d52721924cae8d0263bf9f1ff4ceb55683e21c388b067d63c964adb5075c924c

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c84a98e00f9d82915952cb68f094181_JaffaCakes118.html
Size

461KB
MD5

0c84a98e00f9d82915952cb68f094181
SHA1

516987ad911343d85e5c6075b92d4e051253c149
SHA256

d52721924cae8d0263bf9f1ff4ceb55683e21c388b067d63c964adb5075c924c
SHA512

8795cdf9e9f1a665e33dae6c2cb8951ce8af5c66d873ddb8bf9cb90007565fd8d526c7097849e44f106cba98542026198d28dd942452350248f6fa3604c2f578
SSDEEP

6144:SgsMYod+X3oI+YzLEsMYod+X3oI+Y2sMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3BLS5d+X3m5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C10B631-07E8-11EF-917A-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000058456aeedcf5be627b380ae23a0a8da8e61969fa2d4689fe6a92b1eb9d104f29000000000e8000000002000020000000bd961889bf36a3ac8d31edb3c217ac7d9e63a788d57bb00c4b1f3a251bfcc490900000001ced8cec6e2ab0383fb7d8532c1f9ea59832fa99faaefd195685f73f932fde925b4d72e342fc514574526284e8a65ee4272c04ffa1564629c9434d89185bd879e7a9c55459e9585a9c319086c1e3ccfc38ffa00bcba88075c777090977e38a1a6bde00ec17358cf817619642dec57430c24c7bbd8e17da3446ae8de37cfc652ad05b97ea0a5d72857ed28d7e1513315c4000000043fa8d05b280fab092654bd64ca29ad2478baa3a25b1f2726d8a0de2682b8185bb49e8df44be05134a21c9b6b9f3192cc12f5125749f7c3bfa443078ca7f4958	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420749817"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005744a85e5022e01efe2cafd72614df5aa46447165f976dd3be82cc9f47fa58f1000000000e8000000002000020000000dfcbf17f84423fe20e26ee58abab147b0a8d6e07fd889ab5a82afa132ae941a9200000002e78d7b04658f68c0de661ab977a75c9897d3b148f58ffcddbb108a99d766c51400000001a54597bca058760dc3c0079acb292dc698913bda3409577a9d15eb8e4e537dd7112e58541c0e49c8df1e9a48621ec77ddb6ad047548c3d171bd9ee8a1f6595e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d69914f59bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28
PID 2732 wrote to memory of 2776	2732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c84a98e00f9d82915952cb68f094181_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
038e1e2bc10e0e08b0646ac8e012d5d8

SHA1
3dd6ffdc56b9a88f4efe9b7f24f645159128902d

SHA256
1db65caa52afc1a314463068d92dfb75aaa58269da64fede7f8b522fe71534fc

SHA512
803e238dc059793f6770ea0865fdfefe00883190f32931ed2ee7c2372355d1930ecc2de7a7a05439486af2803a597d53b5cac886a7197d6ff36a9e2bf1bebb2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eadb981bef41558cd3a1bd51619c53d2

SHA1
5e0aa9fa0204af31f3f48e598931a05444e59c11

SHA256
a575070342722c53457f388d6181ebdbe582bd19d5ce374ae2d33c4c90b4640a

SHA512
f60b955c46398ebcaa8bde2fb8bb18f3e2160e75d303d4004b0f23038a993e341c90891c32f54cffa4cbf24a3daec119178c46dba9f28f9212892be0596f4712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6026d4cc50d53857d8ed03f8176b6001

SHA1
fdd160e46693da290a2cd617342a68d4b056e7c6

SHA256
38fbe1613a353c300c617df886320d4a611739c90f55107076d13ec9cd003c46

SHA512
2a1085db461046d4a5799bf069aafd319b86acc998e6de7167c31538727d3e44f99a4496774454e55f4a48f2b7c900ddd7a60fceaf34540b1092dab0148b32ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e40e85895a34afa1c84aa52d0ce176a

SHA1
94b2f10979cdd8f343d71ae48ffbd7ca96921071

SHA256
d5d595c50b4a0054100af5b6c40ca4819941ad0e938ae8e4b22384b6bfd63a92

SHA512
5bc3eeca3177904adc43416a713c7a9574b73ac428cffe755206690d6753ab58686c21f651f3e5e695d80ad03174fbab17a8ce6f3dd12bc1f232702a0df17601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80ee6e22fa190b8336a94f5c3585da9d

SHA1
96e203aa0b976c3e0a46e9da276d0660ee2812cf

SHA256
7d2797d740db3db48c16cd1d7a62c2569a1a9fdf78448bf7f3dbb5905072bf97

SHA512
b0f47a07056ded02c344be1523636ea7ecaae41591faf242c7d82603aca4cbc6f514b0a422c2f7dd4a83afd4aa4bfc6cf1198801f04c15aa53c5db067dfd4e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a990fb6e0682ebc8f10b0304aeb4d1f

SHA1
5e87e251aa54696e2bfc10695a5a68a7de097cf0

SHA256
88b77d5b12a1ec6fbbad83a38014525834815867346b670b6398855f57bc548c

SHA512
505cb2728b3ea87f70e2e2a281b6268c5851f543dfc30c8d0cd3abad2a20044da213bed22607299b9c8ddd05b8ca74df890fe78e059f1533e0dd0245a6df4313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d62a54ff4106645317b6e54df8e4252

SHA1
7b2be3a0b4d6c895525e2dd5cbb3192774ce9d8d

SHA256
e4bb090197605e1e5afbb9d50db2871ebbe1c26f5ee49861b141669e0f386123

SHA512
3233bc467aa1ba91a521d595c5e5451ea2266544404f72d1d4d2c885e02c2fbf43f184e9f3ec7f51b6dda5d6738fd20856fca83a112e7dce9ddfc94f4211ce48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b564280fb57762fd0891c04c9bbfb1e

SHA1
f62452765ef4ec0efc9cdf0e5e1f450f27107e23

SHA256
27c1026cea814ef1938208d0c5c482af100a1eef17ddad199aabf2311bd2e757

SHA512
82fb8d8261c0797ef36c3b2e8caaac554062b11fea70f86629a97f1948db3e1c6c186e17b08b659a60e23777d20f37a67c950e6081145b04a14ff54f7da388c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bbb568562d5dddb2ffbf910bc36d6b5

SHA1
1b3bed9037e549e790f5259404ede7a0a2b3c82d

SHA256
5b1555b13946378d0e7992e5e8271096947d7fc129a5e8c315ab1a1273cc6cc1

SHA512
1df84ebb378b09c8c2e0dcdd14b5fa28f9ffc4a84044d3dccc93660cd0019f9b128a34e6eda54428dc92f1cf924f66f0596e78c4721a3f0692002235a6b80617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cd9549ff6c43c5b185219ae1363cdb5

SHA1
24e119b5fb45e440bc31c07db5810888b743c35a

SHA256
d430666c069bba78f9a661d4c9aea93d3ec4cb620e10ca250d442652867911da

SHA512
10e25451dd8cd9d4e45c20b8738e0ad7d6560d632c638db41cb0357d4cb2ba5a9c482491d1c3fbd050d2828d9c475fdc986f019b925158b78649c84876a9d372

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40DA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar490C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit