3eb100b9d9c7925d46a09f5b2bb96783c11d62e99e47e1486860ab1304426189

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12976f0e06bae2b4c06cc3b2ea184b09_JaffaCakes118.html
Size

76KB
MD5

12976f0e06bae2b4c06cc3b2ea184b09
SHA1

ea9e5ca49285dc0cb631c28bc22774a456ab610d
SHA256

3eb100b9d9c7925d46a09f5b2bb96783c11d62e99e47e1486860ab1304426189
SHA512

af3d8b2f8d29b8a1c86392d107f9fd7c586c5641211de6bf4bce6c10b596ca38333790872a789cdd4e8e1acafa849bca1c028390c473136641d843bff035db7b
SSDEEP

768:b02TFaGR9yS9g79H2/9Wq69GD9sS9Sv9cn9zkY9mAmzzTt:b02e1p2MqVyL2hvo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f707a5a2029f405862bcc37e103d94b0eb6081038403ce6f9ac24123f6d184f0000000000e8000000002000020000000f3541b9fd95147cd3f27b41e44341d4ff9bbc995cde14f94938abb5768a318ed20000000c646548e45b84a76c5ed48ba86d1c17e050d8b8d4cdeebc30b714b6414eab176400000009258d877538c0a8ba900be8f845d765c7b045dec0fa6e875b29301dbbfef75632f92257932cf0f7e1aee48c10c14740a50516c0feb39bbf4cddd2df8d396874a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10023dc3189eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420985050"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB72CCB1-0A0B-11EF-AD30-660F20EB2E2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007f0680f82dc1f2c08c45a8eb58f045969f8b66303debfb19a46384d520f3379d000000000e80000000020000200000006cd548eac5366c65c097cd9092c504437945c6ded74a16d1953fe342b4f10679900000002eab50f8e622efe9799458f58c778664a5490c5d804ba68aaf887349b98c9dbda7608d78f1e94e458daee8f407da9853d9f6937afddc96422a41f9d03ad8761bedbad10af28b4fd97eab686b164cf89ddaf22706f1fb9f02a8fe85d14bf06519d161fc34cb12f16fc37c74da2e544abf586f7267e7ba8d3e02050f7394b3691cea3df5266718c97fa636da3c29d51a2c400000007305aea71413098390b8a94ce68dc6eced456dff6ac72bbf10b73b20381c9b640b12dc297e2f318c0b59e1a212d4d2e651a01503ad6421a22f4a168e52398c2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3020	2036	iexplore.exe	28
PID 2036 wrote to memory of 3020	2036	iexplore.exe	28
PID 2036 wrote to memory of 3020	2036	iexplore.exe	28
PID 2036 wrote to memory of 3020	2036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12976f0e06bae2b4c06cc3b2ea184b09_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c648203dbcdd99e58d9a204f0f25dd70

SHA1
2627c52b6d128765e2a43efabd960ddf0dc7527f

SHA256
d73bf3c16710d9ebcdfe1c214d157ab9960e49b6633fdbd4b1d7d897195b265c

SHA512
9aae4484765a16531b9f894fe8aa6323a318b674d78cf86885a4f53f02f26f29584411013354397c693feb403cc99d42016c2d1b863b958e053fc60ffeeb8523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e6836b750e693403019b0544b10eea9

SHA1
cc570b88d79aabdda0d133add505d3e85b477b97

SHA256
7d0e38c32dff63df74544684b4eeeadd8e7910c949d000f2eb8784b0d6a9bea4

SHA512
de908de0b594431deb3c92946d30ae94a9db362c6a8ef242718e97dd7da7e81fbb17013de79d3c65da5fe0d8a7a16800191e15379ba9f159d807f036efff4ca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d20d08326b821d906956fdc5f217d207

SHA1
448b95e5072d7268917bf6223d4ab3cc9c65e500

SHA256
2396b77cdbabde1a2b66886ba51c4e4fe10f5972778a163b8f183a6a474ca84e

SHA512
9fbcc2a027c55af269f7aaa9ae1a93aa34501e203f8ab5dc253fbae00dc68a910b0e288d13c2f15975ba155442069d7b6033310a55e5059d31eb406aff8a0b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34f9064da4ee580beedec271fd34a0e7

SHA1
ceecc7cc774dced103712ef506ffcceb1458838d

SHA256
11993bcc9eaed60e72fb36cda476f144c47d7d9ab54839e6aa80d8816eb08e2b

SHA512
17d194b1f28a47d27364c864d872c25b2ce9bd0891ff934eadfc0a61d485d1c9657b456a5dc74f7d42dc8f1e2766d164567b043373c8e49a21dbfce40709faee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a545310f0cdd10de980ff0435f08e8

SHA1
44b585c6d9fe7fba6b4a8aab30fda27d9ec56d6d

SHA256
b79f452b49cd97581093d272a85a2833d442875615cfa7b474d51e5cef260c71

SHA512
7188c3e88dd823ceabe8c8b97daeb70994d999d289a3bdb29516ad2c3bdc44a9c0cfe532df8d8ff133b5dfe0877251a18391fa54f7bd8417beb6af4855592f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be3a93dfcd6578bad528a6c065327aca

SHA1
69b24625415407755ddaff25482783ec81668624

SHA256
3fd0e54ab182c5d14961510ab0fe8902d69d48a0245ea2dd1270a563d0eb2c4b

SHA512
252ebd88f77e8d04e32970cdfe6a530265f9e28ca1ba3f49e3f6801cb08fd793df019d477425c2e157b8a10d05d375ce122a420349e337bcf80f2778f4f20079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad7aab4e6711da7d23858e9578822cb

SHA1
48cf0d48d9411c75f44dea191f97ef79e5e3612a

SHA256
9dc0a03cfd392369defc77e541113697759c8f8140820e1be312011de80bcc0e

SHA512
c77b512ecc92ec5d6d9deed2a8c0dbae1d6a73c33f0f3cfd54fbd62d775d6a4d6e06eb74f72fb628a6694de542dddff58b19609c7b27df7b5e07020cbaafb007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0720e88a120cd782afc0d8a780dfeb

SHA1
91cbbc23b6f008b5ed598db54d8a988cea2aa247

SHA256
de4e95d26d5601c3eaa49c011511efe97cf7fe3627808d642497823fb67973b1

SHA512
3216cb0b07f0a4042f8b07a5da89ce28fe2b9f5fab0b8e7ee9280825d7f960370aee2dfdece9e34367e2167484c9bb141ded9fba63d1b7a0b121bb619318ea9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb0101120b8f999bef819f072ba4e01

SHA1
025b8fca967ec0cd0a50f249d90cabb31cdbae19

SHA256
e4ba39e474a9b692cc1479d1f2407beb5d65141dae954f9808ba64f9889ee95d

SHA512
8f8db4c3d6af4f46e38dda56b18b136668469224c78ee35ed78b3bc6618bc13a9227ff32b3054d5e5607f0d53e74f064567681bdf5cd5e79eb54a9d7a25dadb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f95c5d895d7079da93019ecbb49caf

SHA1
d59fcfcafda596d9c4dd11395613e821af5a7570

SHA256
18949dee3427179a738fb6d7bfcda8cf73d2b20fc356926ac74223fd457049e7

SHA512
fcc15dab70837851c684e62b9c9b4dbfec1d2bdedc14796d81c6f5cd1914e581461eb1066f7052c54f206e528e29420f80b9c78a69a3032c0d2f3448512b41f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
67ab86309621cccaa2ad985a36189bab

SHA1
bd46d1bf3ea056bb0c3ec858c5c2ee2ce2db3f7f

SHA256
5af6744168d41f6000ddf348670497070cf5898e0731160641ad16b7689e8656

SHA512
b3d561093b03fc2f397812f60d2d4da49e2cc7ac39a5642a5b8d6b46d950b35af95e1185c1336579cd2207a232cf8cc1edd031966003e6382bc70470ae57f5ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\MenuMatic[1].htm

Filesize
95B

MD5
9c8e0593ba342152a39c1a6d38740218

SHA1
6241b5ac27502551df70ec59281a04cef5c91492

SHA256
23bc66f1fedb8acf4e318dee0fde6eccede3c3bdf834f4e3b36d3da4041d7c81

SHA512
8ad14a0e02d6601926e8c46cc9d102244a0e306ec90da5dc7b9d40bc1a30fc28f93afe3f1b57801ecd8e48ee7e5619dff89f8633990ed056294811d9186e513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42CD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar43BE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit