6235070072312a36ab72fd6cd542d0ea21ef26554dfb2fda5eeca1398f7fca7c

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

002fe38129fc29d9dfb88e000b05c619_JaffaCakes118.html
Size

139KB
MD5

002fe38129fc29d9dfb88e000b05c619
SHA1

b13978d592295fb84ef195d1ee046f4b9935b958
SHA256

6235070072312a36ab72fd6cd542d0ea21ef26554dfb2fda5eeca1398f7fca7c
SHA512

9b3e048ea0cfc2545f72c609142208ba2bef6fe6568b23c3aa92d6e7b20bcbd6e844217a2080d59bb2723ee8c0e1fb8664fcf2abca4a25b3a6bba97a8ce60d3f
SSDEEP

1536:SZVnvaPliTyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SZwwTyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d085718aa397da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73873041-0396-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005bef1efbe67b641d60f8c8f9dd5722a5788cf921a656e83733bd0562f00766e3000000000e80000000020000200000008a9f555f93214f9a9763e49703c3733c483aaee2cfefdbd3b732b3d65b4e67c42000000055f0991e64101e6066b26fc80ee11ee0d4c8813cede91b431d1733b64efbbc7340000000419920271de1352b05943f6d2b8a3e06ffdfdff955a4193038e77cf12a60207681e98ecf7afa8d182aa9aabeb4e5f76a21d8b68623469aee73c9c7a625af9194	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420274889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000094708e3791cd896c69e469fa4167d14cd2b6388924376cacf753f2a878d36a02000000000e8000000002000020000000ecf539ba91cab4dd896ad45b67df37678821cf2d507ade72636eac7bd7feaf5590000000603156ba3204fd66baab1385c8e6b79693bf0caabe110c9ebad493ce85aefaf5e78f598235ff0c72c5d9358ac6b891253bd0bd66e318c2085493abc61d4e04f51141b92281a1af8d1fd32c752c85bdd644c01d1e59b84c810a3e0f82ee708c5e9e21e7cb51fccfb721c4fc5a2514967b1816aba30e662a3962396c3fb19f5e58c53d09d31ffc2ba2adf5a03b0245207b4000000019bd19e7cb5330285589b0a3780e762f72bb2eae249d3c283891686f4d876c4a3beaa871e83fa992bae8bfbb83cdc58591b20f903a3f33f93425df218f453f44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2744	2172	iexplore.exe	28
PID 2172 wrote to memory of 2744	2172	iexplore.exe	28
PID 2172 wrote to memory of 2744	2172	iexplore.exe	28
PID 2172 wrote to memory of 2744	2172	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\002fe38129fc29d9dfb88e000b05c619_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d01f7d52f287c297d0ee341f61e426

SHA1
f4585d9e8d3fa89273c6adb808efb87f6d3b1243

SHA256
12dc65faf96c0319b080fa559c81b7e1add86edded6c16f9f77278339d507bcc

SHA512
39de7ba2e4b825b52f3d47b729da6fc9bb1b509d1a6d5a03e764fcdf6e9d7567dfdccb1b80c367aafdf2fdc0b7b48ce03688fecac24974beb595a31a8c24363f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec4db2699136004fa949976410a42a25

SHA1
81e4aeeb660f89e95ae2e38f54a34ce8007a18ed

SHA256
53c7fdaf21fc001aaf6f9de2141d55dad361b37fa7746e4ef6025dfbff6455ba

SHA512
d86ea4a97d80b5e739c45d7809c735fc9ce8d9621349dcc0ef82eafed8adf9fef25e274d60ef1a1263e22459b0a2df4a942ca9737cbc8dede8c44ca833881803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bebd37723db146039c7284ef48c6275

SHA1
3c62a0dbd9a4a6234be933c05235c85e6f7e1fd3

SHA256
18aae8adb6883012438ab2bd623b1c7544d7a38d18467ba863a026281e31d73f

SHA512
14925ef9d40c34c25eba9c1efe1cf39b9dc513a717d36256c5b5f0a23c78c9c71d33fc1eadbd4469cb84da956b580e0289149c9a4a3007f16108b0ac1d45ee93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a12f9bda934cc3e1db1091751add358

SHA1
0bea72a8fa06a56639bdccc3b9a1efb0a3f8717e

SHA256
c1319b2da6ac6645f2d54a66b3f5593021d4a651058169f4d1a024dfc68bc688

SHA512
814b7cb73a4b360a9d9f80405a97ae472d463495438aae802f131299c907f57c31d6eebba402fdd3c42c6af3df7c86556c16efacb894e4026c513005679d0758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c4f5a07b3f59b351dd4753e47e4c8f6

SHA1
e5a00888282717b4bfc6f9e5dd4167f2ff338ad9

SHA256
7e50973d141fc0eafc805562fc29cffefa17079ee4c9bd2c7105ba6c31d1f33b

SHA512
01187775ab1e7f1c5da519eca5f7a0955541ec503c1caddcb80aa55aae0bcdf7b16495072c4b0ee8d71c197eb0c2ffef1b9ff1c9791049c9e855292c2d1e11d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8324694b37dc4f0eca51ab692f6677d4

SHA1
6b490f69aa4270586749ce21a89f46898fe704d9

SHA256
4036779eaf22734590a0e38cc8c37e8b08f28f8bb5893103a620d6b475e2fe46

SHA512
05d0f5c027411e7929424c905b882b2132919fdf9829eb840b86cd082dfa02f3def20f97a5defc4ac306ad701f2b9dc000679e2269255fe28a0b6404c44c0f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdb6475b400d45776c6a2da6b03f039c

SHA1
ddba8ed95e8ea93bb39dc89dcfee677ff5afa06e

SHA256
e1ca71585715cce492d918f1c3e6597f54589d85e0305d5668a2387658780eba

SHA512
eee25aff8d342a44c99851843b17bc45ff6926542613e3db10f6456e015a7cbfb2483f8096df7273b39b6ade4d31d323c807b148b429e094c505674a304143d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a55f8f26676905f7a2768344f835c478

SHA1
27210748e8a84a2d23c6f8ed06eb8093f731057c

SHA256
8d8f80613d434571dabfe826635d3276897bebbd9023f45768ebe0d8aef11375

SHA512
f5eb699eedf29c6b06007b6c08030e106599246de6ff80f1f4f6a0bc44a154146bb21f5a13e11368b3c7ce1cd8e174feb4c1c53a3ba5b5022e4160c4a73b404d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f8ff831ef4a9d56b6c0b830470a1096

SHA1
dce351f59d8f4463d56985b5d21a4ca7bfb75a3b

SHA256
daa8c5bbba4b28ae9aec99634b12363859b6dabf5159481a12f12470a2a16396

SHA512
257706fe716b003da509dbb3ad83445b5fa0d00e141185939bbbf79edf9b6dc6645663e79edca758bb81a58fe9fca0f1f140ab40ca2fd834fc314450b1c6ac2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584e6e54aa204c49b42758b049bd1cfb

SHA1
e8e81edb393ce33606a156fe5d12de0207751632

SHA256
e063cc475142a3733b4fabe8791155cba7a55d4bf27d283ed22eb867d18be53e

SHA512
1716c4a5341e32ba5aea10968b5972bd0d2227a76ff3a7b7bc17d26165916a446d353ec6267119ec583ed8ef2718b5434c77b0c42fd999032faa8b356e7ab4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbf2c8df469a879a821b2d2584987fb5

SHA1
b27e58ffa074705d23f6cc5eb1ca869d503bfbfa

SHA256
b5268afddd62ba2e242f92b553c528ad20d2b219312d6d43dc5c074417330043

SHA512
a5db81c29eb28753381a670c57dd966eca4fac1132acea22f9f359637041a10a88cf98c8578f41f4af33cd760255995854ecf993402ad456ac41967b7f438f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1498ee98738f0901d389183e4b32184a

SHA1
7e9172ea046e6f6b872f0c1d09fe95aa79959940

SHA256
6bb8a72dea4e1264aff755557580dd833d82c02e30b07dc084c38eb15fdfece2

SHA512
350978f8665b949d071672e63899b8e0a226cf8cee263bfc96f3d6f1a15dd62d54486636c3ddd2497fcefba3ccf6a3038ca2ad12a092c38d0300e0805f6478b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29357df93e32f29bb23c6f676a27884c

SHA1
e0ad5d3029baa9d5a75d104667bdafbab07968c0

SHA256
958ee9c5529314d67fb2accae887e695eb73cad05f4bb202306cd61b5fe90c4d

SHA512
05efe5852a91515c1514384a631c4b6a64d479c75d41512467dcb7105c6a5bc71b08c515b22876f33f81caf9f36d6abafd94f01db395d2026a0315ef86203c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8391.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar854F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit