ea656f553978391265c71b36af2d148c704531ec2ca4c7066d63663c712b8ef1

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403ce0c7d2587b9bb26076fd2eb7c522_JaffaCakes118.html
Size

22KB
MD5

403ce0c7d2587b9bb26076fd2eb7c522
SHA1

3a3c28601d6b60fb92a520663619a7bf0c3b3752
SHA256

ea656f553978391265c71b36af2d148c704531ec2ca4c7066d63663c712b8ef1
SHA512

e14c61193be20c048407d1f48c1df8b35882c281c669442cf13012d9a60f260751185bda049bd3b5ce62f38849a886879911b5174c43bec74cd92b0305871395
SSDEEP

192:uwv1b5ns+nQjxn5Q/bnQieCNnnnQOkEntpZnQTbnxnQ6v06J4RnQNjMBiqnYnQ72:sQ/Ov06kkP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f1853cd137e9c4ef306844bd3f886870030d96e9d107d8ca681cb6a537031359000000000e800000000200002000000063fb4233ba40e01c0c75838038c41bd8d0d74364f95f727901e7130139ea9f9420000000273ec17ad911de7bf6d3c3907c883be82cc9d5acaa7b0e66e713d327df2563534000000065b4848198f5f9db33c584642e5c76baa1a2649c0cd4e2d2408dfcfe8ae9bc7c034d12adec5dcd1f5e1f058d99cff4195c18a68940a8401666b8666dd29cfb1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a2ed564da5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000000eaf9b1a055b9ae63df06263b048ade9a1eaa3b2c25fb7a9a27cc36befd0aa18000000000e80000000020000200000001863c789338c1f76c41f2883a67670ae4c482a102c9b8a8d074253122334a4d390000000c0b269f27bed13c8dc0a887aabd1ec29b027239f95adb868ed6e060750464787e20859deeeb58e99a16f6b18d0faae7ed648a2f4f44fd2fd38985881d5688677a867e239a05308f08b3b249aaf367018a791a3df3d2c410c1f8f0488c54f7a842a492aab1a9e50f03104469a64fa48fdd46122176e8fbe7ace2bbdc5f43a37b2265d1452044d3bfb7a6d238166dd311e40000000db0b57948f78c36e3a1f160251c133df05c7562944eac0b135321b7d01f8993586c2dfdf216f9846380f2fb035de05bc3818e172c1d178b915938d242a151907	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421777289"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81AE1781-1140-11EF-BA3C-D684AC6A5058} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2292	2880	iexplore.exe	28
PID 2880 wrote to memory of 2292	2880	iexplore.exe	28
PID 2880 wrote to memory of 2292	2880	iexplore.exe	28
PID 2880 wrote to memory of 2292	2880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\403ce0c7d2587b9bb26076fd2eb7c522_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b0e1145da3f80b35c01db1f40d0283f

SHA1
5489bd87c93c33a124eebaa4266715f5acac040d

SHA256
8479f9234c6617cc21a5fa304efdb4be11300eacab57649b47d88f29f818fd2c

SHA512
f256cc324e51f3f2ab1eb4a9e9879ce348a84c05b5453b13f0cf5d71485eb5ac3be6ee63ed08a3fff04f2e6a300541ac1a490d22ea20c0fc74fc3102592fe1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8f90b14835627d7be5df32f0ec5f1c3

SHA1
53df1b86bd23516b368aa54e049d3ad5592c477c

SHA256
0a9493bc383a16f7caf7e73b9952e7e4aade30ffcd7343ffca29f31c76b7b3f5

SHA512
05a07b3f1ad5c010d4512cac7aa4d4e63791dbfa7728bfd9db9162e32fe86e50992cef8365d693ac1dba9c1adaa917a71acaaef14b2ea218af9bf3d140d42b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
169f7eaf0632e31c7fddfc7542ae4568

SHA1
fa3f0c2661b883faef68e106558cebc5383e8253

SHA256
59aa2ff43c936f5e940f1a49119b36bef2a884597f420f3f66b4d3c9a9dd1059

SHA512
09f07be3e4bde696a45fc4bea429f88dd2832ac59326fb10d5691568cecae742eef7a9747eb4349d9a0aa03e2eb26b97e00961cd3d45291352ce3e1e2f3af774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
124f0a1104654cd0462796b35f10f61a

SHA1
3d197cf164a1d293d1d42ded4842c74c56c67075

SHA256
9d68a1da874fb26422732f060e1ee5fd5cd6310f99ec02d51b3e2d7669722e5f

SHA512
6598efccc77b78a57721055a2e607761a902cca96b733b50c7dfa79591c990195c0e779cbda7372f830938527228d0b4a436e174e73235f00c4baa1f4483dc3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e072730ced18e0baef94a9da09a14c7

SHA1
2106e20177c1a029e6b97362e2f716d90f62f614

SHA256
082c2ca64857f672bb12abee9aa36f49b64cade50be47dc0a9c6b22cf493c46d

SHA512
95ac27574a5b4aa0e84c7336526606a28ac8206c437fd631f8464186bd2b322c2d7fcb39a4cc52e8091aff7ab1dacc5432a7f39ad05090bfa19e17d0199b3b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee367c1fcf366652a05aab3f7f105dd

SHA1
e1425492181c20189ff2d05512025ff4c6d3eae4

SHA256
77e5575cb1220344da9217a3eb2521f6e865e2743738f5139b9f9e94597840cb

SHA512
978dbf3e57c2c945cb1e09bd60fc0b2038ce80585005a842b1f7c6def6e63afba300e58f9eda55f7ca2771b6450e903331d053f85d84bbfea8a59567425d2a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
132b800fc00e77c4356bb97ed5f63e0f

SHA1
ca02521eb2575fdee6fa61bec1337d5b111248f7

SHA256
84ae7bfbe1986d443a30f8ce39dfa0496bf84bc0b73af2e6478928b2687061c1

SHA512
4c2481119a030af550f237be7d372269474b1e39ffcf4e4b0425afd38bc4cbc3e67596aa43a0a31a115393c449a7467ff1221f481685242521422eb450c1452d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5faf0c62198315552eb21bdf5d20296

SHA1
1e658d8500b41d2c1fa15068a10fe3a28440268a

SHA256
6b708b639aca0e0a4489502adbd1b940cdb94dd552061cf8f371cbf32a975b99

SHA512
4d7905514c7b91f47d1f2da899660898d2de2c16ad1293d5ffb94166ad8a575be6a5b91a1e56e97b2d90e12387773629399589bb8920a30772dfb3a63cfedf45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9977d1f7687487abc462e68d18fb96f

SHA1
13291ac4c47d7374681d43c18be2d3223a0483fe

SHA256
467ce3086f55b9b2e096910957fe77535a4721f4cae5bdc6d14d34d6130494bb

SHA512
55d33ebf11eaa868a3439b8c395bcd6b8679dd2f69c13326e27851bea18f252b6d5d91463adf2fd5b25192d4094fe006b5eb6a95ce0057090dcf02cfcb928bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a76f43967cec86cc85a4500d2d735e9c

SHA1
2984b2379c4336d0056a469acb917b291ca74d19

SHA256
c6bc881ca7f79bca1511dc13eb0688c337b0271631e99da099df3e286097f581

SHA512
20894f8375c886ddcf79da1953e61ca79cf59b9ba033f422db650e16cf47baf6447b20fb0580a18a02ca31cdc7fa8ae664f8a0572f7a8cac63dd4d20cb747966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7629df2b5373efb5cdb9b9fce3134227

SHA1
cad16fc1a1c558739d47c750d35e610b8944bc7a

SHA256
5d545125cc8aabd20c23c93ec2910a3d4135bb9868bf7dc3c581f5acfda0759d

SHA512
80601afca6ff2fe5bd2103457981b23724b64c2e49dde867a66cbdd14b6fa9ba354f3db81de193f2663442110ad134365d5798079be7bb5d6fdba6cdacf21404

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32F5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4051.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit