cf532b61d0a25b16eeeaed3d83137189a6d0b49b932af5910521c8e0341105c2

Analysis

max time kernel
121s
max time network
153s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ef29673f5dbc857b8d2fe09e9921b1c_JaffaCakes118.html
Size

23KB
MD5

4ef29673f5dbc857b8d2fe09e9921b1c
SHA1

f393681a938ec8ce146cd9f749d62ac94f00c9b1
SHA256

cf532b61d0a25b16eeeaed3d83137189a6d0b49b932af5910521c8e0341105c2
SHA512

87fa0eb8ae6be2d425fe03a2d1d6917f89664e60e69d892e24947d0f802fb05757ca42dc9f36065fd72ffbe7cd046c7ac5fe62edbae49e8c737d643942ddb69b
SSDEEP

384:rouHDsbxWLYe0s5q11gXTIQ/IZf0Ez9YG/4kTyb1GTnxfsffK1Lms:+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F7B6471-141E-11EF-A2CF-6EE901CCE9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009bc7010225e747429995e7d29e7d089200000000020000000000106600000001000020000000c4cad21fa097cb35ec2433b6e52b61f0c9d78cd63eb03ce0fe4c89896c97ea50000000000e8000000002000020000000ba0d417b02c523203ca6a2060ddde2e8abdc77cc1a00346ff080cdf63b120276900000004b9333f2abda11dddd48ac92366932d175ed054b015f3dfad3ea39954278a7a9603b71cae4b0ac876034cc9d7a6ff1f1b5a3dde0085cdf7e8a14479b4ebbdc31bfd1a674aafb0df31268b622574b921bed9da086974de3e2133aab72c0093d43ed38dd21156fbcf9489c7b06add7a14ccfb2dcdc82f8d4eedceed25fa0978f4532695685318775a6ae0986a8bd408baf40000000bf4355c60499b45a884bf65b07af6be42fc054eef1292e89dc2f4df589ae7b026790cb1f4a281c2fb096d1954af375dc6cfc055c5bf741baaaf7861cea66b134	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009bc7010225e747429995e7d29e7d08920000000002000000000010660000000100002000000000e06273266dc9bdef833bdc6375004385bd21cc0500ca9bb4db85dbd1b6dc93000000000e8000000002000020000000fc5882308433069d856772a7386a638885de007319e229251813b10d4cbcd27520000000a79988c62984cfc5bd0565cf6c05869b27032186b564fc6188732516518128a0400000005fa1207141cd6593075528cfcdbd4e0d3fd603a48d45ac0e090963122d56d2045de04c57920cbef4eda3846d07101ba9e45bf268c2c970927ca26c9772bd7509	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809a60e42aa8da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2312	2328	iexplore.exe	28
PID 2328 wrote to memory of 2312	2328	iexplore.exe	28
PID 2328 wrote to memory of 2312	2328	iexplore.exe	28
PID 2328 wrote to memory of 2312	2328	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ef29673f5dbc857b8d2fe09e9921b1c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
310e89d8bc23196769e9c115b5d0e295

SHA1
2104cd362e9d94038f4fa3042db6db44b5ec2e2b

SHA256
6e9d4252f7e7711a2fec9adb0a505fc0e16ac66d7d0fcd7bbe8f23613f6c74e0

SHA512
90a6bee1669c43114750db4b886a4893eabc3577c9803602a8f82a86bc14987e8fe988a763a42a161cd929fe311dd58cae50984ffabbbc65a08e9f4505c285fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f8dde499511c367852c9bbf37d53c7f

SHA1
dc86d4f87f2eb38426f62b0859d24154ed2b0e9f

SHA256
8a3bc4feca123dd0ae6996eabeaef0e98207fa0b9cae486417f65b43e503aaa3

SHA512
530e0131f01be0b6fbe3d06188a5bcad53eeee91761d302ea460c9103dbdf0896b76b3455efc89a4f4650a57747c29121bb9e8c6cfc56d82e799c9a95ce4d66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe88d1e9ad115d39147204d55390a82b

SHA1
88ba6fc8af5facbe813b444ddb41e41510c361bd

SHA256
ab8ee88d952603772282ed7f9e829688c2dba3bec8a4205d3edede0894076061

SHA512
a6fdebada6aea551982772edf9ba0313071fff7945f3d0c414bb7653bbcdcc14d0066f626fb71f2085a7e0abfd375a407056a981149d854f9207dc71433ddc31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd2592156a41f0d81dbe62977478ddd8

SHA1
ed503125b9b670648f875c570295d7f782945e2b

SHA256
b48161a51f657523eab1e51e1750817d80c87dbcd77d4155d76a967a45b6d8cd

SHA512
fe1a12c7b14259b61c7dd3ad328d59f6461526d2ca0fe06e5deb25b2feb481d191ead336cb6033b057aa45afa8efcb3a75423f262ac2b2fa1d7b8a5747f2e114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7429f1778cf241128cbf4aceb9f28461

SHA1
ce5704b6009372cde632e56842ca7fe358d464a1

SHA256
77b97bf666bca68680012a8ce7bf2b7c082f4039db738f09d5facb7f4eae8f29

SHA512
e8cb1557e80023ad141e0944ed4b495b87644b3db20e64a5df05f5d6430edc2ee73e803ebcd482c0b4ce5e0a1881c4ccbc63af500377825c5cfb2d6bd8b1142c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
973ee246a390242671176a692a68f8fd

SHA1
0c74df183e1772d621c26f2110f5e6dbb2d050fd

SHA256
8e7e8d3fca561e1e2e83175ff15a9ab6709851ce4ba14d642bf9f34f14d7df81

SHA512
779093c43b806686b95e22daf4fac49846c28072346c431a0e953b6c29e08daa57855e8949593c170ecede6c4775550e0ebbae0b9d9ee79ef14162b6ed02f4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03164285245e20fbdc9bab908dd7c31

SHA1
48a2f80a8d2236fdf2423f6eb47542c72915d1cf

SHA256
862dfd902180c6519156694fca642f7c6e3b43bb31fa008b6664be78ba1b3fa2

SHA512
108b982df70ab8432467234483645a5d8c7cd06ebe48eefd35080a8f6c51a3e58a4baf17d1a8b88edc053fa0483dd6f9427ae732fb1092f18716c123a9c89ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b28582eed31157760073745c21a04676

SHA1
0d7c7786d8444ad74d6a3798d3bed086fc0b0954

SHA256
9ecb9ad806affbd2b0be861d57e18953c52fb1be65403543619c6ee61fce95b3

SHA512
87895386967f65006e6f22684730e08a92d4b93a9e709f793300eb3e13754fec3ba8221abfc8dc89a97f533404babc1fea1ef89b4e1880901395f4a0ef469627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb0cede0ad88a6b1bcbd3ddba83a7a6b

SHA1
9df386f796136d8302134eb8ebe6afb42e992144

SHA256
db60473ab11272525288e5035d08e96bdfa1aa806aae89128589a4bd121ae2b7

SHA512
a14c2e699e406bca84333c3a819fd8fbfa3cc0d91e93646c8fb0583c515af768da7ca3d326c4fb3e741baa56fb1359252c3d261ded327c6f8ba36fbc8329b43b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E52.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F26.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit