0fa0d2fbc11eb6cbb0188c00f5cc2428ae277503801fc39ad8ab332c284101c9

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
Size

139KB
MD5

09a9cce74a2f9fa60a2f8e848d244286
SHA1

cee49720ac00e3bced62b13208dec788c2510000
SHA256

0fa0d2fbc11eb6cbb0188c00f5cc2428ae277503801fc39ad8ab332c284101c9
SHA512

fc1fc79671e8c025200416ca6d84c543cdd1b2604db562ba3c65798d5993c62a787741b44895399fa53a83ea81acd18a22be30449ca8f72b3a9a6a72b53df242
SSDEEP

1536:SHNjI3/9lqOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SHK3dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a9df847092b6204f9bea47851789ceaf000000000200000000001066000000010000200000007265f5fd1b72bae300b55a77a20698a86d3d8b1d0246879950400c2fa2249507000000000e8000000002000020000000d123f5a71b4151c210e5442b63a433f70e40a349edc0e3213771a705fd689d00200000000b9ccca17ccc2f9c08bcad76d413ecba433845e0c78a69d451e97681cfbb2c55400000009da47c97505ba272b43a2c954109e54f3b17598390ef94515991d611b5c87b69661be724bd2a53e3312c071009af6c829ef23ffa1b3329456de5d89d3b75a507	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A647711-06E3-11EF-8D15-FA7CD17678B7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420637826"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a9df847092b6204f9bea47851789ceaf000000000200000000001066000000010000200000006b8b1676972785867a6fddcf4961620e189d2d40fd514a6a86cfc3ec0a688de3000000000e80000000020000200000005bd17c96bae8c79ba65fff47bdc9bbc93f5b83856ea57e695a9bd63972cddb36900000001e41267744a7554b760004e7ac82a2b1b29aae9d053509287ac7d84532b7546c5f774ea3a1d46b06a49798b2fcb4a7f5fc189eca1aecadfd18704cd643e2342c05065b553cf5911e8446b6609910aa4c08febca36d447ed83dd09f903d1b9db048468836a609ea6a8da0f71ae66a1c765b36e75cb920e0f2c5262f6c79158810ca94f5b08b41875b7a7301c2596ac1914000000080dc48cde77606716f00f56eff0c8267bb50ba9cb4ac8da56753eac977669c0ead6a515fcb578669355f277fce554c93991fcb567fc2e66ef46898a3633722b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c5b390f09ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2176	2340	iexplore.exe	28
PID 2340 wrote to memory of 2176	2340	iexplore.exe	28
PID 2340 wrote to memory of 2176	2340	iexplore.exe	28
PID 2340 wrote to memory of 2176	2340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2d142d268ce0764f722b135db501db1d

SHA1
c159c859231e1eb706da42313379d1301cb32eb4

SHA256
09d08731d5068d9b95f698f2c2cb17c01548cdd51d8eb8577f15f78c0f279889

SHA512
e12c6a76a683bd32a3b89ea2f9bff0cb5c8c9da3b763448c3cc63961a3bff05b652bc984786c02927693f7eeff310bfc89ed61919b3e1aba4a192064a1c31465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0f9dd9248473a4e7673553586cf5317

SHA1
950f3e26921ecdfee4c0a7e1205b8652a139ea65

SHA256
8ddd1f42cbd1102e813297d261f79987c72a65b1d70815704d5c4995b897bbe6

SHA512
214b0574a2ee10b58b43a3190f023bffb32e6c9152d5d79da5697c22282ab141c618ed6b85760087914a32a6d1856260dc323dd753f5d0538f12d94afc95a199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b676dc96eb948b2b17e07250227eaeb0

SHA1
a19c43099401dd176ee9007285967b17139a1cb3

SHA256
baf6747d7d9cf7923b11e8b665bcabe995150a1ee6ff5a53ccc41f52c0e1f978

SHA512
a649e8fbf21822c1b28ddb4b0c8a831001be9637b73db9825207d59aecdffe84c8fa3a7436f3aff15efb364cd8c73a143815ef4383dd694036d7b876008a11f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b7522425ce51e861447bc3d50bc9baf

SHA1
ce9b38e94237a14d3e6c7c1a37814d285b8035f3

SHA256
713871d2433211fb9a4ad19395dc6dda4a50c33b271e85e3046913e3d966b411

SHA512
e4ebd504c5c70175c8f49157b5e6f67df9a712a4d6dbdb95be8bd9a22048c5b3ab6b21154b420c3c58ac00fdb7862e4a27b5ddc8d8d5472cc8ce7553a66e48bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44c0fb9cb01bd44e9780e67e03abb9ec

SHA1
04ce1844c3e03d3360a702991a8ad26907e6f45e

SHA256
1becf44005be7c7e84339de3a2b532a3b9d39578bd3d036fa83e23560a99c672

SHA512
919f3bc20cf91a59008ceb9dba7f1bea4c9f4ca5131f5fdc0ba6948f7cdf2515a68a9c039f251506fdfdff9c716f57f5144b9fcf97e0f8929971031951db4459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daa0fbd3d53b5a6da166aa9400d3ef42

SHA1
36751c166da5e52b3ead7de72b81ca594b016529

SHA256
d3fbaf08806ebedb9da4c97586f4d4a99736222d373cafd5b6cbef535309d8f4

SHA512
3819364b614aa993b912c8a3460b73f7fd83b393daee338f6980c58d1681d6a74db4f48aecdf4ee1000657d21c72843484ef6de07a4a73e9b05d4aba2495c7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
390f10f824ab4b3a5d8ffbfa1b5a74f2

SHA1
2e1edb790bacbc80ace051337ad0348d39c456ce

SHA256
27a4e79566b4dd0d15ea2433f1af7a4575bd0a720db518d0b5a177f6d0501931

SHA512
a3796e9280ee1b61c161f526fd180cc6554039e3d55c6d3077f95cd59f3e0b98b75ae64f87b1c1a7eb3895ebf8eaa786baf5aab3ac512da7b1552730e346b7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
216d54883281d24f69139cbf19c4bc80

SHA1
7bf36af90872d2e8a37b9d3ad5be47a5e96f3e3d

SHA256
62fa096ed3343186383f7cb9a7aeffdef8cbb883675eb24e2df548af323429fe

SHA512
cdab8e0639f6de3ff3d1865671c98a7244bae1a737b637c5448932bd7d1ddf6598fe03d3b25aff242a4e197bbdedb8df5ca8f96eccbd966c13efab2c919f8ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fdb493edf14dc3286f03bac12919c71

SHA1
cd8afb792a306a25d9da1aa7feeb4d85a2a550aa

SHA256
9c839c8a4a118b23de35bc77a825fe77d13768bbab0b145623df3b7a6e39de5e

SHA512
eb7fba8c6dad59075531d0478c792f7965aa6170d4c4ca60b7a821316c89b576880f2fd55aa827a0edf56b78bd0be90d7a074c6f53502f7c75fa9e3f440be14c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef817a21ddb3a07dabd702168186ddd3

SHA1
4c5ea725ec1ef04b8cffb00ad0fed5058401574d

SHA256
99e3a84ca0659bed2c4f38d1181673e841b19efad84c39e2efaf750653bbbad4

SHA512
bf111e6a140cf1ba4889742ecb83f5f58f7134ea4ef017f332a2e8afb8d6ebe14fb7b487997f8c88dea697fa4dba43ff50870c85155b8aa644902201e9486610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dc9f9bf8ef555f123cfc7e1f681eab02

SHA1
ca922719c0821b3d42c8637c8178a71d7336592c

SHA256
68677f8111c69f712cad17d712bfc8932c86fbd0b03910b0577448f31a70e983

SHA512
84e8376db567494c41eb929ce4c589018ea4a7d387c85ef52ecc9a92db6c85572754995cd11ba03fb9c7ea4f0eac0c19eaeff6b2494180486f01ec30efcb69f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BEF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit