d78c77145fec2e770e404587ac30ce13b52fca7c6a04179d57aee54d101f42f7

Analysis

max time kernel
142s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

642885d5408e5e70738a817f480ae473_JaffaCakes118.html
Size

14KB
MD5

642885d5408e5e70738a817f480ae473
SHA1

8656a81b5502e50e3691095f58a38dc97bd30bf8
SHA256

d78c77145fec2e770e404587ac30ce13b52fca7c6a04179d57aee54d101f42f7
SHA512

a93e86703d8f67a4fdb68f91480f5e1afd46a606581ae8fd65a0753621d63a625259ab3c9e90b1b20ae5f90245217514594861fa3fec29ccaeae7c42df7a0b5a
SSDEEP

192:4JaQaQqCaGrXMvn7zHb/1SHJttqoaek9/F2YFEjChWpsZHgaiBHUeOXsQ+SVfrGp:cPg/Ji6j9OjCo8Cj+Vu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427832195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000bd7137bc9583825240feeb1b62c7f57257b21d75a45ed8a0d42a26d48866e927000000000e8000000002000020000000c3b0b92372ba8927023587bc33d2b6727073c24e39dad78ab35bd7b0b3adc34e20000000158bd06ec454c5dfc765f029c707f835f2da4c9a10235d389a9e1d0e42a022b1400000005f877522b834126caa58e97fe599e59c44a8bc93f75bbbf85389e15013b1c58c9e459bee13c64d8f0c1ddaa4975e9d71dd3788db5a8485a6f698bd21a4e9221f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006e9bb42fc54e72301019345c10b3a2211d527b2235d47c02079a994e049f44de000000000e8000000002000020000000a13e6b45a14f0ca94b40f3a38f1e9396f310086c42ae20d34561c50db231d7b090000000db7007dd318a46809fc64b22a75d8bf22aa53f91de7fb86051791381c66b4748b928e4a14f859495a31bac3330537db433b36eceed9108e6c57a4dfa927c353edda69fd395b848f4eabb85beb92d4878bcb8f46c0af3bdb7a13a72b92aad2dff67f6ac7bf3917bb27cb6498aaeb68feb6de91d0aa6254a787e0962a0661573133767179a72d08dab50c8ec466e70b27f40000000f20b9ae5f7ec8cd87aa1da4e1d41821a826a4507bc2b15500cb7efb63a03c62afb2b7b717ed76e4e7e1c7a4bec651db2ecf6165f7fae638a9b4217fb1b7a1117	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609b04065fdcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D5201D1-4852-11EF-9143-7699BFC84B14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2568	iexplore.exe
2568	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2464	2568	iexplore.exe	29
PID 2568 wrote to memory of 2464	2568	iexplore.exe	29
PID 2568 wrote to memory of 2464	2568	iexplore.exe	29
PID 2568 wrote to memory of 2464	2568	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\642885d5408e5e70738a817f480ae473_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
787244af0fbfc95d2bcd12e4728abeb0

SHA1
dcf8b9dbf68408fe751df57f63daf6dff3eccf1d

SHA256
0f535d98f15fa422f719c8048a5b1f2be8cce8622a08173baee95a209aeebd2b

SHA512
d7f96a3711553fd253dba7d2146f29dcc661aade2c17c974b86a0e712682a7a75e643dca220ba1dbaffbb76880fdaa9f59b8f5a55cd76598aa7f146d7ca8bc5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22dc9520f1c7fd64a525c40970fc75b8

SHA1
e53d100d6f0e058263b255cc37f66d4696bd9a6d

SHA256
d586bd7aabb314e41574c74f51333c3e70f6eb9df1555258735c28610948086c

SHA512
4e154db6b457d6f80f9ac7663ed4d8d6901cea915fc95a95df643fdad71a14471ccddd0e2e89102ba7c94f7e767ac8781f2182a82db2bc60bebd1061d2d73559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12a865d9dfe4a8dfc14b4ad7c150f656

SHA1
dc0c2175e2ac967a9ef1a0800774df5b6cb47f95

SHA256
2a32a91a81aba49226535ac65db7015b7ce01a6c50b345035ef22ce7d7919954

SHA512
a7199e44054b1290c594ff501d51db5ecd1778555f02651da83bd4daca3671e55e4d53cfd3527249980972b9bfd1f11acaa3ba6d8573b84fd86f3282ab68c744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb3074e48dec446b2f898a764e9b0502

SHA1
5de96c92f92d5877f5e77b61b897dedefd4ea5c3

SHA256
7b67163d23d2889f3168ccfb6c90b857f69aab0b2259042b6550837551bb671e

SHA512
4aef7a10847c24c5bec1cfb72f3795b4994c50d1ff62cc89410378d05c0902350be4e19c90a6fd948414294fd617fd15a3ac0d1f31093e6f7de4337321a8a482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a775a7a860cc6a0cc075ad43801460b

SHA1
b193c5dc7d6e508a0f712df725f334ddb6a3ba61

SHA256
cfe096942afea8002e6074ac87325ff00ca3cc8f77a6794feeef2da8ce9af19c

SHA512
faaea18b650b36dca48933c1227d55d48abb44d88cc9ec7dc83f1772bc5ea5874a1502775b569f29db086fda911e93b30032fab1de4958d75f59cca87286302c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00f36a867699f1121a151eda9e08390c

SHA1
b253938518801df2e00133060a30f919c115705a

SHA256
84d778c63ce1a2d1f0159c3b16503017edfe07bbf0fd33bdffd8a1a338b2db04

SHA512
7662376268945e1af2ac8b248c1e8394b6046e4f12467c4834abcac8f8b5d9340e37b16397d788d7b21bde020f7b51a74afdd6adb998551be2795a63f304d05b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9201b64b437b2549321da25d2cbeddfd

SHA1
23532aec5fb608e9926ab88eb6b98e2b22c1ef31

SHA256
c50f64ca2069cf50ad9e9be80b4c15e7256abf54d7a27a1fa7c6f69b7093b67a

SHA512
5a553517b4898b2de8476ba5daf1a930971f29772cead8766fa3a06cc587bb41c6f9c088d7c6f55c28f8d5c5f5ab31172f956a6c5dc62cbff5b4fbe50a1daa26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a68b0c48f36d59ce913b3f04d8d4413d

SHA1
f3bf30d0925975b1241368e337b6459bd98581c9

SHA256
723834f56bf19ce16d58c3b5c4b3da9eeb43d83cfcd72cfdad112ee0ec7bf685

SHA512
a905ce650da3ac82741e52d104b7f4412c0099a818302d771da9a23b120dd522fd670f0c876370cfcb263cb85e971f8d65c45c163b13043ce31268b2bfd4f90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93cf67df52596af10294a13d010f865f

SHA1
7ff35e9ab97c86d342b7bd89a74b6a8672e1d8db

SHA256
2772bc38d26d4b061e9661dd26cd32605be63b71408c70b37f6775bf58f4b607

SHA512
7dca3e7308882c59b31eb419b2cb3f0786ad56fb9235c8519f10b296dcc842d5712ad28eddc9a15d74c20a0dea2fe9c4e8805d2b57f95d00f5adcb017af8c10f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cc043e2a06e6900c8237b182b24ff3d

SHA1
776434e7e6502fdf5b7030d2fb80b70960847bda

SHA256
e4e3a8761c17932237d0269079298a6176cfa4e5e1387ebf3dc887c3d1ff1a03

SHA512
3e732ac5b4c7281a3c91264a48deffef84dc12a55734d94b257c1176cce3d34cb0ae25ccfc76115bb0c67c8ab76d8da593fabc8bb18f142e14801245dd376346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e6cb4112bfaa36ead8ec52f97ee3a69

SHA1
54aee158ea56765cdf10554b6575794e4b0113b6

SHA256
9d749babdcbc5d7bf6836ff30f96ce264a543bf632481ff14b2ee8a507ad65c3

SHA512
956974fce58e1ea20c6f779acc12da5c2388c63d30245b6db73e27c55ab0d2278383cc856cce0514b2605c02943304c03a465798717062f6ad05af4f981ba037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff419e135fb930ff9ffc9f5405f365a

SHA1
5c74edfd2f33c4934f6aca1ce2760710c63d5c8e

SHA256
3eaf36fb5a9ab6a34f5458309b16b06b69f072197a5793e8a532b7a3fa055df6

SHA512
ed5f5d580d99d0892e5851f20880d77b8cda919dd143441ee952ed0f8786330ad0aea9d2c1258fdf458b94e99e03a6980b23ad9b34f22a4e86097ee58377b444

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE3BC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3BE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit