e972c6256551a4803f1144251ff7a0d5646995b326d8f20d54b6701d23a73ca8

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e88ba8cee53f245384df1bdc0950c4eb_JaffaCakes118.html
Size

6KB
MD5

e88ba8cee53f245384df1bdc0950c4eb
SHA1

8cf548ab6b822e2a7d9acfb00c6c52cc111f13dd
SHA256

e972c6256551a4803f1144251ff7a0d5646995b326d8f20d54b6701d23a73ca8
SHA512

0494272d495e451e949e084952c1dffa0c34488e07301cfe9dd63fdee0879ed53cbea0d6f438d9af1b4d7286cba8a0734b5bd6327575b9486404d43afd619aea
SSDEEP

96:uzVs+ux7pQLLY1k9o84d12ef7CSTURV/6/NcEZ7ru7f:csz7pQAYS/Y4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000e79cb762222e882c164cee0f37e4e45ced2d98356fbcecf045f79b51c801d72b000000000e8000000002000020000000fa5073aa71312bd0cbf005ebe06f43e5ca80af9f683f5573d4b6bf4c601447d690000000f5d5142b2e9b58110ab9fbd1bca7b47f11cf2dcd859c9ad0b435e8ab75914c629fd3b6afc7268cdde74565eca441d7b5badfdecf197fbcc8ae0935798514153d1468d8c7994d888c087036a17fb0182884ee18ad48258f574e5d85f430a379b9f7a72bc8b4228a5ab404e0c2fad3a52da1eb46b7d571c22def5faac5d0b1f0e218762057ae740e05f86bf171e7d60b264000000019f9033f5fcc3de91bc9218844b96f541a157eea31292ea113bb5dd1280bd365760750dd72ea8eea5b3e2c4f8bd5802d64de80347b17ec344b35372da36303df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000004e26b18701269670f33f2cadc4905af1cd997b3189d44feb3c5b00687975074000000000e800000000200002000000085b510a78a8680aade7f44a9276d17b0de49c3f5a991fca4edc0edf4a5c8b4b3200000002d40a909f37560f09fad0d77775ac16a1caf2c5c110b6afc7aaf396bd5a9c9ac40000000f1a94ec03aec91883b26cf382f1ad80d0ee828b04e8b48ef6c71fa369868017f784c8614fb2eb78b4c2e047e8c246fc431016b8461dc91ede456a054c4ebaa68	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418776414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00458d79028ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B6FAB01-F5F5-11EE-BB22-FA8378BF1C4A} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE
1572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1572	1680	iexplore.exe	28
PID 1680 wrote to memory of 1572	1680	iexplore.exe	28
PID 1680 wrote to memory of 1572	1680	iexplore.exe	28
PID 1680 wrote to memory of 1572	1680	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e88ba8cee53f245384df1bdc0950c4eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef52a2bdb20ba0c27384069594b55629

SHA1
1d0cf8791e1985531cfa479f2b87ee36082ad6c3

SHA256
29c8d9dcef9b9e2153076e2a4c85ec4bdf4933e164530ddb04d7bdffc7ca66be

SHA512
e3aabbefb736c88cfccecbd754dbf3d1f55a943ad61c3460e538deb581028c695bc7a85f0149f4d485bf524b163fc2c252808d031c8a4a39fb9be0ef9dbd84b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1220c360cbf2669f61fdfb953bba6dfc

SHA1
db151bf7c028ec8cb16d28955cfcc99c373c65e3

SHA256
239e87cd6ba2e8e9054a9764d374b7fd3a9bf5ebdc9b2b0284f2b759a238238c

SHA512
d4d42f0bc6f4a3b124daa5af386c8e82110fe5dcf9cef05440c190551ec8e1bce95a374cea2251002ad5a30b1960d1314d934aa5fe02365988888d1ad94ce406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f3ada78e08e0bba183228a398b4597

SHA1
ab9af2dcff64950421d73c26a4453725ce13c7f4

SHA256
890dfd9ba6ae57f2b519f1bdab0224f70a1f2a2d79434bf47f27c5913c4ace3b

SHA512
a08736a55dec13350198a4a196a9fb4ad9a4a53d82efa73133cd21dad5deec224c49acb073a7b41a75c085faf2b42139e31b6897ebb7021a9eab43db4473717e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e7d8f76553d83b0b690f38d15a2e6fc

SHA1
27a52d5caa858792514f1c78c5be67fc6102e7ce

SHA256
ad2746c26c48090a8bc4b6d3ad4c4b059f5ec84aafae86727988442b9ec43067

SHA512
75d0a2e3248e7cfe6cacdf2f7f0e36491f177a2f98bf0a6c5ef064579b54c16c5e0955af39cc6b0d844116bd33d4e20e9671de59a0f98fd970195d809be8bfb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e886555045f266333c9c6cbff74578

SHA1
c8ca9f70476320505d86af0e7ce109e1f54918d0

SHA256
a48901d014ebcef438c4d542debed6ec10d2967f6a1492f1c39a019df862b0e9

SHA512
93065672efd20561679fc47d52570cc29b16e5f50e2028599db78b2e402f8dc25096d2d71f7bd3ee82587ad6c813358c0ec1249f2a6272ae2f9ab1be1c55f416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68e977b51571034f6136312cdfb187d7

SHA1
84728f5d9a11cf4bc05bfc769c62f9156b4a697c

SHA256
61a845f6cdf794ece2d34a97b6340c910ecea641838b14d9d522372877a6d8d9

SHA512
7c10afc11dabff4bfb0118e913293c229e7da15690c326e780eff691021b4fc2390f90280c9f4eebc2e5f80a6fc3eee70a71d8f99e3079f4af3eb591be2728ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
332e01758566057b54f36d4980f61b4e

SHA1
e169bfcf47d185a4990f945fd332db7091c74adb

SHA256
bcdf578fdbaeefef37a0e29222bf68beb610e5372af7f57fd829ec69626ee5ec

SHA512
c06cb7decdfd59c31f35cf0f60ea3b834541adb3faba8693f787cdda07a8431b3d59af2afec3c65faf987b488d034be8ebc6cb00c752be6b4293444cc6419295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e797b4a83934293491815a7b3f58bd0d

SHA1
b759fce9c2f2ef3104a5c8e386f634d6aa8d47ce

SHA256
97a07c0652cb37f5df89a6e1f7a6ca9049058eee9a9d65c8b4847efd3ed2cd0a

SHA512
742699df858110ac9d5db652f12619d4cf6d18b672b1826f6f420491725d4d4bb6d4ecf35d54ce2a37e5f52d89d945b1b3edb5e979c1372637cccd1b1bf2f17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c17dc3117cc55b2ec369d89b776414

SHA1
ee900b3ddc433d5508b351652bd220d8385cf92f

SHA256
645a457a7cecfee932626e5bf88d191ad98b41108be6a19d9f86eef17901dbec

SHA512
5b744f7aed974167ce4b687551d2a4ad180bc94644c2af8d0f1b569d5e396766f068dcd3065ff2d5a3ea321fc172cf3a3bb0c11b54ae65a54402eb536dbf42e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
104d04d0c5218fbbaa7b2fbffd2535e6

SHA1
7d6c070846590dad2a025d305b37380298747bc2

SHA256
aa105d494f8be1c6a50e60a97c9dcea08946d85097e864e305586f546024fd4c

SHA512
4b4cbc46e0e2b628b7851fbe88fad8a4cabafd8e1f919734153aac1bf45d0a90d3964dc1d3e2c06b9f0e3f936d156aead37ce1af10fbecbe3438cfdc5f7f2980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2843787970bc927934a6fa358554959

SHA1
c4c0a8c7fd341673a456d21eaa8e04203b55f078

SHA256
072456d58be251d1f4cf429563ef0cbb19a08cb3addf4f4aafa2be59717a7677

SHA512
a36a3588949db9e9e1f19a2bebd7cb71e36fa6e5694fc5e1ae49f5e5986b416752588e796417cdcfeff303ad7599f9e4660c1f577f6bf13e636150c191ee8cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aaab469cf93ce06ae4c51875668aed8

SHA1
62cb6b30b1a726245acfdaa2f41bfb60071214b4

SHA256
9edb6de34501b82dd55b84eb63d6aa9f8e7d4e72fdb3570409a4126637ad9b2c

SHA512
605e7c1020098522e231797282f502463959aedfc25189b55036d72475c2d465fa920d90f52c70890172ada6d3cca06765c0ec9721a2ad183e0d97c151de96bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aed2abb5f295789773e3cfa1b697bfd

SHA1
73b55a14ac31285e6e90d046917644724246d3af

SHA256
7d29314728b1e00cad0a38788895fb6711e4e956793be289ec03011a95e7a3a8

SHA512
68892de698e23472828978a91ca149bbe8cf36f28530de0c90757a75d96f9e5a605292e97c07fe40dc3926eabf659b72a41933d15c7138a8895d2cc161ca3a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6920efbf3cdac1060d18110ece7786dd

SHA1
b5a598ba25cd2e75b4d7e00e39b0c96ccee5c11c

SHA256
8d1c80c968db8e5da1625fc22c847e07015bce7171ddf225e207b784483fb7a5

SHA512
079e72ee25d7717f024a04a6b38d131c09d585143f8cd958770e1fd42a8fc78ce853a6519ec9f8fff7b65518255b4c3e46037227b76214c9c9809b9c9fcd0819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d42bb5e9e6831e8c6bd31858cd8dcb80

SHA1
7a133e78bcb00b2c86d676650037047a42264e78

SHA256
ed9ad6a58df68d91802452817e3020d127d7b75539a397df6623d6b2b4283370

SHA512
461a818b53dc9285487d4e37caef5da70deaff7f3829aca83a37aeb0a75c1fbf5afe9711f9b74268d8b3ba8f7caba58aea2f77f899b6b17e80f2e65ee76a4c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f76ad4e6ca58b775bf59969082029982

SHA1
c9a8428d42a3e64cb5c19ca2ffa9799f5d26a286

SHA256
ebfd45daad67a5bdb0f6753d2eff78ad02d388b679d05b151c9a56b68976108c

SHA512
c737b6cad667538e660511befcc37a61d8ef0f867528cd8a6b711141d40711f8d7fbff6c9e4d01e92c5cc9bb4909bb446c1133c4e6dc5d1de878d40bda3f9d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit