155e65c72685ce45197c3cefe426fc4d9a237db8b2133d6ea3c06fb7ac56c46f

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1265d6ed5e6350b21ea30cba6c3ae833_JaffaCakes118.html
Size

139KB
MD5

1265d6ed5e6350b21ea30cba6c3ae833
SHA1

3485d09979154f2abc95549a62850082626566bd
SHA256

155e65c72685ce45197c3cefe426fc4d9a237db8b2133d6ea3c06fb7ac56c46f
SHA512

7655135201662246c28ea65999751a9db25bdb5ac5d1cdf750f711148f9e9b1039f66097e338420e82c276b55dec7434124060af46ad04bdc586b272b3c41514
SSDEEP

3072:ScBgwcEXQyfkMY+BES09JXAnyrZalI+YQ:ScBZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9042cd51119eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000583778d6a086bc68bcfeacf6b6f71e09fdcd23cb22f512e2d858dd07e03be30a000000000e800000000200002000000011228e583c143505d5b4f8cf5043b7b7b1c024b64a99edb8a2c607e5721caf0b90000000f24c369d4316df3537311870b0261266908dabd95c01996235c8cc373ba096be2310e05676f33542d89a046b8f0bfc72444f32023f93cf9ba9920cb505ca911e7d53f88b0a13a13f7b4add999b5a592277571a10014dff68db97a37da4ef9b2dad527d62514368339f4431837ad692e50a319c481b1b8e27b012dc5dc0d422e970eabe1001feb7bac3faf3befb908f96400000001efe03747f5d3ded614f6db01819fc2ceebdc5b4a9a98a2cd1fffc52b28dc093c3668d8ca235666ad67f43875dd20bf7facce853f8964f13da4f04ae6437d55e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008d3634e490a56c642ed03d814a60f424ffbe6bd621ed4ff96f1c2eec0286d3a2000000000e8000000002000020000000f871221f237a21bc582fba2a5ca2626c6f7220344fa15dfc3beeb814fc57dfd020000000acc763abddb061a105ba55c4563af6d88b00cba16a388fed84214591df64953940000000dc392ede9ce535baa1530eb13f88b8856ed612d1eb49b8ada955d86e2d13d855b6479bc5fda073657a3a2d61f6729a148da5d7ac0ca9b0c598c39a95af0d13ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A208F31-0A04-11EF-83FC-5267BFD3BAD1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420981745"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2228	3028	iexplore.exe	28
PID 3028 wrote to memory of 2228	3028	iexplore.exe	28
PID 3028 wrote to memory of 2228	3028	iexplore.exe	28
PID 3028 wrote to memory of 2228	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1265d6ed5e6350b21ea30cba6c3ae833_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e3a9091c2b95ff0b9ca60b9d3240353

SHA1
dc78d100ef8fc1f32032473e14522cc222ef586e

SHA256
a3e2a85da4a57155bb5e6a293797e6fd2a56fa0a07da4444c6192e180008dd42

SHA512
1d111cc08268833fbe41129fbdc7f510283a50acd61dd3195e308f3c0693a44d036ecaf312d367b9f50c951ea7a0eb586518ad8eccd694d9216ebc4f48496679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b34df34adfd63377ba0e1eac7fe015c4

SHA1
384d8b81fc77adb640224e1aed45d64596bc52c2

SHA256
d6a4641699a0ab48e05e2ef7cc72fd80e66106abd37e957826072acc0ca2e244

SHA512
bea95b7fcfdd5436594891b21f0e8dcb2f963513db8f18661cdab6288a678a8ee8d7c7c41604628322327c6fe6028fda97307a5d79c75c13ed25494ada26bd0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ecf94a2feac7737e3a6048d4234225c

SHA1
5cb7c491f49893d39495ad81d510ced622543c2e

SHA256
f5b26abae37f1fa5974b233555eb47605152b1c9ca5f6661f3ac7f15deb02811

SHA512
cd10c1f74c8962cd7c7453f82d2fad369c28d1834feb55ed92629e75779e2122507db6de9db8585ec99cf55280fc1f863186b2252831c56c81824e39f3b08aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
995ecfcf0a05327d6cf774eef9e26c14

SHA1
3a1b081656745cd2f65b91ed22890ad6778a7b9b

SHA256
aeceb41f7c126a8aec4c6af6b5fcc8f904b7aef66fde29279b4b11831912dd0e

SHA512
e8450b57864a20e54b2cbfc6a71420ed4ea49e2d9c7dcb74030187092abaddcd4b004352866298f80c9b62a2fd8a8aed415b0da9effbdc75a62fad40b0982ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
932bca18813f88d36807cd8971013833

SHA1
6eca71c9e26691d25bdd861dcbd6abc34af6fac3

SHA256
a2362624ff0a90bf28243700a47a13514dab257176fad9fa7974a05dd7b6eba7

SHA512
fccadb34e2d8dd836867803ccb9f975eb773b02fb6b126e072bac1fc812584380f19446daa2d657f58fbd830ed6cd847a0002e96372239e7b421793d589eea33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd889025037a034b0a80b6bb2fe61fc1

SHA1
6e4e30c92b082c772ffc60c95f43d9c2f14778d9

SHA256
896c3802a0ee7048df83f565334cb9f4599c6c9b5710c51693e50fc66069ea16

SHA512
3b16ab6c9b31ba34afcb50278cf241cc0791c1e2f24ea980037b31b4310e58f5faf976aa090f80a479e837a266ee88e81ca65c679ce7002f77ef4f527b4f9431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072460d6a0472774fe320c938ddeb9ae

SHA1
2ff536905214dade6cb3c1c6de910a3c4d8acce3

SHA256
951f7c944c71a543c9dfdb43339cb9af3c87be0b06308cc1c81868f8313cc532

SHA512
e85cd83b7f1920feb8ac6e0e77039822402203a138ae498b832ac2e156b48f863a2eae3a896cd444b2efd655874e49534210af74d7c883b82d2a4d57733abea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31914b08e85ed70b09682f42d06c5cd1

SHA1
1d30dfd73f80a0d5c708d19ed1387abe9daafbb7

SHA256
54442be51ce96bf681dc30ba0287c183761dd59a7dc5ac36b9e6d0235722c63a

SHA512
836cb360439e8bd496e67aed57b7e2569e79c6767a5db873a5ead4c2d532d6cbebcc2048f3177d4bc8085f202b2fb66d1cfb4bc9547fac5c96b6f79e8869da1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d762173c087e236f56ed4f0c90dfa87

SHA1
b80cc6056756f2d84b316fc7d3a8582413d60bed

SHA256
a2cf2786d61c4f4bbec823088752d75cfe7463bf227c5a2b000130a264b51586

SHA512
abd803bf7cf7150d976b069588936e22d3b8339debcf69e58824f87738de92e5a748bc1b295b2c3f762b390812af579db395ef787c674b6d33ab1d852a17e6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f9f1c80d11e139e8d3136c15fab408

SHA1
44303d421fdd2a745dfb6ff077f933ca9eaca088

SHA256
1bd1cfec503b637c2a7f51a45859de122b5b0f6bfdcfcd40bb6421c567328334

SHA512
3846cbce054dd452f18a526dc87ed750ee375ad8de5a105fd3a88ec4f69bf3fe0a4966b1fb9ff1aa1c33d2e340dd1bd9c5903f36bd404a178da890ae0f64f46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18B8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit