b42f47f796a1aeaab52bc3054e29105d028047ba1aa58960e758fc1aba344e2e

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70d261e3a4e5178474249441e512b66e_JaffaCakes118.html
Size

28KB
MD5

70d261e3a4e5178474249441e512b66e
SHA1

2a915534c04e041d20012689a79106f50bcb9dc2
SHA256

b42f47f796a1aeaab52bc3054e29105d028047ba1aa58960e758fc1aba344e2e
SHA512

46efb792e79c96e0d999872766f8a50e987de2dd0b8ffa83910ff7e51137aab9d32c56ebd79cd96f89f87d6e85651dff264d5ee48f6db365efb5a3437080e1ac
SSDEEP

768:CyizhaE9hnEZsBJLcumWZOTvxxBxJvL1n:CywVnJa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005cd64d4598bc9ae12670b8466b04c17e39f5cbedb335e981fee78c90ce7de1e0000000000e800000000200002000000093875bfe1a439534204e8aa102ba4d68f39e85635382ee0344051bfa0e2cb7d520000000907b37ea64294135a03e5f4a622e757e54aaaa75c50fd4c9c70cc1aa235cd4ce400000007435a3f46ebc26c7b3606d308a99d5a45892773ea839569508645e40623f615a33dcff45d5d48d01217f61b3cb358c5b6ef1fcbb98eff9db31c5ac3104aa7ee8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7021a19859aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C39A3291-1A4C-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422772118"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000c703b326a276c30ac72e9d9e3a89e8910873dcd7e6709b2bb2d3f30a343cfab7000000000e80000000020000200000009865badd276f3549c4ab3895d785a718c0e78ad65e5e9116a18169c7b0551b979000000040cc0bdbf9a9affb48d6c3d2dc5233a05ce47b69b929806f1ae13358321b0003ec7a0b66ea5f4dfef83d0ee894a484154061009504cb3bd07970d2afc8dfb544b108f505ea96bb5c029b4b9894f54903b1684a34870562049874e3d31d16dbcb78f29b8a1d69655c1f99758e4f006ea472ed968b193c913654965768e7486b73af063c3c060e24c2ac21e968ce57f0a64000000057c52de52363a1814a91f6a84e4ca853a398f815710d0420305d2a04aa73a4ac1d8223ba3d161f9c38695b21fb839e014fda38b663269f6f7a65e5e311669923	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3040	2344	iexplore.exe	28
PID 2344 wrote to memory of 3040	2344	iexplore.exe	28
PID 2344 wrote to memory of 3040	2344	iexplore.exe	28
PID 2344 wrote to memory of 3040	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70d261e3a4e5178474249441e512b66e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df74d71122418c541dde30663cebab44

SHA1
a2be5141136f12117cc095df5b316b98ba3eda23

SHA256
1249fef59f3558ca2e40e814c463f6f2773711ddb7148552e50e2f4ab551750a

SHA512
6819701d825fd5588eeb3a3df621f594f7321eac7a5213be647f66e33e173d1c110797881e4cbc2d140a8ad9e0ec590d7e99498bde4d881d40ddd7090f980a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b939b006608c229d97aceb2050be6f6b

SHA1
d516cbc066074917ef135e713533482cf134c927

SHA256
77ac51c6f9415dc6df76fcb3053882249c55f0bde047030e8e188321e413e72f

SHA512
e91fe86f0bff21f0eec40d0e16730de89976e35ea549471a78edb431aa2470ba23a04fad12b4ee6d7dbfe4586c6de2827b23d3d1510f75bceb5042ab35447ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eba4877cf4d55a7d16f9883d71cf0d54

SHA1
18aadd1f9108d2d8b256be1c93073c9d95d179a8

SHA256
85a3d972665c02230f0e6d0297b1abe706cc69ea1ca81f392b57a5c2596da1cb

SHA512
51b42817b0ddbc595f9c09913a0af45762355983708487a9457ed64f706eb00ed7f25950b6c0284b1d722c5189d2d084860d29cd53c4e9441f1599a80f55ddb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad12eed001eb657d0c421a533d32b63f

SHA1
06d878599bf104640fa7221be7aec7a3b091b9a6

SHA256
e2ec4646e325728248942e52c5db99ca1cac45a7ce3f8a218cd35c9b958752ae

SHA512
02c7d6f0b447e072bc0b00b227303fc0a24ae26f5efb0b0880da5e888917336ffae3e3a761a49bea4fc770c8c5d977087338ba337708ea60e1eec0170fb496b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44fd25a9cfb98c2dfb0bf1a2bb151877

SHA1
461713b1d082dbd4575ca2c81872895fb4e0bfe1

SHA256
703681de78a49fbffb25276d7b27a0d7018153cb8970921b0de2df3ac08ed947

SHA512
fdee70941d4e02cc932e1485455da0e35b5b5ea2b4c4ad95027c1b7bde5171102ced7552ae34cd7f51a28c23f73ac754d9aa2702fe9fe2d1000db265a851dfaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f13cf8824a5d1c6ad64c29e2fffae72

SHA1
3e27b91d619dffffbd87c1c396984cba5992f284

SHA256
bc7799daebfa0e6bb290921c322f67f54852d65369fbf2e58ae44ea0f9669bdc

SHA512
3c2faa3c8ca09a4ece3d465becd0fd0366b84c5ccecce803495a32258e7af464c36c2a1f9cac0e3aa2456d8093ad3b1ed6991095bba157f9a45e69a41caaae95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff902dae588ef4dea05a20a4bb358fa

SHA1
aec33a50aa794b271ad9472212f51743b8691044

SHA256
3c23e89f4b9e70fc5a246f1372531765eb9303d884af568c38816f783831735d

SHA512
76f6ab3c588bbbf30d46dc0d836465320ab2e11be50a144eb697d47da9b2b8c066ce226694d8e193ea13f95c59fa83b495f68c405947e923ea34cc43e46a10c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7a232b24267de6e04a5407022366199

SHA1
bddee181ffb7c48e694cf70ee967f97f3a6fc9e0

SHA256
29aca5877e919e7e4241f191140cd49c6ef29bc1c1d6254b9c431c33f1b7ed2e

SHA512
5764d746738048592777ffba582ecff2af7ea6a4a0ee28d12a957e4aec3e2a1e7d874de105068c892acd9122f2ebb2186dd6137e9ce211b443c16bbcca5e3007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
614910120453e3cbe3f6837483fea474

SHA1
590f6bbd161631a8c9c6284402f14a816d986bfe

SHA256
a61a2542d6b2eccf415118e67e10f44e30730a8fdbf52ea711bd9d4fa3ec43f3

SHA512
eee300b31cdc96e65238881c5d0aec02762cdcc282c64a24e61cdd79e48826fdeec948beb70033f62abb68b0c386ae3a2bb8983072ba00ace2c683f417fc7ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\px[2].js

Filesize
32KB

MD5
f48baec69cc4dc0852d118259eff2d56

SHA1
e64c6e4423421da5b35700154810cb67160bc32b

SHA256
463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c

SHA512
06fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CE2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D45.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit