5282c6c6a8f22e97d0f995a804e6c7887304c238c3e30b22426a388bffe34413

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1eb226370deb4a69694e25efbb87a421_JaffaCakes118.html
Size

129KB
MD5

1eb226370deb4a69694e25efbb87a421
SHA1

cbcb88dedb24b9733dab97a24d0aec8532bd4aff
SHA256

5282c6c6a8f22e97d0f995a804e6c7887304c238c3e30b22426a388bffe34413
SHA512

764e5af34d38879b06ce26c4e792fa24751647d4933063e410d9bcfd69b8673199332f1be3599909f1a4267b08251998e87b2ef57e6ccb0f23dfe42a0847ab1c
SSDEEP

1536:SPxAN1h6ZICfIvyZPXo/CGwSDZcJKNx4hO+GYyLi+rffMxqNisaQx4V5roEIfGJK:SFwk3yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000800cba58985671f52292eb31aea36d1c61ae38d0bc90c08408ad8c8c913a6434000000000e8000000002000020000000e79ac92bec81f9649dde8cac21656b06a98b59bd8bc839c24e6eb93cd36ea8c990000000f67d196826df3279b054266a0dc8a9cd6ea453f0752872c992c17eefd0d5345790f395fa315c09956326b9761eb53b7789d146c22620b696bbef464069531c7e0e9508874084d16f0c5e15b00c32362dfabb28babe7766ff3646231a0aad742246246c01c608eb981b0eca7a57aa192f55360584d9f7cc91a7d51938195fd8c4b9e2befbc7aed6e61c07c1e8dbb53619400000004e47300e60f63b8dfb02f4262c240c143e29d4d4a20d9b64e137e2a5c5264a28e490e926642a244cf5231296617530e00b01d0142cf57b3e6a2cd6f589c558bd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421199813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002284e057dd38d2ecc27271ebd5c6cf7ed1060474db5aec656b354aa93415eb9f000000000e8000000002000020000000a88d8f61b6c60bd905ce28fe4f96fc26803c46d3737947561439e45076930da8200000008219882d70b86219fba290f9e96d47bdd8396da95c0311cf3305c07f45e0175b4000000074a8b17ea2fa04f6dea87f2695c3f315d052455ef4f239b6cf4d5472aa7843025c62e20c791329310cba76a340b32a6733507cebc29c97e506f8821acf6527ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ba95cb0ca0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7219D21-0BFF-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2980	2284	iexplore.exe	28
PID 2284 wrote to memory of 2980	2284	iexplore.exe	28
PID 2284 wrote to memory of 2980	2284	iexplore.exe	28
PID 2284 wrote to memory of 2980	2284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1eb226370deb4a69694e25efbb87a421_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da475728bd2b7c4ab4c86ad1761d7dd3

SHA1
795f2ff91202bc21a13af257348674aac2636f11

SHA256
bb5425be5b2b813737d7ee1c23682c17c8720e33289e5e9c3336347b866dc8a7

SHA512
ba664f61313081fe3516a16e7c2f355db40e45e3dd50810813726e69fd44f7166debd6683f77add5a1e843962cdb9ed6b16cba05e3d2b23d154d75e4b8d329c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d61d9d565dc95564c2e50d28b72f9ef

SHA1
e351de02bf067b2be63ac687f35921d31c0ccc9c

SHA256
28398b8213e83792f6111a7ad793ceaad759d454e271692c32003a346a7aab6c

SHA512
1f173e9de3485348f35df38d97e2bd72594ad1931449505c2991c60ddbfe663774e806f4ca1cbc8b39538287f62900885e84dd63fe228eee186573a6763ec22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db67bb0af915b03b33bbde722f365d1

SHA1
e133f84d5b1ca1b13e046c8d6caba82d2ab07533

SHA256
82f63d1be5d221731f8d8d0551faf150effc1b21244934fb8cd86e33b342ce6b

SHA512
6e47cfb50d42f36243b30dd1d87404105af955059d2bb52d9eacff56c3ef92ce72f575909049f66ab10c56809ea5bd47b28d54a0a585e00d173e68452ac1d635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b88721d8b562dc1c58fd777a701d8a2

SHA1
34e36273a9ac0633228d255d0968b41cf9e1e356

SHA256
dd073d2d4afe4016b497178d93be47ae0742c1af7dab62a69cd3f8f70092b29c

SHA512
787ed839f1e4370d43613f4a94a3b34b6158cf1c2b777a6dc66dec94d79fc6792621fbe8afaed07f10c93fbdd82887e1025b2437f6356a63a49ee613d3c388a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119f99914d842d9aed4c1c57d92d27ad

SHA1
4c8cd9628d8a2f9a3d6e686816d9a61eb2237cde

SHA256
8ef744969090632a6b889236c563f708b4a1baa3ab95ae2ddcb10535ecbe84f3

SHA512
096878f5530c978c462d777acb77378772c305e94680965c562990f1ab4d75c0c8b1c613db6231424beb2f9c21d3e66c3c1ae5581aa7f04821f464089d352271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7df973e88aa2c14994306c0b489066f

SHA1
c66718ab3e30a5b72fc3009b0c7d7c598221bdfb

SHA256
57280594bd407a883ed757f02af6d9616183b85f9022c3abbf88533c59af0b9f

SHA512
8ed9bf2dc71757ec8e8f1cc44ac6fd6760e557919fc3fa7476b00c8f414985e349b120d386ac528663d24382bc1a55977cb876556444949679678984e9baf732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
831c729078944be0d4a3503c35d2c5ba

SHA1
53796f3002f12edc5a6dbd9395c40a522799dee3

SHA256
95054e327dbceb6443f11a4b378ec465f158bf0da7a884e6d734c71b323b4439

SHA512
4cb236cec83ac610376af22ef15d40a139468319873a575ff159f2852d52e580d4e6cfafb1976404f3ce2ce66d48b7fac8e4dfb676a68f0a989f4304ca63599d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb5fe99098381bf247f3fad8aa2eab1

SHA1
33b00acdd1c3c8c55470f738149bb15f6d468515

SHA256
0f767bf34a8a4c70bf3bb8349581e0b3b876200c78bc7412a45d4246cd4280d1

SHA512
c0307b9c72b517aff805f4af3e55251aa5eeccf2ef3dc8186be80c27436abe5254e664dc575642e8f862790fa404a871fe70700036554ccc8842befddc10d74d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
771fef450818fd05e22df5849d611d3a

SHA1
e145fe1ac365c85fe02894c00cc9770665d7c593

SHA256
4c0eec1c8fcfa1fc060d9055740508947a3dd5155fd53d7d49419f8c1ab54fef

SHA512
3ea97b0fabfc5a801d18c16b84aaea5e6b70d82970f21eebe043308b15c81fa10511a34e60b09033072223224f0e0976e59c0ce70d7e9c90b538b91c877d8669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5db81e8ffacd22154f809cf7a815d596

SHA1
4f31c9deac85ad347d282f1e09bc018bac84affc

SHA256
4ef2f6f7e8e52b69200574c97079923e7e8d191c47ed1972f02bc9868f58cce9

SHA512
f8c015face878501016e72cdcf3f1fa478195bb567adf733504984c003baa3e117be8da4bf09eb73203c09f2c7f7f33e0e8bf854921c515f5394803649b413e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee69cfded4fc5af48f0fb7f7adc3e56e

SHA1
5c000daa504bb9723cc67aa40a0d6d24340224cc

SHA256
1d5834f1eb36563b0cf1df8fec3405e49686fc0f6bd15a27fa2f9b17445c100b

SHA512
fa3651374a662c7d352befc0adbaaca4de0fbcd234690174587de983d3367a800ba0d9eec541bed909058277b505e1e791592fb8d472e53088ada9b9b22de3e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f84aba80c8ae66ec806209f16a4aebb5

SHA1
4c0751bca52c763119ce081a07fe19969b173a1a

SHA256
8b173e69c49bb4d75d735b065b07fd256bce8b57d804ae28ca18c6afab1825e0

SHA512
fe0999f8a2355e47c68942a11f17f6c7720ade0b9cd0c2eaed1fd0e7bb3691e6a82dabba1f9022358c7803a331c5b8c2c7d60bf1e969275d3fc629af6fa29601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b141bb4565ccc294ce4d66521eb6699

SHA1
29d7cad72262454209be298122667c56e0fe8eb2

SHA256
cd12fd9d876fd585384404394bf509ab11d93c874c573fca84b31f5522515bf1

SHA512
db3613a96ea34547d5681bc0a11cdaad7e8e38bae206d4f348504a3c982737cb7bc2282b975ac7bb8b22f90479e1d95959e577908f546fbd63d99e42efcd13af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b60ab6fa33612591c18276138960188f

SHA1
a2b8f0559c3e41c9cb66ef459da6516e8e9e8225

SHA256
dc7144ae8adad73cf3f037c93213644d207b1534a0652b026600f04abfba2e89

SHA512
46335487874b3198e6eccbf51f59a2ca4478b874887bc396a71ebc404d8136218830275e32287a7c1e01cb3af3c8460b176c26080c73067af8537327fa83de00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3000.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit