61753c08f9ac3b85bcd36842f298c04a252e294d5bf7de6c47c56239812abea6

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d4fe788d134055c88746a903c2efb2b_JaffaCakes118.html
Size

23KB
MD5

0d4fe788d134055c88746a903c2efb2b
SHA1

f9b84037e7d5eae5c4f80da2b969f2a79393f3ee
SHA256

61753c08f9ac3b85bcd36842f298c04a252e294d5bf7de6c47c56239812abea6
SHA512

a1c1527ac8af7ab4fb5ecca8ede6bab3d083aff1d0a33e70f8bc59594af9aee328297d6ff2175facdb01f3fad752ca6e3a0b6ce2699df87abc655090504c4a12
SSDEEP

192:uWTMb5nGenQjxn5Q/JnQieUNn5nQOkEntPjnQTbnRnQ2CnQtGwMB0qnYnQ7tn+YW:XQ/VOnF

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420781154"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3301EA71-0831-11EF-AB14-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000007a6b9a597c881a1c14cd7e0db9f57d4bc972febcda7b340cb05a916178234c4d000000000e800000000200002000000032c460f2c9310214303cb339d15c4d6a32e62f4a56aa1e54736b4fc2106b17f02000000049dcd0dca2bdbde6a9f9ee8e8df4d373077aa8641aca8b550348feda7c1e8bee40000000025d1869f3633c451a928487b77db6bedff3eab6a32abdb73c7636dbab080ffc89793c881e96a0e3eaab5af160ba8d40b1dc08259dbcd20682a2798e0f5854d9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000031793183be3f5db05bb4c366359e8c25af572160dcdddaf94f93672e884bb660000000000e80000000020000200000004522b905f466b973c12a57eac8e8e3a717e0ceaad11c822ba3ad068729f97b6e90000000e7cc4d619323de8ad86573cec9a724ed397b52921f941ada03cbff2e017fdea9488507f65233c5d5329203dd07e7b1acd40a7a72684a2a56eab8c4fd85468f04c8c44d267d91c401635887ad4e3961f82f62fcaff6ae12e32489bbae2229450f70171eb4ddb093f1d6f2a63e5ed87ef3126d40a9db99657c7ba596e0bf33dda366eb459256c4d059e17258536e454d4e40000000d1b069555f2da0c41a5806345ce0e2183e6e6334403cb8b30cbe5810055735a40376f96e983a3651aa92333ce6b4103403ca5dee1420cc00893cb6ae9e3c107a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a2c7073e9cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2344	2612	iexplore.exe	28
PID 2612 wrote to memory of 2344	2612	iexplore.exe	28
PID 2612 wrote to memory of 2344	2612	iexplore.exe	28
PID 2612 wrote to memory of 2344	2612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d4fe788d134055c88746a903c2efb2b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3672e2674d432b8b8e92547dbf911e3e

SHA1
9cea73d34b2ba7aee3f591465f29dd60eadca7f1

SHA256
10ff3f86f2c043fc000b2061c34683faada1f344a42cf2d1569c6e1c128c3a32

SHA512
443c70ba788fdb27e03d314d2dc99e6b354b4c2362daeeea3a13ad24fa2953b29dc74d6963b33780a1a9d13845f632e3763a429139d5257fce7fab97b4beaf69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e545f2c8a60aad8ae84c241a09aeb29

SHA1
fbe5453e73052b4d529c51c13babae19766e8959

SHA256
bd4e345d81ab3093ff4e0924d16905b55594d9f2754e4a8f41014207a0eaf1c6

SHA512
8b26e1108f5c49017601fe5ec77e35d0fa4197960ff6bee332755972a09f56822a0dbc5a05ae3e877796323abde778cff098989f15277b18cec118159cd28bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fd2513964a08d51afa224895c5e3125

SHA1
597e869e4426c39e620fa9f941e706b65ac0f016

SHA256
c2b7037f5e2d41853ea9b82db90fc57832f54f3c8019ff45e9e2108c3b2f266b

SHA512
401d3029b2d30bd9bad7f1d075395edd66908929ab4f3148d1ea5962ec2c709337f3a255028db66f75f4931e7631a9e5c5908537e39075e5dbe216b7ae0b52b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fe7f6591bdd07f785b1792323f842f1

SHA1
c90f4de7116c77d0d60fa59341ddaabb46471a3a

SHA256
642534bfe1ea3176cd382a5d8c1a6e16a3bbf0a758875b91088272f5914fe943

SHA512
a3ea26660a45ad1c5bc277c344712bf20e87021380377c417e9bc960900c96afd8812f6020c137ee019bac6667953f9255c13b3dcc1efa0caec9d6641830d976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c9b03ad5e949e2723e9c6abad7c0111

SHA1
671bf58ea8d366fb4830f4aaadd1f31effe6b23f

SHA256
59a37cf754b7bcd141aecd80e3f3cd6bfc319fa6e46aa35c3ff68d7282f1dadc

SHA512
cc7b86f86e3fbfa52a2ab077adec6d9d793dfa223224c581d4fe64155cd206c585f0f37d42e5529fd30a9d4d26d68a7d3f11b6678e5216334243e94974556f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bad2c38573aa12bd406a2006f145e936

SHA1
8de8d4ddf58c4dd4771faf676943815c698a5586

SHA256
2487a6e6c88c6bcc322ca9aee043197e1ef6b87eb7d021a7f758c94659702e91

SHA512
8b6ed570d8725b621614d60f89be1160f67f2e77d5f113d32b3f0b6d4fb989b61db07d3e52d9e167a4a113fed8176542c99c56dff3b56bf83ab04ccd1be36bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd7d3d91129a6b95f33aadefdaf52a9

SHA1
bde32715a8e3fce37420634dcaf794b90fbb0e3b

SHA256
b06922c37159b98361d6cb623224cb6a3468dfdbe5347c08849a8294349f5789

SHA512
c9a3c228854f098b42cf5e417ace5fe51561eb07785fb591914b11e8255008082f1b3c0cf64c24e2eee49f702c093503e37a8ff69998fa8017a4bb3d1bbd0f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9a7b9e62de3a80bfdc90f9b8012115

SHA1
f6625d1e227dbbed3ee0c8bb74b04b4be40e690c

SHA256
ec96d7d70c381dd2628d2dff7e17fb03aa1937f52ef24f0f85af5548be86a32d

SHA512
e5a4c129917dab431877e33ad6f5e8506f7e7a2b851bbe8ae257598758878dd2c21463e939c15341bb7a6c9c645d4323feb00ab47033a3adc4ce8330e653eb14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cefadf5e8b63febf0086047e13d73f38

SHA1
e2a9cda527525fa0ae747007f82cffb4151fb863

SHA256
c2c93a05e1fa1a4600804ded179735189213ba59ea0835666306ddbe6ce62c87

SHA512
8f3687233f5f01a025d341fafadf8cefb2fd6c0311593b0fec3ba9c07b581364da990d2997a75e47db55b9fb36c99bbc8b51d39dee36d79f96acb63c4656cd92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e10d061ae583f250f053cda1995b3f7

SHA1
814e09ae3b3a08483d0318b6f8c890562bec1967

SHA256
b9bb7cb991e01ba85dce5d7718149db1af6575d70ae1da5353aee2d7b215d308

SHA512
a325cbcd99dbf10e3f38d8ad23860f919ba9c9a298ccdaa5a4ec117bbf92e7c1b8ebedde45f2229ddff245a27b7d59665ccc4bc0f8e7650626e165f63d68e356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97d969a990372d5433cf82a318c13728

SHA1
bebadf3afccceb8cbfe4a6b17c854748673bcea1

SHA256
ccfec72b33f3ccc70c343bb69bf92f1168f58deb4b31915676dc764a23bb9f0a

SHA512
fa0a0fdad33b271e5ce10c042ea549f1f57ff4db2a3446523d09062f13243e34b9fa81bb0595334b56a624b26fac1c6bf92823a7bec4f3f8ba86588709ba6483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b64bab65ceb8073b4259d286892d7e1

SHA1
cbf7c4574429156b031a3e7384941bbfbeead6b2

SHA256
d92c63aab8713b47a019d42baef5563573902ed1e167f1e615fb0d10f9cace4d

SHA512
b1042f24984cc43fad1bb6991555c317c3e1ca2dca254cb498e69b4870fb412ea04cb61485404fb81a37c2260dc7940cf769fc6a3a913260469accadd6425fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1547cd490d5b492cf94314422736c1b4

SHA1
9646e80b0757c0f514b0e487173988e002a21c41

SHA256
feb8e2769a8859902e246f16debdda6498fd1797d966a009385350996afa444d

SHA512
2b99049e015d870ab6a5d9a6715e1a0673772cc176b087e1c15d2349a4bea9d15759237ac6a3f93d5024bbec396319a2fed855145a7cc63738af3d81a9eae01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C12.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D42.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit