bea843e33ac0ad9f74a487ddc29a54117d8af2d6931444cedd46413b3feff092

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de5b436a769858b3b4270d1f955a4d3_JaffaCakes118.html
Size

43KB
MD5

0de5b436a769858b3b4270d1f955a4d3
SHA1

d22200e6ad72ae28bd4241c3a3da57866dd58b6d
SHA256

bea843e33ac0ad9f74a487ddc29a54117d8af2d6931444cedd46413b3feff092
SHA512

d8bfddc1ab0b51250bfe4ffe3c11be2307dbee6c1b3c197f859e0829d992919f8db6be22134405bac388d17525a1319694bdaf218e554f3452dbb54e537045b2
SSDEEP

768:zl9m2DawLyybh0T8+HR5hXfzJ+N3KDi/3MKHmPwl4HXJ/yHXJCh:zl9m2DawLyybh0T8+HRDPWAurJkJ/mJG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000008788b5e19747bf1bfd4ab6ef26a70b10ef8dda89ca8b5baed65cf0bac04d2b7a000000000e8000000002000020000000c11eba86548edd02a2407d0940ae4b8d20dc29ab7de1dd1c0b91d041ef3349142000000004badaf9fcf45dd9424bc1c6f0267edf5c2d052c4193b6513779659fba1c4008400000000d9c8107ae3e9609359523b24f64b82a1b7ad5410d0d71b24d44934e8e3476210e2bbb49bf2283e1e26bac3b0b3a1c595ef259a34cabf1babc07f26d174be44d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200dc879639cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ce173ed2245aabf9f113b951c86cd86df5ca1772ac30f0c8c004b85af681e853000000000e8000000002000020000000570cd1630fc0cc05f41b2752f7d62a00581fa2014262649f19d3cdab8d4df715900000000a4d617200dc69c10bf5006cee0f8efa736195c4c8a7d5e01629ee119c3ac47fbbc73bdd7dc9c10229757e626a09b4963339c2dff22f1abaebb5d480148cad46de8978ce4e39e5e02f4abb2eb2966ba1913784a551afb2af0bfa631f5d6e81afc0a208b0295672d8c1cd9da47e01bf85169979fae4a8012384a8d274928926e0b012c6d5dd73f81fb588b277ed0b45d44000000078356ee9b429ed719c5cb3c42d719b11d52e94637d4759f18f71338d584ca913cfdd6e8a43cdf224606117dae82884111030cd7e8078aeaa84796b2c47a682d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420797236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A492D2B1-0856-11EF-BD6B-4E7248FDA7F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2152	2104	iexplore.exe	28
PID 2104 wrote to memory of 2152	2104	iexplore.exe	28
PID 2104 wrote to memory of 2152	2104	iexplore.exe	28
PID 2104 wrote to memory of 2152	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0de5b436a769858b3b4270d1f955a4d3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
986ad91c2025e6b55e286ef7863fcb6f

SHA1
f250c50861266c7b382a0615c0303b775476cb31

SHA256
92a6b06f8d4a1eb28373c067d5e03eb1cae2be9d25be207ffcd58a2e1646af67

SHA512
16f83b480f6334cfd4ba029e3a60c491025dde5c1e3933d4c9c00bed143345aeddc04cc8dfc1a3b6e56767e3168d511c1e477353113290443ae0863c9cdb2e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff619fa11326d8fe7d49dd845250266a

SHA1
5a1d8e821afbcbfbedae8c3f5e572aa123e851b5

SHA256
c267f4945e6be51db44da63f3910c3c2c33b0a68b9a812607c07454c6d3c82a1

SHA512
529b3668a761b2f87565a47db2315c0302a05fc8659ed90fa9fa740e8be522d598492b87c703d62a962824fb9c87469a8ec8250d07a630f0e8cb662e4e1bff6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fffa6b45bb729b25ca3d2c74c004f852

SHA1
49767032b95f9e4fff5b0cbceeba786b2c6ee6eb

SHA256
c2b25cc1e52e3a4fcf48c7c1152420cd48739859960b569ee2d59b0b03967f2d

SHA512
abb5039d891adcc919f746c5971443a74e36773f792ba71e5b69a00f361b56a08c4703ab380622dffae6894266f9aea84d433c4d4dde1931a3365ff87ec833d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da355117b402f91970baed9f28a36f6e

SHA1
54ef6fdc315d5a6cdd39a5d41fb086d726249cd7

SHA256
a4cabe4cd217e02228d6e0ec545929938dfa8f16cce8e61e4c245511fe288f20

SHA512
e74c286dd9b5d41f9cc3c22e43489bcd762bd364f081121263ff00786249e889fb4821a5d0060f8b7b0137c818074cddd0e6f5329d043f011314d855e80089e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c1cae7afd7396a5361363cd6af2902

SHA1
a94121e9c46f0990ec4c49ffe157659232d60fd0

SHA256
14133935562cb4e3b72d985f234961f12272391d88bb7c49e76e6a799a4edd9e

SHA512
a02d49eaff39366c35d6668e1852a3fc80202ca1c8211e2757560d08108a73b01fd55c96591a3ef1d6b7e52eefdec84dfd927924c0e80dd7d64febff38506b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77af72484fb67dc139c0d16f9ac33335

SHA1
b471fe2fffcb7a6c12c8a214fdc1ad9161ee2421

SHA256
00cb590295c063f26de2fe78c574a1961cebeddcf535a0d7293b7aa93feddca1

SHA512
47e58d1439d95adea8d874296d305222202fe3ebbaa1c563dbd031485564837e29134188cd09c7afe5be774463c2de24cbb838d03f18f7ff1fe6106fe739e160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ee02040ee422060e2d09c4d9076eaac

SHA1
493e7ef3384cb9974925c85b41809fc6da98574b

SHA256
9d828bc71108fb61cf9b0166c4196fc061fa50b11b429e459a55ebccc50bc7fa

SHA512
032e03e7d7fdd955b4d47ad4d70002c0e47b6bd6eea497475520b612bf0dd3c10958d8154528a97cf99256a300fa53ae78c00ad93732a90a8fe789ea67e48d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
429d3846c76084da743fd1b87bb7e788

SHA1
e5cf58993ff95acec8af394a42b08d3ddf0703ae

SHA256
6b0f574739bee2aecacea127e6cc454b7fb8ac4e3f8734a0c6a5802da71048af

SHA512
f9b87565e02815559577bd41bbecdc7dcae7f07e47a183c5096705d5da1a95575d9791ab56a6aa706aa7c340d93ebd72b620f421f0b30078dab6219f2bf7c4d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d8b54de84b18e84fb27d68f1e000d4

SHA1
909aa27ce4165b9719c20faf092afb2149b515ac

SHA256
8838c80e1cd1f06507ab30cfca0471bbe586b62a1327ce51532a32552cad8c37

SHA512
5cb78406e4b015d876d1cfdfb7479eb6640ef12351c8235112cc5b5bee0ca78ed484ed2164f2cb66eabfb8dd023c1a24c41ba54424812e8e052f2d9d3c27c21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a42505469c4b158dcad19062ca64859

SHA1
9cf8ca794f81c4e74f205177c6a12a32ad1d9c51

SHA256
46fd805bb40efbce32103d1e9ae7688c842eab07c6c7f19af757d3f43edca48f

SHA512
3106c45fdda47e52600ce13490aa23192d17922837e8aff348f97d2b640978dafbb1bf14457fe86464d83e487f089a48cdd398de57933af627fd81592a54e441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acca801bb043f98829c0ee5c831e0bb5

SHA1
343f408c71c81be093d54a0d9da72b46dd45dab6

SHA256
b082ac3a7467f79188e419b5deea45dc231019fc477b4a95fddedd590551621a

SHA512
52ac991fdda85ce6a626053d61fb3a670327493ce0872b53f101f98bcbb575210223d2035cb0a247057a950636855fc9518b2e5d358568f102a13c8323933b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c36aea9ed92bf63d2343f0ca3222db

SHA1
985030f50020dc25725ea5b65adeb0b04a78b582

SHA256
70a42eeb65bbadb3ab4b30aab2da4b84fe65258ebc62a0686bad3dbaeff144f5

SHA512
6f08fc16a9bffe28c65e602c25e952e9759e38b7bf98fbe6ee7bdccb11a61aa4d11419523e07545c3c8937b592be595172ab21b4061573346428be2f5009a6c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfbfb2ce79ff8bd3a7162e488d455332

SHA1
db526b544adb75e94c51526029333ecf5d01c578

SHA256
bba6fc48c3ba023fe9702e5c5f620afafd075e779f0c5b624937206d44bae5bb

SHA512
7ffeb00dd2fdbbd4d704a2b27661eeee7d11d178bd3da8993b1d3546249df67f23639ebc1728be5e2e92c0eb4fc3405da6c8d7f26a5086d0d61a7a2e8fa2b9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159af6f960e35f16cddb2ff05795e63b

SHA1
6cb846922ac1b7b6d75289962f42bb45c2e705d5

SHA256
f48e852b50ca7d85fa37651836ecd1c211cce322738f445efb0d34a6185de4dd

SHA512
3d0733dfa463dbe16e7e9d67b30327d9e5cfb70fbbfbcf3bef0e68b751fd16634fe0e272517e719831f3d47dd4056c90ff6056d9ab2109214ac89b9e92e453c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f24b1f44d8601b64c942808d9924b2a

SHA1
ef111ad51b2da34a411cb46b9c015990f5555a52

SHA256
d120aa6c098b970164d9feb0d88f3f03cbb432134688b77a4998b5a28ac9116c

SHA512
3664ef4b92e5540fb61dfb1f3ac805625180743a1a83180fee1efb9c3ee2a6996ccb53855b95968fef1046f7ae313a64a257c264d06d5a4b74ce84274fe2017f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5455c90b958ca0b2e15f1ee5d22fbea7

SHA1
80cea2385f25de6c9b2c7554ddcaff42894e9487

SHA256
f343652b6b279d8b265e88e6a314385f50fea592bc0ae26eaa032e01aa4a0da5

SHA512
8895f7070c4c4fedf87493ae8e6f7e8cb707e7e450d04ecbc60ae64e98b943c46d91461d25dc5eabf5c4e0da0f59168b6e2d3281e838a222d85c6fb1698a0197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4df8a2a300df160fc531142f39e63e6e

SHA1
d9e4a186528a726790d9cd21688476ed24cd06cf

SHA256
86e4f56371d71718fa56bdb734f0f2c0fe5697bd259389b775483821ded93577

SHA512
de24ca25b141506c8c99e3d4988054e477a4769c1a26bd2cb884e6686b7384c688f0bc84a2e33cf09b2e5aa15148380c9dadbada180dd6f356354e97293cc420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3095.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30F6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit