f73a8c89ed35a7637ec989aed1ed64c517bb256a3a054c4aeb6001beb341864b

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ad948a9f7d50755b8c9be36374c04b2_JaffaCakes118.html
Size

139KB
MD5

4ad948a9f7d50755b8c9be36374c04b2
SHA1

6e296e6c7e8499ad35e3264fa4e3ce55f5736793
SHA256

f73a8c89ed35a7637ec989aed1ed64c517bb256a3a054c4aeb6001beb341864b
SHA512

f52502b3357fe7328cfe1896fafdf4fac0e0961ea2da4cfe779a43d41c1b8133171fa13e042ec0b37c15f1dfdd852992b5e25e4bfd351e41fdc48c9081156dda
SSDEEP

1536:SZNT1/JKsl4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SZ9K/yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000cc47ce2d3583889ba57c68f4d0239e99906e8c5dffc5fe408e4225d472135b9d000000000e80000000020000200000002fa1abe58b6af779dc3fec617ce2d53481f97f98e805f25af04279fdb1ac54c5900000002e7fbc3280b1e6554dffc71f8a6baba7feb1babe08fb3b00f62af202ca7640a6519a887307b5e877167a51ac4647f881ef208b00a6e288d170c0b205c5018970cc06fd10c8d5df9bbdf3c873062bf070cb02f23f4be392b8f7ba82378feb54caaff48cfe1e1ee25b5b8e2acbbc9280ec433c92e8838be43480896be4a7e2e95c409520a16724531d2391b3926b4d3c5b4000000080659935d5376bef86e991d9aa4489a495004baefe9f7f9e5465d18ec14a9207de32e62337d35394e03af39bb8cca285dc5d21d64fc01ffb59cd26f6c81af94b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000374589798fe2c94101d99ebd430bff683c51fa65517c820767607b9a35589fc000000000e800000000200002000000049f1e7e9df02796d87285df75609fa437aa7eaddb06b248b472fb9b4bded50f420000000597e0d0731f371881d731bd095bdfe2c6fd8e62af9fd22c54244e3449c5ef19140000000c5502a522d8b25cf89f70d93de37fd14d3e61471726cd46a8f30d023d5ee1e102dc9d390a69237759f196f9ef4b38e86fde50e7e72abb10b4896f63f10de9c6c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106728f884a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422020979"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1DCA341-1377-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28
PID 2240 wrote to memory of 2472	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ad948a9f7d50755b8c9be36374c04b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
703b958e84d949fd8b955b987964fcb7

SHA1
c5ed2d00dc6f41d7d0717598b9afb1c1564aa07f

SHA256
f960eafb2523cc7f2d49b9069b05694caeb05c26944a535eb9075302a4592583

SHA512
417f9ba34c8934e0a51a7e7fa7d840da950d718e32017b2f28a7c7b094e8527abc7caf6270ce86b0a0099ea7a5167d20853b5424b09fb9209ee7ab7bfa6dc47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d792a4b5e0e91ec408248e2f11546f2

SHA1
e3b41d2328a6d5e04ba673904a7415071d5848e0

SHA256
a4de1590ea02a9d80261ce86de8d7338f83205bc3fcc25fa28de50e7bb6e6f50

SHA512
dd3f62c4e8e100b00090c6de482b355f000ba47d9c178587d54d8acc363eb51af3616fff42843f22bb4aa641022c9283f15490b8921e1a896ad19a385cdbd6c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f45c2794985346d621d82e5efbb2bf

SHA1
9cb649d6e7c95c875d8aa711306d9120849fa092

SHA256
a5a362a597bc4a7cd4923233cb1f5ebcb79cb6c85f7819b85fff7ddb310ee44c

SHA512
b99f659c8bff5d03e4c10d85c3e3a473a82e232e51efea36ec85d98a337e06e2f74999612447d0f5020c6ac5e86310cc552fcd02682c80ebd395effeb4f9e36f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45cc26ff9324dba7871a53a3ffa480dd

SHA1
f29dc09995d9315553209ee9bbb190b104c3d414

SHA256
a516a0470de7f3eaa04ca4e0a7700a66fda4d269286535755dbba9a0418f47dc

SHA512
020692dbbd65ee1b007ba806c5dfe24c3cc856594bb289162e89bd3e4ebf69140503bc809b7673d0c61da510149c5704d10ad97b7535123769674cbf02f0c306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fee3cad49f842482de092a1f30a7e273

SHA1
fafa15e05e43136881b9740c762cc2e4309be1b3

SHA256
9c656a63cccefcdd3873aa6ee387d282cb16378227e0bab8db8519eb62e3aa3f

SHA512
d8df75d41b9904fe078328262336f9c7546f541d54d57038b5912117a785719fc78dc5f529dd6d019322f6a16d15d562ff2c7dc031fc4f2e63ebcf07d4267c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dedeab7a723dd3e58c7e4c9ba3949f8

SHA1
fac546d1fdf8f33ad0c7f8a0fcac975be601bbc1

SHA256
8531fbe995ff84f78c4ba33b9c3f579a6523efd30fe25f335730ea04bf79c075

SHA512
cc81ebae2be6c845dab6a4236d1c819d79431e47c73aab818233a64423b202fce2b4b914a4f256f9e7757f2a160679b03826fe4a128eeb60b47b80a2d4c5dee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1005a496d021d75a1f6ca7f56731fbf

SHA1
25591b611cee6754401a482076e81c44cb7158a1

SHA256
cd99f3ef75f8c217d72470c9b3c2912f49a4eaf9490e0d8e0ea1af235af6e58d

SHA512
aa102f34419752a4a98eaee9495c20b54e3f118fea39d09223efde546e7a10d6e454b1b435669d59ab1f4259a2fec3ceb2f9e4e6a5c656f734e6e309fdae1a54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccf25bff2c643ae0c0dc9f3a0517b7fe

SHA1
c61c4f3c3eea36687138b8e2e91e0f69a9d2f221

SHA256
a04fd5bda89123896ccf8a80cd41d5a8261b2d5b68c2c5560c737cf1c63ae098

SHA512
5859336a897ddb8108a229b9db5acb14487ba5537e9f51f97ff456da4f9dc83e03d756321e2cbb3f539907aa8119053c769e08da18bd03c172ce6633895cca0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a9549fa063e58c82b7e6b24be5c8cf

SHA1
efff149810a34a929de55c0163c420f60863e92a

SHA256
11c6678fc07bf9e55f5cc0f5269a78ee2e82555690da8b3fb5cab46acb4e87d6

SHA512
4ca90031c8a8eb4a1dfb570003e676def64dd7085e1331abfcc2a04c9954857d1aea7c9d2789e66e186320fd1d9802ce0feb8ca59c967b2012a40d1698d77bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b1ba665c0178f2547d12a5be8d6ca6

SHA1
c04a8084d0bf785c54d6f1e8832bee58841a0605

SHA256
f0da4d2f797abe263e06c4ff926b930b966613182439df04c5a96931917f3626

SHA512
7f4d4f2c9680f66c215c205ccb0a8176cc915cbd2c2f89cd557ff6042d15dd659797cfe1bb33f874894a15405092f1937496b30643f999b50a4d881da6e1cf70

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC40.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD53.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit