192b3624a530a742117d1755fe951832e3671caed6f4fb31c9ed900c6c96fadc

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4763282dc5793bf28b58ea00ff22bd99_JaffaCakes118.html
Size

27KB
MD5

4763282dc5793bf28b58ea00ff22bd99
SHA1

cae38669936561d59c902f23e058019d494d69d6
SHA256

192b3624a530a742117d1755fe951832e3671caed6f4fb31c9ed900c6c96fadc
SHA512

532ebd26de2821c0f75c021c20be70d5369889eb7a1e25010ca659ba541fae893c219390fcd8500496133de5ef6ad8876a750845287e41d0e0a3fa79ec037d53
SSDEEP

192:uwDAb5nPanQjxn5Q/OnQieVNnCnQOkEnta8nQTbnlnQ9eNJm6u/HyQC9WQl7MB1A:yQ/QwDyHYSbMX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421958320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD1F62B1-12E5-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b708625a188adec9d0c83a0fe7b8dcbba64f73bf241f4242da84ff0a78dc9949000000000e80000000020000200000009a36b255e5e66184442330ec251b1f4325dd378b161221dad4680b1381fddebd200000002959a39516cbce73bd7da423b1697322aa813b5fbcb1c1ea969486a41fc57ce240000000a04894931bc4f14f6a00075667a1bcf0f4b811986d362a7e9e9ccad392c0c925a6760952bf4942669637ebe37111b4608a1fa5504019e86ca7f2206b21ae24be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309118d3f2a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000dc931c8f608e64da9f0950c3e5a3230fc64c5edaddadd6b985be81da0057d70f000000000e8000000002000020000000d064a4bff16839615369544326e2fe4d958997281032f9932d5d9a0c21bef3a190000000e17ff7aad5fd3df4e6f42d30f0bc9a87da18fe511584f91e19ce7986e5ec73dc03530ffded9e1e3c90962c25abb3628c7cadc84c82d14e5c6f08373b273b843bfb4f65029368f2c20cb637662bc2ffee53af4e2c7623a693cc52d2f59c0999c66124eb5df0e8ba5e08f15ac234756306a15253a37a3b9154742f848538f9ae65150015e2f87da71033fb60383263cf8240000000833f7aeff151b758d434a49edbf88c9eb1b580040cadfb18c89bce495583c8b09fda6fd82ced8e8bb77f065713af2aa5de88fd886c6a65de510875865883a36a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3036	1952	iexplore.exe	28
PID 1952 wrote to memory of 3036	1952	iexplore.exe	28
PID 1952 wrote to memory of 3036	1952	iexplore.exe	28
PID 1952 wrote to memory of 3036	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4763282dc5793bf28b58ea00ff22bd99_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b3325748b4957411a259c625dcedfee

SHA1
8c43a9e3c7057f131d9d59c08a05b606b2a85a3b

SHA256
46616c5f78ee2b23ef9a7c650a4e20e99cc11eed7a1141d73de465bfd6b31606

SHA512
5214b0a66c4665a35faccac529c014dc0f164e8fcff3a294d00f8118066f2e0ba8e6f2fd33759048b47feddb451d1b6bcf2de9449dfc06db44530bd155593847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e601982d9d5c4a06e06a5d6eef4adb4a

SHA1
7408caa0299cef2b5cc9c45f7b8111a68967913d

SHA256
52929e18e0845d1a8a4533905057c3faa0cd94901760ab6ad336ee798a735747

SHA512
04c703c80bad039a760492ab6953e0c474fba3dd883c7ccb5517a1a8f57f2eb6b2da91789e62faeab5980a865bd92e6bd910a2b29861ff7a7908bd4933b5ab15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
552e354e7616ad7a1bf5c126be0ee2ac

SHA1
63af794226b6ca2ad406a48423ac7e5576d26ad0

SHA256
a94811b51eb8c328a66bf502909ab12eb2d21a9d4c36d98dd45287db5285c48d

SHA512
c14b57db5c579a0a6041324ff65e6d4e8c27993a68725523d51e3c4377b0d1e406da2ecf1b7c471281e0bb3e874504bf9d11d9a5d456b5be882467e4e49fa9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62fae6475729811325664220a265729d

SHA1
a27dbd0add615517b454355d2ddd2446b2019eff

SHA256
7cac30ea2b5766872d314e2854e517d7115da00d8948076e64ed174caa462dfd

SHA512
606f0422ef50af1332dcb9cd92339585e04cffca9d64cc1181004f126b25e1e063a5873b361f8ca5e54fef2c0e2a79a93519d80ceded01a29d9eb0206e2ac6f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea42a14f976d1810437b70b2cb5d668d

SHA1
8577adb4cf41860aee8ea93f222f0486edf9efc2

SHA256
483127152233eb527a3c6fd3892ad5ef3355e8980ffbc464de0002818ac38f09

SHA512
875194345172c83b57207d367f15d5fcfe8e17ed5b2936f37c680493348bee121ab13035b92be2912034caf2e13afade3ca5b08b44845a6fe6290e39d74c3f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb7f82ef46141e3db6559ac9f1abd56

SHA1
708947894900056eb2922202d1967a93a6d55a79

SHA256
778a9e301dc3df063ba988ce7355f313cb76aa6c006497f6756a7274ee9918f9

SHA512
a1fd63069c029bea728f10d84e5f046b3c9112cae63dffc34b547fa24b11b94831745ef632d876fd2566a7726983784689480546737f25846419ea6715b22978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb5a0d2d3557e524bcf076c628eb14a

SHA1
2018746a9a4bf44a84434fb56134a98afcde7404

SHA256
a430903f361524221f2b0d6b933787ac4ad39bfa1e57e1b6973dfc8ace755944

SHA512
9e6a81b58d3fa99760ae00cbe8ce3fb63df70d67f21c47c0ac6c0d74914e54fa86939bdae1b9e07d958c04dd43d008c9cdabd9a8f718698edf884a3a223aa852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad9b625022f79d48f12ece4ac472da47

SHA1
a2de7bd009397e1693d2b86d77ee6726261c9368

SHA256
d1059a1417399b260846faa787440a528f37a1d4bba11bc27eee1888a3c2af96

SHA512
c1b06a7c1eb65901c20e1246d9041bc04a4b48a3c5e62d977caa7ddbb91bf84f6ca17399b214c3d1509e5934c46db1495bdc14c7cf44d2355a52cbc7eb6eb2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abbdf25260c7f9fd1c3b45fbc2631e8e

SHA1
7d1d571caee671c33ed7a43d8f9500e843722cba

SHA256
160e5aedab66fda376456380dd2f3454eee458b9251f7816d7b16834ffc2beb6

SHA512
c3edbd1e1a87d41a7cd4194271fc941b7eeabeea9ae46e9ff6468db952c66be3723a1e940e184cdbe829c47d6189d173b05a567362923b9401753667d2e6f2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC757.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC894.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8D5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit