135cb2a7f9b74e490145f952845b98fd9c44307fd297fc6862915b1510fe7890

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e3e5c4b81cd98652873490b0e721699_JaffaCakes118.html
Size

33KB
MD5

4e3e5c4b81cd98652873490b0e721699
SHA1

d3e72727c0e90ea559397f91129d918b470e66f2
SHA256

135cb2a7f9b74e490145f952845b98fd9c44307fd297fc6862915b1510fe7890
SHA512

a6bb7ab434fa312b02cffa3b6aae16e2db4c239b7bdcc2e7c782668dd26c951428b3c9c77acdd42f88537b67625e02030ea3c5e3432b51492de761115583f7c3
SSDEEP

192:uWLgb5noTm/nQjxn5Q/2nQie1Nn2nQOkEntOYnQTbnFnQjXCPAeJ+vkWa8O4SWRu:VQ/qmDmtzVnuM1XuOs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F06A61A1-13FD-11EF-9A38-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a81cc50aa8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f9ec19222efbb9515ee5af8e3d32fd869f6193a3dffb44bb34fcc0ebf53c0955000000000e8000000002000020000000235e68a534e6923fa82a6bb9b36ac372d46a1eaf9678eb59561929850e5fb865200000000782d1bf2b3d16a573461b522706759481e39da9cbf2d0b051dace0d19573b7b40000000e428d8c4b54eda9e0a828cea1b0da4719da7992593a6e8cbfd5c980b7779115edd506fd42cab60ea93f318c66e2b2af34a9960a88cfef7e1c4dddf2818a259ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000083f1b31f40e6049ff46e0ba05be0998da6508eccdfd6bf440a284ea90af5ad80000000000e8000000002000020000000f8f264716e122986bc944b715c725f299e086bb7acdcc7f0ec10319848e5577790000000a7290e200d74635b3cd5d39fc59aa3dad7dd8780ec5c0f0b3ed7f0f572185461face78e6135610fe6b9fb56a4f1dc0776ae3d6152462e23b639752d9450f292967e259d37a83305f4c1567d4c2fbd3af0c29ab07d3a9f4ac048488d7e4f4b00c817164b80fd04a14d168a063f3f868d6edc4b7c0b3e3f9d1cc62de34ea1ca724826034ddce0004b4cc461973f32e949640000000b8735677c4b29449fdaf10b0a5228ba36df2155698772e904bddebb365bcbda00c52ba23cc75b0483c95c738c5b40b4670d1eced0fa42f9a83356fafd0c920fa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422078552"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2960	2056	iexplore.exe	28
PID 2056 wrote to memory of 2960	2056	iexplore.exe	28
PID 2056 wrote to memory of 2960	2056	iexplore.exe	28
PID 2056 wrote to memory of 2960	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e3e5c4b81cd98652873490b0e721699_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31661a1cc1a564ab4dfa9ea8d7010add

SHA1
746519fcc0be16de06db1ae995a930f1a4763cc4

SHA256
a5becb5b11080d7fc7d487558aceca882ccf41d7f003d5f89bb37dd0658265e5

SHA512
ab3d6d6f0a0138385fbc111d19b14b77513e67fdebcadb3f45d034224f9cc819d8b199b2541856484110ee0d9b02bf9aa8b7d83ad52cec7dd6a8d094e5c9985f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec45e0236718c50ced13ec7d7ffc10a

SHA1
c7c44a57800fe5723d2305192e31ac03e6110620

SHA256
39c94f1f6faafa86bbbe866bd2563579c24f51be16149fb275ff283126964e74

SHA512
795bbfb2019a6d3fc79eee39cdaa178439bafe1d0bdc8a645690827e708a59ccda5b317a840e12df50214ed74ce9c65966a96114ed67eee1803cebd9f7e4c399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5158060d11459d9211e49a1eb9cefff

SHA1
7a755ee44701e88e3f95cb3da0d04d8a1cb51ae3

SHA256
74f9ce76a7c1049ca72a87d748fedbddf05d0421e2bb794dfeb9af94c4dd76d7

SHA512
8a8ee5cae8f55bf605d50cefcfba6eecd8e2dcfb86f73dfbd072714e225c84189a03dbbe390b1062a15dd59c25d5050868efe1a7350a1171c3199f5d0b9beb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4158a93e027f05f63f8fac956f664725

SHA1
b758a121e8e3e9af1ecbe8031d5feaf939e1e066

SHA256
4f4512c6441ce9a61fbc1ee2a56b4094a7fce3f827e8358dc12e6ef533276906

SHA512
3a4b950d2339c77e85d7846935395646c66dfd4952177f4bea3611bb85ecedad4247a5e2779865eb6f28a934423b157633087c21592e3508c7db9bbfc58e2a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5ab6e8a4c1fb94e4b496d9badec81a8

SHA1
ae772474e5f50118a7b859578a356030bb257e65

SHA256
761e2c08ec0590968ede50001494ed8564bc03b9650f2df41598072ecfffb556

SHA512
802bb24dc9b0942595924fced02b26617cf797dba9df3fdf5bec2760d6eaa7fe62f3d63db1ab7b1fdf7929e729785940e5518a526c156031b8bd325394f437b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c664f5c6a3d46aa082d0c7927cd8a8b3

SHA1
391b300589d38435a99e3ade4ba87aad3764db75

SHA256
2893d960cf87cbb270ac35b2085665f2cac845dfd697e29fe327d7ccd2c796be

SHA512
2a1c298ff23132987b22628c3c6fea45c437aaaa68321df6d8e07ade6b3ba2607181c253aa8457a276d6b2f732858e6fc52c8d7b7e55c255321cac4b039a6d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a62bdb18fbe829f72c5bc5bd738ef965

SHA1
27026b69db70a47f61b44f456c898c5069b1179c

SHA256
06471438b02b742acf19acf47111dd5c0ec3f95247fb9dedfba6d7019f99d335

SHA512
97a50356ba79f2b7a6a9fdc2098acc7186ff6530d9ac17340cd6e9e293a37983d0669f1db0be70e9e7a33e5a6dbaaa9dcf91023ea89d4fadbb8c4f2aad209957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b12d804f0864876a77ddc2e601e5a75c

SHA1
7e781b55fccc10cec722c630c4403d57da20a5f5

SHA256
e3839bacb4b9f2acaa4bdf10ac2921fba696ceddf7ec9e89209ceb2b00487903

SHA512
20452a72e0ce78ff48302ae4f32b95324e3fb343d1c67af3df01455d24f92d5539160d587e1c8848d3276d57667d0e1a9431c36acc4f2f672b71bb85ccbf56f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de2e652c778081c592695f25a437a3b5

SHA1
33e6f14053dde0228fd973699ca98ce2f3d6e138

SHA256
3c9046d4e1d12b0396e6530448a719f7163bf93acb2f1975909b47e2ef64de64

SHA512
a45a9e84bcb3c0d5c0c1b8eb8e4617870293ff14c7b31af7e5630c0cce706d0d57f068068e73ee6cfdb6169e8439b1929c8186cb42ec5a5348d1e65ce1c72459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc0e50671fb937414ee16a5a83a9183f

SHA1
5eb91a6777ef8badffae4f7654b9ffa16a460a15

SHA256
d5a0bc3d57428267476a0921309c4075b7c38d56922b68f48cf397fd55446b50

SHA512
8f8859800c22528b87dfe1d26ed5495f771a671241ad43ed6fc2cf638e2298dec1768366fbcfdbe2f3d42de765df8466ca8c556eaf8152082f0eda01f9f3abf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fc6b36952c72f61a09c9766f7b7c2a5

SHA1
c96e936f770402d2bd5262425e84cbbcdf1bffb2

SHA256
df71889427afdb407fb940cb7610c28613852c15888142868edc62f7333b2f65

SHA512
994c73ca5a822cc42741e4b464cf791641a8670da6a3abaffd6147c5dae4d6c73fc17c42d07ea4d0e16bf8e0a78343378da4293179f6b24d4b40db18a35de009

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42DD.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar432E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit