a497af077ebdd5684212fba5baf1152ff22f89f680b51d4d28cb9c9c1d4977eb

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

420da530d3ad4ca34da1b12bde2d60ba_JaffaCakes118.html
Size

139KB
MD5

420da530d3ad4ca34da1b12bde2d60ba
SHA1

040d235ec0bdb1ad7f75243ec0916590d693a562
SHA256

a497af077ebdd5684212fba5baf1152ff22f89f680b51d4d28cb9c9c1d4977eb
SHA512

2387e578a1a46b64ecb21271f96e4ca4072606cd0e02cd3b40f23fad2f3a71144148c4941790461606df08d30eb54ded6515fcb664b8c96e7d7d1e3fb1dca882
SSDEEP

3072:SQ8BS/ed867yfkMY+BES09JXAnyrZalI+YQ:SfisMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421863682"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706aabbd16a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000009005bfbf8b7e18b9f37a0a04f6bd7ee8cb0784f60df5a0c39bfb1e5ecde3bdc7000000000e800000000200002000000053f82ec8b1bce0dabbbabdee64f99f63f0bb56109c8c06944b5f5691e4adb215900000002b3851f498fd732922cf20e376675acbf3611a39817af4dab01d436f95762859199db04fcd4d3a4a4d8ac25cea91a1374d6982567e847817572da42a0552020f4072b7dd6fab9b1e610cc439ab44ec9bc848c340dc5d9b28c1bd988e559a079d244d3d420c0558229520566d3119aa36afe862b213d9b200f95452506c3f61c9ad3d7ac48016646bb08a5774e1a0267e40000000128f6fa3bbd60cfe4bc2daec11a08313b33bdd043f8aff2386a32a9565ac8f9e1201133fd8d7ddb3de61022b1323103cd630c65430c1e0bda3108e7a1bb68feb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008cfd7307433be4df6dbbaa3997ef69cd2cd0ca707ad7f9ada42da1f207597d64000000000e8000000002000020000000ceddfb2c2dd0452e7d2c48bf518ffc8a9b4abdbe0d702f1939556d3d7394681a200000009942bf45eafbb7851cf7d99b28332ba8ed24b5a66e1f6506752262f947b74928400000005cb434ab2e4308b61ab707d1c5d2a1e1aa4ea16a72078db28a5ee3d5bc3d762c6baa72993e0c01190255c8d781bd9f22daf9d8e508e8ce3f533911fd461a9f05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A750C221-1209-11EF-BBEC-C662D38FA52F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2148	1704	iexplore.exe	28
PID 1704 wrote to memory of 2148	1704	iexplore.exe	28
PID 1704 wrote to memory of 2148	1704	iexplore.exe	28
PID 1704 wrote to memory of 2148	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\420da530d3ad4ca34da1b12bde2d60ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8419957571ec8e589236c707d94e7f4a

SHA1
5404d50b7a43af33877859a4403aeaabb4a154f8

SHA256
1c7eac6d6cca43779a0feeb01c013b3f72016a16cad03b96423e85b41a4c4045

SHA512
288f704c14fccf873a83859412863bd04b8589a572bb4b3362bb6f818b74250fcd0e5790097fea4ddf61112b6875edda4ebd56e930e5c06516fe11277e6c0a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b714c87ee5b29d7172cc5203be60e678

SHA1
c4703621ebe70bccd2ec215ba82bc00239267720

SHA256
49a68e225305dd94bdcf2938863f3934e9284996e5bc7757eef3becb82c5aaf4

SHA512
d1eee5c01001d858cd5cbd240b4cd255d478605a0b79fcf4cca5876b6636faf40935d891b666d3bd08fb91270598507b2708e8a516e5cc881d9f65d6529a43cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c601bcb7364a765ce864079c9ad0e4e

SHA1
d54dfa48e190de298d3fadf15c758bc8e3bfcf9a

SHA256
a3b7542e934998aa53e95bafeb929c5034a98bff13f5a5c0148d81953f462d1d

SHA512
3db30989f2bbf6bf4ee624840c08b149a3fc4e66d13687b6f59c2a41f5909c6da52648400c8f4a1bd2ca8cfaa44ae19686310981996942fec48951a5440ba97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74b9a89d14a095062ea7293aedfed552

SHA1
1301e9b78522020c7068693d5d95e41ac4be9009

SHA256
a7b6115f276839c6877a816540c7cf2faa40c9bce52fa304c2f64d287745529e

SHA512
4a7d25097362e84dda3bc7d1f1d26761a0d2ebaebc8f147ace498511e81f3185ebf8480550379d1db20a178b76442621d3e9b6ad9b1f5ac9ac0dc74d503d1ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f728203afdc66dc78955db4fb5c1cf4d

SHA1
3a10a950130d0dfcb48b08c37d89c6b556dff147

SHA256
99185fae758a37c8e41a7eaaa694822f0b2c6669db2c7c7a9dfcf6cdf854f109

SHA512
7924194f34b75994c81f7184b834010b9ff7cef2a2d5ce2c8bdec75204c3d6743c87d094a4e41e4ceded609ac772665f8f31d6901337934712501df4f26e1891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f51ab0fdbc4c6ceaa33f6d86036574b2

SHA1
0297bee2dc1d6f29a5ee9f3f0638da0b7fda938e

SHA256
4436ea58110c38a86ddff9c28f8fb48b9228e2a7e477f02fe73c40cc1f34754a

SHA512
c01b3b1666624ef6edba818aea3177f912b2d42e562551aa665791f802efd01b1296a1a997fd241c469b72feaa8d803a02b2972b3d965fa6826b01e69e82267f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3701312a6f760c8dc26c2d7a683d0caf

SHA1
622e551c187b1a62b7a21810323c35dc224eef33

SHA256
8a50f0f87d79711e08b199a2ac36d42d48ed441a0cada9efef14656f78b1b16a

SHA512
0c98355702f02cd6a97a5a163c4414fcf28a5df58b785e3f2f24900b58d3210b4960952efe855170a080346895eebbc174860d595f229b10daec2405998cd7fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
848995c0d97ab297dc53a0e1f27ae5f4

SHA1
3badc475c4852566bef7db154d68f27b4b3c99ca

SHA256
80f7cb1bf73b1520a2939028f66a16bd5b86f9315cd11e84b23231cf3fa4b53c

SHA512
cd4fa03c556f0749449a164bff5eca7d28cddd6a260f75033e27bc9291a0f6432ac51e77e90cb66487bdf202c8e7e02cd21ee85b02deda05bed456e73ff4684b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbc6711bb854dc71785e542cd2a6f9dd

SHA1
2d372f44006a25fe8e989177d411cbd3523e6f6d

SHA256
a783bfeea331c64e6310eee3bac45a728dbf266dd440d73dc1d7c249d5edb97c

SHA512
05f7ed2bed93f64d50396307f4e996b3d89c6befaa9e55d8651a8d7a48e3ca963584d09202cd7678b79446676615221bcde7fd63f7b67260147a5867df76df5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b179ae9d1225699bd67e1ca974ad147

SHA1
66dacd6190a4209249c1f86e8baa870d3aa0179f

SHA256
f8ba279ff17f3a984812a87cb81667bdcc0a1dd6a90b3b43039b326d65a9acad

SHA512
aa7c476e829bcd1378d8df65edd5f07f9182b5b9f66351aab70cb1a7491d01805bc9610f1141eb5d2be5c813a5c0c822d12525c3a4bf9936b2832267564f101b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03c52b0ad5d7e8e5076c5719b41b5f0

SHA1
09fd6e25fe6de31bf9930aec5a074bc79b835cc0

SHA256
5e76170a42eae08c1b191d61569fe4c6a1d40c535e8c94141937914133a24afd

SHA512
12230a320587dadef661cafb7c23c53e27b6f10fc09cba0983c489d52ef28534d578315e1f3d0700150a0d8515939621f631eb50ab980049d3b917f4341e2f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1863.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18E3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit