ab51c93b067766416aa37de63978ee90aa7cc7af9d9a9c270d22469b5ae4a965

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687d07e1317dd90d160004708514a242_JaffaCakes118.html
Size

120KB
MD5

687d07e1317dd90d160004708514a242
SHA1

a0c52c4e51204e3284da9cca342e33642d8fda32
SHA256

ab51c93b067766416aa37de63978ee90aa7cc7af9d9a9c270d22469b5ae4a965
SHA512

3c81a1a5f7d8f1d2e61faac3c41463ae6778c661c28b157818c58d5ccd6d88fed3a8bbb671fab40a47fc8689a2a40b3668c12ff1f40a03c54294dfffbde7f540
SSDEEP

1536:bbHyFTyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:3uTyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570906"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{489170C1-1878-11EF-A1A5-568B85A61596} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000090cea6bf97111c438d595c1f59bc0ac60000000002000000000010660000000100002000000067ae9af4b4bd161a82f3f46b853f00374a78deecd68d3c16c154c071dcc4fdc9000000000e80000000020000200000008651f01c3e0f4d8dd793311724b3209f7cfd45a1a01c5e89f74910b5ff74f9612000000061f7701feeed49a729bd22e2878eb360931ec6e55c8c1ec0254f3258abc2ac3f400000000894d394ac0492ab98d4d81b07bb44138e78c26fe7a3cf2edc59a1b7704f1422faa3185f6b82bead7ebad80c935e8b793b4a241d90175f8375bbf7be74a1a0a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d0101d85acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000090cea6bf97111c438d595c1f59bc0ac60000000002000000000010660000000100002000000042d60ce1ed5f8138fe7f28e9e5eb70b3f503f67fa5b863290c3cd093478e359e000000000e8000000002000020000000bd54fc9e42ac8f7060022ba744b4959449797d5caf67b5c35367002f3722d8a490000000d06af1cd6023cbe7cfc914c5b0cc1d3b0ae4ce70805dbc012a2ecaf9fffdb6af56eb901338a9dfcabeca1a838aa7194584ddafb78e9f64bf0eef65a40c725aaea3259041d8ab19e01cf1134cdf6153294e3ff2e35cf7817ff78fe42b2a12f4028796d24713f98b6bb156386eaf4a6da2f35a2a83846d9dd0b14573751651dfbfd605ac299dcbc61206d03455d863332540000000882d8a1892037135cff34bf824676554e54fab1d85946c907c72aa84eea8245c08c12de0ccfc73ada11cb1180e086e313e4c743da64080dd22e488e5e2dda181	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2108	1516	iexplore.exe	28
PID 1516 wrote to memory of 2108	1516	iexplore.exe	28
PID 1516 wrote to memory of 2108	1516	iexplore.exe	28
PID 1516 wrote to memory of 2108	1516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687d07e1317dd90d160004708514a242_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd395d0a12e4f84b74c1bdb103fac285

SHA1
fbaac57adb545620ac9f7815ce310e4e0f3cb45e

SHA256
29fd07a7c1a590d9acdc97396af0abb2bd8731e68609226a3533b018c98b228b

SHA512
ef76e4c62d7fa2916feb003304067e6ffe120afae0a383fc062325f0fcd3a0e0a100d75ffd4e86248379db545b1bee21ba9ef7e617c9442355616d2ce5d6a8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd173a8ee0a3ca1eeea85115ebe69b0f

SHA1
a3344c3e0e7d92788a9e0300eb962fd08657ad34

SHA256
d12d60675168ed190324e1e72dca9e2aa322315cdefb9e3ea8f1a6cb69a0dfbd

SHA512
5cfe68bcfb6d79392308f806216e926dcaa516ee9ce022ac61546bbbcaed917a840219b9f94608251d80dce90c7d1c26d58b0b62ff69e11218ae61c6c408ce06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10d4c81ebd11e53fae54162ed41cdacd

SHA1
415fa6fc82e627ebdc25f67c21a053b5fd0c7cfe

SHA256
a9643e00eb826a16d1beb286fc31c5496c3c0bc129e65af94e03d226ff31571d

SHA512
022d9ada7d156cf2a46325cca3e67724aadee2dca4f2186c1f23515bdf91a39c6386d0503896e05a66980d083a11381f98050e96d0823a2cf7d8f377b356e5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e2bd91fdde5947273e9d768b9d403e1

SHA1
00f371d96cef9d4922286959f0d40550f2bea8ca

SHA256
46bc6a37c411edbc75ebc3a76b12adedd0c3cfbc830c13658678fceadc071655

SHA512
e41ed03aece8ddeca195344fb19f3c1bbb4ebfe940c17950f4fe0c0755d12ee5eca86129fd19b92189b4e7b409d5da68a785311262427f06c852483ba1a94944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6056deb47f1153ef685ef2094b55ac59

SHA1
be7f67dcd8adc7675cf1abf417ee7966152e9060

SHA256
93c36f81c6e22412b63b25b413237218d9ae66cf1d6daaf74d45cd3716c90e1b

SHA512
48b4b01ebaf528fec43d81cd784140977f7996cc28fe2145c8586ceb8eee454b1c701540ca36fa3c97bdaeab34ce9fcf5ff9fbec5bb697009032d8f3f31ea730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9348a28016567be9ac27ad76554ab566

SHA1
70f2c654075bc01e4ae1bf03939ac916c14fced6

SHA256
67b7cc3893d721ce20d0085821a8e8c88b51ae5d1be76ef9cb8c70d0289c35b6

SHA512
c039e70e4d4e677fb705c6483837c9d3f0a1dcc40890f62f2bedb1e929dd7a258ffa6029c8d89dfb21e2a980844c91750dd067ff8b5a4d7e3729b094d8b282de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6a7edc9b5303e7cbc09179a2e184fd2

SHA1
36b2ba57675579fdf4de69dd820ff0d28822f523

SHA256
7ef0c241c0c6fe6dad3210d5ec8c5cb782bd75219e75f69f644b501dc7911284

SHA512
1eada82f9bcb5ae2b77a01c116a8b268d9c77a16c0872280ba29ce6cca503aed55cf126952a888916a3bf4df2809d7698e54ffe780467dfbab190d9e7ca2a689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00655abb5e3cfb8d6e356d19057bfe9c

SHA1
0e5000f018191cb8882e31f2ec1e3e0e39016fa0

SHA256
fc4146af61dee2f2f77f72cf6ca188071cb75f3cc839da9fb63112c195b7e6c1

SHA512
7d8f17369ce4686e859ae41647ab86a560b22ae2d62ea1d3d4a8aa22a2543c57788296018e847e740f0f4dc56a7f25f52ff63595d645efa1c6094d8546bff81e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6701ca32569b04c8c1a479c48792491

SHA1
c6ba03b28713f6c20e11d3f19ee1cb4dbe689efe

SHA256
87cf6d9704cb880e845198209916f4e9419f166468a0b2de1468d6e84b0392f8

SHA512
3260b28187a25e1c4a8f05836831e07bcd1d4edcc4bcfde80f623497d14de0817f129f44d8c17c7e9a65bebc30ae44dc42c45e2c450352073b9a327b5acb8db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29754bc45cbfef103a43218acec1f9f0

SHA1
1e77c036f2022113203bedd15ea8d54a98249784

SHA256
38f0dbb3c065eda3e32677bf16758865efba9f581fbfbc0e27f8fd5c22286f6c

SHA512
10c099c19bff706a7eccb01192fd03e6a2ffc3e5bd13dd4f991e10d5f594a8902ba192eeb14ccdbe4f23e70812518dd56661b10c4be679a8ac2ade8faba0f931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45f6b1a080634a8ab1d683afb0bb06f5

SHA1
0fcd2762f6c0e27be9d948407a48948b6261d7fa

SHA256
3029d592f6de6d5b10c0e7f6729203b0b56b6d27bcf298c8f1010d38f516e30d

SHA512
1c5f795b76ae42a2bf23171b333ad22ac7ecfa6b8e30b0b453ec981007844d71bba3402a11e31c770d80b21069d17617d7ce88de93fd7066912bb1a2211ee1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2093d288d744ef6e46db4fa2ad45350a

SHA1
81a0c7ce3f63bdaaa76de38a8c120af02dc086ec

SHA256
53ee6c75157fcdced0eb8d98ad4cd882a77a8593705f6086b2bdb653706f58db

SHA512
679650509d43e521d6bbe829bd0d754b2c9c07638908a3a9fb28d49ff66affe60024ab14696f2c1e0780d85d71e87b0b8a5304d2183a54f08489b326fd4a483c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3857.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit