5379a58a9ca8d04f24c67a65e76fd0745eaba8d08fccdca944635ca7cc16144e

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66d693a422f53ecaf4a2de1216677569_JaffaCakes118.html
Size

23KB
MD5

66d693a422f53ecaf4a2de1216677569
SHA1

9322bfa453472a34505a36afa5cf35d93649319a
SHA256

5379a58a9ca8d04f24c67a65e76fd0745eaba8d08fccdca944635ca7cc16144e
SHA512

23a9ffb6397bd800d31705517ba068d3827554709cfe79edc419f965341628c1e7b35363fbb8bfd277ed72d29587eea476a2139fe6663e8c2ab22e77d9f0f58a
SSDEEP

192:uwDgb5n2+nQjxn5Q/ZnQieENnwnQOkEntvznQTbnxnQ3GLnLnQtyqMBkqnYnQ7tc:HQ/8G3eZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A5530B1-1820-11EF-9DC0-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f18e774160d224090b6e724609dc2f700000000020000000000106600000001000020000000ee8e2033848cf407cd775e7ff24b0faf809e541ade0bc94dec8d1aa58c4b4da5000000000e8000000002000020000000a67ccc4cd04e8d0eabfc0fc8d4cd85bd4005b9ffe302ddf9e533186f8ace6e5d20000000336ac923a75c08616290f0a5d4cb3236c00cffe361232e81b3324cea8680b28040000000281e20d03ddc7c9de26f3d2d9d1ee425fabdc6c5cfc1e44b2e60085cbc66765bdc9fee96122a4b8439f90828c7da77942f17bf21fcf806d343ee0ef184020539	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f18e774160d224090b6e724609dc2f700000000020000000000106600000001000020000000ed1544f674d74eb25412f26dc76b1645bb793d6f9ad8d1cd5222da3c0c4cc33b000000000e80000000020000200000009bb985b87367972a71ef10ae3a2c8919c538b378d86c1371e02098c1aae5156190000000c81c14efc8dacb48fd083efd9deebab1ec2774a2b3b4009ccf64853af7eebb3c9e64222ec43eabb4cdbf0de22dc9074d2e59d37fcabe51a2dd7dec4dd0c64a2d4c6b79ac1cc424826f7c5a2b722988f3c800fb9024f1a6b7348e9ffe1d2933db3438cc5509e0ccdfdc0be6436beb3a00f35ff0b7656c6acb6e7afc0fe91ab3c7ea5aa045224b35fa8f0d7ac7caf60070400000003c1a46849dd7754712e27de04f71ca8d583efbc70f8d4fe9b48fc90c04262c47947442a3cc1c01267c91105d417616f722e67764f847fc7920a5d8cb758ac314	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422533004"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107743df2cacda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2676 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2676 iexplore.exe
2676 iexplore.exe
1988 IEXPLORE.EXE
1988 IEXPLORE.EXE
1988 IEXPLORE.EXE
1988 IEXPLORE.EXE

pid	process
2676	iexplore.exe

pid	process
2676	iexplore.exe
2676	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2676 wrote to memory of 1988	2676	iexplore.exe	IEXPLORE.EXE
PID 2676 wrote to memory of 1988	2676	iexplore.exe	IEXPLORE.EXE
PID 2676 wrote to memory of 1988	2676	iexplore.exe	IEXPLORE.EXE
PID 2676 wrote to memory of 1988	2676	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66d693a422f53ecaf4a2de1216677569_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
210cef7adbf309af6cbe2f3bc4faee7f

SHA1
93431710f727186754622245ea2b4bc1e83de351

SHA256
2d9d6f7facfe10c5ba9e4e6d0e181eac70219b92ad1e9b0e3a1713a98df41c58

SHA512
cd3d5059fc3927b119848a61a90da349dfb69a7a4c3e8ceab6d4ca94619057a4d4033ebc17c1f30553167dadd3cfce76778d4fbd81b31a50f0eb5eb23308a5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4472835ab7ee03dd7619f6e97ef741c2

SHA1
9bfec8bce30eb246c63033d68b602df7f72c5cb9

SHA256
a6709e9b80897096b31a2f2e706edc38a650bfe31bee78f0b474308065ef2f6d

SHA512
61f9205e12e6d7e275366635fc92483789431b364a3fd0e82fd3958ce9cc65e829b6fdefa97066bff8ccc7d83543199d26b701ced6b67043722cd8498f69e424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09dd42ef5a47b6e96156079ab4578fdc

SHA1
cf42c728c4eb92622a5e997e1c62eea3ef716d32

SHA256
e42bac61db6b48637b0aa6e1223254f52e93f4bd5beb42a8cd2d81e0d2764bd6

SHA512
76ab8e72c90d5d47978a7b5d5552abf71db47706cf6d71dab412b74e93b17dca2ce195b76354ecf2798e74841ebf242e19c115b5b9232719cf64ae7638f7dd61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80a0cd42a6b26b3ea775e00f86ab1dbd

SHA1
ae1fc4c263d2509d5e1e6b8fee3b4dc7a0347216

SHA256
ffe43b3c182447606b983cabdf353033a715d14804f239ba3fab596419f45e18

SHA512
68991b10e77015d54642a70fe81e04941a8bc694af7271c0061d1581a931f429589ad8e79d86d7de2cd8b21b9fa13b4f329bf9b3beabf566f5936d810777d2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb7246edd6d92405e8bfe71ce5398c6

SHA1
7ff3968db16fc1264561fe1890ba2bd1e7c2e2ba

SHA256
08db07c0f2cfe23175c94edcb17c4be3d351388fe5d12648298d9394ec1c8fa4

SHA512
eee9b49be0b16df8ba6e95235e2aba4cff76c9012e401774cf57ee86be487d3e2a7a5a19f22978fd8872198905cfd04080533e81bc4e0d64588d67d269d54fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dc8966fa42791602d234b0367fe4fcd

SHA1
a30ee4bfab7c52126e997f8e42f5d12d5532a2ea

SHA256
b2203222aa3a4367eeb82486e7cb34986333f9ffcc4a85ffc822ab40c5450e75

SHA512
afdbd0d97fd80c563819e85e51ba019e31310e188ead1bc898ab60e10f98708f8d22141b994a596dfbca0dde14b0ae988d91fa92d068cb8d85edeb886eb26cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70e0fb48b1fb449e437c46c2c5a61455

SHA1
bd54f6f6d012a232b24e98ffba6549d799296f58

SHA256
076ecbc5f58f2026d6e92c2d424aea5bdd50c7903d48f722174e959f152afc6d

SHA512
639c90b76bcd825db00f3ae77c485f2170658382e9e2ad86c899427ed102fb336ebcbcd809921215fad723beb843ef88ccb9ce78913faccd5220e4c86b08cee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A6A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BCA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit