327094687735dcffadd1151ebb84c1d31c9ee3afab53f1f5638890bd4e3a7c98

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52df2c66d9fa922b810761940bd8ef7d_JaffaCakes118.html
Size

24KB
MD5

52df2c66d9fa922b810761940bd8ef7d
SHA1

12347be74e42438691b21061c426f4e5765a7cb2
SHA256

327094687735dcffadd1151ebb84c1d31c9ee3afab53f1f5638890bd4e3a7c98
SHA512

7e29a5c5477b60450e78e2a894a4a2a3e02dd274fc46c0b396693e9f66865377323b3c23f36509adc19534f7c113074610185ca671b26177a8c09a13581c27cd
SSDEEP

384:sjR8AlpG9iTGGjXLcNQvGB8+tIM3FXZp4npB8MN:sjx/Thj7cMGB8+t34gY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000add587543588b04e9d6693d447d9478a00000000020000000000106600000001000020000000d4f5b8dc4e817bbb8aa01ecb3213f1a7620d4a84474f4ce21cf58e1461f64afa000000000e80000000020000200000009a293113ada551b534ba68fee7b6d8e14850dcb9a87b3ebcc6287115e28ea50220000000653c2a75b65a483e29231a561d32f09a76e1370bed9c72bff1c9e87b4610925340000000d50f5604aa80ee6022cd2405cb3eae78d8d78af741106e0d11db67b0438264da7e57637f905bc2a6255550f4b3b1938b345b883b0fbbc59f5b4821967cdaca1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000add587543588b04e9d6693d447d9478a000000000200000000001066000000010000200000007d097b4828671ea7e6c2bcb3db4d0e033c56106e6888e01e9956c041f1d0a2e9000000000e800000000200002000000082fcd620405ca00612c0dc1d1f1b8451488f9488cf69cf5780efef892f8a0b189000000036b0bdda08a0f45a92155795f2bcd9691b2093f4412d45a126aebe5a4ca49416300d93d22638937c04eb20f22b7a50f0dc43fdc7435708e77a2e14e2cbca08d7d9f19e83226a87afa603d5bf32d706d638f336b1417050012c83a286ba1ecc009fa2f0d7a326982f427afb4a2fb08d19889ae806beaff0733a1ee3c88f24633173398363b719e84e95d4c92aad79183d400000000a6730f60bc51def0e995749a3b00b38922dae5426b92f809950ca6c895373dfac68e93eee2c9465c4ed0d7f0f9f0e17148b1ffdfb95aedcb72dbe7347c14626	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0febc11d5a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28D8FA91-14C8-11EF-B20D-42D1C15895C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422165407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2220 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2220 iexplore.exe
2220 iexplore.exe
2488 IEXPLORE.EXE
2488 IEXPLORE.EXE
2488 IEXPLORE.EXE
2488 IEXPLORE.EXE

pid	process
2220	iexplore.exe

pid	process
2220	iexplore.exe
2220	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2220 wrote to memory of 2488	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2488	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2488	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2488	2220	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\52df2c66d9fa922b810761940bd8ef7d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
186dba49f107e8c2e2eefaf92cec7b9e

SHA1
4d53da8d0ac3eccbed6eb7fd886b0c2793138f39

SHA256
0bc830daef140d102aa2fe51e5c49b5696a233629e233e4d9d111d9bf4b24d63

SHA512
b69b598a73dac30862a0e4d45df9b2ca88a01f09760394df3d907e7ef86f20a09ae52dba81ee140da0a8613d0cacbc763c2ef857ee5c61b22e26a5be46f04259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f24b0d8c0a160dd98fd831952372c6a8

SHA1
e0f9eb79bb35d74745aebd023826670979c0a0bf

SHA256
a68f7ac8d739519f11b1b4d49d0cf658ae8f29b49e302c6b562d008a21e93e85

SHA512
0814edbb78a11401d6408fe1a4cc126cb10b5bcb1b50d0c1e108215d5becdb87fc6b7d4d01466b4565e0bfdc20dd3c6f738c8cc41957833ae66a220590df20ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
596ac5e523dc7f9b421ebe2bef879d2a

SHA1
3d6320e83cc470702bf4712445f9b7f3f83d456e

SHA256
03af6ba6fcf8f0d0d31a219342c545f606006576a03b282a1a422fefc1868a2f

SHA512
c214ba3e7a2796754847dbe78524cd4d2ba937864fe15d389a5617da3c4b751d21749678f5b495a8fee447aadbc36d74fed8e2b639802bf1d31b7a54de373b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
44cb35ebad46b20cffbb517db16bc784

SHA1
67c4c81736ad4d3fcdc6e49d6a4f455f1c729733

SHA256
f38cf8a82892a8a667aa9e0acaa42629ca9da6d0340daaa1259fc625d3471cf6

SHA512
ae0eab7cca5e4f6bf1ba403d973134a5b0372cb1ac0108aa9a20cc8bcadf076484f127e06e64aea88ceee3a687e1dc52d75f7d197bcf07ef0347f2a2bfe8a8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
628b10974170d3b74037b8143b68c7a5

SHA1
27258c00932137b4d43e0dc63171df7d60489d98

SHA256
9c2f749b2fc82f5280d2f35307d9b7db4bc57ef277e9aaa9c0a30e181d177cdb

SHA512
c9085908e319a6eb93bf6a61ff6aa2bfc20ca33a48313c49a38dbcb3b76df38003be309396c891b9982d3e450d95d50895f354f84e5aa15d826709cc847e4898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
864c3244be3a563bacaaee3fbfe8bbd1

SHA1
290568c9bac434eb2fefb3a08a72f1bafe2f6a32

SHA256
454454031851a24b8dcecd8cacde7cae1f3c9caa11c4474268e3218597425a3a

SHA512
74a21cddfdfb3a1c21672eb61be3bc33b27be728f2c85330148f6ded0c5ac939a43858691459f94354e7d19607c8af0afe1aa0c961f6d5e394b855fd4ab69a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
47fa573b69699c71c3cd33e4c19fe523

SHA1
eb9a5cb7d3f30245115c2939d280641f2b67c24d

SHA256
b9754f1c485ce2375afe62ee458d23291a419ad57c11c6d967bfc06bc02de504

SHA512
25ce27ccda2c6c6df20743ae62aac6ed260dbcb1333afb8c37bf2b14635a584adf3a9133b3618c069688ae8fefdb3730dd5991c14708215ceee642232d4728c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
58c09886b9018fb7d43af8bae7daa8da

SHA1
47af55fad409940b6ff8c7964fe638493ce25f9d

SHA256
fa38661c3ccb4ed96a8502eeb1f2da7b575c2a4b6f8833294b43817ae3113383

SHA512
1860d94f31ae26756ad38ee32294c37e0a1dc86bcb8ff01216c5d68f4795d2ec424631adb4edf2dcaf044a632c15a94f9e9fc120eadb1a235bdd98fef2d77ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1c0684f29a2e1ba95584b4544b86b51b

SHA1
2b41871541b00cc118dbdc52a347a94632051c63

SHA256
21245f08296232a82702c8bf2e72ff7d87ab79291886c3320fb40266d8cc9c06

SHA512
33e3430be4a3565f646c177c6e3514c59627d74837c352896e20cf696f8e460f48ab08171e0a8a967c9ddef2273b6b01932a9dc5b7e8fca6889f253545c1c53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e39e71ee9d0c1de35fc996d8ac0e7043

SHA1
20aa929848a1a0e37d5b5ba7393d7f0e638eb7a8

SHA256
7ab3e5eb3a37f880ae1d76ab78952a9edbfe4799b55ec3b41c705f76a57b541c

SHA512
52593ed538bed7aef50d868d7c09d8839d8184e21b510e0e34ce68e86bda50f2c528fdf48f14ac871fb880650e39e7f3210da0e7bcef40d3d721bce57842f373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f2064fcdfcf6dc7efc1281a3063299c5

SHA1
c8f87b3aadac965564dc2889942d298199a4e91e

SHA256
421074e97c7ad697af03bb798a922fe68b656d7f61f767ab8594071974f3cf83

SHA512
3a53f2bb634b9f0a7adb81311e4e0f3e6dedd9fb9952e5993cf35229cb81b04d3079e0d1095a9fb1774d38436606883bd7c541228471ab5adf46032857af361f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6EB.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7C9.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA7DD.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit