ab9732b501dc2ab65f35a614f55a6dccc56e778c99716be303d9b7f114113df2

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

158274929ee2fe1c43b3bafde09736df_JaffaCakes118.html
Size

27KB
MD5

158274929ee2fe1c43b3bafde09736df
SHA1

a1dc6399c9904b987c56a2e54ffcb8a98cae5fe8
SHA256

ab9732b501dc2ab65f35a614f55a6dccc56e778c99716be303d9b7f114113df2
SHA512

c62ad12508fc938ab3cc30f0b9ee01037220d7bb5e9893aecbbf1e0cbb56b135a3f3c6e34b4bf41d13de4f6228c197e02ae511972ce6b6b0b12ab8d97b442de6
SSDEEP

192:uw/4b5n6enQjxn5Q/xnQiesNnGnQOkEntPXnQTbnxnQ9eG0m605kiQl7MBMqnYna:TQ/qPMek1SeU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000854b26570d9bb7a908fad263bb002f3e691ccad65b5942548e80c61c42234ab0000000000e800000000200002000000071ba68cb20601ea83eb42a09ddf49e55572278333ab75781f09d9737290281ac900000004c95559140962d4669da2c2dd4035562bc39a91886a2c8e18901b95d4d79ea4bd5bc0c3c2931fe70f67d20d3f79d5a4c6ad5fc3aa4bd4f3aec3ebb5e0095aa6d98b01dcd1f164ba83f8de8cee6a604251c90ca0a4332e42b3102547242c6045d6d5bb265f9b819471b6b2dd6972552ded9c8a3914f3e9492bd70abb0b4998c3f3fe90fe01b3b2d033d03ee4dc6f281544000000017ecc72b1e1fcc7debc9df9c35695045081a4caf9ffc6761932350f6ad8bc45a54dead96c6c30773c17ba969e43a06f1a6704c861658e951880bf18f17abdb66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C37B7F71-0A8A-11EF-9FEE-EA42E82B8F01} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0974798979eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421039524"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000c7b1db4f95097d6ee5c3035910e7e3672443d547cf051d9d1aa8c4581d2ab58000000000e8000000002000020000000a9602b11218f844da7111f64c6189286f46e74dd064320ffb5eeb01964e93bd220000000fbf02648995d80027ea2b289a52bb3f7058cd33d7f451e1ee67428d798086caf40000000efe23fcaea699f93307b3d2aba2c1765fd3bf1c7da4445c15e94f890b29dc14be7bf85832a186d492c7e60cac1f648a4dc08bb601c8a99c5a0936f39a17b06b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3060	2904	iexplore.exe	28
PID 2904 wrote to memory of 3060	2904	iexplore.exe	28
PID 2904 wrote to memory of 3060	2904	iexplore.exe	28
PID 2904 wrote to memory of 3060	2904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\158274929ee2fe1c43b3bafde09736df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b2ab64c31c5b3f9b5835fe0795359bf

SHA1
9b2f296758a7b9d8ef08d21bd3e687aed0009c4e

SHA256
634978e48c2eb03694a9363d8ac33ebe4daa8b9c6be8283643ba43c43c12f2e9

SHA512
605d1f196e7f0d69368aadd52507f785ba30fc8630b641216c3ce649a6983e580640ed58edc7fe6872b6c4459b258ff402a91e51a48c0e08d88a99d83641c453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20cf8ad416484264f038ff22e719bdfb

SHA1
206d02dd186d04bfe557e9cd78f547143932c8c0

SHA256
3d8c0f65655861d5caf83a7fed2c4f8fbb7aaaff99fb6d153b9f997df4bdd5bd

SHA512
c7de88a25ea9553b903f9c9566f19a628a0bdb5f29ac966a12810f7df269ba7a11d1659ea7d7c2814d20860d09cc081d2699401c2d126b336368a11d1b8ef8af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea59129e749254434fa0c3abd327e3c

SHA1
97134d1adc4e11ef6e56e0581382723d0fb7a897

SHA256
17d6dd097c9f7d142aafabcfd308c0b4eecc27d43024fec712e59c057d3890af

SHA512
e7261d146f7d34016b10dd828e93ddef82edeb35be5d4ff5bca7971db3ff7c9b9fa475b4da1e353f8b8371a7f4541e99accbae3390cebb9b47459efab3d6cd10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db1ec290896c2e4b7833008c30d179e1

SHA1
bfc1200f4841e5f5e6d3ebf63e1103a53603b9a9

SHA256
1e7f9dbd290255d1b69d4f9d676ef00988947e55c854d976f567342733be0ff4

SHA512
653184df711fd8170e41f68bbf66ce2199f34c6f741c6b7e087d78223c33844dbd082d588f4c3772a34d3cee9c17f83d5ea30c6a2ec7bb28c75e00a405511c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee97b0aebed5f0632feb847a8a21312

SHA1
8d5a46d8fb3def4f4919417b1460eb2e7c1e60d7

SHA256
e4918ea9e80d9b9d8aa1673cfec3744df83e926d2d40f0aff71761f26336a839

SHA512
1897f7f5527ed755f66784e0a578c790948ec39287187aaaed5f13bb48cfbf3799276539be27e4cd50c3d6be9dbfaa4e661d8f3ec0489930375a5f1eaa649236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
089968e3f2a7e97470cfbd2459b11cd7

SHA1
bb8f518dfcbc481d768fb924379557759a9524ac

SHA256
2f74f286843d4f2e9033d8895ebb086709784f1e156114f6e050b58d0707efcc

SHA512
f5942cfb5dd5b37c27207c91c768f73e9581047088526c266415ba2f4a318b998af50f498cf22432026b19734cec2aa6425d10b00a98981558ff962a08500bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9fa72ed9ccc7c05ff1a325a6f37831

SHA1
7cf7e131dcf83e2fe292c911dcd2d0ebb16fd9e4

SHA256
cf2f4926207d874f09ace673c5f9b842145d72508e06b721aa4dcbb39a4f9dce

SHA512
e509876463b781acbf977da4ef84de0e425ca29d2281a04f1cc982f3faa71803664937e3a04caaf538ac3da8745fb28c66d86ebb2c4310f2e40def1b19c3478f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a8df0fb661009a983e3be227f27a29

SHA1
820524e280e15f09269f74101f75d35dbfc49195

SHA256
a5956cecc5491e4c6efc03356591f0328d1d48d344c28033b09f825c3dad67b5

SHA512
6e196f8e538596e6739278eb4242eef4dcc5284a1a90d42104416c529e303ece44058239b79c0f21711580611f9bad593c3456701bbfcbdc45fa95da4caefddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3469badb49f56fc11b00a778313b45b6

SHA1
3c8a2b9df497426d9749e9974938b5ddd804eb8d

SHA256
ea5c331818110b80448083a0fbf41dd3a483cfcd6ca4bbcfbb151226a20d65f2

SHA512
dd3c04146b08eb128665cf5fae89a412686ea8241e033829ab4ef0040358b76512606fb171a6ffd43322b9bf3831759a790ef09f6b5ad6fc1bb83d99ca0324a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
358aceef229b1870e6378503eaca1b6a

SHA1
5792ea4ab6960c80ecffab82dc6d03572d82e6bc

SHA256
a639c030fcfd8986378dd9cdb72275f6964daf68af844186639ee1fefe08451b

SHA512
10dc68207fc4c30f17cadf6054ad7030130347bc1d3a1fd7bc78a87146ffc0c2824f0e98aa23a434da7c09dc662930db5c6a2258efc5af851f2424c95f5c78f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d38df05534652402b7ea1f4fd59efe0

SHA1
6cbd9fd4e0d1f0836c9fe70ac3a21b59c7cc3783

SHA256
ddd7ae1b4540cd422b33a154668b64d1f8bd6fdd50930e07ae73882352725adb

SHA512
b6e28dbbfb50746324f417d1b75a0ef29ea4b8acb738a5cb113ca0741d0784e52a1d511b569a7e2e991253e54d2c83f353f054ec0846687755cd7ae8a0245cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803fa13bd7022ab3801481b33c33684e

SHA1
598867a92c56de4522e8e4f032510f31144d4cdb

SHA256
5d36113ee23ba9ba8d4d8b631713081afa5082b494e5c1e7c3142b951f2a01ee

SHA512
9a2ee931186040fac15b17175390155551801994025f46d77b42c46c6e72dd881f0ce8245a84cc7a115b20ae6057a9ebcf8a4356676ca360e783a05c2de52195

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30C4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31F3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit