139abdd26fa4888b03ebefe5e73bfaacdac282f159b7c566cfc3b2e61879c8f7

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

628f66df970d4bf4655773b871ee238e_JaffaCakes118.html
Size

27KB
MD5

628f66df970d4bf4655773b871ee238e
SHA1

3c3823c6d12e9ad4cf198ca34945b8f4c558f683
SHA256

139abdd26fa4888b03ebefe5e73bfaacdac282f159b7c566cfc3b2e61879c8f7
SHA512

5738722e9856c0217f4ba1df435d2beff98c86809747d0992b6d5b57d56793b8eebc450ea4803ff96887cb6e4a2a1055d2fb9b1918d3279d615f6dfb2f2ff9d1
SSDEEP

192:uwrIb5nhenQjxn5Q/MnQieXNnBnQOkEntQCnQTbnxnQ9eHvpFm60X5fQl7MB3qnY:gQ/9m5o5eShKS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDB92F61-174C-11EF-A6AA-4E798A8644E3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b26ed259abda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422442361"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005ab1e3b1b405046b30d65343021e59b000000000200000000001066000000010000200000009991298257b5243c4c6270d40e970d482364a0020594075567c590db8b6e19e8000000000e8000000002000020000000dd7850c37362de140390d781e92d6ca133aeee615da36de8bfecd6f4211b1123200000001188730c97327858ef5f1dbcfb8f2c4ac96ab02138b58f794be9efd38d38b123400000009a5434e0ea80a5e2ba2916c5165abd14b87f017f7d9826e5b3e331c755d78625561dd6d5f76c9f064a3f96cd7c0fe91aa4d1d45b8fe55fe35398b4452cf242ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000005ab1e3b1b405046b30d65343021e59b0000000002000000000010660000000100002000000043d157ce1673f905a976467f9979e8b2ccc5f4942be786f0595ad9d39778ea88000000000e8000000002000020000000c45e6a8ae9a3d295686680b2461fed8999920f411db758865089790542e6977b900000007731efa094cf42b3f3aa2588dffb5ae811c3c486a38e7e16e1ef7e6f6bb2907e2ba2641c39421cdfb568eaf7de132f0753933bebd8239f283b31ecb7e41c484185faa6226246490f9b19fbe95127db300f6a04b6fcb5f16442724b7461a2c278909cd4c784381c8509f384223130ba22077b974567593468802bc89f7eb63d377f48c41d6daca60bc15493912acbf76e40000000e88c188eb81b21804eaa44a21ae473a7d6fa4abd7828263a46b650e0248c4175245a59df2b40eb6f25e1ad1bd2147a294f031ee3104aed0ccdf67fc96e1da8d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2680	2208	iexplore.exe	28
PID 2208 wrote to memory of 2680	2208	iexplore.exe	28
PID 2208 wrote to memory of 2680	2208	iexplore.exe	28
PID 2208 wrote to memory of 2680	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\628f66df970d4bf4655773b871ee238e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0490720ef6e5c0f0615a9020a9fb2f5

SHA1
7721379325e0273918d08eabc770ffd5e0e74230

SHA256
09b0854515e90f0273427423cbdd9b7c1563190e6725c3b81acfc929d5e41d77

SHA512
af4a2d278c3a51138334cf88cfafa6c9e8d41287ea6d23c0cf2bc9c15c2a176fd74a04f47485f894566bf1ba7bd73426441af0845138028289551c73ea140382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0283f81adb1f1aa6141c806673c3d5c1

SHA1
fb7f9421caa79239d5125b9379bd454050b3c9b0

SHA256
31e155797d55f924d60109a44f86727ef19a09b2af7386e89db29d598466dda6

SHA512
80a96ae8e8047ee0cdd25eb0317a527b1a0d91f198c37759c338a12237659fa1fb516d3d321187f788956aacd15263e059dcd1812520ca993d70f504c9a14888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4fd953659d0e69503f4e54d90395863

SHA1
b7e39958068937c9f54171aa3a47697e75c4d2dc

SHA256
d0e48f91459ce535ad23afeba8231a39ad155247339dccb2d838d4e8765182ef

SHA512
461dfe9b499fd90461ce50a5a4faf2a778be761442b259a30845e4095bc8e3738c07883cfd1e1b02dc2b9352f09944faabd2241c935dc94d9a9b1d8fc959163b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93fdc94d495cf1e09883c027fd12d0da

SHA1
30695f2fa4ab670a84674960f5b8bc90c7dddbab

SHA256
324bea94b006e1437439735411cb852b1bc21a9d15b216ec01f8c344fb52f2b5

SHA512
49321816369e89f54f8ac9011e57d42213aca5aac3ff30716a7ddc99fb84f8ca89eb7b7b6c2e11ed08f3f1bea67af8f90eed820c6ded992d1212a009e1c42084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760af5b06c09daa456c6ee8d5d4fec2b

SHA1
8a2ad09bcdea4b056480636602d16b0905ad6317

SHA256
f577d1993f58669efca4fbac7d02d05eba839bf91a38a8778cff1b6d11f1f60e

SHA512
7076b88ccfcebbd4d18971d501740cb1fa0b82b79e3678e17092d9f9151f5d4abee88917136d6205d28ca0f20e48764fa37c8280f6d071a97f4f64cef2ce34d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
805365fd866dba052df5a4dd893bae5b

SHA1
405651ea7f2aa0f8fb57fe2407986ed2b55f5ed5

SHA256
60cbbf08a5c603da95e7aa645b4c9b8d16dd2f26e6a39193065bf71bc82083cd

SHA512
ca146e21f7e97d77a699162300d05fb027772523637d00b69f816383da9c365f4c837c51db3aad3bf8ebdc79eb90d04e80017fbb7c3d4d7055afb6b3d097edf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ff06cc29aad2386f2b2d220244bc5e

SHA1
520a59108c23d4a2152cf795cc13e3cdd9ff5da8

SHA256
0a8d0e46e04a2b1cd0418c61a104124b462b6bb7e4db6945ee26a64d85f40be5

SHA512
34adf7f76ee126b1e537b039f4feff8fe9fbafcb7713555c4fc36aa8905b1ad5eb20e638c5ab1be6d6d616df17c927f2497b1feb3b4c4aaf679c5edc1957d22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c3dcc3b80a7561fca54d1b4b516ecf9

SHA1
00aa2e0294943ee5e75a5b44ff67b6e539ba1420

SHA256
08459456c83c48d5cf98bd8affe1801e8a87f13864770f994fadad250c726938

SHA512
0ee7c334b8f16e1853222c864d099e57f398f694938bd9e633c690bd9081cb3da683147870f7a6b806041d791b9e9da27af1134daf102c3c63497aad589a143a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27DD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28EE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit