f030cbe2fbe313dbff446234ebec5b1d9147a676658d8ca37a8cdf8500f16336

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64b5021b4ef29754ad36561b7f9646d4_JaffaCakes118.html
Size

34KB
MD5

64b5021b4ef29754ad36561b7f9646d4
SHA1

69b0264e30ee41b22093d460e2fd78a886948564
SHA256

f030cbe2fbe313dbff446234ebec5b1d9147a676658d8ca37a8cdf8500f16336
SHA512

d4ac90d4143828a158b13650c8efecbce79202381ec1bb8a7caf78e4ba69fd35e26c44937ce11824a62cdc38c0bc01090a107f8b2042bafcd297d776a986aed6
SSDEEP

192:uWrbb5nzwFXnQjxn5Q/HnQieONn2U3nQOkEnttxnQTbnJnQMXCCAvw26k5195+Zb:DQ/oUqRFw12JhGTRTpzoOs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000109ac0dae0616cc34ca1908dc9aedbae14b325a6ad80af145d1390bfd640dbb7000000000e80000000020000200000008303ca4a8721c99fc3c2afbe1f8956895b1d8a828d39bc042aebc61743272aa42000000042aad744bb7b0b247df306a283f5800872f6e74779df525e6135a6e8277cdee440000000858bd7572c70d0b0e21b2d50c3f0edec8e8342684f9f7da24196e25aa0e6c800f96772ae43fc2e921d364b70e4be6b426177001f57f63a83f77f378370a1a7c5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422486164"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604be1d0bfabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC20A4B1-17B2-11EF-9DB4-7A4B76010719} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000040553dfe6336e3ffad55929bf65bf93dc7d58b05717a0128e2e7c9767593a132000000000e8000000002000020000000a39dae8fe1c8d2d7143eeb22508d73eff6a7011df19b9cba41ba23a59d29643190000000c30b52729d9e0729410387d3470ec8f966d557ecfba83ce2c00a3a2ee43a3b3c081fa232a2b87a59086bdc78597760ea218cf18c99e9e66b48e74282b731614c76b430adeed5148480a5315aa3aa9a52b01d2af3ff82fa703f5ff20c77cbdfa736b33ce89c72ed13b79511ca55e762e030ab7e3454a9f195de66712664b12a18f61ddb7a5c7338641512e9b1124723ff4000000085404e07bd1c27439b87ebc9dec7c6b392467be3afc92f4dfbf602c7ddbf19813dcdd78517a7738c88885e938752ca4e740eec0acb01f800c908f8e840ca6f8f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1224	iexplore.exe
1224	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2912	1224	iexplore.exe	28
PID 1224 wrote to memory of 2912	1224	iexplore.exe	28
PID 1224 wrote to memory of 2912	1224	iexplore.exe	28
PID 1224 wrote to memory of 2912	1224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64b5021b4ef29754ad36561b7f9646d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c7b34d2065353ae52468a2cca08e84

SHA1
a27f0be7de1fdc8c50d5335ae6ada4387eed9e47

SHA256
dd90f641d0fa4b8dc90392cfc9aa06c6be31bb5205ea98cdd507e64188256480

SHA512
6f76f853b43b90addb1a41d862eeee8770fd82ddd3c8b335673ab8125f86cacbf3ad311b0bf5743e875f9c319e7536509e6e9777f6ee30ce6abfe6ca665b20be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
113316569cb1bfb1b3f3013d590a62b0

SHA1
6582feff34b3711b5e7f45ad067135cffae984f5

SHA256
a44f22b7f1bc26b42848a30ea54b0c4083c2252a6c83a9b3998b158fad876ddb

SHA512
a16b2b3363a9d57856d7478bda6f622f9fdb4cc48e2082d0dae6f17f1b78337f01fdd0c68c2f56a9f325726c401ddbc56bbc3dfb0ad85b89b5d0ef1a7a18460e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
829b7d9e65fac32fdc61376bc9c164fd

SHA1
a722c3fa239c1c0e5a6ca6fcf57447614990e9eb

SHA256
4c0cbe299f3f69e83158b48e085f4ca6cab9d6d2e59219abf581a0dbe59142d4

SHA512
e935ff678d7a9b832c52927e209768cfa1bbc894f4400f76bbd0443b67847610d17281f51bdf3cc2632a19cbc2a88dbceb8f99f2211daa9dec3fff26587ebd66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d72a46a22180d4d81d09c932e0311a7

SHA1
10c5b0b984a758ed09f9ed081055752f9c6e884c

SHA256
3088b5a2ed9dcedb15c1a22748d25188b606e702dfebb2dc2dc603588cb21af1

SHA512
46dc0475f00a0cad516ff12ac311be821aa7c002e6b4ff31f30ab6a1cab8a77440762f0b8d9b0087c3f34b2bd868eff05946817039f5eea2f67911488844db75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa1596106b7989874dc2c10e85d70f22

SHA1
e00e6fec97d75972d099f0295ceb0c40123d3935

SHA256
9a75ef10e498e411c50e9d2c29da151085a414c6a32eb06a012279399805abe1

SHA512
9758b5a60008e0daf1809358cd6bf8299d604a0fdfc206a0a4959ff7a3dc6f07c8dc3b7ef980bb41a0ade3a59168553416b33059f381af96f30e678839557398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c3d67ec1e9b7fc3b5fdbdb8e5bb79f1

SHA1
de4ae05ed907832a8d22ebaac6f3c84262b88055

SHA256
2f96e38d59e4cae01b4c85d8aa15ff1b1ebe4ed073cf78cf6766d0f288982b37

SHA512
81e1b5d91fd2203d522b17df13e5a5ab79b634b7356d1fe7cac70a45f38ecb636cd43687f71539150b9f65eef34fcb10bbbad7746f6d4c7224062fc2a4b431f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
192271566baecd26907fd6095e4c1836

SHA1
34adb0e60f49b6c3e4a90040ab6bf90d18324fe9

SHA256
c416c88407abc22afc81b7a3a0507ebbab633ea64670d0bc72ce1226b1e7c1a8

SHA512
0eb14779f3aad9622a3cb819703458fa73fc638c0f2ecd83062105c8924d29f2b8370d91061ef53a6086e2a9d9c5e5dc03838639714568e54cc558f5bd7d3845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d50b0859b830d8ce8783b7cd42540bf

SHA1
9a2e2cbc81838b7b6e7047a8b4def55840b50478

SHA256
c427d54903b7c51e10b135f91155de702993b0b38b12a3a8a338a24b61277dad

SHA512
15d9a54a9aa9232cd3d114148b355aa2b94cfaf79300ab76f0a2baa3f6ce1cfaafd47b3a7c31b3cab3bc5566a429a986290f83030b5d1743ba73636f72511ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88224df559ea17d9a600e1b6845ca4c1

SHA1
4c1b9d84c4421afddd1ded67ecb55c3132e3ba54

SHA256
5a507dc5a67e3e2720a4575028152687085c7b4581fc509810c8381d14300007

SHA512
4d28511ed57750d85a84b6c2eedf29c3add57568f71acfc461c6638244e57b9b891cc52aa3f35ba604acabc7f37fe8986df648f56de7bf449e37a84598b788d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03fe0fa2010daf84284f9d13bd619eea

SHA1
716b210869ff71cbad47ba38860dcc41861cdaf4

SHA256
ac0225fe4662835a3aed9d7111f564407f009a124a9863034247cf814d3c6233

SHA512
645fde7d9d05149a0c35a4ae1c13a822b4e8aced64963ff4baa2afafa690b25026fb076a094ef0d2e772c8e3bba7dac6232242db555222233b7955eb5c51ceb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24c31d83c48f38885006c62086444a6e

SHA1
f004ebb47c8c009085db66b510e4f332d31b180f

SHA256
7231f866d5e2c05c5b8268b12ea38baf2f51b99e6001781da7c803a8038d5681

SHA512
670145f7473beffaa0ce81b9716ce612c87df2b80e9e52443022eab8abdb62750c2ea0456b67f9cc79169a7f94d506d50834282a23e7cecd814ca88b852475a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab497F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49F2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit