e0c3ee86c4b3ae567e711e6978995074372f62e7779db265645361791c329420

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10a38cdf69e012d4482e46cd5d328020_JaffaCakes118.html
Size

27KB
MD5

10a38cdf69e012d4482e46cd5d328020
SHA1

74074b0832c0a4e4260069c7b9ec2646b18382ac
SHA256

e0c3ee86c4b3ae567e711e6978995074372f62e7779db265645361791c329420
SHA512

afdde45f378afec79cc5e2b9391b9a099b72afba6f56f65f39a954d988015174450e466b24a11eec19c9d1fea51c87bd30b079ba23250a827c4edee0e2c2bf93
SSDEEP

192:NmOoGWPb5nNnQjLntQ//nQieDnKnQOkrntlmnQTbn+nQkMCLALpdErwuMm4QWM9v:cOoNkQ/wc1IkP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001f1dfb5d9dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25315631-0951-11EF-8EEA-EE2F313809B4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000789e77f794e6644d90b5c10311a4da350000000002000000000010660000000100002000000041758c4da318418ccbcd5b86345aaad1f2b57833a98ca97895e60b149735ee5f000000000e800000000200002000000005bc97c7e7e0bd237e7db7d08fe65d385a4bafa1be3c24bf36d2d100757c99fd20000000fba8fbe405b9dc8557eab44e58fa21bdd0b457b4feb1a7c5074064824659dcd94000000055d4775032ea29f010d8a2e47ddfb95bd89cde44d283c6275d4ebb5df42e5fb17127e190497cbbf850dba762535f97292614d130a4f2aee03580e33c09b9beb6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000789e77f794e6644d90b5c10311a4da350000000002000000000010660000000100002000000066f898754f509c099d43ec1fded2ee27645d81e31837a67cdbd0b77536f444a1000000000e80000000020000200000006b574bde81d81d0cafaa34d7d063316e1e59753342e5d5726a61f2a24461fb8c90000000cb44f4cef715a5f82b21e7cbc087d19bc259d2e3bd6746b82e0fcb41257fa17d5d8fb25ba8f412d634ed91e2c3843f65ca756e448003adedff69ddcd6b5557f69d23e372511cb3d66d2ad1e15a1d78d412306163543b0de45f318565d672977075749670b35ad5c915fcd45f94377e00a57adcd66d7170778b8423d966cb4186467d2ec7502370140583aaef412ab438400000006374b942b087e0faddbc68c4fb943e0bc8a54647c42b9cdd6e8ed37be892707660e3dee507055d1943e65222478833f5c2402692e6fdf7c9ea2fe2f13cf0c404	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420904827"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1364	iexplore.exe
1364	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2844	1364	iexplore.exe	28
PID 1364 wrote to memory of 2844	1364	iexplore.exe	28
PID 1364 wrote to memory of 2844	1364	iexplore.exe	28
PID 1364 wrote to memory of 2844	1364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10a38cdf69e012d4482e46cd5d328020_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
34ed548eb248421c203647e1c2e265dc

SHA1
e6d3be426890b8b70dbad32617e4a34452da5883

SHA256
b9aa05fd5ee95b4c07550099d735a7007bb95b1e91754211e3bfd0aa1c6d7aea

SHA512
248cc67ba5ed74b1f7050f4d35301a373143e521fe8a76b2df30cfd3522b3784a56fa7baf6e72d875c1d9354db9f79291432dddb3613026d64e8dc2217acf520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a52dee19be0ccb60bd5b8002568df063

SHA1
d5e55ecf7fa445c167be04740aaad7199facfc7d

SHA256
5b2fa89269780a027fd4ba87252351b61efd4dc3be53c9c2f5fd9d897ba0ff4f

SHA512
9a8716b1eb7c776dd557e7da22c0ad52d6f736aca300701cf7deab9c4991984d4853c3f75012ac8d1a0769a90a8d3e20c2101b9a6011eeecd0bb302cbd79e903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b1c457e1ed62cabda9906d00e3b8f30

SHA1
0369d971ca853ddd8b73a64dd74e119aa193e7fe

SHA256
e29d6180516958e2d42e273e82ed777de70d8b92fe0ae397b5c0b9ff169e181a

SHA512
6ec77ecffda1a4946f321e28496a2086df9bd8ab91595f930f83b478a4ec23b09c30becdaee65c70ea1eb4b4fc6d4d87755bb53771a2cc4f563a277128ae56e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6873146aa501d27d3eabe8490e750d

SHA1
d0370d12a6a0e33935a64b6fa44bb4cdf2cfaa94

SHA256
607670a8a9ce78df7c196a2540a937b53729dda36cd7e4e45c3ff061e12a13b1

SHA512
85478ae66e24990a256163a643e9c97815e6fac7a0a70b805ba5303e6354a1fb0e504f48cdc8e3dc2749cbef9bf66ef343b962456c9d449d78a9eef4306bd398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7740912d1170041a0110d2a754234174

SHA1
db5bb0fd1866f79748805553af7bd0108695f46f

SHA256
649c883123c8c5286d8e25bf2cc7e604f10dbcddff43c0b68e2d9a6e059cdec1

SHA512
e701b2d5bf0816417d45d8fb04f69922a994facc012bfcc578ab4f48b19998962a33b7366e59897d250ae533c355c8678b2131418c0daac7115f74d933819749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d454d98854163656404cef89b47041f9

SHA1
8c2805f6556d8d3433623b103cd597e774221b28

SHA256
df4e314e6b9316f9a95acd58cc39a30669b7b1062fb5f932348f23acc9e8a4a0

SHA512
bc96b35292805d0169018d4a6b4cf17f63f3011a14c784a2e834b645d9133d3975abedbb228adcc32995c0bbfea12aa80b1d0c22b2b589d7a7bb052aef84cb6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae0943bb8291aecebebd6f376ebe341c

SHA1
c8f24cfd76b6d2b47772e0a6479a790f19b880d7

SHA256
cd25f02757b032ba62c30e7eed3057e16738fccfa9c4602c7ea3f3e27c70abfe

SHA512
e759b2afa6b62c6312c64d2186572768fb84d4e108c434338423e2ef57e51389c010641bbae23398837e51bf0867f15a901e77d50644789627cb391b7fe9c0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70db831afa9abd77a3837a46407e1e6e

SHA1
5e8d4357e8888a42c869d8af798395037ce7781b

SHA256
824382a5076d65b4f0dd72ab816e10822dcfefbd4d5bc224d22d4611ea8ba5ea

SHA512
dff74548d7e38e7e3cf49fe64bfdcbc92c64dcfe40cef05655d8c855418ebec5982f22a9260f13264ca8b946d01d770c709756806c7252a5c065eabb9438fc76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d9a96151d0030598fb136449366cbb

SHA1
a2961d689b9c1e843436f04da1af74f896053746

SHA256
e49012cf1ecc40ce14a0415ec02e435a80c346856b3e62abca48aaf99ab3461c

SHA512
7c113db04726aad42df91998db7cea99d9db6e8428581eb6e4833933a83e448983963c2f1f1794ff39928d2d0dea9809484a31bba95a8121aa441d5be373169c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8627e231c5cc949102f95cc0c3f9f79

SHA1
0a30c87d79aa74c7371c139f9de8b285da933565

SHA256
15e688abdff8e3bf5ceed04aa6b33991c2a0eb01122f59e30baa19f258b37f25

SHA512
50beda44a5a771ea1be6db6d6b23cf81c2eab9c5911112ed4c8025895f32d7d92604cb351471c6008677dbdedd61d1e128806b11ad7a78b1d651889bfb1f8dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39f5c63c4ab9dd1f825f6e96e2f2f3b5

SHA1
f63c3375b0e79a44896f3b2a525da93392e118c6

SHA256
e6cbed95d4a9999060d0d3887c881d72e239b441a73fa03d74e72f4f017720ab

SHA512
048f292bae1421fb11366874bfde3984c1e7a0ab3e02e15f3dc25b6a65c3bc256867614bf33e245e009b780e197c3e70566b0923c08ed961dd76a01b15fdf9bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6d74b54056cdc4eed94a0552a3a1bf75

SHA1
506dd56b3c3c69690495b7985ce00f797cb9f929

SHA256
1adfa889a14c8a975220567bd7d9cfb9d17e308771056a7d10650fa03485f33b

SHA512
44b6fa264808536031a38e1a08c2c062fc72e960f6eca37364c5d37a55b0f69f9ec3d095a6a8693be30e8b136eea141282d9492150b8a2bf02c9c6e1a8a898f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
94b5186f5edb248576c69d308984f0f1

SHA1
f5f0bc27cba047622108914dd94ef32203977f91

SHA256
fe492422fd4a86cb350d4eef7556adc02970a65a15b809b0e60c796b5c1dfcd5

SHA512
4d0bdf23817c64c71239a2270ecb8a50756d8e2af0b3901d8761c6e264d3acb8c07011cd51d01d816da55321f9e4c7f9af7535590071ab7b980ba67c2460f8bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38EC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A96.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit