45e56d1cb4a41274622f0df2c0847dff1dc4e4a9608733e791912435cf282fb5

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63f73ab63d5811b5724f8dc1c60c4570_JaffaCakes118.html
Size

144KB
MD5

63f73ab63d5811b5724f8dc1c60c4570
SHA1

6a5ec55e0a2f0c0bfdb32bbf8b4856a73f830037
SHA256

45e56d1cb4a41274622f0df2c0847dff1dc4e4a9608733e791912435cf282fb5
SHA512

1982ff4263666bab3f268ce09018da59c9f94b28d2242bff2e561ec5c00e9484df3a88ce0c83e136b7a994ad2bdf9bd038166cb4a865c7fc1e5c07681feed20d
SSDEEP

3072:SidXlQV17yyfkMY+BES09JXAnyrZalI+YQ:Sit2LDsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b28099749d052e48915505853029ffbf00000000020000000000106600000001000020000000ad7ad8df402cd62f73dc1ee8f90d1f9871c391ba5eca44e8debc85d125957eb8000000000e8000000002000020000000c2cdb3762dcf0a4ce59767131b5b617f89756508ee4b487c71caed96e36ae1972000000082f78c946d9660bb7a39584c3c348880899f91f2ce646ea588461c069735306140000000588e02fae416fa861cd125e4185150f72416721d71e4eb5eb7442a1819b86e88584743b9549d22cad86eda854eebb3c5c7fd01cb225618fc1fc568afe2dface8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63F05641-178F-11EF-9FA2-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b28099749d052e48915505853029ffbf00000000020000000000106600000001000020000000e86705f6b95f95cdb0c89656d47ee701407b52ecf607d52988d00145fdeb56fb000000000e800000000200002000000016ba782c11612ebd280a952fdf218b9458c913bd5e238637341652927e9ad81f900000003ed78be59da902af56f737eb4e6799f40e60108e42db816619f2893e63eda738fe50f1eff4e86951660fea92cb0b32bf724fb2a8b97707ce3565d6ff4aff1718c7fea34e9f383c691aad9fd12c18c1763ff3031ef974d82ea18324035631b700a2d933c8c3d22c6aa33d24ebf466fbe50aa8a4984fb6f6778d474bf5ad14c9dbd361ff33896b2f87c530e91eca5311ea40000000b15d5480ddf63a044c21068cf07b0c801a56eeeed42ace7074f6cbcbe4f00b36586cb4e9dfbd819f7c0d32deb600bf136cade73b9e5562c861769e389392a436	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a8fa389cabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2192 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2192 iexplore.exe
2192 iexplore.exe
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE

pid	process
2192	iexplore.exe

pid	process
2192	iexplore.exe
2192	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2192 wrote to memory of 2508	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 2508	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 2508	2192	iexplore.exe	IEXPLORE.EXE
PID 2192 wrote to memory of 2508	2192	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63f73ab63d5811b5724f8dc1c60c4570_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57ef6481b89e3dbf5e8cd755d52dba9e

SHA1
b5f15deac59a7e12acf5cec5a466937827f7044f

SHA256
0ae48fe606eb623d65a61ec9c3175992599f1bc228763dcff9520fb77ab7e2d2

SHA512
0353999c69393184d3226aa05e636bd2ea3c7ae2df5ffa8d9cc2dcdc9faf58bf896627e868b918f7ff094827f2db063d486101517ac88cfc29eb3389a1adc6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e2f1e416a26a9c7b9bc7cde280c143e

SHA1
ea907a864de90d389b1f660d512fa19d25176467

SHA256
0fe67c60caa0a509ce6298ca31dbaeb4ab869082b59ee4a4ff83fe791cd862de

SHA512
480019254994453ecaf6c5f2ae34da1a375900ec1957ab6b9c9258c45ddd0e9c061b2db8ce5ecb65e37b79351fdbe4bf3c7ba3fe895dc6d994cf7a26e0475b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07fb5aa53de3166641bc7ce29e479de5

SHA1
594a09b7699f4d46c75e0098e29d01cd2276b810

SHA256
189bbd9ab9d5cc19146b7a4651e401eb1d3deb0c32cbc5ba8773640433e18ee0

SHA512
2e126a498070e6c107d0cac8e9ac0a80dcadf9d2888775e269ab132f5ad8283f2261a01fb26f288fff550a0994bca4f386d662dbaa0f09e4932282597c6f4900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3a535eae0bd3d2fe620985772d97eef

SHA1
03c03835a8ad506b1b4e8663a4abd8bceaf6c370

SHA256
8b7305d8424fc74c1ac135c5585e7cb3b054c5c6075a50802eafc00f54c329c0

SHA512
efe1031d91c54c8fac8a70e8c4daa0452cd39a564928a4be023b7d6cba713695d3e19469d27113145b2fca0d314962a124a995b39e52d4fec7142fca80e8ad48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
098afb7e4819b36cd2050b899280f3f7

SHA1
cb7ad403ab511ee0ab890c25704786b02f9b2d26

SHA256
8807cb9fb856798e6f0a699ebdde246c434dcd0e78ba66fadf5137a5be58f5d0

SHA512
08259f626fc3096f50b26ed7a43c5ebc1fa31823f222ac56e51d091ce90fedea995b3fbaa4f357488c2b068e0f1c12b946431303e848c8824c26540dfa6017f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b9672834b4f437082437c2b7cba7b1f

SHA1
381fab4feae59b10fc1ef787bbe25b0d5167e782

SHA256
8016ea5c3ac3739ea13843f0f1643b913c7bbca682f66dbf89973eb8bffa9c14

SHA512
ce1eaea20b28b392ad177a2e3e5473a9e35cbf3211cb4e5d99565a0e88a0b3a0f2c94f5a52fc29cbf85f93aacbd3cbf94f0e351fcae790a2c3535130e6ed77ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3a562fbf3958e234f291aa54b716952

SHA1
9920a703626c6f32292d9c0fd033b7b67760e2da

SHA256
8435bceaf93fcc0b10e4dd7936eac580124b1fde347c4a49225d936b33a02e83

SHA512
04d1c91746d15e56caee73d93218ae0d191150d577aa2ed12020cc84df025c5c3047018181990b0f1f417e8c2a92ce53fd5d800742c3c665b8f3d585c9c26c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aeab3917aa127397600f7d46bee20d8

SHA1
1e69534c9c8a4007b3e9880b7f497cab00256b3c

SHA256
2afed98894ae249e2d4154d19ef352bc8f5cea4bfd35666c07bdb06cca89f604

SHA512
4d5243ea24354c55c4071532bbfb0ffe2bb88b1f754b2d5c6488a6d5885619184be057aa9e0cad3a9bf55feb33a6b0bfc4214e086c3156df6915b404ce4eedc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee440897a69edea19e2dc7a2730a14c

SHA1
059d841273e7540ce68cc33c03a9dc5ae26a67cc

SHA256
ca1a28c8fbf1991ae8ec40525895de16557e6c63b335a6aae2bd105fce76c382

SHA512
94b8a6492973a255bd7ac2610346cfcd65f575fc914ef2e22f044b06941ca8db734c49146dda778ab136ac82a0d6ceaf78bab91400360bb2d4a50b99079109f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da62950645362b4f103eb6ff0f88a420

SHA1
e2a50a745d2d7b8f8bf12fc26438c3463c6a96c2

SHA256
728beda2be35182fd18fe71de5bb55e6c4476ef7c7c4752cb47808cc5eb88ae6

SHA512
d3304ab894044c8bd0fa070662cb4ed6d4a95fc81b735f35ecf0af57f880ede25dc957b05e68eb27c6126d71cfc6dc39d7d48e6c260add9f0058c58937cd915f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc9902542ffb90b4ba6cac7812670305

SHA1
b63c8a19eec27bd97335a43db7b9e32383980205

SHA256
ace5707c02cb2e07a1d2c7df4e72b5a0e7ab648f76157915b92cacc62081e368

SHA512
a4ba1d51438a94830cb82f1dfd6ef1449a5496d589e8fb949ff6a04ecbdd4296907642dfdbbc7f761bbfb2b68e879213bf9f044481c12bbb962c81ea851d8a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB6D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD28.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADC7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit