adc141fabe4055e45578bd58c756cc38172dce3b1b8fb48e2b029edca5bb31c3

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fbe75fc56553b77942478e91b1fa4c7_JaffaCakes118.html
Size

27KB
MD5

1fbe75fc56553b77942478e91b1fa4c7
SHA1

9cd3f0258449a0554f5a3367e23457be40ccfe57
SHA256

adc141fabe4055e45578bd58c756cc38172dce3b1b8fb48e2b029edca5bb31c3
SHA512

25dd44ae7c2355847882c22a39c90c58af7359ee1ea4edb8f5310131ebe0a6bfe004f8dd717b2187bd80b2c24e853874370f1834580c616ccbe6bd927f00ef96
SSDEEP

192:uwrIb5nCunQjxn5Q/++nQieoNnJnQOkEntkIDnQTbnxnQ9emAm6u9kmQl7MBIqnN:DQ/X34YkxSatI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421225178"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000079bd4849a454c10513186b2692b9261e580a206d7dc4f646ccd47df698284684000000000e8000000002000020000000f8f6ffaf5c6ef3459b678bde588af922b055707c84f1ed41b1b62a0cd8654e4f20000000b4f8b3031c694839c7b7415bc0bfb52691384a3f23a572d7a03014b4f936f39f40000000687712e1047822c5af77433ea5983b77d9ed5c302d199dc920e53f8cf1ab2a1e5bab84c2a9593ab3b3ebe1e97318d5693e0846b80160b6c49b3cc749c1fa30e6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000730e45291605dbb381d04c87be300eff2ba284d08acebfcedf337a50b6a32ff000000000e8000000002000020000000515d4b8b26dacdaa5ba310cc54c7c753deec2a0bc6a13492537d9d9910b1c1079000000090f6a710ee1dc4e4e8b6946863ce934193fa9381381de12a885190961184d55f75099ea0f2de976d8e4341f45e98ea320af481917c62b19304bd219d6d4da79b4b882533a2370cbfd67ae3ec04ca487c4ca81f7c06b568038eb9ea6ec885ac85967e22e98da5fef3f6fdc26ae67593e184c1935ba1be32dd805e27c4ead77005670640478b0497d59d70217eef29b83640000000139a7506c7c0289b38b68b8c539a11fa2363130506f9a3ddb0799ae987fd1d6b55b3255906441344f88167352664f6563a02263be2521ba25f38ebb195be6ff4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504701da47a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0547EBD1-0C3B-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2552	2328	iexplore.exe	28
PID 2328 wrote to memory of 2552	2328	iexplore.exe	28
PID 2328 wrote to memory of 2552	2328	iexplore.exe	28
PID 2328 wrote to memory of 2552	2328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fbe75fc56553b77942478e91b1fa4c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f34682149c9b86d7d6c788ee7893c9

SHA1
a2f57bb3c8bed592938c65bf83be5f96c7c87a8d

SHA256
8e3b315ad822fb92a2ac9f0f99bf4f885a320616e80ec378eb38429d8a6e0c80

SHA512
fdac9c4614ced0b668efa224c272a45e0940c95d0042d0126a36a3def4ce2995bd0539e91f44eb43660dbb252f6848de8d223cd2c5fe49cceb65af2691f0d9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9543fea0884c47bea131ccd05ed767cc

SHA1
782329dbcc4a21f7ca6c1b5f732eed38be6fd71b

SHA256
3bd3659f95a023f44cee9fc0f611ddfec1bc3cb4b9dcb0a78a1639abf30a04d4

SHA512
203903de8920c59cde69d30dacb59274c7647d74f76f1a1c312bb08ce1ad4f2833b4199576e8a4f4d4f0ea8656e39e3c7145a7fa08a4cc8a99a86a3a3f66ae81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b770e0fcc147443077083b4fbdc64a74

SHA1
63d89a13c57e36f5c5574fa7bab0eaef2db31013

SHA256
c4a39d29c44b862a1c7a7eeb2be767c1fbf795f2d16fdc12f3dc3e6e89648c4d

SHA512
cbff0a9f4ee221b657a0f9acfefd3b0fbdde8e26aed735fad08bd5efea5d84ea194af95020898c56c23d6f35f3c8b896620edcff6e3ffd510636e94074a0c7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0747112347d29289bab45cd142a597c

SHA1
dcab25155b4f0aec92ccaa9a79828de65dc59001

SHA256
914f35638edbdd5365adc77bfdba6b027b2a6687aaad6bd937d4db47969f9799

SHA512
0b34f6a395b23237b7b9fddde1dd9bf8fd4e0e5e88f50718666593b270327a31743e250fc9c12e7bc91ec6d7b1ebd42af417f4061532158a900716c25d05d64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbf62b8441551179878414b37d058fd1

SHA1
ca1d9548be8425cacabccb65bc9bf5d9803afa10

SHA256
45fa40c149e301b8acf008e94645040a3bd31e9a70b14ac6de464fb2baa30d2f

SHA512
a01c0f3e79488d8a10f0c44d0a4fe45c92380a9f2eccc43be28b0c64eedc5e114787da6fb651ba639a3367ebce848cb1891215f43accb7e5b4e755bb9afbf5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0456d57c69b0266d2cb6bf49e850861e

SHA1
0ff7c7673130d8cd3c4cbf2cea762d313bd424e8

SHA256
f24e2cc5a84c8362ac540fbdd01dc209e012418b40d83962bd2f60c6ca02f967

SHA512
3a452151904348fe4db29f684b882f6f0fc8ad0f8ed1700c3a0ac6f022a7b016b9c6b75ce85d5c1e67f048dc73d632927e802ec317f392c02b517e28526d875c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbd8cbc81c7cbc2f5f0ae307d44deb01

SHA1
c19a750476a1a3ea90712a4bf9f0410f05398762

SHA256
59fd10725723e8899b3d41aa4ebc8e6d2ab1f5259bfd0cf87f3f1b7d3f4c4bfa

SHA512
5f62c75ea091c1cda9cbb1522b58667c19a9b298d1f7f18c1b1115ce14fc93b5dd63e54a39d7718d55636926e9bd65bf83a0330a7c6fd4cba94f89fa7a865b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4af32fb1580da42ab73f229dd8ef773

SHA1
93b29384150ebcc05e51424c62c8f19db6a6f6cd

SHA256
62cdb7e6e17a5e422b339596eebf6a297e1906b6a409cee88082dc9ccd8aef30

SHA512
5cbe0878c97b8e7e0bea0a29a96dd934efa3ff750d8f7d0d9e7c93b4e2e1993d8fb1e55dc8fc2e3bc230649c17a550929a64675a3828e07f0b4360c728584f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67289e6ba0871f5e9c0dc37856b599b5

SHA1
d47c31c01d8e3b16580b74e95e676b172d432fce

SHA256
a4e74467f3db89d6ced308a9108543d6a094553ef6526b4e39765e8d40391a8b

SHA512
da8ae3b15515880805fab5daeb61fa51ee1d110e4399f705588b208cd7110ef38f8f0db77683ea3c955deb77c1b7a0155799a699058ce6914b3ebf66f04bddce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3809c61fd04911f6c91e07aab6dfe2fb

SHA1
b03e3957f5170ad0e105f0fa3a140eee638ba88a

SHA256
7b394ffd312381e25dfe51510f2fe55ff1f4727a35a9a54b0123b99d0234e0ad

SHA512
605294b2a9e69b7866d01ac1c2baca1ee0f7c1fb31686809194b155a6e69a56f5d0283b1ed6ae6dbaccc336acde0319ae2f332fc6f1d50f08217aedfb51c7622

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AAC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BCC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit