2044d36055c0ae1bfc5000776b1029709005cb4befdc2f1fff06656a37f323ef

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

66b64e661a51c81d147cee2ddf9a6571_JaffaCakes118.html
Size

218KB
MD5

66b64e661a51c81d147cee2ddf9a6571
SHA1

9e0e516b57be0e9210bd98a4fd24f002929f93b5
SHA256

2044d36055c0ae1bfc5000776b1029709005cb4befdc2f1fff06656a37f323ef
SHA512

bba9fb585b912f7bb0090a11c587b8172712d48c819d31cf2f05ae24084ceac400d05f0d0db1576453ae4ac0780017d9f723e3c3b00c31ede75e85884c699c82
SSDEEP

3072:SR7xQFnzqSyfkMY+BES09JXAnyrZalI+YQ:SBxMnOXsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030db4790e1447e4e969c64ee9fdcbee90000000002000000000010660000000100002000000046e019d8fc0924c8d7df965a9858067f50a091e1f3281fb29536b0c0bfc8e994000000000e80000000020000200000007bdeb112488d46c1cf4a06c088e3b1a35cb08634ea40b2f760e44ada7a2d6262900000007f72440288afaa86f4e4ca447152c8ba11d496f818203990ba422af0c9aefad1f36d420d5acfab436a6a0bdc2ce7c202263d7b11a258390064b8393e210022121b486f02915cda30ef866cb4d09eb64a77fdba7c72163fce27e957953832ab7f226f617e7d8fefe9570924a728f23f34a0764d9544ed3b4ed3233d7ac6bb069cce75a9b8a16cd22836a8bceecf07d8d540000000966d13861acab33c1500b988a4d80f04dd95b386e63acfe2913ef89b6fd2e7a03d7d87bb2bfc042ef2cce09bbda8fbc11b8e71d4a6d35af26c62ebebab3ec5f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{328C8E41-1819-11EF-AAE3-46DB0C2B2B48} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f016374a26acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422530065"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000030db4790e1447e4e969c64ee9fdcbee900000000020000000000106600000001000020000000578eeb7d7be32099a296ee570ae34d61fe7982f3bb88d9e458c8b05e1b3cfec8000000000e80000000020000200000009d3b2b78f76ec56e928097d18297de64def4a6dd646fbb7d9d6f54390faed00b200000002063ecb2a88d1949763a220808b9a746cac622dcfd36bf74eaa32dee4f52c5834000000049eaca0f2439ab392bf1ee79718f93a94236724f038c502e0a9aa60e03a362ea434536eec4df11bb10aebcf9fe91af86c0be05380fd82d005f167c03d5d63457	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1976	2852	iexplore.exe	28
PID 2852 wrote to memory of 1976	2852	iexplore.exe	28
PID 2852 wrote to memory of 1976	2852	iexplore.exe	28
PID 2852 wrote to memory of 1976	2852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66b64e661a51c81d147cee2ddf9a6571_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c01b6e4618fe149273e08eb13c1476

SHA1
60b8b7a9c9c8d9da39c6876f8ebfd4c0fc85256b

SHA256
0bbb20df405e963537e8c5c13f1b75952c811b993c8a4d04369fe41371772d98

SHA512
8c84c87e53be04cca4439747f0a5055093618a09210386e28b5cd463f9cd0541532958cde8a85e02139db999b666b259d8e939e402904c1af1b1245126ed7925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db773631f62aa06ecdda17c351ee2ec6

SHA1
bbce1137d1a749e61202fbf3afd08e02b8210049

SHA256
27c2e7ccecc45e1be503e017f1b5f1162720251d29079e9797b6ed571822f573

SHA512
2ac53480de1c09238e9c08b099ab98ddc8484cd6511358919c203ed82f2b68cb24798b06ab054c8eb523f24ce54221239a9e942f22e6a7b2c98563dd9c034a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dead2eb62f6e418451f4fcef21f52514

SHA1
96e0ccddd7490304a13039000c7985e499766364

SHA256
71fa72ba7966d7cfe40e46817833c2c77ce60ac1a99b4d5956bee0c6f4995935

SHA512
bb75ac82efe53809add3484f6d182c1188fd7a5aaa48ecf0e102409ce460ffe550a9550ca0762ef226485692b9248c8ef7e73266b2f33e1118dabc4341a5bcb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
320550223425ed03cfdbbbaf40344a64

SHA1
485961d635a7f08ef4c9d2b4ec167b6a83d3a8d1

SHA256
bc2c2481558bde8ed4a8442b8c51986ab8c2ddcf6ae1e65d9cc9f8c445fd755f

SHA512
fab18446831faf861eaeb638d3bf3e54e5d27430e121ee242fc7d20a49f33cd0aad760e7b3b0f51d9f8a3f579198d5beefc4303e2428de813d4ec892889f05b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c67a3c50e1bf96306579368eeea3ee19

SHA1
6982e72e28d1b7e9f2e36b2e2ea4244104501488

SHA256
cd2359fae0714d67665caba2b25799ce89391f63cd8a637b1846e1a8e6a63438

SHA512
fc7ded52a683fe2c273dd4714faf18d8ee4b72ceeaea334d991789b0760bc067ca4427203cd834d5dacfbe7956d93a1b09f95a50b48b70788115ccfe66f9f5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119e786d1eaf8994c3d7d8a0733867db

SHA1
514b2fc3781d84b88960d268b551e6f9d77ce94a

SHA256
54851fbfac09c2313e203807f85357d7d8562f97e2d77e92be7f201f86572771

SHA512
3582da23eb2c74b30a628627e85fabb9400ac4ae1e153658138a9caac37f1eeaf6f5068d5f33e0520271b6df697d0ff85cd93d71e7443de776e33597ba8162e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eccfd1f03ec2507cf7a6593da578640d

SHA1
49ddc520cb216901efb7b00c3de414e5abce2cc8

SHA256
c56fe7e44274250df14c3188befcd4f25ff37993d8a50549b1d423d5b3b523da

SHA512
62396dbbe969edcea01564e4c2e5633ed32e36a73a1e0bcb06ba68f6e9d59bc93473a4902cc9c5cc31e5c387613a8ba478066d5db014893ec2bd91242d225a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1828aca1fbb632709e53354fbee667

SHA1
c3d8aa90fec5d1e09ade41d7dbef9f9f1d1f1f31

SHA256
9c5fe4b524f4bb7d82713cadb625cf686f09fec91c222bfb60464f076bf8c116

SHA512
a9c71ae60039a2084853c7957db9b874e87a6f7fe3dd4c936f1d55b7e4b07d1a33d34964f4c2743003db54b16e0efdf3762b558883b4470bc616564bbcb05072

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2211.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2333.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit