5beb5a183db83b9c32df5543b1aa0e742d2319e37f54b643e32ce3d84d614517

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66e036909ea815d58776c8e025b116c0_JaffaCakes118.html
Size

31KB
MD5

66e036909ea815d58776c8e025b116c0
SHA1

48ace1fafdbaccf30e69cdaabec20ddba6cd2b74
SHA256

5beb5a183db83b9c32df5543b1aa0e742d2319e37f54b643e32ce3d84d614517
SHA512

25428282ac2ae04212bdfd2c8f3551b56adb6fa77f45b824c1e44cf2a695f268317fa4c2f9621f1618cb70283cad6664fae2632e0ce217fbfc61cd56dde23fff
SSDEEP

192:uwfvjb5nN6WonQjxn5Q/5nQieENn8nQOkEntbbnQTbnhnQmSlxKii1cX28VWnPRp:7Q/ZOxKiiQ28u9CS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aac8b130a579c4c9a46a81db5582c28000000000200000000001066000000010000200000006ad12d318e2761ecd04c3135a8da823a3d77df3da7bdf7d2ba0a48b60ce1e2f7000000000e80000000020000200000000aceac6339052c0ad9083222ea992acd7924f1d78cb1596621ead8ab1e3c0a1d2000000002a64fa2c31b3cdcf0daa10066f0c1c574787378b390d5f01fa2cde9ade3777740000000762959246a0a5cdacb3d09317119ed289b1008cb35e56394434d69857759ddd35a34b546ce4d3a0f04124fe795d4b3351fa6be8f5dd3217137def2125e756678	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42D8C581-1822-11EF-A336-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ce21182facda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aac8b130a579c4c9a46a81db5582c280000000002000000000010660000000100002000000094ebf632bdb18d25548aeeba0db50df1e2a32d9292658ce41f0983701c79af55000000000e800000000200002000000072de0a0f0ad03a8ea74aff4f66f9bc85f1b45b0845d66495bdabdab4026d90ce90000000f8645a66fb79a148f3c2660ca81e5d3b50bf52e289599479398f161c73847d6e14b66bef641277e7d6122d4f55a150be6d2e9788359af06aaffc9001b79076c74ddf3ed68f594098e5aa47c2a122ee9d7ae140e94bc00ddbee8dacaa7c159d2e59397c04555ac7b416d7424aec0a2b7fca138595ad44125d62031e407ed7e4740ec81618bda0d39e123d9bc45488f5d14000000084a4a55eb422c9a00318b6ee7991cbcc7df4f8614475362787d863b7963be1062e3331d3c91a53c6f13b538e8c120abb9c7cc31a9d4c50b0bcc985c7422b55ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422533959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2472	2256	iexplore.exe	28
PID 2256 wrote to memory of 2472	2256	iexplore.exe	28
PID 2256 wrote to memory of 2472	2256	iexplore.exe	28
PID 2256 wrote to memory of 2472	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66e036909ea815d58776c8e025b116c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c1cb1d7bae365949a42cb3c388c258

SHA1
925d3787b529683ed152e17a1be21aab6bf32a1d

SHA256
327d408ef09d27075b7534bbc18f83104a166bb5d252071f6372066c9e86d805

SHA512
40912ad50d043bb40b8f7fd68102ec87c038a0903d848890ca6085f124d15b9ab5715216592e11aca4f8eafc94d0a819b760039160ec8dd191dcc59e9878d235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d6c1390253b58cf6408b5d24f6f5c55

SHA1
0957c8bb970fd30cd6c85a4d83466874e0fd0621

SHA256
02fc6494245a5d10318b011689827fb2e5134960ff4a9d9df503df00cc0d922c

SHA512
50b9e6648253ef9b58d9015522823d481378421f2dd1a0fe22890fdd9e863fcb40ff742336b0028f5bd04e4c9859de7649fcc5accbb6835b816cce3366d53400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defe3b0e2e192731537f5b9f9c07ec93

SHA1
063b4f794bd0756d1cc937145342f187db6a041b

SHA256
1aba4a5d1b4ceb7781f0593c27b54597332fb33db2ec1142944d0dd3144ed60b

SHA512
a13335a75c64bc4f874bdc66a6428a3dc8a5df8b3abb8b27c094f17579eb91608dc246cc475f4f1a237900e79eecfa1f3a33fb757ba08907bf4b6f074e61d92c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a9256f0fc783ae6c89ae7e943ed7590

SHA1
7a2c43cc3c9d84d625a6af3b63e57d050fc7e44c

SHA256
ecefb710b56583fc0e4e24f6874a86f8ebfe382e64f59650acde021564065868

SHA512
d44810a05a768426ee48cbe714beff2652f6ec38023d6a74086f14987222bf07f46a7e7e17a3506d3dfd77e50d67ed6c388d1d909e31d7d5de05d4d5b8381c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5091c910e96b714d4455123897a470

SHA1
0eb70634f4941e32668de0addbc5dca60d1a87b4

SHA256
19bc95431361073a5ece754f23b8e33844db93384ffe2da7447b65a087915ca8

SHA512
b50c802bce2cc41d190e123d7c38e22542db78cbf41c91111a93bceb12c8500ba67d21f3d1359b4e518996e94092da24201e362c1068a85fb7df6a1953f3c4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe0f5acc3f8f36d727f485dea44dc6c

SHA1
ee480289817101a1dabab4f9624118a35d67e9cd

SHA256
369e05c6eed14f771d3bd57cd26bb765f52b0014cd9e5d2ea501f6679bc7fcdb

SHA512
32a731d4bf297290851fd1582d5c2eadcce1d53c2dba494a16ac04dd444bb02fc1aa2c1a2c58a30e06b6424c3466210a52ddf09738a04293207bfe0baef2800e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
953d2fd9e5f3d4d9dbb6a6df39c502f2

SHA1
cb7b65bc941da4f6bf894ee3c7a803df07c43801

SHA256
f1b180984d9cc2305ecf7b4110a24aa3ffd25c2f46867e95ac36ddae0ee7550a

SHA512
883a2e87bdfa51aa12a924815c94761aa47f2256eaa261f7ec1478d806a777592313b78128c987f71f93dfc90430f98c0e79d430a751ff03412d1fa0af64c6fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ABC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C69.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit