d24532750b57c56dc6e5c8b98ab045b8f87110b1d31d67a300a104d9767c8eca

Analysis

max time kernel
137s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b899200755ce957463d02b4389db06_JaffaCakes118.html
Size

35KB
MD5

70b899200755ce957463d02b4389db06
SHA1

be448af4cf65af40a79ed0e90331382b8e2d0c35
SHA256

d24532750b57c56dc6e5c8b98ab045b8f87110b1d31d67a300a104d9767c8eca
SHA512

9ec6eda7af2644e10d16a8c7a2cf37942e8333f96e7f0195065b498e9953a586ea88f533a08658bb5c682c263bd18d57a20e525a79e397cf7b1b273c7b139dcb
SSDEEP

384:S5rXzIuh3zNbwaKO3KF94/Kf/J583TqOth0v7yug:S9h3zNb1A/J583Tq0hZn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422769783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003124243e554cad4ab1fd42d3ff37c901000000000200000000001066000000010000200000007b031ed17b359b57ca0a24b89a8ffad4b14363def1a131dbd52ffc80b845c66f000000000e80000000020000200000003d566389d52deb9766a4652013a79d32ec9946b64aa9e3a2e0a46a127c3be77520000000f317c77f5f23965fc0e5ba285d35f8e9127a5e9cdb7f4fed5d8f4dfde265386f40000000304cecf3aa0d2830d6b68de1b459477ee944f22f22a43974aad1b8617a9e9f79a07ac126691778756d0ecbdcc8663b8e30842d8e353ec04d1e52665e8c2e98b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0252d6354aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F1C1F51-1A47-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003124243e554cad4ab1fd42d3ff37c901000000000200000000001066000000010000200000009a034b488b263aaed0b3c4cbc36f99348c2b6128ba0beb8dcfb31a5b32562477000000000e800000000200002000000098a6b3b65389289901600ea483a67128724ed795aac9c2bcd6a0b0eff186bd11900000001de4146db697d1ebfb353fe12488cd3bb99bcdbe535303ae981c0783bf4ef35c0c0103cc4488c3eab7b812e5ba2c8038bd269bee88920e1d035df665a04aaf2f756495d703fc888bc030d92e8f6b2312ef7c8109f188bc6a67250d5dbb688356db4f884f7ae80f52fd3291f81e9c30acd08bad01fd568c4fa614d9939e574a0eb2799f24444d4d555493f631040b572c4000000045eed9eb9ce572b1361273d195767881d025e12dbe2c4ac983384345ff025d0c33c72196b78839730f2dc3244d450494a9b0529470c301ae685576859f961680	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2756	2388	iexplore.exe	28
PID 2388 wrote to memory of 2756	2388	iexplore.exe	28
PID 2388 wrote to memory of 2756	2388	iexplore.exe	28
PID 2388 wrote to memory of 2756	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70b899200755ce957463d02b4389db06_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62c581f5348ecac01d3f9004c41cfe17

SHA1
ee883a81907c380bc240a74957a3d13bf23824ea

SHA256
7c5fb7ba0595ac082e59c7890065254b7834119ead2683c185c41f6f983044b5

SHA512
e538da792914246e84a88273e4934ea00a804ed0e41870f6837827571c1bb5f24d768b7c072b99144cb2d493dbf0f482bd0b5b6d0bb194a2591b10e2b1abbdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3715a67df47be5bfc945bafe584f91b

SHA1
5957b0464d96e9d6dde5eb9eac0a5443bea5ff28

SHA256
172d777f1ebb9571d852a534ab580f66ec36f026e235b2dfb717244e907c2d80

SHA512
79197d86a302b7b1b89d26bfa47bf0d5fb9c37a7c93ac7de891e78d8af73c41b4901a5facf154c05165421bc6a223d26138829eb2a71ae6bb97316421d8dc438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00fe2f66316a03407c74abfb8975ff14

SHA1
6efa15c2c3d620749a5cb8eaf0e234c11ca9b1e8

SHA256
3910de0524189bd5115621099cbf3f14d9031af25c752da619129ca4c96d847f

SHA512
3b3806859906744b846b409e865361dac8a4b2d2b8e56bc0be07c62f9f37d3c0bba1508f8828f25a95f71fecdcf34ed406a974d3565c94546e0b602abc6f5822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25d389d196310a99838efd7cd6645ee

SHA1
9d8eb372de396488139fc19ae8e75f036aeba233

SHA256
950a2067b239b49773622a223c5b6da9d1bc1e205655e33a16e0e6f999d2a438

SHA512
62e99ed4f48ebd02d103b518e3097192a7c0d17650ed8dfb9709907e6e5f3a62ed08604f714591acddf96d4bb604e0c75a4eac90c8eceb84cef89df77647767a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3fc4c77f9a9432c8fba592ec1c0d0e0

SHA1
15ea0bea7075c72caa35c2d6e7936532167a7eb6

SHA256
4de193ec124e0b5431d6b21d4687e24d83b7c7ed4bc6ebf6e69d05ae85d2f375

SHA512
6af5d37ba7bb5f2aec485798ce6c50d3da865e0451add546ed87f49050e18d9971c21a025885c7e9708bb9fe0fcdd6b26a613d8936a83d7764e1954b32b5d146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b89a7e2f5eb83a9fbe5e1c0689e11054

SHA1
07d51fd353e824cbd2061df06274c93fc1137411

SHA256
1dc076c834e95788e769917126185656cbd115dc91eb414ab4e9188cc33b07d5

SHA512
8c76b3cfb50dab9bfc6eeb215e430466128ee19575bece0ba3946fb8a0077c50e74c3cb90725f7631344a0ceffb16bc5f0c9b91cf9c249e56e7f833353d49f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac776d431622d3362115c64b63bbe2c9

SHA1
53a8d80b024084c807967d84683c677e78d3b08f

SHA256
65ce0979f7af1178943181c8a87950047c7ec8dd0baba50ee37810b80e2d93b3

SHA512
3de037e531cd44d9d38720bb19d2a2fca985aa09369a19c8c8ddbb9a51da28918e86046a95521eab256da4a846a7ae1e5fc16e33473e9231df631a47c3e40038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26c17d0bf3b7f56e7a2fbe18ee490861

SHA1
020c878fa073e103593b0b0dc52becd038d9c828

SHA256
7bf98bf7a50d931f88006e84596c030d1111968c18a6241db05a6175e8466696

SHA512
01b8583608da4f75626e6b0f59604fa6e276794332a674841ed13608af02abae24ae3b9817607f2d284c508790cda6ef86bfca499ba823b73568b9b3f2132bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c86746cb065fa482ea829bd039463b88

SHA1
9fcd373103c22abb0c64e20faf7590fb3e12c29d

SHA256
e21dcabc5e973a3f2ab03b7dd46cc4735a0a6cb1385d7ac32df1702e0c28698e

SHA512
8ef80d77e0f12aaa9b3d9937752cab539d6ada7923dbb211de186a5d181a159d67755fcb466363142d4d3f614659937810a84d1d935aa79eff0d6043a4762365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5235599a6f02b71482768d940a841958

SHA1
7208cbcf6ef5ae51c09b53b961777583469c433a

SHA256
f92fb9c4c8a91821fb96f81bcacd8f3d3a4dd06d0440b0717e3e867f0ef0b523

SHA512
5008764a11f0af2ac347b25ced6f381f7784099f2a6389c77b221aa0d283516c12f72d7de2f8183cdb2b30c26e0b304fc06af272b8c0bf54f723d42f5cf02dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fafea2daa00ab6529d837e17bf11f4c

SHA1
57af7f4f242fb6f342dcf597a36463952a7c5253

SHA256
4b9b2e10d2845c0e9f6f5c85cbefaac705db23fedf4696ea2f47a458f65e28be

SHA512
c9922c646636232bb6db9367548a8eb418598c78948b4ec7718709a601e9016d1417335434bc88502e85cef8aeddbbf2da261e3098e71f6c826807e248273bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4beebe4cbef09a6d45a017d362df300

SHA1
738afa2b07fa288814f860d8d678107aba424649

SHA256
07b70e78c7ecd85b1c2fcde1cfb81ba3061e3004acff1e726ba0e44eb63b6b08

SHA512
49e8f421303bbd0f856ffca3663b2dfda2525c0282996d086438a75dbbd4e03212da7967a931d59da47bda077cc814b4df12915d9a85a8cd2853330ea3b298a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31023954086e8ee493e66743e0ee0070

SHA1
b27b6e7448ce24870739fda218c403d09813996d

SHA256
a9bd106eea2f18c2d7a85a991226ddc210c0488beccef8027bb12726c2bbaf31

SHA512
b1127d915b2b6213419932217e294b69391358b2766bdfd4fb2c58364213f0a39ad821c33c6e2184b71d5d5f151d3c2ec1ef5d44b3081c5c9dbaaa56d3c7ead3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EB1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit