96d793780a2d59c1506d277d43770184c49a9b7382bc857eed0449858e83eee5

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e5f82f0eb089374126e30e430e9a372_JaffaCakes118.html
Size

116KB
MD5

4e5f82f0eb089374126e30e430e9a372
SHA1

f53a79b603971b7c89c07c9e7c53dfcd377f51b0
SHA256

96d793780a2d59c1506d277d43770184c49a9b7382bc857eed0449858e83eee5
SHA512

15f4d3bf843d0bed58e06768c2ca49d9af49ad179e8fb4d8ed08e2bf4a67ccc3a0e5261aaaaaac87987a9149a70dd5869c0d4bd96d6bd5be57d88482fc41a354
SSDEEP

1536:SJ6yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SJ6yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10230b0510a8da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000009c0c2d1a7f62981593def872f72276ccdb95f5f9eb12b0ce2ce564c7a678fb47000000000e8000000002000020000000074713b3fdfcc50dee0b241ccb0c345b4db4f28b4bbaaf5e1669574514983b8790000000dca8dcf52ab4e08eaf99b7f3049a37c2afd7e01af2d776709c01f522811ae310e4145dbff7f0200c2037cc15f4766f4e3e12dc407c83325449d569cfc674a235e98e6c7d3ce313cc36cb5338a74bf29d6742997f90aa7e002c55dca2334191c5baa52859a00d81a9a8b45ae25aa8069247bb3dcb3c385d7aba8d67723aa7494ba487133b1667718a013222c56dd514fd40000000dcbb34679fc18441f75c7e63daa5fcdf940dcf94bd009216fa3f68cb2296428327a7f742d67187d4de4d596cbab7327aa64c966b9c33f098ef4e2d772b94fc13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{308402F1-1403-11EF-8C93-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422080807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000fd220ba8c276c29f1678bf38ce02c6868eae316ad62071fcaa6b958f4bc76143000000000e80000000020000200000002ca9e5b158507dc551f48e848b7a07ac73e89e2d87c11582d2fd9e6d7179db6c200000009e3d324399466a837724365118a38ebe588662b8f7a2de7e26fc180973330a5540000000295688d56a6343b540c04587695948f0651b614bd73cf991d14df3b546a87fb2cbd2cd6c311226576b9c05fc5ada3f9460cb05d68c9e19d45ae8f8029fd4b919	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1200	2976	iexplore.exe	28
PID 2976 wrote to memory of 1200	2976	iexplore.exe	28
PID 2976 wrote to memory of 1200	2976	iexplore.exe	28
PID 2976 wrote to memory of 1200	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4e5f82f0eb089374126e30e430e9a372_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ae99ca702ec2f98e278df6a3dfde1b7

SHA1
09eb7c9ecea9afc164fb14d4a80463ff5ddea04b

SHA256
c7d874929f67bb5277d9f46d2830cadf7a751fd027a0aa7c227a44f157d5e69e

SHA512
6ec89d816578f3507cb2de18c9539cfd481485c8eea2cad4557c97bf409bf553ddf772751659bc5b5b5f0c2743e006ef66cdbb21273d948996f1aa631e94d2ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28d15de5572ea5934f25c9e0239e772

SHA1
464aa9ad0de60fe0a8fe5cbb28e1f6b13307f417

SHA256
33dc8cdc00c945a6f1e585dc983627abfb5b724406db3ec3d322dc03cebe4abf

SHA512
00a4cd87c831dbc1bbe12b114e64826ffa930aa46225c49d1d293831bf1a38bc1bee83f519278803b6c3bcff02ed8aaefb9b4ec273d741aed21e1641c7d157ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f681836b9bfa7414042fedbc4232b1e6

SHA1
41310e89fa9ca824283150681489581975b83642

SHA256
24d5892e2d064e158bc7c2cb64395260bf98d41b7a676084d6a30a168c2db904

SHA512
b58a0dbedbfdea46e404234ea375a5e57077005657d05ba79c064384267af6d0206930a189645495a0f808d32ba56ef04e1105723f2d9d4b2d51b97a8e7bfda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3a0f983524d36c10c107436a276794b

SHA1
7e92c1c66ebb2e1049cace1b6c0a4174da2fe92a

SHA256
5a32f84d39c2e43bcb275ac99eef3547f7df70f7dfc1e4e9a4ea532feaec545d

SHA512
fa4b6dac88d806c64dd95937ddffc9f776b8d9008890b4df72e18b05fe38b6099a47b3b2d66bd39eb38478c198074b01098c5d141bcc7bc45caf760da5f38ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10b77c7e8b7c5a809c8753ec37902262

SHA1
92efe05d8783d982c1c5d72652b7eccb8afc34db

SHA256
0f2c2fd14dad7106ebecb921d2450f493e75e4a45e5a0306be5491a108cd0e02

SHA512
eb512c4533be7c25476a1680034fd23b79b20046a80c7914492b0aed9505aeb57518a20a920cd311067fd0fd9760a40b6c91fb04850de394e01e18beb717651b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72bff3b0710e7537eca823b05e19381e

SHA1
73b26c8fd5796a75dfd148f6d88f076570c5d23c

SHA256
3ac99d23ec3e112c3e9df05ff9c8b57cd7203e4f166a104bc3554cd62c8ddc12

SHA512
23a9c9552f8b29df25f46f1821ba14e4258ee648e4c18848eefdf1fc03654bb604bf86b2dd189f8e2d47ce949b25bdb59feb2d55af549b8f10e0bbfc54648703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db65a6bd6f910c52524fe00897f84b16

SHA1
f4fb88be5a5d7c8d99fb399763d95d5fecd19242

SHA256
ce0ce7a3c92e257d5906aa2b13662d0b96c63372ea9342383a059a40eeb3604d

SHA512
ff44d9ef83fd1cef2bd267278aaf834a4d9f3e4db49c4debaf0d438d4e364643286ba83e8a2a56ccddac03aec5ec0aafcff6606199204caa5486ba9cd1f00930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39359cad02f215b58b36c50b957a531

SHA1
f3b428d637590be1a3fd6e87a0d0561a225cacb3

SHA256
fdf86679a7775287b7e6842cf34c59435c27cc9c1b249385d4d90902d7e665f3

SHA512
b5129d97398b1e716a73ce3a352f0acad97faa183402aa65b59616e743a91c9ece88bf1ee7254244e673089152372041525cfc34e9aec1b2a965b854a50c312f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a27db7ce300fd1c5bb1e2c9d66c32f

SHA1
a73346d167fcbd9302723e9761cdaae7b5335b0d

SHA256
95995a331dd944413137b9516d5febc54fd96cecd269a484231651174c778efd

SHA512
3ceda37c2c304ecaaa5a53c0453d5778de61e464fff310e0686b0e7da70c649ede299612eeded9763f63bb091f7fd24bf8773ce52c949f3227e1f61faf95fdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cda4bdbb71752cf30e3323e5220876f

SHA1
cd6f28ca7248bf0684df6ee39822d99034b2f075

SHA256
b8da23873b33156115b6af8dfd8c55373d387c7bb84950677d791d6d32ce0005

SHA512
9a3fb5c33f5803695dc09c15eedb270cb33a4d6cf38c7fbd85b8f69a2fb79aa87b80600930634f5bd5b7f5fe6a21925b42c441637508a78491f1bad13854235a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38ca758473cac1cc1a0dba3cd13b6809

SHA1
368210a5c697ee04424d9741fb5b93c664bc61a9

SHA256
f65ad537db5ee361b758a68d39d6d32d56017129bd4a8f7369bf66d820506d11

SHA512
6da10c98fd3bb03e0f074963878066c0d105e49c2fecfd35dc56ee5c4c92898116444642494d40423a781c9cf1d8e3c274f28b7c352a3678c42ced966c7f8ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C0A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C5B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit