0b54803d922790f07f9c558009bcf411ffb424b808f91a02a33f824f4ec36828

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

502c47d1252e9bb940267da101842010_JaffaCakes118.html
Size

240KB
MD5

502c47d1252e9bb940267da101842010
SHA1

fd5ba3bb8c01f976c5de41afe46a78515889f6d5
SHA256

0b54803d922790f07f9c558009bcf411ffb424b808f91a02a33f824f4ec36828
SHA512

ab2316285f6362877fee20922d6b4e7e55a3eccf9d1bb3f755c45379caa2a1595104f9b92b29d45bf5f6157016661985a321c0382280c81b8df861ed1156b79f
SSDEEP

3072:SlvyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SQsMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008beff21299e343d8f1ce18395bbe26915578fd2aa8d8a95a1bfdc97e40fc09ba000000000e8000000002000020000000f11377875b34a7cc62ebce316744d8c1cc0346f00b47b85b0c7bd0c308ff859220000000392a5fe80c3663f3953714a7b3dae0a3bba53e3e8187a3a27ccd0a54507295c240000000f41897b94c533fa5ff89bd4dd78dc073f2fefda1748aa8fa5e8d6e57b4071d3b663026d67e75f069c05fb2f52c993d2782af4860b0fc824097b447a6ea040fa4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c15290e3c3cbdd148c8901876314409576bc6984431acd1d84a071d04b250724000000000e8000000002000020000000261234cab8215e93a38ade8eaaca183169b47a9b098ed8bd514d6fbc5b9ed55890000000758183136e2255963e6dc6c791a7b8cf093c4dfdb0be08628befa54255f9b13eb464abf85f4562e56499199c98419b9e46685b6d05fdd80b9eeb8c9812ae34765f76f2b7b7c0c26a26607c9e0ec08d06142c43a0d68a85f143648776a877f189ff51061efce8c8b4e28bee44050ef8a95f713cc59c839e2b9f465a5dc8f6bf49d122670dab5517c896fabd527982ce75400000002b689e8ec050af8d745d19cd27a0e025c303cb6a1097b42e2966911e936c4c4b54aca5fa588e9b2fa4bb7170625286a3f2c39c0c8c95e531e36141a258bb0773	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422121101"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e121d56da8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{006DE501-1461-11EF-A7A3-7A58A1FDD547} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2412	1276	iexplore.exe	28
PID 1276 wrote to memory of 2412	1276	iexplore.exe	28
PID 1276 wrote to memory of 2412	1276	iexplore.exe	28
PID 1276 wrote to memory of 2412	1276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\502c47d1252e9bb940267da101842010_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9de3f7ff5201c7cd6e827aaeeb7096ce

SHA1
2f1e09bcfcf9c0a3d160c99c655d83b1700baed5

SHA256
c18117e5b75b8284231d0523b69ad134593926df424f76594e42b757c250ee48

SHA512
055edadaf89fa3a4a550c0f7d9e1464988a435bf6c9e3a1248f339bb918314a51574fcb42be0d8f0903e04c185ae0f819018679c895b689e63e34706a07c2cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a8ac3b64a2a417e432d6475774b8d88

SHA1
aab6b6bb02ca19e0fc34f5d5caf4825103f5eda0

SHA256
7d2e8d6c7ece3d64fb50c1dbee62b692d07151eadebf3a16d17a1b1e03d88060

SHA512
1a901d3940678fc7b5968ade621699a7b47da85761c9fa3ad11ad70cbcc4c70d414c6953365415508c34cd22afe7e37a7c487f79499bd3ae90de7c868fe480c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd4498bcc2da30fc4551162fd7e19f1c

SHA1
0ebb2215b5c4a5b91d14b72c3fc3fe6ae0b096a9

SHA256
d6d86698cad706d33ca128334c52e6d0c24a23557b5cb186192bd3e43c10e3b5

SHA512
5de99ba01163ba4f924aa481771e391ae9e69464916b7b1a77e3d34b86bbe23228b9bb0ae3a36a4c99c28630012811a92518233048bde2c9288281d6f881d8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
247d58bb6e9da7cead347a3bb78bc94e

SHA1
8d628afb88a25295b267a29cb1e10e5e6faf4283

SHA256
1e8ceb084cd3c3380183e161e1521d9379e5010e3b037c7ea462158a25d41cdc

SHA512
8d8d552d85fb7e2c7286848631fb15f6bacdaf9c787600bf5cf641dcb77ad8e1959a0196004916966a0d0e3d6acb52b59990e5f6ca3efd0e3179d44e828bf8d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7587b30087581a25e18cde6438f922e4

SHA1
f08ab9e5aec5e11ba2e1890a6b467576fa7dfc07

SHA256
3cb01fb847104254adfd9798312517e7ea2d1d3a620aee4a16c39102f18d5d5c

SHA512
ce1463da9affad602660b4d8b30b11f589e104d6f9306d1fa86dc6e0ba734f994db0f5fcf5045eab08cf3e157e8c3d49964086e86c29d0d1fbd455f1a78f15a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba941b9f54c0e23f9427f49c5b62f55b

SHA1
542720842e39c0863c42a23898af66efbec96e3a

SHA256
3862cc175ecec2e96bbef496e1614f5486b84fe3ffd15a351e5287ce04a708a6

SHA512
5537c161826c0b935e88175c9beefb8460bdf72ee2d1864cf842693d50a950c50fe399fd9493bfb4a40427b08dea82cbc317bb462f6b1439ad6e9c9fcc564c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc8a398ad0492b32eff6971954f4a13a

SHA1
e907dda8dd7bb9b993a50a59fd9f5891afeefa0a

SHA256
ef80b49af8988ea47c3121dcc59f6de4935f4358c849333535bcd903e84acb4a

SHA512
fa94be81eb12621e946226d79fad640e6ee47caaf4a8fe15be7e625153b1cfe57f017c5a4b7f11d0e4c71c852780e629267a69c7e4e4b19f9f9e24fa0b42d98e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a3c21d2d0372e05146b5c34b0c1070

SHA1
dc5186b4d049b04f70b11bc0be2d32edb5caa2ae

SHA256
b99b65c2b8cc4f138e05864f13af176af7cd23ebacdf3fbc7650a46e0503a270

SHA512
3fcce875bb8c95566fc6ccbf7baeb85faecfe330d4c66d2ceb85b148371ee0d04f0f658a28e91cfcd25c06cd0928fe2f30484b967d1bb7b48a1cad722c0ad114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fe6fb4038de69f3ca960889bd7976d4

SHA1
a296e492e0145f489c834ca5f76f7d6807c2b2ca

SHA256
ed88a4143fe8761045fecb3d58be078a2a68aa2f5ed61cb09ec104d552d06471

SHA512
4dbad0349e12c395788c0640a013f74a75e70d7a90bd3c7cb960a593bd3d88868352ff45817f5e4729bed8e7d0870ec484c11a6b503e23452e06bc8b412fc576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bdd9eff6ec9912df0fa30408bbc59ed

SHA1
6b8a1df967edc327a5f7046e993776e14212963b

SHA256
2ac32a94be4728e4dfaf426e26a1738db74c6bafe16d33d8f6add3eff8449869

SHA512
1ccce907d059b25dce82e903b3508deee6fdd1c5521c997b2c2a9c947981cf96e0881d4b7bfa8e5404447dd3b4c4cecfcebef7557fbc664f5693962e21dae007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fe7a68b7885e517e9adc83fe52d0e62

SHA1
f3d4a4258fd62095daa7ba3c2def5db1967a068c

SHA256
5c68d3d292fdc3d2afae49d43cc038f6b2f61855b1715212398a7c789217ea93

SHA512
325f1e09e4d55eb0534bb3901067e13d330b0bc5ca8d92f9cc57938938e54fa3f2af8535ba7e749650386907a394b875aa7b0ddad638eb342dbfda20eb2d9aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08c3b1407242cac6d5d569bc4a6926f2

SHA1
7ec92ccfbc0e5280893a4b297431ce3df122a940

SHA256
3f45fa23bf66b17ad812a973f3e215c3fe7b17693a0c8d36573efa7eba5cdf97

SHA512
dcd052661e4f98a0a4ae141261de4bb5ffbb78b39c3213e3973c0946e4361eb9f51161d5e93bee5780e0afc7cf790f2d967d73e1cb3158c12538f5febf1145d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22c85e724af16c4af82885d9e95f7524

SHA1
2abafe4f6593a116554d250517501b8275d5b688

SHA256
484d37bf41d225c4a9b63ebceefc0aa940ca20714d4941921211e0eb96fac17d

SHA512
36bc51424362bcbd90be64895816a4fac458b3ff54d434081678e43fc71fc61219a84c343531d23f3b9cb2398886157d0bc161f1c8d00e7c518b9c04de26dbf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A7B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B2C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit