94f671e06ff6fad04fa7aa8f7a3dd6efe921d7d56bc01c98d9c92b31d78cfea0

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e13be9c4b93ac5b16f88a59ceea7053_JaffaCakes118.html
Size

461KB
MD5

5e13be9c4b93ac5b16f88a59ceea7053
SHA1

f6f916d221fa052e6b25e939b1786e81bb1d495a
SHA256

94f671e06ff6fad04fa7aa8f7a3dd6efe921d7d56bc01c98d9c92b31d78cfea0
SHA512

7c74e6761afc6282fbd3e62f9035b0a697bbf2a8d7bc42c9a57247f5013262d1d65348393072b8af2598811425949a95d72c41fc001aa6223668128bf46b8315
SSDEEP

6144:SgsMYod+X3oI+YzLjsMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3BL35d+X3M5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000223f0d9c3c72bb4d245e9ef02d1756b146015f79ff81972511826410e3548909000000000e80000000020000200000001b2872a9bb6cf93b079b150c1566059f6e74b9f98d801e914f950b9401e5d347200000002802a7732798b70bb8bf59c0ec5c0c2e0288063801cc9f59c6c988d19a3c415e40000000a9bbe48b4196ac1fc7f202ac50ea97773d916254883e808edb815b8e2500d002c753e767d4b676509f3ea21d0dc4ac5d41fe08cbd0f511dd09f67279d5f5f3d0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60714fdd8eaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04C566A1-1682-11EF-93CC-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422355183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000066308641e2073eb7560739851cca868cc16239fe8b982c324ece570a981da66c000000000e8000000002000020000000e2264c98956a98ea4c2b7e1cb0cdd5423d5e5e7334cf7d275df646a1f0cf22cd90000000629e31ec5b97ecb25729b46e2035b53a594a3f62945ac147debdc50009b6482f757e943cde8051822db822125ba415c3317f04be4ec9c889919860d2a058a2b1b315c71425ee6240781ff4c4646adc418c8fd2c93a2855498d345840d5f7476da7aa972daa6f63742eb636ce21e475d3be306f9fa187dcf8928129c61d0791c0375a030678715fa44a79b0f1ecf8ff1a400000000b3bb975e4beb8c9086766ccfa500db625e6c5d62c5bed3a486da62946795ecfab0c96b6bbacc4d4864f1b3ef3eff9da5ca928f1055ec6f6901c2cc7f289c730	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1516	2088	iexplore.exe	28
PID 2088 wrote to memory of 1516	2088	iexplore.exe	28
PID 2088 wrote to memory of 1516	2088	iexplore.exe	28
PID 2088 wrote to memory of 1516	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e13be9c4b93ac5b16f88a59ceea7053_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33930b0c432c332ac6834d54d8faa79c

SHA1
187416abfe9424fea2e950c3f2b021dccd14a220

SHA256
044485a1e86de81dc3555caa83fd031be02702e1429d288b4705800ec70866ea

SHA512
4a83fa87261e8ab88f85341e262765afdf93d69d897ce46e7452077df05f49e43de9a4c3373a2b8a16bc395793f9c44a0b3baddeffc27de9948c4f4df5007b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a97f539f84a28d586c961232e2096ad

SHA1
80b05f1bf4d646ae6aeffd3caf1e4de89dc00ad4

SHA256
fc875bca3081373b0b495d867ddbfc85a9dc2aee93b520bbf77e96f145159cab

SHA512
e7208ed562a2b839a083aa018eba6e4a2960ac81fe6054b48b378c1d29299c919f63dda3f508024a214ee1330fb7b292be8d3dd11aaecf61d08f865d71afeb6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1a4965503cb65cafc4bb9c5ab7256c

SHA1
3a35de2e2289006724eb4959430c0d9652c5c133

SHA256
9cd4269332ba0ec7fe441084841f17b68a5428b0df32985d003db37e62b4130a

SHA512
6dc95844760fed35b4f51699d65e40804261c2a19a96e5353a04f8dfbfff55873a9ac90ae37a1dcd397448f6f741879448a709c6d0ed97486d0c38539a489b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15759997b3f99c883e28dd21c23df8c5

SHA1
b4c7f7747f3a1d48c61e2d950f7138aa5797c1d3

SHA256
f249712b8596bd50a7687a8dc7e3f7e4a5bf917ded4253e4f734bec0ea65682d

SHA512
a978e9345904c4f502a6374259db7bf4e2f212cf500f250f79b23150183c4f19004e8ae3c15b54a6f281cd8ca5fd03e1dd35a0fcef18ad15dd5c4160949c8a64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
412c1bd09de0d3496b2146571d4a11ca

SHA1
dde6ebd1b1b88d9abfc25b6f331d3074abff5515

SHA256
b1f574d7afca7e6da8b04e99d57862b8a623ffe417980f1a6f00e690008e2b0d

SHA512
87851630e2f35c93266145ab1979c0fb50799a3f1c0553059f90119ebd3925e2e80237793e5dc18e52bd115b1e1e3c8788f64908fcefa0d52159fa436771f0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b68d3c54070dc8c39f80e6a662a63171

SHA1
a8f2348bfb08c550aefff38327fb5d0ed7cd9245

SHA256
7282c42c2df3f85b5fc8c62d203689a63284cad1c9a7a83bd3711049172dfd49

SHA512
0656d253835a25b55c514350d0e84e583040aeb16e3b177ea90785958877f94a9e807b97108a2bcc9eeb25be7a5b07a71a8999333f31474a702eb1f8740e2342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a2a7d0cb90aca8ba4c713bfcc739f9b

SHA1
dc53fa590733f89f9a121d48590d373b888a7cea

SHA256
5410f49cce9b3cd2750ee09b91fa64cebd5077cc543f9b8ca29733a1579e2924

SHA512
a9f0159c99c41c39ac729af185e71a050f4875c7478fff59a14d8e38107eeb808220b68930b283eb6a364fc20796a455004832e2e3ade24dbef100eb98d1484a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b90ffa4a0e8b6b1e63791c6cf5e3d2d4

SHA1
10d104bef7139a13f8f2a83b5791944112b1f05d

SHA256
6fd8495d2a2b0cfbc6193c3dba9f7c3249d773f2a68b5a0ca95eed806aa804fc

SHA512
28047b0d4c6351daba8e6be144b0f4d8ddab093576b1e4e6f03139d7e1e82644f914bbb8aca1f660f8779e0740a7b5e0950d3423023efe1e87b2c9985fd89a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ad6ed40b8848122f91544193ab794d1

SHA1
38c0875ee040e22c888c60ca49a1b5aa7d580f36

SHA256
b3d7c7717add98491fd4e43818c3bd391c125381ce23689f16a26b6d10a2f09c

SHA512
0b9a6b46a34b239efa3e8f00111b9970d78541e9042adb17d5473a3c175ace3c942fa0e53a9f53f93a750e879a19706f57ea4f65adce768bcad18a104851946c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8857e21170b3d40243ce42b49d0632ef

SHA1
1a8ee53f221e58a0070ef30c4649a1208110e1c0

SHA256
80ff72eba606e9643f5ba04213816b122901d66309eb3c8c7c9099255209654a

SHA512
95db4bef11785980928af44a3b768ffbd943322e2bb779496167eff1597ef793beaa0e80d396c8f769ba605246894b86682eae0835914acf9f972e5764f75107

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A6B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B9B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit