516d53e3d6ed3d1d9c588863c642170354057397078ed96fdc76334b30be92b0

Analysis

max time kernel
136s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a756e2cfc533de51a2d1da6c3383b73f_JaffaCakes118.html
Size

140KB
MD5

a756e2cfc533de51a2d1da6c3383b73f
SHA1

b927327d642d66415bc794026ab19007c6b00b34
SHA256

516d53e3d6ed3d1d9c588863c642170354057397078ed96fdc76334b30be92b0
SHA512

193ac973598a523b560fd3547603d2d06f31237130b04192040857f0a4fbbb24bb1772de2cc6d4619bfd5ba4f26248ee074c30035bfe614f65c532cd4e6307ed
SSDEEP

1536:SZFdO/9O6efl2bk4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SZeD13yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b61b03d6ae98644caf15bc24ce0bcf5800000000020000000000106600000001000020000000818916244a8b6b5acc00397fb3bfbb7a010bc39f33fb3b7356f8b2311cc9f824000000000e8000000002000020000000e1d843113ba039b44f0a4d5158af949846f0f52b23dc054c93e06e55f2ed3baf20000000971ac31ca72f151b472c519d9d1e83602cd777687d1b736aac61d82de0cfae7b4000000051eb644636a57567ab78db68172c0867b0e43aa9998776564cc21c788cf6d669727fac8c82f1ddf988efda5eba56e98c1a694a1dd94664d8d4ee296bb36a4658	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b087282bf3bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17563FC1-29E6-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424487268"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b61b03d6ae98644caf15bc24ce0bcf5800000000020000000000106600000001000020000000d50540663c8f97fb345b8078b1b544253f5ebdd8878f12d3633cfd7eac924178000000000e8000000002000020000000ac3a56cf67010e77d3acd06f97ee1a642a4665d32288faa032f68016d42fe7a5900000007ca210235b687c0584e0663e0cf70977e0bbe3f62fb12c2bb1bfafdc841f7d58b74bbc19d800b62f830670200fc9a0ce36e3b3cfd7cf827f30038701c6cf73415eebe9fe3c9e9bb57ac7e3ef4b76f03b7626cac7df0cc6e74aef47d3c4e71c14c154eb913d60a7640b2dc98aef1eb85d2344a644e3947e7d3a99fca73de2b4d31ef9efa8e8dbf1d51843316f07792784400000007a81b1c91caf93a6a42a90374636203b5de9fc0c45010b0572061fe1e6a3bc08d2a7fd3efd176aab8520322cfb29b7e5fa7f103432ce49d2e81f39c5b831e906	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2868	1912	iexplore.exe	28
PID 1912 wrote to memory of 2868	1912	iexplore.exe	28
PID 1912 wrote to memory of 2868	1912	iexplore.exe	28
PID 1912 wrote to memory of 2868	1912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a756e2cfc533de51a2d1da6c3383b73f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb092d59df2a1b55247a0474034665c3

SHA1
915355a714cb418f5a3108392436c18a28303800

SHA256
ac153b99d62bf0ba11841b4e4a6ff9b2a141b82577303a3d469fb3bbd60072b8

SHA512
7d74e323598df549d92491edb1106b36ff1dbeae2c9d4dc8fa9e1a28ca56f1384ce2b14c456a0c13c2a976c3df658493a1e3a36451bafe5359888fccc8bae7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d94cabfe0e0564cb85f85f0bd5e61158

SHA1
636859f1bc3d930272caa1d870be3e4cf71b178e

SHA256
5ae81895c09516ed5a647bfe6099dde1652f8601046557a6b8a6c8eb611e7a52

SHA512
3726a3f7f4cf15d1f224663447fdd3ca20b34adbdb02b9224f5cde86888124e4149dc38936e05603f3a90ae54591e2a80f9f7c028dc64269a8fdfc581209836a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
176d792b3f1b89ef1cce083976e47080

SHA1
88e0f5cf4d51c973f0b77a4dc783eb85ec33fd0d

SHA256
85379528b15f9356f594a74fee33150171fbaa808acbab9ef3e4bc117026a6f8

SHA512
935f55a00f82414e96d01e2d9ea154e6fad7990363d2220f89341f4deb25206e1e12ad193133e8a0c27e43d99e3d887ded375f0fed973618dc356dc1a079b263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94f926119fddc4993ce100282c11f0f2

SHA1
3d4b2ae9b9d61db15b43f613bb9e28308a37d77b

SHA256
c917f786ca7ea29f32ba7509b81d936f8c796b7d7e7cf22c4b58e59e49562fb9

SHA512
b28ef9d82ff27a8fb6c3f1602fc59579a0b2072cc38fa7a4d6e7ac6c65d142fd0001788f356467cbda4f7abc827f61aecc0cd0da98141ecc4e180fbcb4da154d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f5a38baa31907d070ef22e5b9a48a9a

SHA1
b70fe18aabc16e747e03e10dd27438428a1614ec

SHA256
07096509f37e239f266af13eca682403e4b3e290046c7faa7ddf9bbdfdae0126

SHA512
68fa3eba27bd16106cdab5e696c916b42cfc8511599fd85f0346d5f35c0b85e86d37bf5128117c129c2c94490bd3d65edbeac8439dd1f21afea12a36129f8398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a7171d900aa4cc5657541002930be4c

SHA1
99b7679383388a7a400c3a5fb371a13f98b84583

SHA256
94425edfd4cb3c2aff3892df134eefcb756f1ca83e3a2335cc947563bd71f070

SHA512
1a1c9371c1e264adb381cbb9f0f629abc033c779362e693381c000cb382b2d5acb54815a9f46eea6de384683604568d645c14ea4817084c73be38b12e3d08f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a651b28fbd3535b9a62ea34fc2d9b2bd

SHA1
c38245045c7e166b69280895af55333d2f451573

SHA256
4901cd521695d38b20e813605096d2d4254cfb254f85a47b133b4fc31709629c

SHA512
52d39ea5f77a2b4d8d05d3d687fa543bb52d62bede3a7b91426d729491e337e3c85d4b08037afd6ac80b5ab5227938cf73227bf9beb57f1b1c2b9b8dee8c714f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16192afdc2ba20698365a8f06c74d588

SHA1
7f400a588ec09f23bdf430bd1818ea09b3aaaa25

SHA256
781c8a4c5ad2494fea6d38baf80d4962f3b00b2419de6c7418c17870dc329b6d

SHA512
c9b5dfa9fbe75d5bda5f65dc36d08a283d2a2ca815b2914794500ad4cb465b50538fc342b521aca455acf4accbab009bea3736645430d14f8e32c841165f6cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18a48c6fb6a922b28fe9d7308e44ac7

SHA1
711e270c90b5a4f4d3e0ed56cc10732d8530ef21

SHA256
646786768b254094e46a44b26e514d5de909c20882e1576e0ea0c3a536d9253d

SHA512
562ac0849d916c44eac6a632f74c01a4cc0112da86b43c3c129817a7815b69cd073d8f15c1853b3be98e750942856982e564b0eb6a14445655b7f7a8dcee3033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654d738c4fc951f77bc59e793e872d95

SHA1
fff69d34504a8beb3a9abf149b3384928fe691d0

SHA256
3346f65af34ffc5aad4477129aa6be0d4019d9cec79b2ab4be762996302f0114

SHA512
e72cc261ab482100175fcd8b362b738081920d8b80fc5c7f165f22c7e7009f60ad104f816ecd301f9943f03ba524b3ae510f362da770419a1b7f16682624e21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6332bbc6457ff6fffb95e825e97518d8

SHA1
c64080f07969885888b0c299573e1ecf1a7f3741

SHA256
a4ce29b266e1c08d25907f8a5341b9e972b12a6e1bfa7579cda5e46cbb55a33c

SHA512
106355ff7e99414df33451c211bdc154de88030bd70898f61f24925d8a3d749c4cbfeaf1573c8052dda8741b7df2965152524f096af9c7632b1c4997eabd12a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
957558f19b4e82d5df2c4b2546d6ab16

SHA1
442c7e80e5cf5b68b4e4feb5f8ec4a06cf047673

SHA256
035cdc457f21fb2dbea7a4c5375a09bfdbed54bd7c7ca3ef59d91cd7540781b9

SHA512
af014ea5824ec3b6ab16246f6697eaae2d97221f3b67eaf77db525bc8ccf09c4efa9e53fc4b52252387b46e92d36fb7d3227a9df698ffe7ec1c4f8ac4f83522b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE69.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit