c626476939fb9f4c482c7a21b2de2567df2d93574d475c31610e1f2d22335a8e

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

472eaef1fbd8fed420c7fc44a87fd357_JaffaCakes118.html
Size

23KB
MD5

472eaef1fbd8fed420c7fc44a87fd357
SHA1

289ed6feb0715cc4af7d13c40852812aa4eb1e1a
SHA256

c626476939fb9f4c482c7a21b2de2567df2d93574d475c31610e1f2d22335a8e
SHA512

00333a3a110e01ccc6f6431bc417aa0c6bf5ea812a63fc04530cb486a1d71193b921f53b3409b507cb14c4a4d844a549758b62b683a7b769f1100cda0e4bcb01
SSDEEP

192:uWfMb5nG+nQjxn5Q/1nQieoNnjnQOkEntfXnQTbnxnQmCnQt6wMBIqnYnQ7tnuYu:fQ/PS1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31789341-12DE-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001a17cb55b542edcb47a0e78705f171f75b00c0c710563ff61a1c5c94e75888fc000000000e8000000002000020000000e27dbb0fe92aace28156bec8e7b59a4c7b3d690b2c9d0a2f9b0c1e014f4c12ff9000000045ca596973e72f415d922c2a83b0ca806cf65aba6195c700fb05e47ab1ef7a3f505b08f5da139d217f16d5785a007af44e6e236d2cc36a07dd447d458f4a46ef71cf1cf0baaa388af50a472b0246f75eba9cda7970be9110cd9a86f1b16d1c8b9424e38730738dcca4d5f9a8f9332ae7ca78ccf6b0d8effbdb4b093a2fa89079be1b91a4db80b20af8319085ebb1821740000000efbefc00faf8da1f06f645c0bfe99eda5ee34f7453117bf1dd6c03226a6af163ee799ab1636be89babe58082e0fe4ec078566a9c1a96afeeb7b8b74524c46009	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802f2206eba6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421954969"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000925f425743b4cfb858157beab24087ee79499a7c01c8485e6ade58257667364c000000000e800000000200002000000071c8c0c2f5b0f80d87f9875a9966cd3dc00fb239781e99838430447b6d8d3e7f20000000eb6061368caaf7b16022e667e4ff83500902f7e83ce2d74a561d1cfbaa0a06954000000090ce65d0cc651e439de178ab032815e9f705c8040208a35fca502105d03fe1388a3f96f109d89913be200d60bd2895270b4d578749018e0743f1059c6c7dbebd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28
PID 2188 wrote to memory of 2528	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\472eaef1fbd8fed420c7fc44a87fd357_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c046d939e5d698b05e2c17115c7c013

SHA1
ef755c2d889eb4ea45deb6bc9e814fb118c4b9e9

SHA256
c270a01e0347f155ec84061287a70280f4d98091ee80297f0c8f8e0448b1b67e

SHA512
c2006afe42a2dc4a5e2b900968171265b6dd806c91c87e03923da7d1775d7b3d6f392c5fdeb2a059794715c82e0df57f80996e66f2db3f92977a8560b421fe87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84ce2ad764141dae407da976de5b640b

SHA1
5970fc8abad81239e957526bef2fe581ea0ef5f6

SHA256
8e13c961ec811ace70bdf231193ac866feadb42fe432ea6c5cab3def1aa7b127

SHA512
9feac3a4210b64dae5ba7fd441080f863fcb3e22a7647b4c1173bc6b50dfbd3c5c79fd559903086f8a8e4784e352590590c3ae6519ac4976a49672988c10377b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bfef1d5d9eb1ffbfb15a84e2e445642

SHA1
33023f38c7311036ac395d9b403bc4a70f572659

SHA256
5cb163dd7c4dac8c68c2af8ca852008ba0cc6561ac9af31b3347ffcf03b672fe

SHA512
eb7e875febb64b10c82b1b22bf3f55b26a4b7e5965c06a36d6a2d3dac5a72b257db2100e6da6c464fafd6e6fb5e879e0e8b19e5c805314070554a14e0859f736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197b6385707437d9da773630ef5d6a2b

SHA1
76d7064edca14d975736913248dc272e3b0df4ca

SHA256
eb70495f72c7223a499b881a5f8228b06c5d271b59441880d7de2e4873a42254

SHA512
a372437c9bd8a648780f4dcaf0dba93b5334d981a7320112f58381cb261a28d533c7ffc6765f38f1db7b21dec0a4e51d1e13bdce49b679380876dee5e0f1ab58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
701fc2fbdb8588c777f3a5e1f15e685e

SHA1
a6e70a801d1f56d52cea4449d19169bd706d2fd3

SHA256
33e3cfbc9ebb79759d4879e3760a2b26b38a7136e18b03b0e480d47a8767acb7

SHA512
802e4da46d4a380a672897e404815d1e81fe2c6622a884c1aa281387b406f92ef6f470ef8e466ee979d5967ee6a2a3205820b0d589ae0d4ea1a5a939757f6701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a1edea8470c42ecbd81116909b27b8c

SHA1
3127e2887276ed6b490956f82bdfb2b22d95eebe

SHA256
5816f875257151f8375aeb11a2463570abeaa05f2fcea12d8961a9c64635d72e

SHA512
a01e36f15a51ac5121c0279ce44a8f6208bdb652e4176b9e67d08683053a3e95f23491866348d5b3bc3b1b38f56967551b69f78ca391f955cb74abad4677e686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1b52ce77d8998bfd0d8750b2eb02f49

SHA1
263a1550e617aaefcf3a583d380247dfc6343ed6

SHA256
93cd2aca3059bf5c5f47c16b23db8933034814dfd59475da5b10fd9022613ffb

SHA512
9865c7cc4906cab3587c5460f5d6315d15d1a3d090dffd0d83a3a14e248a77490d26b964370218a84f6d22204ee5c094648ed1840430162a35329045ac709038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77c385e86672ed56c51e861c01428b5e

SHA1
9e4bef3df85ded0f82089a317149ae5ba1cbef0e

SHA256
4436440d7e4a4915399e812f0945a3a55db8306348639a92caca9aa8cbd965a6

SHA512
89d5287b21c94b51fa5dda886c2795f462417a093bca2df565a2e6277d4eef540d2bf8429275b47b35e8be66dee9dd90ba6037d68db8ee3c434db811e7d1239f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd97ebc1c3c593e78b88b9b51e861085

SHA1
2bde557149620457536e0c70370e5352197cd4c7

SHA256
96061bcaf4dee5c1cc7ea0726f9ed4b5673fe3cb1b86b57f7287cfac23f31305

SHA512
dc5107aa3e98b3cfbab5a1b9f6b5ee6da743b404b0db2e7ee52b84a866232cc2db5b10f7fbf5442e9adb2bc9daf22d5037248978a833e94a60e20078f64babff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4378.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar445A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit