1c5a9f3abb96414bbcd3400dae8a37ac7a552192b1d9ea1e4e184c60b19dc82c

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47925a6b23efb47d76349566dbd39604_JaffaCakes118.html
Size

115KB
MD5

47925a6b23efb47d76349566dbd39604
SHA1

98d3bde7493a69169da3f4169468928adbfbeb4f
SHA256

1c5a9f3abb96414bbcd3400dae8a37ac7a552192b1d9ea1e4e184c60b19dc82c
SHA512

02adc1d805a0248c5427818d99c27459135663459879668780ad055c209231872ba2d034e4ee0a579b1976b2455abe4efe18fc91f9edb6ce29f9b60f38b52a78
SSDEEP

1536:SHTzUIcibyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SH/UIcibyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007047587b4d10bf8fc1c505a12350ad7f645b431698dd24a9d2e57d8da0e703f8000000000e80000000020000200000009a1107ac181bfa7cc43ae94379276bc78785a35d48a1926aad34756753505a2990000000ddac807b4ea06d0668df98ff46c4ed9e47c756a85fa3022dc1798f79048463be4704e57c0f6d6fc3e3784eda5ba556ac8f22fd41bbe4f88815de86353318efab678b494cba19268b69b077ac4bc1a1438a75316214885c5ecd3049e76ddc8f379d9a2621df908519e1cba51778512cb7189c910bad33d8966e0b05fe6acfa855e310ce7c852f8a4df74f871c58ef9f8b4000000015b49c17826e8846d7f3c10f99e3273f85baecf5b7fff7cf2e5944b769573344e5374a88965817f123587f0b049174a77c5ab4588d59f758b33584b1da2ac83c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000fdd357c0bbf46f58a0191b0d1ce1396b4f645a0a488ffc5842949eeafa344e4d000000000e8000000002000020000000f71587aee37bfed5bb3d44a1d827516b4325da0ace9f41fe7078678ff50d5bdc200000008457ea68a7cac42df313ef606fbe229e895fe3aec2b09a8fb5365dd2e9ea9f9c400000007f24f70c7cd360e85e2a67c0f5500d6f3a6eb58b991c37cef8c3d5af1d7bb93252908ed26e282c6f909fdb311e500d944da794072af22b697715c40a3b46647e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6A36B11-12EC-11EF-8B56-EE69C2CE6029} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300455c2f9a6da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421961286"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28
PID 2184 wrote to memory of 2212	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\47925a6b23efb47d76349566dbd39604_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
825b8992aad6878ba44f8270ac9cfcf3

SHA1
77508de4a775eb2117d1c0ef5db91202ee064b93

SHA256
9972b90a388fb088ca249fd5119dc9dcaeb56e885e34176d571987ecacca707d

SHA512
2dfb8b323cbab0150ed8b2e82e562684ca2a8f79ed07b1c3a9b6f7518a7637764f3de618179e5ec24bbe307daf2596bf0276f365e0bb5cb33885ebf71db3c92e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
414930445d366346082c62058680ef41

SHA1
749a59c15a6a679915e834f16c8e06119f1d5dd2

SHA256
b40147ba46883b1be72f4a2ffb4cbd02c719d13adaa655409078e442a9c1e4a2

SHA512
3555293ec2efb08f9ed16ab5c613a3a8a3860d12f2e376ec68d1220ab3f05d6cff06eb8cf573c893b4052ce99e0d592ec9c73b837a2416e673ab10eca8992cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dd7c77877a67b40989f667c09524332

SHA1
f3c70d8ba415d40b8c526a580467926ef477c75a

SHA256
de3f23345789a486acd27463c6e0ee1d53520cd422dfe96da9458487325ac3d3

SHA512
570f86a9518ba4060fb986b5ac3492e5ddb6baa02786833e86c6d14bf7f92e18efc0ddd8fe2723e0c92ccd41a2601284f0bcf03da4c02e907b76049720fc0a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49a8d909525e8f06e42154ac74efff43

SHA1
2bbd0b2c46abc4e1ecda7045f88e7db397a3650d

SHA256
b372cf9afa50a80739906a3e7a6df332cdf41f576674f380d30873987c684e9d

SHA512
e825fe39214e72319f1212ef376f5c938e906d8f4839ce08d1ed396298e0fe19e722e7f426add5601cb437ce198e025dd268a680fcf7f651e5188a9809072a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1f677b3ac0565c35b1bbd2f74ef9bd0

SHA1
bc1334ac5ff67372e2df1aa5afc56ababf620b0d

SHA256
f02784dae17a61e1537d0a63600521f0f1fd278191a6f22cc2bb771f1c143d21

SHA512
ca533c5f5ccd96981e0ef3343ebde457eda5b9407ae61a3e2a06c9b1f42186118e754c64715901ec934ccc3c14676c76a3b080cc146adb78d39993160cdfd6a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47e883c94d1f59f7acb0ce8dac72ce94

SHA1
b19ddbff8366b667ac2ae5783465d3fe164948e2

SHA256
976aa4871da3d38ac0926e7218722a28c94de42f54e451b31df29884a8ff3f10

SHA512
c9901ab6cdd6110125e95dd7afab3e6deb1675c8d8867c7348d2fbc02cfbe7040723ff34e54fb0ce5cab6c41a5fe5623331d2a38963ca27512cc398b82229339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d4c55995b889af1b0e2b81808b8f2ef

SHA1
d2f3286cd0edfe58f8950ac0d6f78b23427b3848

SHA256
28c10c4f3885a29f46797dc251c4c160af73527b3aa932aecc76eaddb46f3c1f

SHA512
a1e189a0474f494e5d46e0fa371a250e72f8d2876422f962b89e28e87486d9093c2f8d02bcef696be612d87dd559c8727e7bf14e62ca201be864a50e9da7173e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf01bdc59be3dbd086361bc7f1fdf3b0

SHA1
d07919f2556dc95ecaa61650bd3684eb5c576ea8

SHA256
92d8ba7b231558b395714bd4f76b8e12046920e9724f531cb21eb04562b7caf2

SHA512
543acc6fda7ecb9b65b70107ad3bf4fb8aab8fecf0b060af32174b05095f891d05e207c225720601ad27d5d8da7027067a2da06c31db82d5bc900fb0f0462d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a82b026a8914fa1d6dff8dcf4f5b35

SHA1
43684f9d44f73009daf1e97599e041e05a66faa5

SHA256
1b8b2931b818cb16d645d18294e5e7472defb5a5b7b842421878428e8c530d84

SHA512
4d3a32857eb8ed66810001b4344c595e9fe71393de274f048afd4da94fdfd6cfd5103b4e98e189c60b858f0a2c5ddb04562d00f44cdabf40b6e6954c8135ceba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616b8d573d9aa80361e495ad09e26450

SHA1
57ea4fd2fb00383d623f69d35e16df8c6a8800d5

SHA256
d6ae9c2a962989e255b3c4852e330b37a46fa5a7feed6f1f631cd24746a17203

SHA512
a563bb98f6c2a7f68489219910c708fce103dcdfec31e1bb0a11557943870086df7d6cdf45d117d78e0a26fdb170dc2d4b0276e4f9228d9168cc79b7a9b9cc55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit