c82d713c89807b31162a7279f0ef0b0cded65e5dfe5e1e6695611bf64663c3fb

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

173a56b750bc9b235f363b6b3874d0ae_JaffaCakes118.html
Size

23KB
MD5

173a56b750bc9b235f363b6b3874d0ae
SHA1

e56bd8501ba379cc32bbcdb788338dce6a6cdee6
SHA256

c82d713c89807b31162a7279f0ef0b0cded65e5dfe5e1e6695611bf64663c3fb
SHA512

3f44c5c0dd3a01e2c62220b319d6e402dd5f6541cd06d07287517b1cbd043926931ee3a1d107bc14e4f92273ffed4bf53e133cd3e3a3cbd4831a992cff156522
SSDEEP

384:SxFPLdvhefpmS603SqAzNuuSus452XelmeD/HEoB+:SxFefpH603SlouVs42XelmeD/HRB+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ca52ee5e1055b7549a7def5949d00093a6d436ef1dac753b4a8f1438bbaf92f1000000000e8000000002000020000000f8c606487226aed8aed7cfd499046950af46fd86258c9793b87fd9dd661c0660200000003c44ab325ba7d42dd6337335b60fa0961cfe00f9b2557fddc56566e1f2371bd640000000f8c71810e4265965d10afd14d9a09210a385a8e1ed837f1f4d31ca5317d4be81540cbe316b371c406c8c3a0f2f987fc234ed31f74abfd7fa2e7b51d42238f9ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49B6AEA1-0AC9-11EF-B54F-5EB6CE0B107A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421066389"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000014f15d37753a6f27bc9be3e1881ee57b57eecfee2da1be6b9042087ab47114f1000000000e800000000200002000000097a1c786f6c16266e19378e465e182d288da6fc3dc2e74256a5683d97cca042d9000000030415b9f5de4bc1eed72d509bf598b7c1de35feadbce0345f5828ae492398522b29d3b851204cc44ba3f648f6ab7600b5d9052be03e95d7522faf5835fd63adb002cb165ff7b16dde3aa2dd4d15f8c0de22fb59f76afd40103303001156b904409e511d85ca38800a5d49e6b19bc939fc5a25f14f41485870c400aec32a6ac0e9ffb42eee022d16542880c7fd49cae0740000000f9ad249a8d2df726a1ed450534235536823b5de9754b8840aced9e7d7e9bedd40c7748320765adac818f289378e705a9c9dc8846a6bc2ae9123d6b3ed9aa3faf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0055ab44d69eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3044	3056	iexplore.exe	28
PID 3056 wrote to memory of 3044	3056	iexplore.exe	28
PID 3056 wrote to memory of 3044	3056	iexplore.exe	28
PID 3056 wrote to memory of 3044	3056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\173a56b750bc9b235f363b6b3874d0ae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505bb65008c35f880067bf486d5f6059

SHA1
e54ff3dd4714fc3f3a260c3efbe97141af0a5f92

SHA256
2f7707cb4321b6440c6d77cba8d201e20067e440f06cb32369bdab3c5f94e6d0

SHA512
1ebbd1686dfb14d78038d61c4bd1f424d249d0c841c77f56334229b80ed4ab0a1ce85448d00987597a783a402b77df72269d5031d2534a66524f4328d7fc2ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a296e3a1d86ae090d77e1ec3bc62e82d

SHA1
151980b8cf20a21251d321d45185f54a51197e1a

SHA256
b6e0b5858de1ab63837d1be6cd30916e4835577337256a56c91432d9c5a54452

SHA512
0dd60a7f325523a0943d9ae751f6fedc34cca4702381dfd49d2dc9a846261b36d7ea3040407da34a6363ef9496fd11f538dedcf5f977ade4ef4ef867a2599797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8007c7e834ef76a980c4889eafe8f8e

SHA1
b116c8d8cfdc1b20c73bba529e0d4e19a59b031e

SHA256
bcfcdaed72be3dbc4a04a6b973fe5a98abde4514671c2089d1d85829eece0299

SHA512
dfa7c1f080bc08cc35ec3f2e682b6c1f23dd02bec7536c2244f987706e3e4bbdbc58d9df45349f8a217d29da7e4c3c774cef8e1d7fb2026c5e27e7bf1f40ff6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41159ad47dbc097d7695db8ce68fdf44

SHA1
0a690c763702b5a0d10072166335ae961022a949

SHA256
18b131efeaee53e5d7b0d40fbe0412a011bbeef3679745589f76e9467b7e4031

SHA512
c49044785155522e7126ea95091dbf80fcd0336e0a5ec7b054fe4668ca45f51e5dd8eec495c17741318ab9c7fe91999b2ac6272393317528180aeb61776b3b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195707aa847d065e56b061d5d0df8124

SHA1
60e80ca3e660bfa5ad680230732f3963886ded2f

SHA256
7f220bd17dd9f78cfc4c2c7d8f84ac99ccc26be42b6b5e954154f0631e48ceee

SHA512
7fd2b216e983b1dfb34455ce95462038f329e1bcb75b5d78124802de56eda17380cb5d3c815132bc4b63d1786e786ed58ab77b7999e2f0d116530e6555fca7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6313b865fd1e5e4307045b43532a5f89

SHA1
be6dafc09f043f9b8c07fcfad72878dfb87be7bb

SHA256
5e5de7972e3899bb4102c8b64d5685f0a01f4f92281d3070b65629b8317fb2d6

SHA512
824a954abeebf8884fb327e7605d18f50f8905c7ca7e9ac5d0f112272ac117788c21eaca136c2ae0bc837cb0b7d74db59f4638758be3fb05bbfc4ed2fae7a88e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17326fdefb58848831767a320ae977c2

SHA1
3b72a7a87688b0b142747f3c65e15c3b868a6b23

SHA256
cb7dd2ee9cd71bc738a079076f5214c617fe402abf64da0ab1d5a257e308c2ac

SHA512
e314158834224f35f1a1974c094e95d95676bddcef387106b0e5243100bead78b7348d7581e4f8d4da18ebb02f73828f0ccc55eb63b51e7273739f7260c32ef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb5e376362dc6ceb0d8c6487c30b6405

SHA1
b7cc0f6a19bd0d2c1ded3874e69d8fee46fc4128

SHA256
e1a516146eb1a4b42158151317c7650a0a1ae9af3a791f9e034a3b40b89249d3

SHA512
78362edd9f5a81954433cb68dbfbabb65976e57b57f7eae8fbdda9c355207ca13da9d296f0d7bd391c641ccb16f30a4a09498ea40042f62fb977c774134bed80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb9d8a3bfe920c2c70bcb37714c93c5f

SHA1
1f29a31d9a620fdaded3840b2a84725c01b5eb3b

SHA256
20b4b1f94e1759a3b52ee0462386c45b5f893d1b85cebcea4da1b9fcb01f91eb

SHA512
7409817a847c8f590d8425717b72316795c235bc44599d5f0dbfc3122f857e83c069d64d89c6567459f1b355672517c18f7aad7d7ea120e4f66d8d61658c56fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2831f1e0e2b23004988e8f9ead70f922

SHA1
4c5a7b2ec6055f1c88821d54ac488f5e3a65d764

SHA256
aaa2bacd3467e1f1beb36f94500137bb27b3df8f9ba9a32bc406dc29d579836a

SHA512
ad99dd621f214e935549d9854e3411e6b0fb50d04a9d27ce8d8a97d1378d3da034ab79c92f25125794252948bf3e6845538b2535fae2ad9e39be6fb2dd9d2b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29aff60d584f6d08b2f4f38471a409ac

SHA1
4e66283fda435e0256d8a7c84fd27195f54543c4

SHA256
18c6515d89f128e4920731f2d59076ff2db873f2d65ebf82e969c9fd031472dc

SHA512
03ca003bf6d986bca27d8c4bc4ada20b1a8279477e6e81f99def1e0ec64767e946ba4e92e914cd2c9c8be8d5b24b720a9d65073412e80edba1d33d56262ad186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0c16578ab24e5af523020fd1b453e4

SHA1
8eb0041d3393dc35272fffe80690e8c5c712f850

SHA256
d6fda87f1a383e562e7e20b5a6bf04584ff78db4afe9514e8b33cb7abcb12c1b

SHA512
cdeee2bf0582d167d619308690cf50d38cd14c72af2ed746711227a1c5dbb4acbf06a248d71af3e9d47d7f597659be43740e7b9c2176b09e5303b696428896a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit