cb3255dc3a620e0d6379049fe2a6f058d16a34e7965b1a6ca0e378efc2a6820f

Analysis

max time kernel
144s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

468a198af6016291c95f530dfb3d70d0_JaffaCakes118.html
Size

4KB
MD5

468a198af6016291c95f530dfb3d70d0
SHA1

4b34f2bf20bb663a0277851967dcff784473b0d3
SHA256

cb3255dc3a620e0d6379049fe2a6f058d16a34e7965b1a6ca0e378efc2a6820f
SHA512

ae1922aaf6b3b45f7b461c9b9807496618de8be7badbaec9cac017fbcf8c1e46580eb2771913fe61d188b3db9058ffe1658e4a2725490a55d7edda8f0ae773a9
SSDEEP

96:ziEdq7CmV4MSEPBDvV0n47ej/hgOKiljTR1QnynePhgMplIB:ziKq7dV4GD8/h/KiZ7Qn/P9plIB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000020bfb8996c4d431e1d53090c6072b44b974abf04cd7d579a1a539c9c1d9588f4000000000e8000000002000020000000b721850504e3ccd8d65c018d1d6462e49d3fd3dd6d27ae80a1ede6032b158b0390000000f16f5c024dcc8141739517877d0efc1ff03d2ff3bcef34764161d20b326e5d3e41c5e6fce4c24ee2cc3c2796d10df4e086c3ea8a8e4de7d019863a0b73aa40c1cea2ffe4e7edab2d552eb3333d8bbdfda3a583b0b3488dad171ec5bcf2dbdf5ba5fdfd1b37bf5a7ae40742f8cdd29c12cc2405195979208d98fce88e50609901fc66ba65a521b0cebb2306128d5c2c6f4000000057a157b1aaeb1ebade68547d4942ae146760d1760b7a0ca139f7e24a768ec699f23e9c7ebebeb716930543d52192d92f2a98796d3a440135e31eab8760ff2ec4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30850afbd0a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000007ec815c5f034b10f32989f3b6fdef81b31b4197007d3a7cdf2af231a9679faa2000000000e8000000002000020000000d96a435286e4caf159620fc3837375536bf00cf020363976784fcef1b1921fb0200000002464958d659dafc12d21232caaff2f80165e392e14e95403211dca5e80677b5040000000e17fafaba089e0c4de50f691039ea8cf1f382d0237c758d279a6fb7170f40328e8b070bfd27bb8435cca7c2941c5486183516bf7861b1096bc9ab393f01a0eb0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421943818"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{375A9521-12C4-11EF-B023-6200E4292AD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2344	2188	iexplore.exe	28
PID 2188 wrote to memory of 2344	2188	iexplore.exe	28
PID 2188 wrote to memory of 2344	2188	iexplore.exe	28
PID 2188 wrote to memory of 2344	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\468a198af6016291c95f530dfb3d70d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f3f467284520e8f03fab5ecf706227b

SHA1
bd40f237e7dd2ce54dc6ed3490082366edf6d0f2

SHA256
d7e715b6718fe51fe68eecd5afd2559376df27256a28422314688c40ba9e6080

SHA512
69156cb5689f1b238232fbe4f8688f340c97dfc7012677d3bbf73b16ba0479252634ddf784bf4d41558b144be986f4bfd29d6e51e039ca2b0b503b6b2ce43f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39660f009b2ab10f888f0ca72827483a

SHA1
72d8971aef51e0e2c9ec9c5a2cf2e4466dafbbcd

SHA256
2d486dde31c32e6449bec49221c22d53b3fd1682432ed8439f40c2c4fd17ad5b

SHA512
5292394ba4404c23056662bb53df6bbc4dde5a0f3d4d3793923ea852785619df9fbfa1fc01c2a8f0f9646052c828a57c528f2afb922ca18199f032658db8809d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
721f825f5fe8674a267aebb2042d749d

SHA1
202aa77f113fec8a45a7b8f3aba85a183f6d92be

SHA256
abe3c7d38b20ede15b596c31ac472a7a4be837b5647e339cc9f4df04bc1b73d4

SHA512
f7e01d1f21a13630c396f8dda9711ea3c9465774b489487880326ed129e99dcc181412ddc85377dd194e4f46747a79613f00f44ab61213b835708fd1dbdd950e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73156ad9605e469ca937eead57ef19dd

SHA1
634c53a06f71bc3067579223c2b25de24cd52b4c

SHA256
1b3588567e0c08893426a8362f7a7141fc85f72bcc436fadf336d06bd37570c6

SHA512
5dfc4bb6dbc2e36c1b1ebc290d6e446dc2bedff82da95426bb60a3456c76a8a0ed2b1df319a620f314cae83888bcc9a0eeae8282bb78f57ee153f25442ecf719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6bd3db03879428629290e4616a32eb9

SHA1
8ae5831a3e0d5b3beb50210ff7b41fd06c9b096c

SHA256
a1edfd3431c354b1a2ce99b15e3ff19b6092d40e7b3ee5b7a73f27edb6bf1211

SHA512
ad43fbdf390dcdfde3e1ea806d122d20e36d3d9bce5238f41efeb81f71532fdf2ee496eda61a081c889f78739345070c505134766d839cfafd1c0742562c5020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
021a545ec8de1237cce314896afb596b

SHA1
b100cb1a8bb4c749e395373d638395bdef27bd39

SHA256
446858edd984254127b82397e1dd2c63a35596febcdb8c684b9b744d7ca986bd

SHA512
e33d86557bb7fe85a2fcf0ecbf78a39a679370ceaa755af21e8fb86d0907f59c04d4d61dd5e369fc24a43b1a067c456ce52e0743e8d720404e6a33ba2d683f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18e53d0f09660e31a912f8adb4528ec7

SHA1
3e3395ce37362131b0bd5839aee841f1bd31206d

SHA256
4967eeea0bd30587e9ddd06b2257e604790c28833f62ac5200fc00108a155ff2

SHA512
785a60bae1e5ccf9e43b9f35296a6c850eee42c80e856140460db7667961a5fb74a33dcef2baf5d2eb43b50364ee9990a7fb3a4da1e3ca1f234c80ede99c817d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25932854ec79939d5a1d8c05533f6b4

SHA1
0e1ac0ae77450ccd4f1458247667fd15ea7df28a

SHA256
8edd2fb82a077df386afde9600ca454969854e93b781776d3600ea4caff3c3df

SHA512
a7c4e23933673198ecff0dbe1c84b563f451364aded2d0df7332fa49452093ee8be150971e66fdf60d49624578cb2bf5cb7cdaccd7c434a1386ed92f4992105f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c818953959ab54659cfecfaeaca2581

SHA1
5b96bce55957230c4ad4d60d39331e6e9430de9b

SHA256
24b0d1d6b92d0bebc8004518542a3774849a0e2b32761f4510df15328d4f6fc9

SHA512
df5e7792db59ad23ed626a0c87a293e5ce2bf27df070331d758b4a57a09b60ff52d4d4f34a26e92963e2236b3baa3cad7cca1bcbcab44a3d70a65d9fbeb020b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c41acaf0dad8a4615253842ad04579e

SHA1
b8ad1a8da68032f89c5c38e9620346d10ed35c3f

SHA256
1dbd2bbbce945cc769af8450534e8b96684d2c1be65a1f0433ae143d89c5802b

SHA512
bec4bb33fb3ece2599ac24ea7552c5b1aabaab89619a47fc66d8a84e66f325efb4039e4ca06aed2c69cdd7a849d973b5169e2e5b9763dd26d88b4e715282451f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a5b62fe181941c1365e27d4c317796

SHA1
05c232173f8e3e3d16e6b8591b463899dccb5b9d

SHA256
e2d5ac1e78300191ab597655a92419071d583f63859c72ad3bd7c698ff465e40

SHA512
8d781ab884addeff649fe1b2454eb23b815a9987fc460f3297cb95c056d99a6dd6ca3522d2c63722dd864643f4dbc0dd136f25adf5460ec88f4aeb676fc5d677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cff2b4072a7ed869c81f8d0b7aba99d

SHA1
1ad9f54db584192282a7efe4822834b40996d313

SHA256
09bdab7e24c20367f6ff95faa365d3b19b5ef4aa922d0d05c60f814f75f2bc6f

SHA512
e6a9ba18348e90a8dd1572fc4d1d3a02dea39314c6ee376bc9b4f7986727f840bd93cedeabf3465bdf57c9107e75598cecaca1f01c1fc338cf41ad351848bab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B57.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BA8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit