014492159551ac451100f07e181cb2381dc2e53c23592fe6c2ca8bf766509b94

Analysis

max time kernel
136s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

724c7d23558980e73b984bd27ba71866_JaffaCakes118.html
Size

139KB
MD5

724c7d23558980e73b984bd27ba71866
SHA1

d7498d0eab399347f68d1617ec6b1251d05ce13c
SHA256

014492159551ac451100f07e181cb2381dc2e53c23592fe6c2ca8bf766509b94
SHA512

8a0afd8b8b65d8da2d60d26adc2b95d28250405aca17b52ed3e617e4eadf5b62a89a3453bbb01ba7b544f16f059b3cf2794a23bff0b61dd0d8d98cf727cf8d6f
SSDEEP

1536:SFtc499Gu6Rl4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SF99Qu5yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b357332bd2b292c39e672b486cb653e32674d63ce0ae38b8645d213199f06c67000000000e8000000002000020000000b83584c49c7464af6334da65bf7c911645b86b7731b43a9cc20cc8c6b04c596290000000a4a7adf097247feaa6854afec5615a8f8e3a2551fe01595844fc5eaaf449bcb363ef21bd9c162b9073b80cfa94dc7c70d121f19bfc688ccb63fab1826afa3ece825dce5ca1a8ababaa9d45ba0c622274204b27f2a17d59e3f8984fd751088ce6869cd3f15467776e0e0c1f5f6d740c535a88cc4eb5cb3d5e103f9408d2185f6de16b8f97e448e15701f6607dde31fd634000000031b008db7ed002477c9ab4d678305a4ca0e5744bdffeca9f6a7a813df6b71b199ea901f647bc294ef413d0089a3271ffcc640f0f6594f5177e8f51c5a431ed35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{055B85B1-1AA9-11EF-AD96-EAF6CDD7B231} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422811741"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000002535738a872f3f1aa53a4bff5f2b1a666c8add875f43729b0a12b0cd44449192000000000e80000000020000200000003a832f4f2af4c750fe6f3023cc673c6c0da7f9c8caeb34adea7e30a0f7ebb85c20000000760a1594d5fc15752e4c3b178aa403e26e7f79cdee5f89bf9c01566ca8ba4d35400000005cfc85d2c1660d1ee66d7c8cd347871f6899c469a66c4c08aaf32f8ea37a6afc6a71742a4b95d55e7c318f2af054fac1dbd6f0cb7f4d1f1339b58109a98f534d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01cee18b6aeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1280	iexplore.exe
1280	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3044	1280	iexplore.exe	28
PID 1280 wrote to memory of 3044	1280	iexplore.exe	28
PID 1280 wrote to memory of 3044	1280	iexplore.exe	28
PID 1280 wrote to memory of 3044	1280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\724c7d23558980e73b984bd27ba71866_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cac0d87bfb7a529d28e278316d8bb00

SHA1
c7caa387d39a399b2a07a909db8ceca29e8cb962

SHA256
77be053e144e1e1836a47a9527d16791387918f87d6e833ccb692911018b36e5

SHA512
d9bee0c16a92183e69865200692d319e8fd525586c21ba787c7f04fc96b55d58c472c57331fcd62acb15f81ef4e0009821649b3fb4e91a90bf239a8729cb5bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bbc9b9c044d7e84c83387867c0b2ff1

SHA1
5c9e75de7c79e7fe44a66c50695c22354d15408f

SHA256
53006136d0c103e9b071a00ad30617c7193bf0faf504bba159ef5704cc75dae6

SHA512
97dc501241f69e8ef68f5617177f364342c34095febb275933ad29d8218bb7c3a9969b5f8d8b200fab521701312a2794a9cc3f61203d8417d89ae37a73b0f359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7656c828d2ffed9d9452985cfd82de12

SHA1
b4b287a8b409232267a272071d0776aa224b1d78

SHA256
5c7900ef65e0bec6f98d7e7180301e182562bab7ddb54e94437451ab1adceba3

SHA512
181cbd92c86cefcec88ada63e44c9c64d29c489d31d046553290993845b7ef9065a81b73a93f6079474f1a79168faab1c0fb65b873e9918f4a4cf8e0bcce1f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c9340e04ddadcfc427f5caeffe07dd

SHA1
5cb824d14be277155901737a1087d12d97497904

SHA256
edd28ec12e1d15ea59865c80fd9b850df0b268ce9be69b9a246fdd582c95d82c

SHA512
3b349ca63c9f6256f38c82f9805222893402ef589477a813efc5033500adfb86828bfc5004d8a32e5e0f7be80a0aa3c79eff9f87aba501ce52bce6facca73760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8201c0b69b8b8b0e8d7dadd95769bd4

SHA1
5ad75e826a89d9a54cfbf4c9bc8dd655ce7accea

SHA256
c0c17b8d3aa3a252fe55f523c0cec6476c30c9a7d27a2cff0c16f43b71756630

SHA512
3f11b638802e53ae30c30f474f4b96438e63ea7a9b02e80e6249c3bb97cd0a7eaed1f64af6d62c1fd028000fbdd130981f1e1c7ba71337ce0472a2cdd81dec1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa07600db525f9277c0a8ce9f8810e3b

SHA1
904d2642852e59d1d3210daa13ee48ceb7315eb9

SHA256
ef8a8d64398217f30f8fb616c06330d8996e2733fa03abb08ea1c632b50be506

SHA512
18021224e03084d97d1f6cf8dd52c5bf38fb53cf5f7e42085dd970a394f48e0f89cb521633f34097a00e4c66e7b635917ce94d0ccc8aeae2bf5ef2793424db77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d14009bc7150f08225d55e5062712684

SHA1
ca52919efa2ba90ebf75219d2fdaaaf773f5e58b

SHA256
c88ec10cbae49fc19957c45eb4d7a8d40c91c865271a954b77ed9ae128323334

SHA512
e41adc3f4b525d2d0593a8b0d8a7ec63495d62a237cf75a1fb8977772a9424940b15e23e0ceac8289b4db474ed3a0eac25eba1621e13077b02066bd32e101e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e89148436b5c42167bcb44ad438fbde5

SHA1
550259b3e62dfcc7a9ed0451433cee5294c01121

SHA256
688e36ef2996b7c21244fed00ce6d447cc8d1112842ea42d9192e2d8f39047f0

SHA512
06313ef5226eb6c0459ab4b2c37360be07c8e338432220cb499648f9802972d863b07043a4bc489ce6364cb497a90d93140c719041d0df9d75199a14f2cc3ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
380131155e1f191434326060c8cbcb82

SHA1
9b5eb5d82bfc9ab0632dd6ff561043307f6f6cf6

SHA256
431635b4125bb89c5fd634d0dfa21efe8f8caefeb3335a15bcc97dfc366d5f32

SHA512
95618158e08444491b10f7fe0ce7d705b0728ca88329c620443b0d76466341929f4f574da4121569c35528e4331a1588bb110a364e6a5550663f0d3651ca2ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8665a606c7a62320b72ecbd1352dfe9a

SHA1
91f657c9c093531115c6b733214b73d19c64154e

SHA256
d1cd944e5dc6c05b1928e87b35715ac635d27699b559154b283c74a261816f4a

SHA512
5365fd180b76820fa1975a4fb06b6124104fa211075f09fcdb94b4b9b0a3c6ef53e70f3483efe6103bba8754a57ffe2d9a8c2161f60384f54e55b35000fa5184

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab230D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar239C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit