9b54d0e09f07c10654aac775a26fb07ac872954a73ee28f683549f4c2023b893

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d71d54eeb32ba1f65a925108f787970_JaffaCakes118.html
Size

27KB
MD5

5d71d54eeb32ba1f65a925108f787970
SHA1

a6d60da37686d01cce5172e2bb2f45e1c2db122b
SHA256

9b54d0e09f07c10654aac775a26fb07ac872954a73ee28f683549f4c2023b893
SHA512

1f47c87bb6e60fe42060db1e37f955dad6fa80ab5d0100f0ca94a2da30e7b2d8fdb42931bfd37c478f73f1fd76b906940fc6ccf6d6f1584013aac835a3d8d1a3
SSDEEP

384:CSBkhvXIxTNzxUSWtgMSfuZJm9qV50suZpmBa1o:CSBgXIxTNzx37ffuZJm9s50suZpm81o

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000923d2d9ab7b1ea7c474f67b272404c5f615f14199a11db86c9873c34fa49b9ee000000000e80000000020000200000009c7b8b97fc41401e6f2ebb080bb2010420b269c7ca77a13ac0e65520c07020cb900000004076013d234a6a1990613ec78aff62c60286711c12b7813158a710af48351e376b060f4426a1a45a802958de9c1c07c6a85d712927773a3e6652cd7435431b277fc6ae8a8ff5b4e361d61f320685ef27d2201b5a7b33ba90018cf5510659a33f2fa0e71126849bbaddcd4bcc82fa0711f63fa4e6240d18020989bcacc01af0824e00120298a23a8699cf3ecdba2f74164000000022f8c5ae3554865190c346a7fe246e7e6bf5ed702c750d0b269763abf9dda75f47738994b87ee676706b302d5958a34f51d008c4d157c422960937861788f924	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422345400"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000005335c34e98a1575bc9195128c35b6326acd11aeac2047ba196c7f11372ddbf31000000000e8000000002000020000000e68050b52733039c6e9cbbb9f10b541fb1a8065259e744003655a0e9857e67c920000000dc7aad1e0a8c5672fe0045e3949a88aa50c5ee2fbcf53c9ba3966bdf854359304000000069fcfc07f0f02d1db18af1c6fa28dae849bd877fb7177e08fd79313044e2cd88cda7f4317e5cc9a3627f2f6a43f0a7eda1b917ac38cde25ac3d47703dd32a44e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e6391378aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DA49A21-166B-11EF-92D3-66DD11CD6629} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2916	1976	iexplore.exe	28
PID 1976 wrote to memory of 2916	1976	iexplore.exe	28
PID 1976 wrote to memory of 2916	1976	iexplore.exe	28
PID 1976 wrote to memory of 2916	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d71d54eeb32ba1f65a925108f787970_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a987f69584ec9a79d88e17bd440a87e7

SHA1
89327828e2cc451ef39354e51a16bec8475083d7

SHA256
7732ba976f39bc4b27c8f434c6bdfbd3ea07ad245b009cf5640cdc0b25772e70

SHA512
d59b9ba2deb0cb2a6371bf7fc6751eb35f921834ec2c8f07aca7403e7b5e73748a642e0c4784452f9370292ccda7bd63b9dc61878e6837de4b84f6a0f994b964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e90e3715cc9b11dca076787f9fe07225

SHA1
19eeb757724e0972ee88b24f990e6a255c164b1a

SHA256
6c8ade4162911ce57ac5d7c9201b83f4169e42d2da99101b49d78c9431f77287

SHA512
129afa9fc1aaecda45c0b2cc7a1573ee20d1cea29689501d2dea66bcdcc8f879af38d3f3a6828dc0aeb4eba8ec02ab0160a38d238d5f0068736a71a28df6d37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a942c2be02d6bc8e7a8ec28344095105

SHA1
94526cebd4b06b77de0e2c495881adbaebf66224

SHA256
2ac59734b329e8b1be1fddb6a7c237ea2533d694cbef689b2404550a03009bcd

SHA512
775cf9646e20466f500fc03987d65b13622b1fd8ad0573efaf48758844bc3ebb74f3bc44aa0eb70c2523f0b1557d9338591df876a6a31345166733c38b3d02df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dde7d43b96c40231699390e4a325c14

SHA1
3f63c5239e754a7df1f29363b748e03c09df59f5

SHA256
997e8f00453c8b7095335255270be0d9187492ce0ca023c4789129fe76a37aea

SHA512
7eb665946f2fc07a4182b1167c94aea26736cd9cf3c2392a433b2951769241b227aaf68a0e0ced5a335a574d109ef520e8b7cc7ed704af4d5cc6b1de1dc1c7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f9b61e7306a7df4c17a81efe0c5c834

SHA1
e640c8298ef1c5896f551f7cc6596991eef3a891

SHA256
899f91e29c18815496631379b02fe0ce569718b84e73537f38bb3f717e3fd28f

SHA512
2c5cf05b0938d896f9e767b860c173d88f4f6a8e48d4edcf507250b329ec3da8ab4d74fa9eff1658e026294fae67872608882467eaacd065dc1946bf400cb5b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d894bec084122afb8e58d00b1529c7b

SHA1
0ed4e9b5a4a9b334eaf498db14011c137dd77b19

SHA256
d5320c266a67a3158463f2944a578a9ea2fc3478aa7240237583d6a16059883a

SHA512
6bbc804c8012f645bd7f09d199ec88ec3c3bc4c84825708219b712bb837629596e2f99acd535ff7bfbbaaee6c89ddaac7a49a2da9c26e1f5c2b2b46e2a91bbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4993753f9c256c2ca2ea06098a88c20

SHA1
28c4be795a004093d459a74217d95deecd6900e4

SHA256
8ad33d9b58a9f0ec9f545224773d2c7c89846af4ca34088239ce4929fd125637

SHA512
bb1b83debcb707ab9ebceac2b29222ad5f8951c2271ab1f89831d7e1ecca41f83f5a2d8339dbb2d8274522fbc4d969c2e9a2aaa5847b74fb5d32813b047bab41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ff8b435851a49580a12bcefe6f30d49

SHA1
ec5d421ef85c24aafab6fc7cad283943b1900bd4

SHA256
6c6a45f544c7f237e2c36ce1e2c3da7543d723f015e118cfd40ed135cc850383

SHA512
90db226d43a19995253f6e5fb65006fb2d52946144232ec8072ee2431eef0b7a4c10f68169276e7b2600832850f71fee3cdd96658ebdb2fdac8639efbd981460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1336bb549005636e20c304f49857005c

SHA1
52cc1ae3f55021ce86c18b8b434d6e8541fa3f7b

SHA256
ff7cdbe2e0664be941a1770f6db0a8e9e207c943d22a33489400c542ef4d2613

SHA512
c27a2007312bd8c84e22cd6d24d025a30a7b18fcf5678d2f768d08bbc3c1c42becfe84c928779f4860b6f1d0f6ea8108780443ed955905dbeaf4c315a508d994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44beebf5b4fbebf635739c2e9514f2c6

SHA1
e959cc4dc30dc6530d34ae18e4f2592eb3e86b54

SHA256
4298f77573412dad7cf56eef1da8ee6774d657f3135db9428d86bdac5f6661f6

SHA512
36c55ede70d4f1c9c0a2a486a3fbc72029500eecae087a538390afc057771e075917035ae12ffa6cf33d50a48bd83cd665c52d965d9fad9e6bd1395b9c25d0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab404C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar416E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit