2954127d4ee32850e159182cf662b742f9c4f1afbc8fc22704f64e3165e8d414

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ce3a742c2762e2093f60b05292341fb_JaffaCakes118.html
Size

45KB
MD5

0ce3a742c2762e2093f60b05292341fb
SHA1

2945e48ec7db82495a15558d1c53579db0750ea8
SHA256

2954127d4ee32850e159182cf662b742f9c4f1afbc8fc22704f64e3165e8d414
SHA512

23516abfe866c2487f47f144587b661d577bd0d6ec9420c47bd936b57095f35fd03b2fee4ff194bc80079f938eaed48f275b25548a27fc006c090c91e6c86c13
SSDEEP

384:qJryWS2e4jOZ79FwPUUxiGrQ/5wb2kGM5i8twxbzkdHoGbG+3qrFMT8t7yKOK2dg:0nLBzwjh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0053e4a1219cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000000039966dedeec7e767b20647bee5933a16349098729c38a133138555430abfd000000000e800000000200002000000091473f808b7c9d3d3e2acef289ddab83074070220e2095b5c2174fbebfc3ed1f90000000e3d8cde7ef9b8ab55dd94537d4f463ed56a4fc131dad6614261f93e5f1223b6887f1a42c7485798c2c8ce5db7c4a52b95844a512a8cd1960b61d8fec7e5105991f66063462620a010253a1fe68a5106602311995f77a5543e756e433eceb01a91541a0ff11c8844416f2e86fd5a7ac030aa913a712d8f3a24600340d5fcba418705cf2164a4384731723ef86bf33e8984000000009991c598b5d4b43a2ef9af5253683fb8b77bb93069b24bfb10e31329cc24e0c07c3a4b1aabe8d638e299309fd88755fe57dcd0b18d213c15ab92b635ffcb7a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC5BDFE1-0814-11EF-BF06-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420768958"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b0dbfcff7ce86f2c378e56339ae7378c69379831f765cc9bcf0b666240cc7038000000000e800000000200002000000072551606add538f15cf0c49588307b86855beae0b1615e1de079a8850ff33cf02000000099b97e5c77141262395dcaac6f2c621448c121c7a7f57daa60a584cfc9d98c31400000005cad138e918782135d5adcc4f8d31dfca14f75a81e2fd9edb3361d9b55e9cc10343308bb205e09fd4db092ec7a100567df8c5a3fe0f8b6035999630eba5f085d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2060	2032	iexplore.exe	28
PID 2032 wrote to memory of 2060	2032	iexplore.exe	28
PID 2032 wrote to memory of 2060	2032	iexplore.exe	28
PID 2032 wrote to memory of 2060	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ce3a742c2762e2093f60b05292341fb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0079b0a9bd58374a979582794d8b28fe

SHA1
e98caf6c550d90ea7fca03dbbca99ec64e687168

SHA256
c40a6ba94b7e8359ab25de7b24c800d826bca9aa7e3c64a639320342d5ca6a62

SHA512
7053b36a91c4e15474f27a98b86b0bc434b7bc012ce5103e374137f410d9f37893d98c60acd1012fbe319787cd44370462438f3b304bd449ff26f6fef5759100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0bd62b7ab5db38938442360d56e5ab2b

SHA1
3b07798e60c962906d9e7d498c70dd93a1b21915

SHA256
cbe6f14e307f47e6894d6ae06c9c1d202994e88089ecb9ffb115b2c808b7b43e

SHA512
9a7f5c9fa3c91149af1f75d0708c908107259e4b207f5036b7a2dc7cbac39d7062448b30fb825731479e06940bb5aabec95e78c72b6f1b2690503f234f4f5ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c0a0416368ff423254ac8470fe83a3c8

SHA1
860ce61b894945ad292962cd9917dd18d8c96c89

SHA256
557276f7ddb6fedb3031fb09e6215600ac03e7edf58a8f38249823e983e23cc6

SHA512
d467a33363eb10d5e4a15be64719c72a5e9d125a2cc0c516db4b401e37d4ea16d93d2ce1d427f5a468cc7f27f83c331c06fec467ea2a8610fcee346734c01029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8c4bd241dae81b3e3bdbd17b9c3559b5

SHA1
7b39f83be51d94a6cbe81f55eaa98505a946e9c4

SHA256
0d78d6bd8332c680601147fdbb1730339e128016739af00132e2e4156e4e7d12

SHA512
11ee2e20429e35f5118d9b2b25dfe866f0442653bdcfbf3251e0534341f4a8012aa2d537e0ca521cf6b46e68c23cf60fa36f8816663225c6170ba8035164e932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6923cf709bf5edcf43566d8a578ca533

SHA1
acdef08b1208990684550b76eb707529263eafd2

SHA256
de06bc34a055d4f11fb9fdff491594fe1f0acdae974aa9d3a09a7b05b47df874

SHA512
d155368803f5a7f5e6b7613f7c694b17fd085b29275ae22f155015b6bfbbe19e5cd6957febe4e1ec5bb5a99a21ac4bc68a83d7e3b25bb3687eec632fc078d9a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1bba8000b9b3e63c35effc58a0184e00

SHA1
f31275bef930a4960c3f5bedc273b8dbfd4cc6f6

SHA256
a7b1d1cf4f26f6ae0501f7051e9abd60829cce36d83daae531b871926d297fc6

SHA512
2d68796e668f183d5b2eed2e4da5dde010bf6dda96d505c6b0e72d076a42e856afdf9ae0e0eb1829a2f5a8f95b42ca4a6cff1ae71f473a4b76beb7a70bac907b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
124f9e988dd0bf392710c25e7517011c

SHA1
ab4802110816e4c67f90da6958cdb075f7ce9205

SHA256
23b1ad0e85a71239252dbb3f7c5110fe766eb6ea48b3464df41b6bf2c2064992

SHA512
be766be775f9d141b0a8d31234282e54ef792de83913ea226503f34b01917da73349aab44a522ab3a9cc46f3e6f830931182636379f91e7efe06912b2095feeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cffc64da3f7fbb71dc6f95c9b33a1334

SHA1
a2bd948fafdd44c11ab76b6c8ba00e02c8b38fb1

SHA256
5d39f9844973abd256563074efdc7a62fc6094ddf4fa607a15af69f41f3a9a33

SHA512
36d3d827557da87248d7daf57e86bcb18d9def1f95e00031b25db27f621571b84440fae36538af294bbb6e5801cf66e2d2401587690051500777725b8621bcc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6ffa492d17410e3e184e8ca9692adac8

SHA1
80576af9398eeec6647e46aac05bf3a7e9852c42

SHA256
9138ea6ec02c044dc6455f1e49f49670104d7dd9c3d2fee72c2da9ba318442f0

SHA512
485b1ebb7f491530b63ec252c74fd823727216cd055dbeac866073d20e5c1753e846dea756fb437deef5020fe6353b2618ecd8389d3a21164ede38fe38683296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4c06b11f324e7cae74e52d5c8e42a53a

SHA1
ad2832771abe7181c49ff648deba4104e91241c8

SHA256
152c543e5af56655ef9f0a9fe86997644a8e4025ac3d8c62ba4bf4e0cd9c84ba

SHA512
b42c16b26e90f1a4a3a6c75ded2687d51433f9b877236e74fb64918f4130928b85ee070e6952ed4dcfed48ee416d2fabb7436b70ef78285e7c429314e89eb9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e9e1bb3065b2ae6bfcacd5e783d40de4

SHA1
0b599f07451777f54f1a4250381a97e28eebdcc9

SHA256
f4c68e59e66138cebf525fc66974af8ff5c25c0cab60d97de0a0946d60c5d1db

SHA512
f20c5adbc4c678dba40bbe0471efda7d3462705389b998a8a6715b7c94c12efe3ff8b38ff7f9768e8c180537410a588ff01c0ac1ed6d578e1a1f43639c63089d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
722c122c94734f3d00c31025b02897c1

SHA1
262e038930f53489cb64a0bcc7a37fd62027ed4f

SHA256
63a21de2b6c522f8e8a080271f143e147fdff94abdf62d09445a006da73ff134

SHA512
309c53946380db257d30904bc00bcbcc891b1ea224b63035c14f8f5561a2b8168214c01336a7698227e4eb57cf1e79892427f4974c791bff4158cec210349e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8cd46a01ba6571e40e220abd53e1edcb

SHA1
0747e01edb56f66086790244a4bd1411e29d6ff8

SHA256
e7c8a1692c096caa5ecce9f27c5c0dcf7100fb02d4ef789d4002d871313456c5

SHA512
34023622468333e4e71e9a3627b3501e9711b24b75f422f452a036f26eb09634979c26a98f6e871b7df8d34b6d28d94426b92c9dddbac08116b0b477cb58b60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b2935f760841b2f9b790eee72a1da784

SHA1
2026a111649e19c14ddd38f1aabb915c89949461

SHA256
5fa7140e81a3415f63a64f5981dcb651769c86d7650c6c4903add0b8669d3be0

SHA512
afb75098ac07d495abb6dc2f633b4457980847abf390bfb759be17c02ee9814832721ad4b9b689ba3aa96f0c427b8b084c073993e41a613d15beac71351b6972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
99de5160598009698eb4b53e6ad11193

SHA1
1a7100a148d5210ae4716e36332b036270286c1b

SHA256
d07240da1c51207c8586cf3105521f50d815404d3ac1a01d39a04c50586abf11

SHA512
074e886723b8607a821a84d5d1c53005c17623ac9812cbc744bb081aaeb355faa4d768dc993bd2d4d29ddb0ff599af2ff5f2e8bbcfaa2e45342dc410088c8b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AD1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit