41a95e78b47e6f0fe65513e09a19fbd0ec9cb25dd2ab05e0ca16e2be157708db

Analysis

max time kernel
137s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

108b5f815b6d7584b4d00585ee4a2f96_JaffaCakes118.html
Size

213KB
MD5

108b5f815b6d7584b4d00585ee4a2f96
SHA1

3ac839fbe5bf897e0c19419642a4466bdb1a2a1c
SHA256

41a95e78b47e6f0fe65513e09a19fbd0ec9cb25dd2ab05e0ca16e2be157708db
SHA512

2af160f11b92e9a09dbecc36079dbee5771e24be39a60d6ca64a15ed0db2d00064b5f44c2b827b250bd6b85f95f6308b9ec35b2de646da50a84423bb105286ba
SSDEEP

3072:Sr0qLrIA5dTcyfkMY+BES09JXAnyrZalI+YQ:SrzFTBsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420902030"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1581161-094A-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2860	1708	iexplore.exe	28
PID 1708 wrote to memory of 2860	1708	iexplore.exe	28
PID 1708 wrote to memory of 2860	1708	iexplore.exe	28
PID 1708 wrote to memory of 2860	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\108b5f815b6d7584b4d00585ee4a2f96_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b238ed652b1ba80b6a383ab8f5632e7b

SHA1
e56288f6402084ea77d18838cf2f30503c62163f

SHA256
1ee7caf91249897af92a3bce148b4c0d8f554123a7c62cfe7de436948fcd6d3f

SHA512
c6229abef70a9254c503506f9a3d9ff2742cfc4b69c6592acbe468e93dc5ec66a79fb355a7a68e049f53fa1543751d06bff4def0d869559a7c456ad6c2c63a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75bc8b47cd70710f6b32fdea21bb87dc

SHA1
fba0cb3b8a0ab43e72b02f8297f9294dc1ebc1ab

SHA256
8a2a4877a81605152ae8289f5796526e5c04c79922083b595b0424d4d5758505

SHA512
e17f7e58a2b24a93a1488ea1e9121a188d5ce74656ce40363e923d0f9b3d08b78c2e021d2a9dd549d72010ee16cf45f4a841d1bfb4c0f1a49944b64b0dd40515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6405db4ac59325d02ff8f38e4694211a

SHA1
503101b1a56cc8945bcdc58ea689553d8423d79b

SHA256
262864670e83029f3efebbc4787f60228ed1e48630c29b16a492fe44289789d7

SHA512
daea5a67484f2595a9704fecf3d115a817bd33420222cb502865fadcbba441d9f55a7f6ffee6b2f207015044125977491fbe8528991cf3513dcd54fc9614581b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d67b2aa6576b0ecc9fa8f45b7d6f4e98

SHA1
1cfdc418b239fba3341ec87e7fbc90ccde659825

SHA256
cc69873c850d30246b06420257714c3a9b7fede27d2794796bb045df877ad781

SHA512
f01320423facfb951f535e5f0cfc7298df43725455d1f504f6167bd4168da28ef0bb73c4a418b09647a2c30a5955db2d2165653603dfd1eb368c255a67f66dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c71e932217e0934177a5f1eb1c31c1

SHA1
9eea1e37aafb2da79e3e053618a528d3ab2a6605

SHA256
cac32dc1e60a101580b602b56b482dd97d4b326d530e07b716dcb373921f2940

SHA512
653cd7cb237c905239f8cef2f8f1fcfa50fc95137e1dfcfa825c96b7b5875a7a04c935f17593c51d4f1876f65f1fd3de50082440831ab7169f7b20f679a88a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eef469eef38c17897211b4f903b37622

SHA1
f93d069d0e23e20dc59537f580951a4f390074a0

SHA256
c75bc8fa1d3566d1e8d5b2248ba3c52fb302b68fd3cc61bd77dee2f8579e14bb

SHA512
ead6ed8cefc707ec2fbeb75e9fdc8508f2bca8437182c6ff044beeaf688f879ac2766ed0bfa3a7862eb227d78309cb2552dac2135e01bfeb1bf32f9c01bee4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd2a30fad73eddcd68590e2d2a033b8c

SHA1
0aaba50bef75ad85117be8d8254966ba852ffe4f

SHA256
c7f5bc21ddc95cbe5c823aa9a686290efbbdd934f18d1d70569ee4bf196de956

SHA512
e5a76acff36f2d96a50d41b612d586cdb149efcea08e4867fd8f8b3972f4cc01d89a1eb56d7febc3d729e6614c35dd648facf3a436ee54ed33137cf3a7e79870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f4795468419e125a8e139ee9b18d52e

SHA1
7f1aec53394e9a9b69e239c8832d197fa0e25d4e

SHA256
c587536ddcc96ecf0ef69d984d45626fc7b1c48bb7551354df62027261337066

SHA512
20030a8a73f30fdff414652eb18e11d21b6fba79922e9eefbdfaf0e82d34660d1c632b7c9b9cad750da60ceb3a7eec8136235904977f103548471496e64a420b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc965d6365cbde1f482f8025811ce4d

SHA1
f0cf524a66d6cfa3b3df443f7dd863de90b6f797

SHA256
863634a229a76e3dad75e1756038df3334b4f9d60ef3e3b05f195a99090e53aa

SHA512
4d16c5b2c707b8cb651df39a8f15257a98a7b0c16cd3034030d9e8ce97273bf5307562ceaf3ec22578c36a4bb7ba0528910c25a2abe22b7ed34709cf68cce8f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
352b2fe4194ff3bdcebee8264347e770

SHA1
0ffb01683633d4064b44ffc7e0ed3f16b63c8290

SHA256
74dc935b486e82f31b704d54bf501a2a1fd52f968fc50c93d3a74cbe37ee99e2

SHA512
db047f7109b100a43868b4ae9835ae64defb9fc6c0b950eaefcdcac3529884a2c8815e26eb3adea0ad946a4bc4bef9dfd62a42249e00042eca1eb0dd8bc86e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533d16919c2dd881e7ac5f0f8880c7e2

SHA1
8f4989c08a356934ee8fab38612d4ac8f3882cd5

SHA256
f57a32e404b12a882fb043e254c2986d7cd9fd6c15620a03f2963eca05be6370

SHA512
f696c742f7050d7ba798579ae104ebe6cbec1fa5c05592dea1b6e96d9bce01421e3e9a11b413f2f70a647cb6a1fbbbdadad998d359a0c5f422d44e4d7edeb6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d9a815cd8b45cabd47121e2c65d7b6

SHA1
0d3b01e96cc945041044c63a4ee10076257664e9

SHA256
fd8e843fc2a7cfa5bebcda8394ba6aeee8b8d75e630449f7f8f53c40fa05a19c

SHA512
bb6cb6636feaf12bf26a059087e6f4beef62a063613c32cdd37b3dfbdc2d4a954230c9318f7d7ecd1687291b52f5b5222e1ec29127cd3dd04cbcdbc17e0a52de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9d913173d139d201d8202165fc0dd68

SHA1
d8e8b88518078d41efc134f5bddb7fb257cac0de

SHA256
6563bec39a84eb55309e88a57835da0c05a288fd6c68f466eea683ec5968788a

SHA512
ddd798964962110481b69ca2fa6c1f9aa0dd059e92c0c49819942098f3d1d8ec3da750bbb44681389e0d0c2431b6bfa2cfa11d514afe2e54a478dc8f421ebf14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac01062593d399aa3887c60e0de59b8c

SHA1
ec5d4352488903805a633b8ccdfbe1a351c36a68

SHA256
d589e08f6641b271ac2250f7ebfa47454b52bc5a6d558e5cd2bcdfec4744d2ec

SHA512
cff39fdd8b63052226301732d1de806e9e6319a4ce0420d45a1da39ddb159fff9506a988308e29fefae51e0364277abee2d384cc5367803d322a10c3e3658a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
791f7d957a9fb2b74f42ee1b2bbef4ee

SHA1
eae49823e319d39dec08b8ddda6081f49bdae38e

SHA256
5aa9500d1e24a31638fbd132d83925830898a443ad29cd66fef2e523a1761120

SHA512
392db4b5752a29a3dd9c92e4521ca97343de7742c1f54116e6a277e04c1f0298e54c60be14ea8507d9795d7d19186274883a8246ec7e428d1bf12574d1033eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e99527746e6f3c30ac864f9a159c3d70

SHA1
059175ce964652fd86c27d10b47f33eee4310eb5

SHA256
3089415607996fc6624d7685e342696d78b90975a4be3de8321e05a0ad60e08f

SHA512
69bd156cced7494889978880cf04027a3b5760bdd353d9fd99421b686f75739ebc56dcb5173e6fad1ab18c72a0bf7ea12186a4f134939761202f893c5cf27c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56913aa44810b4e9e0d532e24404cee8

SHA1
027e931fa6efcf6b6d85d36d4355fe8e3e3cbd27

SHA256
469e50aeff54f05c03a5d1cf4c3a12a84cb76dbdd6902bc3104935797ebfa89c

SHA512
30385729f896d702c0b29595cfc004d685029ed28272dbc38d9b2ef52a9dc41355d45df08f311cd1b09e3c8308e5f333f6a418253d50019252fded4838a7e288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bf0222f06b8eb606f8a7f5fafdbf61b

SHA1
a0d1d022b3e2935d4a00800ff4994dddd3af41c4

SHA256
15183d7cf84f7177cd229af4c9a33832219ad0827e085cf5d07fabe817d01a47

SHA512
616f01aaea32ca585496067ab71193495b887d288662b9d35322c9fff82356a0373f1fcc687e1a46f37593b65fac083cdd2b695fa2518abd9b6bb6019759ae91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9232.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9334.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit