66034e10920618acc439d7c0f21297c25ca16cea21408ced803954b937490a96

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de23d88ea7110a917451d921f8b4366_JaffaCakes118.html
Size

145KB
MD5

0de23d88ea7110a917451d921f8b4366
SHA1

3acdf9be02c53cd6a7759de46aba40b0e809721b
SHA256

66034e10920618acc439d7c0f21297c25ca16cea21408ced803954b937490a96
SHA512

2b0ba55c6ca5aa822f238abd70a673ce8c3901a517d3fe93779ef5c5e3532ce7499f1b5fd2b2e521c99cd4b4010ae2b1b4f1d86a6a26a8899cc21e7cce0d9e5c
SSDEEP

3072:SN0uQ9/zx7dyfkMY+BES09JXAnyrZalI+YQ:SN0Hxx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420796847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB868B71-0855-11EF-93CC-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
360	iexplore.exe
360	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 1804	360	iexplore.exe	28
PID 360 wrote to memory of 1804	360	iexplore.exe	28
PID 360 wrote to memory of 1804	360	iexplore.exe	28
PID 360 wrote to memory of 1804	360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0de23d88ea7110a917451d921f8b4366_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a813b7d3d9bac9741bc10c7f7c3062ae

SHA1
a07b88fca8aa565b540c932407d6ab3271dd5ff9

SHA256
47aef46e6340e6103fdca63820159b97d959106d09279219aed44e8daa882fc5

SHA512
5f3778316f88dbf5c539a853d1eefd72d97044282c49a58ef870ba66c2e5dac34b4c14f93ad42e7df9d3e5fd4b8f4bee2203ee2a9356425882c47ee4c66430cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5902b1590a473f99ad3932123b3070

SHA1
fe836c4f9855566d3488cdef50e44ef60218314a

SHA256
93d436fc283ef2294c52110742e07dc19eea3dce7b638d0d1c152e2ce751f364

SHA512
d879674fffd37e47bb6ea2b7f61157267a60604f742724c72bb1de2312c691904154a1af899ad109a1622f216c7879f4da5232037ed9513734a53685c154e874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb59aca1b3058b587effadca76c22fb

SHA1
9456176d8c9aa8a61bdeb963cbbcd3293ecac7b5

SHA256
b0e23db39227e8a9def69783a906781ea8b31dd8c321dfdf776d21f54b855200

SHA512
d6cbd2cc1cf93b6db88229f1a28c85533447285ae94a9b20523f0c371e63079acca5c1b60f1bcf1b29a2f79585a6c980d9dad6a655a1cc46b2a65cb390d9496c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abc407dc748e903131ec308bd159fdc2

SHA1
d493da299af454848bc4c1fd54dbd80e3b381a98

SHA256
94b3fe592e746e7bc07419c98e238e10d7bb72495468ef5043b8b3443ab25354

SHA512
dd7d8f41845120c6b76eaa3c6247ab1b328be0695fc18aa3f99905279955135dadf41779fa070457d419047126bced8567f03c1f9e2225f7414df51b85aeea96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e4880d5d71f5d26ce757195e71ddf2

SHA1
affda88c52d735da57f2e8793c44f9a3bad1eaf8

SHA256
47e31728283d12cf7913678227aeb0e7194d9c7999f29ca0709fc1e18d01604f

SHA512
5c58fa613d3e3ed03c17cb96ded95d5a96ad9857863e88513f6d7622f2d70ea92298ca40ca947b38edb5aad84a5bd1bffafffa6b24c6eb5f6e50749889947951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80bc341895fd7f178b247ec41439771e

SHA1
923739c29778be763db9d7ee590d3bed247711cc

SHA256
d75f121cc5649f49e642b986b624c1d0b87dd3516d9add0fff6112bd5c9410ee

SHA512
37a8f3b7fde7fedcef45994359c05c07a3d1c5b051769aaedb2e20a44b097c3493e66d512e871710c5581bbc4828b3b5e97a6902883a327885fa8810b7967ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f206af5ac86b5609ce3d568e921f41e

SHA1
44af79a53b523bd97279d94f8fd3e23f8ccb05c8

SHA256
d32308f6eb1cc2c8e1605497d828dddf69623afe47dca6aec81ca8ce9de35aed

SHA512
491488796f4d7c4a8f3fe19a37a8b1a69b2c4d4558b88249372567cb029e7d257fa4d311b776a2b17151b989a03c7b581b7a3d6f3e4a1df804936f867731455f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
766209915d006fb006492b5f15afc010

SHA1
ece4cb277b1442669b635f43ad8da69f24b67663

SHA256
a819ef220c8aa67efcf7f690ede6ba61a3927fda8b3f071206f0671755ff1428

SHA512
fcd083f7292adce5e4b4ccc53675657cad6b8a312710b3b8fd907efb8f47fcdc05802b3c574ff72ce5ad0091cfe7de9900eb5f95c33a1170f3f4d3fbffa3d378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5208bc86ce0eed68feebd3c89214b2f8

SHA1
34153b423fa4aaf1627e6a3b43f1ba4355015a7b

SHA256
6066176ce5b66f6dfb10993992c6b68a30c5ca7c9edf324a804913a71ab3ede8

SHA512
4ecf09e79acb146e8b369e75efa2f278b4e6ffa765c10e6ac281480f5964c310f5f757b0442788e651f2447a89db74d4cb29ca486350b27ddb7c50601e76de99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b63781c805b984b72b181aaddea3dd

SHA1
733e393759c98769bb8d2800f0fbfb3aeec2eac0

SHA256
89bcfcfc95fae0cd737a4dbf6d58e26eb6c9bc73ac1db25850a86482c1a1af9c

SHA512
a56c8ab5a874320bc31111a749ffa803b3f08d84bca733c1ad8b2e054e280a50a60f0451df3a48f007c5fb2ea3829f913eb5afe1b6a916313760a5cacf5952b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ba5f62f5802fbeb1e3bd15716baa962

SHA1
1fa5f38765b37d7bac7dacd7d26ddc1b21d0a576

SHA256
082d62224b7ddb5afca97963cfc3961e0a09c33c959d5c8ea7bb721725587dc4

SHA512
650fc35022573efa16dfc569b606be57d70fddfca7fa791e5dc2206cdba75733c78006d1e54b5665137d41daaa939533c82ba505749b359fa956c26386e50e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab195C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A9B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit