d5a02d0cf8ef7ca66eb781b795138a12d6f20ef0147dc2b0d7c1b4a1d6f86da5

Analysis

max time kernel
136s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42a8fb4bb1cb68b9ba35f2b3aba9c817_JaffaCakes118.html
Size

139KB
MD5

42a8fb4bb1cb68b9ba35f2b3aba9c817
SHA1

c25d1b77199903399c5b116a2dacd9c20dfa71ea
SHA256

d5a02d0cf8ef7ca66eb781b795138a12d6f20ef0147dc2b0d7c1b4a1d6f86da5
SHA512

064b2d50fc544761ee961cdbd289dd9a932969a9c4293bd7143a66ef2fd96154190f31b86e7ff7f2c2eef78521e25028c11ad0a79ee541d84d614d5c75bb53e3
SSDEEP

1536:SoNdTXUlMQzyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SoDXZQzyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BD4E541-1226-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001fa39ea2bf9c0b719a7decf6ee52c61e7340154fd1d53a148a8f33a999c32509000000000e8000000002000020000000ce6daa9b3b82e0ede18d491a267e16d586d46d1a0068f76747da0e2591e07233900000004d702d9bb0c47b184c6671fd4c668281651e847f2a286ad86f5cc5cf0724438e3fe4329039acfaa035ccf37f3c1c6cd5bb1821d5b317115efcb49548504e554847f018f6b4c843c26a3c570707a28bd2f60d9f78361931384adafdff6f94b66e5549350070026b79215a9ce6892ec97de527491f1c1436e1324795c4f5cd49640aa1b231eb9de4a32b443b26aedacf3d400000007240802b12c3b32cfe6a32a16d48190f8183412f243c5681f5b4bc8469d6409dacac6b68ac48c742d78c2beafc289ea905b652a403f7b483120e3038fe22d655	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30246a4f33a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004be718cefbb3c762b13f85141e8cee988768399ad3011554b8ce67a2117a08b4000000000e80000000020000200000005c321bda0fc8129f15cc31d02b7db8edb4d761eb38b107b8fa70f3519d45018220000000578b18d0015ff6e0509a5105108ee8e09e8068e7e01c92359b4312838986ed5440000000f7ff754b7995af0096aac3476804d2d4b23fe4f05d8ee12bbd7bd4071e6d797a2afd2e624061239f709f5cc917dd9297a990efc10689e2e24f10619ce8188ece	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421875957"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28
PID 3012 wrote to memory of 2984	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42a8fb4bb1cb68b9ba35f2b3aba9c817_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb1a25d08894d57622f11f2dc8e987b4

SHA1
e1a388e0dbac23d6486af5034fcaf6c4efeabef1

SHA256
920b3d6a85202d5f0bf475af91fca9176f14ac55d8ffc10e1cd5282e132c5cd3

SHA512
a6f774b89a11804581851b26dfc75f163854e1a171ebb67906639d6f1c46db909f599f8df7f40da12ecf3a9d8890e4b6c9668368b1394cec5c1e9081bfa07c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f608072618d2adbde765160f70ad8c

SHA1
49b64905333487e829e67fd784766de94787ac73

SHA256
e33f2c96d076e743f47e3563309558d8d9736e19f291f59d488af11a03cfe015

SHA512
c36e1c9dc1f7cf1b1133ebd3817cf1d8d1c5cfb411dfc43e0d1059bb13add0e9e1732fdf89b8f4d7fca0120e9001853b298aaebbf5991bcda399895022788700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b76be33f6d1869dbd741c33786554d3

SHA1
69847ab41fb9eb5c68de0acb2dec2717e7d03660

SHA256
89a2d695a41fb24771d8562eb89e88edea205a4964ee166204eab0355238a843

SHA512
1de7b57b0bb028f9313bcc4208a8e2b1d4473ed7713304ac008381fc4df679088929688bd8b23589df91f51e6ade452a486f93e1915ffafe257c7179576824b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abb9b8e999d75dc3729c5077b6eec42b

SHA1
a1ba27da2c3b805b6fef817d408e8ab989fe4c61

SHA256
245d891577bfa1ccc66ef710ea46303c1515f2b15e0f7c6e0e6351958ff2d114

SHA512
74a5e547b3bfc9bae89e9745f229de8a13f020be3971cbd639581f2dcb3ff5c1c4abfc95b75869f53e3a4a2cb808fa1274f802363c8197ae260f742b7134974d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df892e51d937b194780f8ac9c1d900fd

SHA1
21fa7a3d62bc9e6877c53d3060b768f539adcdc1

SHA256
f1497404d41938287ca000acd9cd486c7103a39f17f4ed51315796d6d2db3e14

SHA512
0fb2083f76cb89de93981908fb67b5f5b0c392ac0e621950f04db74a86a64ccc8fc05ad25a2cdcf20f25377b54470f1f92dc5ae55e6c18afe735ad02d95036eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc4d44776fe3f634a84b9baf2e317ef

SHA1
70208e949ed422acf71e557cb01734dac37e9cad

SHA256
cdcc5dd144184a23cf8528dd7ec79368e0a55011c045311a57723fe8a1fd1154

SHA512
66391b32eb955fa1538a1fcd8bb778cc129d2bcfea6b31d9a5d7f50a95470db8cc211ccfd49dcee2e698d1eef57fbed5e9cb64574608524858bf71c49dc1a53c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3754e10e60d9c6bf890dc00a732f9151

SHA1
d207b98b4f11257ffb7645f0e8bfe7fa0de76e6b

SHA256
e0d1233ef13f1dd22483b214b16bcb22aaf68ef76e512f4f080b361c5b4f9794

SHA512
42e35eac58a1f5323cfdbdd229c96fcc78a4547555870bf0f4a966de6d82401f7621545bab6c2a42ec7e5fcbc7dce9e64e2edcd7b3850b3771fbf63893f10adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
490879dba9b6eceb5f9fa6a772229881

SHA1
20b18083944501f5432c93acd9a9c25ff2a72082

SHA256
4452695c25c247c8af05ecef4e2fbee9e0c61d87ba42bed485f1f1453964ca3d

SHA512
e58fe525fe356f21a1171ed635e7fdf11da7ce28bc231e16a7bd8a8c46f990fd229faebe7cf36c033e0e65d14ec853d53e825aadbe0dcb5ab63c8fa08476156a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
396ed30ba9edd6a97daba9d9410751c2

SHA1
1553078663b2c656fcb56ff06383d565db16e5a5

SHA256
f9a91f69fcdf8e71f7c321cd636889e183f720b2902d7775919105a808e4cd76

SHA512
e2eff871d0191edea3b2c838a53bd12f9522f998f0a8e9f0d4a1215face63ed85f4d67d8eb46512190642d4340de25154daa1558d0b81266034bc7d3a2adda49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a873f87501c4280769ea9fd6a750c5ba

SHA1
ca54f1459e66a3dfd9ea6ebd6b1ef4a0b59bde60

SHA256
3675a4b5035f6a230679927fbfe70ceac826ffecd4773f18ecd1cda31731f75d

SHA512
0a8e6055658337aa81decddb922310db17dfa7267ce496bb4c70e0be0ae1aba2804e6339c9fd94daa661f68ed5b2a3c325a5c764775896b49e4dc0908ed470f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aebc389eb573586781d35de53073873

SHA1
d73863d017500ca8ad56c8e40808dcf6acc256cb

SHA256
1d81b5f2db3481521a96e108be27fe4435944c468638273d359397efca364e12

SHA512
9b88afc0562ff6cd51425eb473e0e2f857c1326af8ec6d17844788e43193e3098a779e345a8ce592bb3a9ef5caf57e514fbf404d363451670e1b946257b79711

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1383.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13E3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit