ea1cf5ce5061414786d0ec6a62194104198ccb94dd882107277c38e4fcc0a01f

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22c00e39bebf44521af1da06fa652706_JaffaCakes118.html
Size

5KB
MD5

22c00e39bebf44521af1da06fa652706
SHA1

d24c1e03268581c09cb5dd57ad2a9f6dbe92060d
SHA256

ea1cf5ce5061414786d0ec6a62194104198ccb94dd882107277c38e4fcc0a01f
SHA512

5bb8f01bbf169f9afc38cc6a74ff7c849a01a1de3a69563a08f70a9b1d90d46f4d1332ab5e0f8f99dfe9bff81eb56cd853f2bdc2a50e3a45ab252a911f635dbf
SSDEEP

96:yGw3NxPTSpNA3djLkBP3lS8WS9lLk5Rl17yPTSpZwv8uenVpM:yGwXm4Nj4pJ9lsRl1+mza83VpM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000553a5b26e7bbb5060f517b6d396a745f1d1676d7649353c103e74e33a8d84d94000000000e80000000020000200000003bd0ebecbb0a4674679261d2b23ae724d8cf704f696160d02f5d7412329f15ca90000000cdf7e5a8db73d9daa60806098718c7e1f02a2b5aa0a7f49f8a5086cc6ae23ceda44e25619d1562f285cc3c2dd51bfa64f1600e1e972c021836ab76430d25fc6c22ad971e97b7e89df7b0b03dd2af7aa2a486f210fdc0ae520be1a942e1636a80e7a525209310ebca8f9b1f19865f67a27a9e7c335a2f1510d693760e1cb96eb7103d858ca572bc4ebac0af0f2311fa53400000004694bd8498f88f8325439650675907c666e03ec6c1df921187c57bc252243710566c324050c99151e431bba4014a0b4dce522a621425cba2316dfab454bb6f8e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{422C8B81-394C-11EF-8144-CE80800B5EC6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426180389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000064cd073e99d4a74eb84ef1e9225a20216b6f30e2669694935b35e3ff1eaeae14000000000e8000000002000020000000647c7c26af02729678e7a663b754de456f0037d7a30249323585d164a3bdbdce200000006ead22d5d3fd3edf40a120362841e8a43ab67b8bb65290c49dcdd32fb3d6017f4000000062d08616aa138d7395f647ce9f93235238cfdf34a11eda004d27936ebcb1040153d1aafc51bf4a06a96ecc34f2af68125fc93b6901222ea8278232ea1c8662cd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70078e1a59cdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2632	1252	iexplore.exe	28
PID 1252 wrote to memory of 2632	1252	iexplore.exe	28
PID 1252 wrote to memory of 2632	1252	iexplore.exe	28
PID 1252 wrote to memory of 2632	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22c00e39bebf44521af1da06fa652706_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7da63acdef033757e73391237594dd8

SHA1
241eb7e18e5181cadffbe9410eb6a0aadacdbe6e

SHA256
e685ba60b69e9cb99bbca67ae54a0e54fbdd8251ad1582570e66fc5145453ef9

SHA512
1f016f1bbda0c19bfc574d2802c6d40b40d63f6f14257000f368a2bb849a00b085a1319bd9d792e15f6ed7dbce7a4d6bdb7af14b17b758920b5ba204e87a1fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10dc2b1feefbd89d922cbc7c3a78bdc8

SHA1
cd8d2be7c843a595e1d1578d8b55d487150fe643

SHA256
a7534fd803879a160a2323ab416c0b8912c40e7dade7159805f0907aee65de73

SHA512
e60cd6a035856c88fb960aca021dbf6e3bba6f41ba375d43c191f5bb0d0b185c4870e73d3095c586966a94f9939584668d47f96aa405d8f0f2ebe810fa86894d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61bc71a9e928e3844265801201935b22

SHA1
f2faddee54dbdc3158e7fa907098afff147c3b0e

SHA256
2539e9652f9aa2afefbf638a86f0503b1aa74642d011e349905ea02d0c60302e

SHA512
05e6780e5b0eb313ffefe54905fe3cf7765c0021bc969faf2deba5b5690f2a19191b207542c9397473cff98ce8beb001886d254db74aaf0ac2ac549882423bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed544a3a2bab0eef917502fc9aab1fec

SHA1
e29cd1d28081f31c22ef401c52c8739254919761

SHA256
c5778d705d46cd1d8b292009af4f1b77a5f3334b8c97635a662030838327de06

SHA512
dc94e3964fe0818eee6b27885afd4b81527d80aa242b32e1fcbaa01613d1e781df34bf435235ef438c14cdc0752f1d258d2198dba2fbbb3706d551b3d3151247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc5f726db7a77b05c94162a99245d07d

SHA1
08539113c99fed237973044f1404e578cf834c11

SHA256
ea04b38fb7ea6f1594a13e485eff8e620018fd5df21893055f2c7008a894dc2e

SHA512
48931a35a2c1981f2f455a0fbbda326727a7480079b9479895421b6b4d30e7b5ca1fdcc763d7e2e7be71e499e52a0f44c7fbefcaa6fa37f672fec4263a28d066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a575352234ab932152934d4a4fd384b9

SHA1
233c814f39bcca90adcd4a725ac1c87f4d67a9a0

SHA256
b47fd3d8e256180091601cf956833f6b1b4cdcb90e1dc17829a0f827de55e4fc

SHA512
3c1b7f6691c93d122715695d62bdede3874cca8eca49eec43d4ab58fc3d181e501a4d00a96e7c4e62bf170e9a9ff80ce8122a826cd2cd3740dd5946f04954633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48066445a9c7cdbeea5199017005cba4

SHA1
ed89aa69ee217ca58a6de1eff95f63c3b4cf602a

SHA256
01249d56975ee651417b1c9b4bebb63b871f8a52b20e29e4347ac242b58cace0

SHA512
8452632afd25c26da70bc4c9c603d77416b12f630642fbc4e370a48df1db3abc855f9d92c1e97825b2df15c4dd877714f7627b52b709425ab7666c6d08974e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad9b64b705251424ea5491809171bf04

SHA1
d133e8cc3b77b0b576cb8a4e84923419e5fb3b27

SHA256
f5cfee87db5da24f08a723be46cf6a15c8e38520c7eb4c06321b9ad227f7791d

SHA512
00b4782181e3a1062aceda7cc374af687f503565fffbf773951f18aa96610f4e0463071ecb6f41634d416d2211f2dddfce9166ea5353513bdaeff5828d79cf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29477ab55766881000092ef84ed36aff

SHA1
369ff30e8a66995a54e22c677de7c8c0c596c7d7

SHA256
774ce3a9ade07d8a9e8af759c077b30d36ab243f81e25fc4a421173efacc1da6

SHA512
f59b211b80167b381ccc440a139e5f6af2a5e21d825924744f07cca30495b842666ce518d2fc97895d896ef76bbfb514d611008e9c08633bf9f5ac7f1117bb44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a95039d05afbd8fafaa553083ac3007f

SHA1
ca3d86beb06a3583f86b4700991cc784bde1a32d

SHA256
f6dbe9080db246d06c8294a7e688bbac29c86a7d7358c24a4809d9f7c05860b8

SHA512
100570ac842af3861371649c50f68d91014616eae4af5a76cea14b6e6f01d77f6fb699e1e5310378c5c0b4c0a11dbe52a5c07e0e37adaddf8c2aaa447eb2914b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab877A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8829.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit