aae7d1d2a0581e821911b117dffce45345d66af6117478db31f827fc9a39be8f

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4752aa54b5a1ca187038f2dcd216a046_JaffaCakes118.html
Size

4KB
MD5

4752aa54b5a1ca187038f2dcd216a046
SHA1

b650d7fc1d1bef09cf4e9629ae74845a523e4a1d
SHA256

aae7d1d2a0581e821911b117dffce45345d66af6117478db31f827fc9a39be8f
SHA512

29118e9982da62c13839b62d1a33036910e26e109129a0d0683a1639ea475ff6314b957f1c6f6369e05963be60ec887aa70bf0f943704e07cfed497575a1bff8
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oomugVd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421957294"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c5f970f0a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060da67bc97d47f4a97f71a7bb5688d7c0000000002000000000010660000000100002000000089385b75f9bb7921e06014b7c1d69d069d0e68aa26a727a671b812f2a5c528cf000000000e8000000002000020000000e8c29f5ae9d6cbd993225d4236ff9ea5d112c2a104c181647bb97b60147c4013200000003b69dac3430d62ba236b5d63f8fa4b31d415e68fcec3d6f150452146420b6faa400000004c072e7d99ef58878696330ae3ff14b73fab5875872ae3ecae8a525dd3adcccbdf75ac8a87fbe748b44aef33fc509a1eea042fbbe863a8d53acae5b8eeb4d2ec	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060da67bc97d47f4a97f71a7bb5688d7c000000000200000000001066000000010000200000007edb9fc9884f07a270ba5f255fa88779219d012668273aa419a8b6ce9070b4bf000000000e8000000002000020000000aec7c4686a3bb6338cb1f94677c62e552769e22a47fb97c43d7f81f914ab5c1c900000002d4faf662c89bc1a740302b97f3f23eb2187a562d0abd44d048abf899029d52dcca15944d0b9ec7294ae9de67a0fe35b11f2dcee5897df0ee9e4658d6e254c9968d64a5a066fb6895e4ac46cc2e670df949dab307bab46ab21ace2cb7f588e6e6e0955bb5332802d58f3fd0662536714af7521ab087fe577ee7b6a44f089239cc74e412888f220b37920e9a12691dabf40000000f9ecbda90e9389410316eaf5877ec6a78033fc6bae9f00d442e97ba1e928e6449458a34b6752fbd944d36c963ecfb204bd22afb511042a40975738905f6137e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C6E2111-12E3-11EF-8B6F-CA05972DBE1D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2972	1956	iexplore.exe	28
PID 1956 wrote to memory of 2972	1956	iexplore.exe	28
PID 1956 wrote to memory of 2972	1956	iexplore.exe	28
PID 1956 wrote to memory of 2972	1956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4752aa54b5a1ca187038f2dcd216a046_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eece30c516d642963d152dc602fdb47b

SHA1
e3126cc67b474c5f7445dd7f5b7430e7c4aa5efe

SHA256
3cd9e7b94a38dd713eb40b6eaef1ea9ae52b7765827c2d6a055b14a4667456ae

SHA512
6b7a0c594e861fb77997c3cfd5747e594f6bf78059cfca9d925a3374ac70e6e078b06574b5caf3139183384bc86f3d94320c9961229d9d484744d276a12d8317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
19efa62a558488038f6b844fc9a0e610

SHA1
651f6691919dd6a2f4dfa3599374175f1a1da21e

SHA256
470c8ebb91f0ca407f324a450e0926f4db9a1de0a2826bc2ccf414e53608db76

SHA512
56f1dc3809f331300cfba074abc0853cfe0a7fd6e973d64956f2e4b5caa2414b0e1e76beab31906c40b3f4ce2f25022acb07061f09899ee3771be71c19919d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
31048bbaa7d3c17cb7edd750564f4945

SHA1
6a95c0ec8e75be220e58bfab9818b4db2a26b4b4

SHA256
6874026712f801c89266557b35f0dd9541ae6acc1a25681d46054b0216d4b80c

SHA512
1eb3d3e634c2ec63e79e439a061f4033808467c1f3b4aa5e9b4aa3c93fbaaf02abd8a3a74efd4d50d0848f2d2fb22f768b9481cbe4e42c27a0906a380b380bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
90714f243477df742e8a6ca4a779243a

SHA1
61b3f5575ff8628197a42280eed001ef809fd690

SHA256
dd65b7195ec3eb2aaa5431a8b6fb04be55cbc0b6b8b89284a858e145d6dfa494

SHA512
2f020fc5eeaa00011ad70d54921e531f72cf46d2e33eea896958f895d4d2ea8126e5e0fb5368f23dbed1e34fd6bfa08aa34983fa3926ced2da0aab303f9b2742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b4fa673d7e558007bf3ff21bdc9e4fa0

SHA1
140050779085cf2ccdd4f28867f103fe169313a1

SHA256
32333e682491b1dbef3cd018ea65c9d4130de6e6050103c02bfc894a6b4a8ca5

SHA512
6f3211db941243483eaf6b4906030f64c48c92902ec75faf9ed64c22f7c1d8739485c705af859c15231576412689134e2d47c42eecd1cb7b709ea24aee73ba92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc28ab3e745551cd510c58cceef6e6c6

SHA1
a560fe2683ceddc39e40b4e0e7cd71a06cdabb9b

SHA256
d3f7ac2551aea398f09c39c7dfad84a93f57c123835bab281785a9190e598d5b

SHA512
e7d3142be117e1d23f716c3ed359f7d6cc4469ba7a13b7c1c544c14223180aad398c13770084ae41febda46a547b50a14a823e251e82ee6987f9d5a794662cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
525e5595b38678db9bdf4bad8cd58bab

SHA1
f6aae8ef58f5b85acdf1d27088902e393c8fc494

SHA256
9fad715479ae985294c60feb5e83880fc7e50cb6a36b1ab0b9fbd2e83aac6b71

SHA512
2e205818d5011fb64d14c6f11652c3adf7c84ff8ca5724a9da4ebf788892409d848b4b774bef8efacbcefdf7bda938d353bfd361654b372faec1572b7704b8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1162ced8adcb904f1731dffb4104b86c

SHA1
9e5c55cd770ecee49e38e6a81fbba33b85cff4b7

SHA256
344fc249744975c09accf7f1fc6a6cf9c3b95ce90699cd661bba64fed9788f5e

SHA512
f5d504c8cfb65e0992d4bdf676d3f5a4e4ca876acf09740db2ba98469306d566e4afb1f4abd5d7e8560813ab0583ed7c1955adb8664d5e0a334cfafa3f8aa890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c34ef486ffb42fa5fc83c283bb92d72b

SHA1
15849f5ace11384a15304b7e7ac884ac04ea04ee

SHA256
21db79485954b18a66123e7447a2d2bfd4094b629462f3ce090708fa2c68b9a7

SHA512
cda1d9d852f1f69d663ca339ad7f4d3196e14bfea2751a02ce1b6764747849f1243798e3c1e2035f28ab4499ec031aa72617002418f0c478bfec7335e76e7549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a4ead496448f39454eaad0a01b28d3bf

SHA1
2a13a1a3848482b46d1457fb1714ab7663a9c18e

SHA256
9977f5334d7b5d5621cda2146dc72cba73a3175a70b8f0fe28a697e3da3e26bd

SHA512
593fe7e6428d2650ebb0a0db6c0d805f98381edd7ff7bc9408f6b467191309832cce12d4f65665a8d4b66147b2bdd273d0f293d1edf54c493d20cfb39159c00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
01b19c5a5b655a545cb0e473df9b4de5

SHA1
a9980081053a1263a7bcbfb97cb4e26104dc6334

SHA256
ffb806cc367b4d942479d343a94fe14a9b85b6a179d78e4318b03b5b49c79a58

SHA512
a8b4deabcb3f68efecfd8ceee46b7536762144681d6be85012c25c5397ccc8cc23dc864208a42e4f3b5e7a0f5f371a60a21f1576aa7ac772d398e6950ec914ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
491811e67ea0c61feb31a74aefa3d866

SHA1
1481364170deb79740647a33d03d7d38dde705c0

SHA256
f67a6ab7d0155e814f614532bc7d344c18efb7f8a4b390e4f7cb26fd6b972d1c

SHA512
6fcff9a3f50ce9613b2ce412934c07fe002a7a85959f2465d068722fad09976305426c8a9956072e258302667779b9d66bdcc3fe89fc3816c146ad68ab2d0e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9bea33e63afbc28889fabb27ec705c8c

SHA1
e587e6b4133f69f1df7cbbed9de9c7b604b93c04

SHA256
64f6747ba1497ee1d574e2c650d93d378c760d02ba17414b8d674b72fee3e7f7

SHA512
6e58048943a5317de9a155125c14652d8914365af6cd9ba1925536b65ea0273664a0320ec552c650f8af341e4f5898991f0aa9b88b693d512187fe2fc80a45c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2585.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit