0d324ee27a16c243f1e927dbeb758b2bde4fff3288fcfea7fdc57b6199864baa

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13e08d9e56fd2701276b425860475651_JaffaCakes118.html
Size

545KB
MD5

13e08d9e56fd2701276b425860475651
SHA1

03b75d74e2b8ad39392999ec572aed3666a90b79
SHA256

0d324ee27a16c243f1e927dbeb758b2bde4fff3288fcfea7fdc57b6199864baa
SHA512

a729c8575e0765e778ca78c9357c8b1d07b1d97cc3ef20054a87693530f969205cbb3f46c39a2fd8f87e451433ee528801f5ecbf829d6afa29af381e29d9978b
SSDEEP

12288:+Z36IWOcHy4M2UG0zXX2/+sJuJMBR0IH8HRRfcGHXGFj:+Z36IWOcS4M2UG0D23

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000554132b7ad0cd4a433771997234a8f343a1df3ffea1b7b92e9ae7fad1085678d000000000e80000000020000200000004998c5e6d9e928afdc4921f5f192a29383fb8a24e99c87ba99979178b91c64a020000000a2b31fad6f6ccaa17cc7282791387aba8d3df51d245ae03efe72cad34c09c39640000000c6332d593c8b97239380c724c1e3ccd316d9dd377a6a5299dd1a1a5a620b54d15fcf92ac2cffb2b7e80f46e857389714155be18c00e32b84dba67b4bafc823e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F844A41-0A41-11EF-9891-EEF45767FDFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b4b1344e9eda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000068a3f259025ab8274ff5ee12551842bd7a613ad7cb13380d937d4d9229662d7d000000000e8000000002000020000000b5b50897498bb67a5329d8a93b24dc44083ed6b0c6d78117aad4944728888812900000006f0cab4366155440e384329c9c15fbdc5c39ea3757a1f87622e2d63ae0dfd659a9bcd0b2bac474c5ebac2ae38310acd4674e41ba769852fb4f22d58e3c2a64b1d1e874275f2bf024a1b6dd941781e0fdb8108982b76bbe152c5ed4cd2039535131e936ede023e7898d44f1b6819b6d9757e5565cdef61234d82a8b533ca06f99b5aeb83384168030f6ac74d41efef75240000000ef9dfe9bb366dc297c6916f35b02dabc8835d9d07690d575f22f4498319ff6cc6fae2a292413c8cd978ba219ffd20d9399374f2ffa851f574d793a81bbeec276	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421008005"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1756	iexplore.exe
1756	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2884	1756	iexplore.exe	28
PID 1756 wrote to memory of 2884	1756	iexplore.exe	28
PID 1756 wrote to memory of 2884	1756	iexplore.exe	28
PID 1756 wrote to memory of 2884	1756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13e08d9e56fd2701276b425860475651_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5b5ea0e50c949d96faff129668d78d4a

SHA1
c8b90ac33a9e0a3475a01493b8f4e608f47f08f2

SHA256
6db6ad7e0751186361fee4baeb0034434d003465791bd2e9dd3389b9bcaa0e1a

SHA512
d8a0b6a7c9f064ae489a0467bb79de89f229a79dea693cc63b0af380fa38c59acdc273c46386d83bc1e6ef2ca47da9940aa3b24781aa46d625fba70de8b4c486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1204b805f28a82e4d6aa383b489640b8

SHA1
b31e6bef957c43a2e714a271c380f6bb36c68ae8

SHA256
cba803c4268ebc512e80d0202fef0209f6763e4cf3a8608a43ced6e9d1bb5dd9

SHA512
02e22e1530c1c61f4d54235bfae1e5d9f01e6e197219210f46576583497d8e47f9c0e3afdf522150ecfc70cad9c66fd30773846200c27a9ff5c0d61638a1be58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
298fdbe6e65002815b6a259684153efc

SHA1
2ece58f0313eb3cdddfb5a13fa1925ccdfe261fa

SHA256
c3fa44123f82e2eb0138b848f42dfe160d5192724db9e0457f4b9947d8b61ef7

SHA512
367d60345ef4865af926d452a82949b1d68b368b5beabbf0001311916035e8db7b9c6b89d4a04ee25f4273bc1802b4ef0cd2520b76e64a6cf526f93aefe92bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39c50fc59e41658b1b48f925b9839989

SHA1
c51bec147ba46f35a1ffed0a2ca1e6b7e2d8ba6c

SHA256
83cce443452289a134c1ecd552e7f2889cb9f300a799bb9d9d444dba06f2e3c2

SHA512
b23ca93d03c084da0b3049ed5943d7c7dc6759f97fde063a3ff3848920c39d0bfcca31ee7fe33ea8bc39188275f763de7b223e4be3733c1d8ed821e7db60d454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
372534b6b2eb067546c9795dd4d0b364

SHA1
9ddbadd93f173a6a40cccf27b2d6e909aa2ab656

SHA256
762083d60aaf9fc235523e77113dc4e4c022b498728dc678a41eb0bc8b3d0d38

SHA512
6fac702cb2dbd8dd68d1453fae4141dd6c367e691862448aff2e48263a3929bcc6bf962484ca020170c43114740159fe06f1b7ce19fe83d35a18ecf1b38304d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cd3ca66545d59e27be37b823e5f1ccc

SHA1
54ea3f638197ca64e0a8a75086c4f6406343b0f9

SHA256
572fa9d66c06face954c255d5d772e8d9b5ad9e6d4b49fc296be802ed3445d73

SHA512
38e788e96ee3eb75047582581445cfd8044e7f038ee7b72b14f03fac13b58312998fd80782539e1d487df8f2de7eb365f59b00934f47d9539df940b47d967993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc51bd714cba1c4cd70ebfc28dbb1864

SHA1
2f31ddb90800d60bca9ae562e6201fcea5b78095

SHA256
0ef75b17afe50b4ad884ae594db81cf5da5b63d431df7dbe2c35a8938b9fcd34

SHA512
1d3b4e3552c09685d4b2d1c0c06215a3b8d94e9702f874753435dff0c5e806f54f5e2d1d1f0206f8bb9f0c05ebe3ba992c76cfbaacaee10783aa8718bbd6ba00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5cd7929061f4bf8d14ca3e92fc82b66

SHA1
f68fcc3ab8ca5b71a5bc4759b910ebdf876dd00b

SHA256
eae9b7d9de8cbad41005d4a65e5e37745471f61a15627353179206c460318d98

SHA512
75804f76dbcdb7afdeddaab4f6f9b1f3b38d75cb8ee17ca1170a34711c72c0039c03684f12233bebf9b9168f80182557c3cb9acb3c8da14bf3f8d1c721cb4318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be3c9797fee308d59c98c46ec228236d

SHA1
1669113c2144e990f6181b0aadc34e29c9a2ccc8

SHA256
acc1d8223c276cc4bdbd8eb888c23e2fdb5987f920b294e018b3167fe4aea4af

SHA512
3b23a1133721328fa4742d996bcf6fecde0ecbe6e7076e96d3b458c0c911628793b115f2aa41da3b09f7b36dce3c6524ea0e354c5b25c380f90f48a407a21bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f6af1fdc900a58669a288e9d551ed55

SHA1
fbfb64cf333b9aa235b7c281ce9c4a5d5070c8e9

SHA256
ae2d59b17bf7355b142b64c739cff2ae1ccd6ac965010ec1c2be242133f31de8

SHA512
6ccf3d27b69182712914a4a0015ee9e8a9b4c2dba9203ba991fb948c9b85525da8119817d3f6def39c96e7843906ed02fb74d3741e34db63672c02e307d8d216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d3c01ea5c34b6e96d4fb354b0cdde2

SHA1
22951ef3d3a4c9022f5cef7c7953cac10788cb88

SHA256
860b0ea766e7db40d977fbe2aee93f3a40af7801950965d83d5aecd4cc16ace1

SHA512
3412dcb70b20e8762230bb0fa85e7b4152dce5edab44346f77b1a8e868aead9911cede6c5719ad003d1bfe83527456b958e32a4cf63cf21297647d17eed29e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ac742a6e9145db58fce15129161a96db

SHA1
d2db5ecff4105052737b493cc624a9c5909ffb42

SHA256
e19ba96dc582b4ad1be730cccdc43c25c2bcfacc64f47586af394fcba7942538

SHA512
55b7d5164617839e7848f57c6f1ac87e2a3adde9c5daebed497d74b9929d3d208b06218411892d9dfa006dd7dabb96c4d620964df9266e221d56466465359c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4210.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4213.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42F4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit