714c421720835fa339e8708521a27a695319316a3bf808d464cc2fbaddfca3d1

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f593ff7fcc7e8447567468292144c26_JaffaCakes118.html
Size

22KB
MD5

4f593ff7fcc7e8447567468292144c26
SHA1

c764dc9ba9dbe1aa03e277622912d5fddd9c34b1
SHA256

714c421720835fa339e8708521a27a695319316a3bf808d464cc2fbaddfca3d1
SHA512

eb06517ecdd0997e14422767e43cbaeb026dbb2c46a5871c0e587ab9d7ee2d532a7d650b46746c1d12d7b0e0c95d4b5b35d358b9d28d942877b84186f65ef38f
SSDEEP

192:SIOKLGwFpRVvmThkAtW8SrS3Vs9FtGtOF+tvtVNQwPLNwlCm0GDy7Zego:SIOKLGKRVvmThrtWo3StWQeFkwTNHkko

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ee99a9940f0e9ec8dfe42887d1fe4a7ba03307bd7bee3f00d95d3f0c8eb6ece6000000000e80000000020000200000001ead22d4ae687b1fbd0bf45e8c203c6847caa9c9b51512a918530fb48c976eb190000000471182f250a49e826cc217abd42ca57c090dc135537ae159b6b4fdbd01a9763ca4989ab7b204bb885154bdce13548084efe3c2095ed8d358b122eb1449f0fd1e2dd985bd00916c283098cf73155d42d05593aa94ed209f9ea0f82f45c0cd7e6d7013ea35709b148c9bdf2d3ec06eeb807da3d78d2db1115dd6302f064167ff6858720955baf2bcea53c50a9b6db7885a40000000469cbd5d5e552f9d786e54bb65036c1cafe745b6b5bdf9cac81efa8eb2d100d6fabacd3464a7ff9339c3e6f4df9f2ba1666cd189cc52a8d425ab325cb0a0fdfd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000024675d234b6a4bfebf9b96dec2117995fc0f030fa2358eadde2947a20e67dc4f000000000e8000000002000020000000e6af95b3b227fa158433078f8bb1a99ebb96bdd4edaf67ffac52a1528fa53a1d20000000289e7cd4e900feb1184eeda53dd292e96cc9dbe7c446a9ecd33201fd60527f9c40000000937b183b78d607233599126387ab3e7807d525c1477323f7573be99f4431a75b9e792569e05537ba06d3f3a4246cf8052e273ddb3ae3f3c4590be4b250f0f25a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8019599c3ca8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422099965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C76C3A81-142F-11EF-AB01-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28
PID 2056 wrote to memory of 2648	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f593ff7fcc7e8447567468292144c26_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df325a157b5daf2904a758e93797757c

SHA1
2bf70bf859f32edb2056144375014bf5d6cb245a

SHA256
bd9c74a902a9c1aaf8e3aba6ada57ad7efdaa5f5f320eaa93a5e05760f21f423

SHA512
23330a5e33d138470f319add5f2bd37a5990c822282541492cd40ddaabd6fb7a44f607e3c0ed3de8e752590098cc734ecc000006504af90a4d2eb56fa4e16368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3039d27319ae387d20712cb0b0d7b02

SHA1
635e7797a2547380391f9a0886833beb42138a0a

SHA256
c70349bb9f62238674377a300fb2012f27175dfee5251ddc908b5faf04c8a798

SHA512
ad483da19a9882b8d22f7860ce938557e1da09ca1f493aab7237e1b9f34ce0219c67a418bab8f094a1618b5dc3327306dca87ec73775a3f19aa31ec89f6d1850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fcb4181e229142fd9a3b382d229af16

SHA1
36378dc5d23d91170db60d8b9b0f0e0b1f192ae5

SHA256
3ab5534f19b820c59395adcf6844fbe3da5579f1f378a95d358f986408fa6d3b

SHA512
043cca86c16cfcecee17e05db1113f05e6eac9ccb5dd91cb57516603683e11fd7d798aefae5221ec9f59f3326b6b4a31d619750e6210352b9f74047250850b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a59014c56d267b4317547786360f76a4

SHA1
09ed34d805aca5db0b9dfb9eeaae3fcf9374458b

SHA256
d23bd579ba45e09807df93605205843ac614e7277ef42aa0c84cbfca8dbd92a5

SHA512
e87bc9e0500c4a4b5567fe39a5740c954206137435e599c22a3b3a187ed5e610ec6fe66d50cd49ea603778c9d4beb81bfb55fb6f11b18c2521a4ddaccfa5345d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ed795ee1a8f2b6117a953ad3cea4a57

SHA1
af5a68f9192adf228d77e36693e56f763f43d1e2

SHA256
5bd10eed6808d9c9a46f3ccd62c64417aac4223b8bf5526cc691637b33140572

SHA512
720c2291bcef41dfdaaec968929c633a59d38ba6fa737cc40e3cccc56e3116cf8034b0e04358e5073f65ad467c5b776f7d8baaf5797e8342bd90101ddf7f6824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43cdffa76d3355ee0f8d8e9d9c5e10f6

SHA1
a2b15e5cd16a607d7e15cef3797c5b9af5cd153d

SHA256
afbce0cb4908b477052fe47672a48449934a5488ecfbf2728ced88dd60351ecc

SHA512
ac791a6c0a0838684886c56bd5e8101c56320d4dcb455d16bc49530c66dc0745ce08029d1cb91d9e231bfd4ae5ad0b723a632f74632883cd1dd29ad14040ecfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c78ce3a1f026e72b01e2e941269540e1

SHA1
5e8c6ea804aa6b86aeb781f6f5140cd2a28648b1

SHA256
3a2213aaa482874855a1ba6aa2081cf2e0f8d9d5e9304744df719d67eac0e44c

SHA512
950816cbc60d7f8c15f3a3105297ff1b44cb0be781835f36ef67c90bb3f8eb8108576ae30e93870d4dbb9d4e71fddadddd36fb5977120c3e6b203a64260780b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7d727b354b1c09163082bc6bc0d6cb4

SHA1
a3d542eb97b2d590a1ea16752c04522fd46f4cb5

SHA256
13e95712f368edbb450680f50ab058ff17599eeabeacfd68bf7555182845c4fa

SHA512
2495229c0c53abaf6a621bfbafebb0a5af804d247e5cd86613eba64014af6effedb9c22ece18327bdbd7991a787154c6ee052979dd769590aef92ce8af03c86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d74f8fe9fe6a2c1b3a59f95e876923

SHA1
26fdf5679419e33da6712406e7f328201832a923

SHA256
1935563941c59422971841a59a85ff04b09f6949bf1efc6fd34b434978939a39

SHA512
dfa64fdde4e4d246ff002bc791443d3e31c393fb5a32d37ac23e0e5ab2f64502a29e265dbaaf7aeb48c0792363f384f1d1a3cf9123fe5eb1f2afa0d3fa58727b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e29da26bdddf7cb2476e30847badb3a

SHA1
a769c7d0022064c3ef47e6cef170d0f705207b5d

SHA256
2b21decfaf052e94abf4d16ca86a7a9caf5ae8715c01410076810fdcab3d46f3

SHA512
f2e19943f6f67c31d3daf0383a930558c295306aa38530c8a6332866bf580d6a337e85a0e8bfa550291f944e5b7e6c74fc2f31f58e5c0feab521c538c1e1cf90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee4ae307c41ea121603006c6ceb6f9d

SHA1
786881db39096207d659263f05856dd579e97aef

SHA256
ec28ca92fa754cdef977f507313dfd847f1fa3b7b62a06c589dd9d5279d030a0

SHA512
a535b8a75f84b0f62fe8d4172b91b5571316283d32a591e2a0aae3b559adecee9da05d6d8df4dcadb8b31529758bec69df44f1a77832fbf69633dc469795e260

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B04.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit