65d56dad20edf2926cf34f12e1bff5108026776bb3dc4b2b111338b6cca8b4a9

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df2eca2454c0814e17cc11494c223d2_JaffaCakes118.html
Size

68KB
MD5

0df2eca2454c0814e17cc11494c223d2
SHA1

3c7422968630b3efc44e5467618fbbbd5d99da87
SHA256

65d56dad20edf2926cf34f12e1bff5108026776bb3dc4b2b111338b6cca8b4a9
SHA512

b366836e74b8d64deab4bb1164c56075d90888f73a760672ee25328405d33d392dabecfdc4e37b0321822b8f44ffb2064570ceba448216e054d0583c769704d6
SSDEEP

768:JiYgcMiR3sI2PDDnX0g6sNv4Jv+OsoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JY/gJvzhTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000063796c41b44badc838b173fa312ba835d2b649f8997031e2b0f6d7553f6bf1bb000000000e800000000200002000000055ff3c617685390eb543f1d7f617b10949f2b43434700ed5d0a953ec2ed0402c20000000ca900707834f36bb93b7f453cb335a60acf3411856790a095b0b09e2c105344b400000002375b84c447431c927a00f593d2c1ec39567c5fdd8861b2c2532a12183e22b654a1d810e2473ebc4c045b14431d1061d7b3a52943c95c6f4a5e3e1570ff15a90	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420798996"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD954551-085A-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506a2392679cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000004443b68bb30497c0718babf89a292f4e4ca6fb18d02a36c31d0a0bada8fb75de000000000e80000000020000200000002d2d523ae981d6ebad72cdcca53c4385bf992cb8039255e9c0a05ac7da768e499000000076bec251bbfa6288e813b5ab6996c5d1e34c73f3986645752fc1841913859964d7638f765418fa8563c75ca1c2eb862ecf530c64e2fe69ba0c538845a4e7fd7f9a1d9306af53a728020b8f138763647e48bb5c9abee5a16ba0d282179de2645684bff967d4e40c882552d441005a2f66df53d3b697d2c639695741635519c33457e219c3df38627d7e4fda03a77ede0c40000000e5f2475df4f0e063855cac1c98b323709daf24163541a07587b7c900a9bf9c612604738ecd9b26c3ad39d5a49de665ea7c36323ed9b565a844b9edfc07b4b98c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28
PID 2072 wrote to memory of 3020	2072	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0df2eca2454c0814e17cc11494c223d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01cca4948846e65ca249decf842dd733

SHA1
9fe264d92fa89d16027cfdf5c30128e091df6567

SHA256
3894d5eb7dff21f78a9e13c66ee85d21e145830cc4b506957ede561530002eb3

SHA512
d6588959dd84eb65f48ade3922d18380073ff0309559aa07ecf986fce7cf7fb10f2da1ee41b45e7c0fbd9c9950d60147d5924f982f684c9e494e429c131019ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa4d68c47ec6ff26c218912bc72a14d

SHA1
be69e3767aa7b0c9ec905e089e10aa9259bafee1

SHA256
1823fbe656e1e5452735bde060eb92b51a8d97d9dba5a8f7afa1c4d2c2c3c0b8

SHA512
08353ce36f26fb9507c01a3c54274de512260beef3305c6675405c7cb73e2b2d4ffc25289c649e399f9cb2d5160fea5c77be1057be9a16ad64070db501a68626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62ef8f2319f4f7c05992f0fdff492bd

SHA1
1b686b866f29e2e97269ee5eb0f64bfe40cc7b5a

SHA256
4af36772e3d6be1b0b4afbde51dc5316ca58ad8d092f000c0fa6a6a74e600a2d

SHA512
41dcc21063588614dbc345ed9b07914c41d4110612bb6beb4448fdf17f182517eae9662e1915a398138e97d07ae11da573ab059e72e4ae7315f685fb02365739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff785b65a9a3a6545a144fc5ee87578b

SHA1
51a29f36f23681662187e01c9ba7ce50b88f1da0

SHA256
6f5941fe139ffde63ff3997b4a5114725c88b7f79676f9b1ff61c659890e622d

SHA512
83e63f1aaace7c81053f885dcdfcd7098f3ba54538c65f100b2404f73dfff48a107ad187b73bbe8a3110152702e331fcfdd4a955833915ec73dab00b0a9adc62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a5d9c479c58c6edd0d9977af669b132

SHA1
e29b6243850e91be0f9cf5ee52f3a22ec7f76f87

SHA256
9b568622ffdd028020119f1a1c936267431fbfec8ba9d8222a1d6e0fbd8360e4

SHA512
257aa8f571d9dbe6a83b6e0f3b2a14f76db92448f5ef9ae13983611f18708ce56e1644a758fa4c6e483c6417e8624cf9b2161f3dc1a60e6e0e79bae59446b624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062c2391c83d1b54424a032fc0c03548

SHA1
aa14fa54d7d8fa2883d190a648c0a19976001f54

SHA256
be5ec844fe9c284772a41f3e4008203544f8ad829387139a00e0d3171bc4beb1

SHA512
0657ee6d22d58f41497372320b62c9ca7bf4fb48a1616fe1fe389597247185b97342e3ec116e822d64ede33d98cd286c126cbb354ff59732d79954a8c98df1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2de59243bc366cfd64b66280a347f774

SHA1
bd7b905fa1ccb766fd134ea5cebedd76ab82e598

SHA256
9fff72e1f7fee0e8edc82ee0d7d9897a0d4558050b079c54b57ac64eb03437b4

SHA512
1cd59398c5cf52e7cb3b5c36f742127d6f3ef3ce9d89f6aba07c720e0d45b581554a5de8fdd2ea61aa2c42c54f6e7f2ff1ea44cfc69885641c44cdb5453b6f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71201bb9b840f35b2cab44f581918a31

SHA1
9f920585b3989a04cd91069e6e455f9f976643c6

SHA256
0d738be97ea241cbb712ff27b0f6a169e488e4f4a6caf92f156ce42e0b4e40ca

SHA512
e7ca7f517026834ad2173cbfc9e9cc3954ecfa29fa275d9717c6d7012b274537f71adfdce6f08e6e4179758375562da56dd45092245c8e8293187c7841354216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d34932ccbd17b35290d643ef12669ae

SHA1
e99c17d4c0d865d4e9d6090983aa915b3912b0f1

SHA256
62fd1c9cb3a3a84f12e54cb8932fe5ec7eabbc351c07acb3ebe6ebfadc469a91

SHA512
0d8505c1e21ee16953d9aaf296938c997e0937a1d9a4f84bc80ccabd858adc4b9688b79b5fc6ddaa2efd2c990485ab3a68e1c2e25c80020b77356bba8e0d182e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9499a99a621590b3a33c28a8a7e7ec9

SHA1
4cf1d8ffea72de79e870a0aa4e42ce544d1c8d4a

SHA256
9d2013d519ba67a15199a570fa006bd00aea8dac828a7f40fd58bad290c92081

SHA512
67e2fe0cf3e88c66619b55c180cfbf9b5349a90235a5f65124a772e501c3dd0fb4d08b4398a4d090c39147bc72cd70a410e2edbfa565487d237c957c6c35c8b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3267a16dafb83d8e5ab2085afc93ec7

SHA1
77bc1b0fe044aa46b91d81f5606c970b969f44fe

SHA256
661d3ec9c75bde3590e6f0b352bcfb763c959754cc9c2fde42187e7f994d2c17

SHA512
30c2ad1f60c88120888e13eb0585326ab09db54485a6404330e4bd54f7751c092a4719215140d1dc89ae7715ce1c8e5f36a3cd2fd25c7fa3205c28b0deb8eeb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6608942a1592fd0810331d582ce08422

SHA1
f0122f5452fb2361c82f5e6cc1a8e7c322704b87

SHA256
bebf752e32b331ac62b5c3d0c07d2d9ff6b66caee97bed01821ad6b07847ef69

SHA512
825d1869ae16ebc7794b5effc95909011a9ffbca61dc9c6a16e3ac893b8c9b6613e4c5de6ff1feead5d6f677362954dc686c9a88742b131b53abe37b25ef8bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7683387169a0af758a32017ff53d6d3d

SHA1
775e42cfa627b9b47c8bba47a09d2c7063b75f39

SHA256
d1d175d7f5940a3cc2ae4540a164720fcf52d8dfaaf67056ca7364fcf1079cb9

SHA512
b7d8a41942658a041dee66c458eaca53d1e8340c6685b13031dbb46dcc12d78755416c6e9ce87302ff9ece5556bf3745489bf26a3cc03a2034c49c30ae5e36ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d75eb547f843639e4a358389d70f642

SHA1
1a8bbbc9cd8d817ec355834c6b341baa0ed27263

SHA256
827b983ab0df4f2c2ec064de46b6032394e5a88456ecbdd149a3b9943b7dde53

SHA512
c15fd53643921334c5b39384b981eb3e73edbb1d5457bf477775772a0b4815764c9efa3780ce3a01f3b93b286271bf2a8e94945df5c97d5e7ef589c4c777ce12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bba2064a84a14b9311b7e38a6cafc4f4

SHA1
5c4455c8f613cd9f816c57e431767bb6582a3ef8

SHA256
eadf8157e4f37d0bfd7623209e6f69d7135fa05297231d8435d17edcbb24b907

SHA512
38483c67e928ca6d65f731be7a06796e64381ef41e5687731af5650b5b8ec9a7bd1ba44e2e60a8109de56a5292442b50405c262c44ae8dff8232eedad62d7a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8aca49a49c2d5c2731ed0e752d6b22

SHA1
2e0b616542eb68c5d52c1c1837472298d6e68248

SHA256
7bf87d533bcde901bdf887c0c0de5ee18cffd74fbee8fbdeac06314b6863a7e1

SHA512
41f0dea6e9f1ede339fa86593d117676c57515d17c536a8cccaf361180b7daeb00c4a73fb4b39b074d350f692a3562b3293e136a6d579a7739acd597a5cbaa7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D4A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E1C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit