e8fd73404d0d2c27a7f7c6e51ad6f95ad213faa232a37837dcdad23fbff4e5c1

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0928b3092cee2c409f78007b126d5d36_JaffaCakes118.html
Size

121KB
MD5

0928b3092cee2c409f78007b126d5d36
SHA1

252e305f710e454668aaee7f20b590fc38d17805
SHA256

e8fd73404d0d2c27a7f7c6e51ad6f95ad213faa232a37837dcdad23fbff4e5c1
SHA512

8b8f2940f0a044ed7737821342549cf2dd1af14bc8e6b4d7115583c4242b94eb646991b7b0a36969dd19a241d64ec07d8e250e70d0a3548a784f09b5f21a10a4
SSDEEP

1536:Uomc5yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:L95yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ccceb2beecd72cab000a594f6ffc5114bfdc8901b4982d85904572fcd9912074000000000e80000000020000200000008f0ba23ae4d43e899b01ddc5d6afc4729df76c76b7b5971b87a3429ad69d1c0890000000cce500e61f9b550ca14d95b9e20fe0cca65d45ac12fea7566b7fab2203b83468861e2cdd8b5428b9e263684160e55ba63c281d0b0b439f5189ee0ebecfe9615235fbf0007c8fa8ebe9f724ef7dc730453ae594a84b7c6381706f87e73f468b92559134a670b56a039d4cf70188e6d13a4d3f69bc4252ca67dc9f61edaf28476fa55b0b5437b45657c8c765170f7c3121400000001b02f028c83705367b37a6d4f052f50e43e613cde747c9d78c26a279585b917dd85c2e332f3b2bcd8797b38e68ae08701875424adac04dd69f43c4aed8e5a60d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420617962"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CEE63B1-06B5-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303e7e11c29ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b6dbcdaa4236297cc23d12ebb41856d0aa5f4b05d8561c003cd1e8957b71fa11000000000e80000000020000200000001e2dfd09190dabc4f1e8bb670e9d3f471fde8a0b87a56134e82a2e4248a408a220000000b31cfcc2bdd6c37d7c6b9c92abf02ba411b8366c9495852c5c378cce8c6bf79940000000810662d2cd5b2a67691bb94472c0e1bf4599ffa864690e5f2d749b5428b966a0de6a35ae43160ba64bfd35c9970c36541250f42eb83d8fa5d2b3b14a49848d28	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2892	2164	iexplore.exe	28
PID 2164 wrote to memory of 2892	2164	iexplore.exe	28
PID 2164 wrote to memory of 2892	2164	iexplore.exe	28
PID 2164 wrote to memory of 2892	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0928b3092cee2c409f78007b126d5d36_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f4d898a14dd535c32cd8425755a0a5f

SHA1
6db836812ea4c1b496a443f30299471b82f6e2b3

SHA256
9fc1b6b87484d27e0fd71b1e4ac58c0eef074f9002af34caccea597d639baaea

SHA512
3cd055f7403a81614c128838b4bd100807a7084bbd84bdd2b0fdb6a84f7a5c53bd6016f137eb7f67d58f1f1b403a0209044b514e2cce78b95e89d442c1b45449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e7628213ca448cbd158292bbd9312be

SHA1
60c90652dd14c174c0575342b71d273bdd9c4dfa

SHA256
9c36d927b5d82511d75ccccdaab5764e3bae92ab7ed1acff16be667ee9933c30

SHA512
af719121d9307a60db3b1dc45b1e9a7a0adc42132b7f55d3db3e29c1722f8c898bd9b4fb4cee2dc0509ecbd58c098068e7d903e82b9671c99408a3fe2b1b3f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc244894d8f56febdb519a5269bc1d4d

SHA1
a0614a861b801c76c0e400e5062f1643f745976c

SHA256
5883ba31b8c3c80b4c68e3591c1b042eb1b4adc808ad64f7b6ae70590f3a73ec

SHA512
425650fd34bdc7a3ca204df246b0fc592406443f36d8941df3df247b7b1c5cfbc90a91ffc3fc27c6e3fac7a331ba4f6315ecab9eabf0992e82e2812d887e6d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf368b2dc3943ce833854cfea8463fd9

SHA1
4e3598c3134602ff32e8c18dd9b1d568afc4d2fe

SHA256
d1c8b07e9a79f6802e915e95cc5ee7e0f7947911e3dee53b60d54258830b3a3c

SHA512
3d082c84b4ad6af2b40b79783d9ccd8c82ec900c169254599e726a0688885987fda2a2460125db4a9de5b2675bcfc16b372ec57a4a54d5a2d75de6d498ec7ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5640b928f859183094139a60e01d8b3e

SHA1
5cd4524c7a908b248eeb5c767d06b2ce47a77cae

SHA256
6b0c0d8d17cfa4b9c9592dbd686ddc779ddd8346ea576b7eb7f7145db24d7f47

SHA512
1c15f5e6bcd52d062812894e0838668578d194adc640f76ec649ef4857c091afec8290a2c178416b0d1ddcf74c5c65d84ec15dae30963b739ae624639a20aa50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18bd661404746918dcf7a55d7d706e39

SHA1
9d5bfef854a31e0f8909d316d9de273cb6af6d7a

SHA256
0be3c71cc1b9abe1af2eed4c0ed6d79eadbee6e9eb0857ddf4a10a4f410943b2

SHA512
954733d5fcddf44cff354656bc4906357dc7b6314f0c86f1b02b158073170f28c88a9e6d6ac8a9a92e4db98b2dd5ced86209b50edc33c88c680a55220105f7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ac344c2fb1fbccd314af8fa266a693a

SHA1
f3699b7284a9761ea45e5b7873bf51c5ff2c325a

SHA256
8c9b90921c2555efffd8ca0f258d59cd306652bbd72fa9f07c2c4881713c8d11

SHA512
0a4294c1176c24ee3292cddbb2a2c3c673b47e9737579333611b87c83b1e85ae9f8e50134fa0b4d1f13fa28ab5948ccde75f913f9c1713f65e64daa5b2f47598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93503165043891e8e56ab84d6697fcbe

SHA1
56794c8e82121070364e04e995f4e5d5580b0626

SHA256
ef7a54bde8eedf3bd27a91c9a405876c7cfd16cbe72515cd2ffa9d661d1e8cbc

SHA512
aaa485db2baa1fe01545a5edb031cb15c21c0abf29636f8d53e15ace6a3e0223bef6a9d8ca41704cc1eafce90f50b5281d8ec3f02692e0b06d7966fbdda9dcd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6735e7cf4e56abbb51f12d2d0ea74ae3

SHA1
f113267d4a3ac5f25ff540fe28f044a40376e9a1

SHA256
41a55b4a9992c6264a986d3786e1a5ac44bb6491c91abed61d7e1f186ec03acb

SHA512
1e3d02bfe32eeb1e76d26292be95cf6301b3721349ac90c208d9e05039c1f85ac279e5dad2826d40f03117c26e18005174e1a627f1c8953846389a0f0649d524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97318e9e6ad694f0f5bd94ae475c4b8e

SHA1
a5cb1e3ef67ef7c8e2463b875fa6ce51ead93edf

SHA256
9ab0336aa31996ca4a871186285bcb650b3c94fa66f346a70d75e55fed6fd164

SHA512
d632836cf365cd30f41c70c0fc5a39dd18161efc31201186065b826eedad9802e8325c6d3eb1490d5e7bfcf2cf166858bb86513921029894022f9a586c77bdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab254F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar266F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit