e46d161799bc2d5e12d1c4b5c54c50a0e6ca8442fe802b6ae7a552567eb88126

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8d4a9917822fe8c5292e23c04948fe0_JaffaCakes118.html
Size

6KB
MD5

e8d4a9917822fe8c5292e23c04948fe0
SHA1

1d2139d623fad11231262bcd9427daecc47eb63a
SHA256

e46d161799bc2d5e12d1c4b5c54c50a0e6ca8442fe802b6ae7a552567eb88126
SHA512

e5ef186c5cc708e1332c7bd46b4259a1e721dc14cb2efaec4d7bd7d513248d93e8d12840bf312c170812afecac8bd7667eb98951e385c2ee6052ff06faab039a
SSDEEP

96:uzVs+ux7wbLLY1k9o84d12ef7CSTUdZcEZ7ru7f:csz7wbAYS/Eb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000c9c6cda8f623ade016bd5e9a43e0611adddc5811272e517e4a8e1087fa21c697000000000e8000000002000020000000acf191847e2699fed76beb6fffbff1c27ffe9debb58c6e00b255d391af8c58a4200000005af5255d58a49eb2ce8dc01d2ea1f526a7cdb03059c3e29fcc17c55ed664ab9040000000bed9e66c134a06211514d119abc9db4fe5ec888c0d0ae8d1b0db67b335df1742524c646d4b00c2f39f97c2d04fa7a5b54579df02d57eba9226651a05b83ad513	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ea071c188ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418785746"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000002d824b9537895506e522b3d55c4ac176087cea2dd9592dd1ae7b9aabb621c67e000000000e8000000002000020000000de5c9f31a6879791e57920ae241b50898b443acacc62f5c9c0e13909ca17b259900000007a1f3581e91ee60d3f187a5d9fb25f4fe1bf39880a0002f57a04fa32ff05560e47bc6919ec614dbbc42f27cb9128a3fab5b7c900f41373fc08e1b2bb2c36b1b2b91811b78d0e3ecfcbf54939c0504806864d84562c8b9017f8ff7e4c21bd4f266cff6e95677d379e9671fead9cde77f6aee9cf47cf8fe6bf0c9c3788168092869247ece4c6eff43593926cd740a8623840000000ade37531f8df963e39169b33b3eb24a5ffc1e9dd82b13836bdb69627c238ca4da43f4002d6e3f487e0b9861f1f8e98fedfaca1c16ae97c64d1924f8b2494f00f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46EE7591-F60B-11EE-9CFD-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3060	2972	iexplore.exe	28
PID 2972 wrote to memory of 3060	2972	iexplore.exe	28
PID 2972 wrote to memory of 3060	2972	iexplore.exe	28
PID 2972 wrote to memory of 3060	2972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e8d4a9917822fe8c5292e23c04948fe0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
149e1a1de19081f71e30fcf77d01f17e

SHA1
ad607b9fe45bc55690c3671157aabb6fa53db722

SHA256
e6f827e208f55a0d6e83276e18185f5556fd27bb1a0d9866cd32a21ae3b2ca59

SHA512
e546430bb785b16784584129ad927b5db9a15552e382e3378fc4e0f3eef1597472dc6315b3bf3b3fd6b891278599d3879c25578d6a04b002c97a078c15ef5336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b51dc55e751d06ed65b548745f9f4868

SHA1
7d6270b591a863e9ddc5f3116be2ebf0ba73eba2

SHA256
18b9d1ce682db2e375f6addd1f16d7da09ad142f4c7d1111358610a322482566

SHA512
01b84961a7226fd154cf022f4c026fb54e33c1098fc0028eeaf0d15fa92854ff7e3d4c61dfc779e5b503d25d864f38359bd3b185c075a64b931912cc35957bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bca661ce7559cfe36b83f640f2bb4b05

SHA1
354b427920fe71235a0b1f11e74c439a5aaacc0f

SHA256
d603fb59589abf9904cf924fc0548b9e5cec6e9c5ece4fb30aee67dfbeedaf0a

SHA512
d6d85914545272181bd10dc58bb543d16e16246c798c98d13f3a2fded74e73b06974686f37fc21b2d5956ff7d14a7d1ac2f900c194e6dcf67d2b984943733013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094fb18afed89d3fe7b7b29e75900b74

SHA1
fa924b873a3555b16f14744fd50fe1cb436e7b75

SHA256
b9d110c348542981e24ef665ced087eeb2259e4df833cf0efbc641f68828a252

SHA512
02932acc177cca26b50a3c787d8166e97c096940fd3600e5f56acaaa1014afbeccfd6f72487cc565e8cd0e643d121273fbe69929726709aee5ece2acafc03fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b51c9073276c083ff34bd9ad1153ee6e

SHA1
c0d66f87dc5e986a1c7985f7433ef29dce64f780

SHA256
e15e4f79e74bf3c6adad7eac3f101995fa393cb88537beff254e1e0f018206b8

SHA512
5c57c3acf7b8e1a2c56a0b240b375440c1ec584b495c8b1e1479b8ac432958b0e40ea642efe723bd2fecd304cfb4267e8d166d69620f88866ff0c22b5dc0f47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d9e15c774e410c585442110eadb2a2a

SHA1
ad55f86dbc6e31be7f482d34fb224a6db832b18d

SHA256
d1a2b14016828fc092743700afbdb2c32a13ceaeea6bf0aa297ca4059979e5d5

SHA512
5087339e28b23cb286e2f87f7e76468cd36a4995928ef6f72cd59a07fa83fe5068ef3851f840f0e00fb7b1bc00dc324023fa80c8058f422cb5c16697f5b9e1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7830cfe2dbaa415dc1f7872805f8c266

SHA1
4c9ac3701e6f1a18ec10db8a623c8f29a2666416

SHA256
a77b106a5c50d71b7c9c7c606b3d18224b1346ac14145552462220e37731fd50

SHA512
84eb4b2427068b6e230d6c0c3475af68d6707fb992ff7326b66711a2c7b614c97f53dd16cd389443121d3ebe2e3e691333788504202525307b10a8e8a67940e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e4fbf2070552ffda7169c44a993206

SHA1
42e7a1958641255049500728e4689136cb7c5140

SHA256
b5a8b64187f07080aa2b01db312d8e2d63ff357f1cf6cd60b599c3f5ddd95c5f

SHA512
af3677e3079e68e1473e40f3c592963d45c6ac1025ed92302dab3dc9d68ff707bcaa0546ac7d90c978a685ef0683dbe56fdc435230464682dab7094367a6e293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c55a2b6321dfb459c99469ec9036a7b6

SHA1
c5129729cb7f7a26cecdfb7e54c99340966712c1

SHA256
8253e6b02ef71a0918bd3b8e12e488d6b8f6dc9a5d3329646e0c799a7267173c

SHA512
e99fbab21fbf001d8291d25ad0451638e58e0feebd41305281100f88826552df9b15a646f1f19e68fdf31cd0a84a6d77af6f87eaa02ee8dc10f2e63f6d067ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2345fda525fb31421e0638e21a9e62d

SHA1
0cd24573cecad235fd23aa11246bf79ba12eb27d

SHA256
357981297acf817cdbcdb2d427c9495f1e937f66d66e0f41595f324eaf55c73e

SHA512
c214855b767f24e5d3345344925e0a2ca83201254a32a510e7042f96da0cba86403c03bf761399f03ac5ee7c03cf4fe43b90f21067e6b2d7167deaf3ee667322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b03a421755f2b8a4f7288c5f67910323

SHA1
f89bf7992d0981df0adf8ca73c110d87caa4eebb

SHA256
83d57b78145d383abcaa7de8671a9be0b139140b14481cef6578185b19b4e6c9

SHA512
44f4c1f9befaae350c8193754b5dbfdba63c9901c89ca8d3cb4c3b098287dace6052dce282d3d40fe0896842a44adef85abafedf3a04a4eb26b9be8ade437354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc134273c76b576b10ecadb5c9854673

SHA1
a14558c1706ef3bc3f2c7ffb59beaf0fbcebe878

SHA256
5bef766dcc92c485d2d4a0c2cd9eadd92a697e606c3e5205cd63847beefa0197

SHA512
b159550160ffe755266095d9f19e5ae94d11f30335f1e39ffb09993d7086c0392c0bbb8eb8fe952388f62c99ff053255eab0dca08b40a7a126283a2c5e05cebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a8244756462b35e3b558e55e4a4231d

SHA1
0f3fcab9486c0921548849aa8ce1f2d6de311df9

SHA256
baa3cd0d46256eab46024e378eda9e12e5539178db6917a54d3b62205faa6262

SHA512
08be8a2a3dfb1b66e9dbdd4b08af9d93a5d8f770c77596f69826534c29910264ee50025736b06c7ee166df73cc522ab8f43983d3d31b35a18b6b3d178fd40f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d0427a5f162ae9e624afa7ae54b9fc

SHA1
db9d1da347008c7451929e4c5be6b2312014b440

SHA256
0c2dc52f9ee4e605d5fc4adb93c8328fd3598710f2195a91633b001200207c2e

SHA512
5b279c778770342e685af8a245811c8336a0e982195f3e130d4a2e9570ffa5f8432ff8f9f8e2321273c87a1662ea8ac4f4f0e027ad24525bb8ccde59a78a311e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a884e7bb497ce560270d5f7223d27ff3

SHA1
f02fe4f5cc2dde4c2808049cabef90db3b0ff866

SHA256
690f33bbc36f35a0a09a08e30e9572a2d0aca3001b4f99a2255942afe5005f42

SHA512
17ba22262c7ecc5ed44acf6d3ae4d0af719dd3b115a1d9378755a4e1f41583e1cc23c67d2fd10a713c6e9318b5a438fba03746c03a396b6d0760ff00d6b2c215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c578ff1b52028a43f58e8fd1b0170ba8

SHA1
597ce8b4a160e41746d3ff0c70c4af9a06b2aca9

SHA256
78f708977027eac9619843304447ef0c909b61e106811a3da71193a9c69a508b

SHA512
9aff9ce13010f84f416881dd418cd1e864adf4708fd73ebadd08b21d76264d0ead8845e0afaf9cc2c7f11302ddb15ca5f3f4bee11efc927605a20f6521646a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6578.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66B9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit