0340b5f9f0d8b6aa86962295562a395a726144a50da7b2d1b376c7d7b8c44764

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c8b73357d9c95f6478441d81188819_JaffaCakes118.html
Size

73KB
MD5

14c8b73357d9c95f6478441d81188819
SHA1

bd418fab0711d814d399bf618bca6703c4b66967
SHA256

0340b5f9f0d8b6aa86962295562a395a726144a50da7b2d1b376c7d7b8c44764
SHA512

1a1733e61903bdbd9a39d46085a0128da0fd0c341d2f0da5913185d6fb615860760c90aeed3b55bfdacff9c1abb3cd8ccf7af77dae2f3c0e58b41deabcdc5489
SSDEEP

1536:o0PWI8K+y6fDjIE/4Xp/BOmMgMJlGR5it78Sk+BqOy/X/nIJ9MCx+oRe46:pPWI8K+y6fD1/kOm1XRmFBqOy/X/nIJ6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000093f0dafb27db6af9c0da5f97f0c8a60b8d0b19ac25d5a8ac614d966f491c55b6000000000e800000000200002000000017e791e0eddd77053ceb31278468093d5625307975e4c282ae0f7d4cb480e5a890000000a7b0ff3f2212644e787283a43b84d2503084866f80deb080428ad255b3b3612a7b2823d2831e30577c71783f73cfe7fb9733862b06d225ea7cb3ff88a30947d161a31e6d47e4206807c423619097a1a009fb137c69b3b5ea492155e849a210a2fa6f83cb2463876f01a29add0a647e9a1af01d2c48946b5a7258c2c5d5e807bb2b24b470ea6af59341d5799dce3204094000000066d974d49690622da69ec3427c07422261bb4c91b79d5666d95feceeda3a836fa0bdb6e57e2127d04795693da9876ef7796f1375ed45bdb0afa19e45a949b12b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E43AA7F1-0A66-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000de7cb1523f06f358a6930639f38b4d73b01cd83ea8b96da05e5a2de826e439e1000000000e8000000002000020000000b9f60eacfdbdbe8f3b8d4308515ded348b312f4b5c26d2674f972e8ddb32b67b20000000162d7e3670fd2a5c002a7650ed2fb59ae45b2b918291a4007cb9f5d556fbb6334000000037b3793aa6eea7b0dcd68279229eadd26082951ed72f7f5ff7ec2ef0b6cd65a672ab949735c0e7adcb96c127e6f0eaf74b4149160865451e4b51aef21dd2a430	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a084f2b8739eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421024128"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2508	1720	iexplore.exe	28
PID 1720 wrote to memory of 2508	1720	iexplore.exe	28
PID 1720 wrote to memory of 2508	1720	iexplore.exe	28
PID 1720 wrote to memory of 2508	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14c8b73357d9c95f6478441d81188819_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
65ecc6fa0d6766830d4fd6b8f73c85b3

SHA1
924eff58c4d41c8c6c47fb6ca1fd60037ec005b3

SHA256
6551a5d05685ad1bfba6e7afd3a768e56c20179c2453748ccf4a2d250de9b858

SHA512
eeaa13deeec990011364c5421830852f235293ede146155fb8c154231f1140e66ff5bc61d2dee7eb2e50abb11641aaa6863559645cada0ef7c50f6db6fd57c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cd57b3fd6b1838041e785b15999719a

SHA1
d380ad3aa67f54afc6cfc00877c756158a05869f

SHA256
9e82dde7955389d11f413eeca11165925199076fbce5718c4b585ce64186326d

SHA512
b720e9ac748d7d1f538ca7a31fe417bc6e51a91185867d6baa3c6dd305d05f5ce3a2620b9aead1e2c0f87a6fae4d60ee97f51300e07274564e69f47d9938a507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a2c67517499658d381570e512eb745e

SHA1
26f00fa417b7c1a2186c371e54e08e98b2f29df9

SHA256
9691ff5e300039d94f2471a43b5d0c35a78eac623c8e09d9f1e4d6ce3aa46605

SHA512
2335cd937e66166a5b4247897ea4bbd088fb38b84e186e2b775450435ade061adcf0198f78e3d23a25f59f747ed66eb475e144bf4c4c26de20dec8a1e843f528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da071c457c39ddcadd8485bc211081b9

SHA1
0d47ad43ac6a3e88af01fa3f03967ad64bb5a417

SHA256
e6262072178334808114ae8a5865f067650276eba3121733a3e1adb460f4b1a3

SHA512
5ac4fc2eb9e188da4f8a969e0c03e44890ced3f42dc52c897950117c63e1ce5f89919e9e3d7028dd5ceec23a40dcdf277fe947ec12009b659c3c372b6f71fc10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a59a6fa62866f749645b6ba99a5eea2a

SHA1
5e8bf550839c829b337a53e238b226aad7406eef

SHA256
3b44d4c211f9f9a89fc6bc1ff0f7d535f5b11ad23b74ad84b6a8e7516c3058bb

SHA512
16f008652c86badd19ad4663d467ea2a8e465e341c5b8b50c8bb67fd6a79c6d442a64333b147f752c7bad1c19cb7a1ba533da28ac589594267f5ee68ac0d0093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95df077b4f29778cac58d18ac2b384f

SHA1
1d5a15f9b6b5bbf4835a6d4a8a24035135602d28

SHA256
7ba89db90381fc7de9986a09b91d0ce4e5b9061b389735147b7dfe313b9b815a

SHA512
a94b43384af53ab080f2f8f16bb3879dd66910af7c86868c0e283cfb5c6ec3ff2052aefeddfba7da47e7c9d441fdd84e6022ee20ac0df3903bcdb5c10a84cc9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46bbe06ad6158fd9a6d13772a435da6

SHA1
786c9a6309a839f2d0320042fdf5b628e298c358

SHA256
ffa5e1a2830b14229d8377628702e37eb4ae78f4bf5829cc07f62ba4607a8f5b

SHA512
87ecca1ad3599df10fbf5d5acc09a060ba75b9656f785f843bf40699beb0ddf4571f2c8928fce93b5beee2a7e2aa99dfff66dd91d92a88a80db381adb4945691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c7750f00ef1a83162798bc28a9e92d

SHA1
276884738d88e4e45a91cf610ae2c895b3cb9a88

SHA256
532fc3efd6d4f33941fc07858f7c566d75e35a261cc5a9cb539db6d6add0ab16

SHA512
6780114afa821960dbbaa98fe23dfbebdfe41935fa0f71009305a591c6a7079093176e76828ada517340444098ce97345894e629a63b09f5ae01a41263e23067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2e872666d02befaf14788cd262fd1d26

SHA1
7aa16ed9b4e35a1cb353a5c522309ab12aa02a27

SHA256
c72a60f5e6adfd94c96a6809f07dbd4dba369602cef6c9a7af9298c2e7e06aa9

SHA512
1c472d7a249bac5605586ec88c2d5d217a098e358877dee60515723ab0f3f5b1ebc4064e44f18ddf7dec08ad44efff7c0f4d9daeabf8c0ac4b80d33594a83d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ff5c83384340242cb5eb6cbad770071c

SHA1
ca69b0528f86b387cf5b33cc6001867bf17730e5

SHA256
b583492f993775fb4293493734bd003f6ab287054960eebf217b2238d1ffb523

SHA512
2da2de71bd0a40c76a7e27fd8a5cd974cc7853f4e2185ad95dbe44de6e52f7efb81e962b6bcc571cf6dcc2ad21707ad696bf2ade4e6152f2f82accbb005f32c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E3A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F2C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit