a543e91fd781b192a8701ed412fd2b6371fc151a88359b82bcc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d0b7e188266b4730499afcb96bc2f66

SHA1
51a0f24ff6a23dcfcc0a5644d695f35f421c04b8

SHA256
9bf317d9010c4c3acda0000d0a59cfe0928cae71b1461c87dc3b3edf0401a67e

SHA512
bfa15a3971f5fec2de4a63ca7360f3f047df5ca71e4da16da64c7fd8e48b9fe0b0154fc5903b17226dd7d1c14148289a715757612142377641073060ad133a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431c50940db9576df2af6a7404e9913a

SHA1
04d81576d074e07b1951831fedb7fa2d5c117f54

SHA256
978ff6aef02c513c81f41ac9642eb584278c9f761c95beebde14d089eebee979

SHA512
2453f891cdfac512de4b1f2fb69984e79fa89a12fedf34977722cd6b8feba2445f6ba66136de662be46b0aa12063faadf2e3e37d384cebef92ef0b9d1484435d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36FA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar381B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit