061007f622ea4ba5efbfe8472e9424fb98e14e378b756aca8b21697de6fa081a

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2232882eff853d0ca71c4e2784a6274d_JaffaCakes118.html
Size

45KB
MD5

2232882eff853d0ca71c4e2784a6274d
SHA1

732e3fdd016383ee028ff576c7332d7b4b81df8b
SHA256

061007f622ea4ba5efbfe8472e9424fb98e14e378b756aca8b21697de6fa081a
SHA512

bf266dd8342b9efac645a270a083d4caa3d8d3f14467cdac3cce94ca47c65680ab6816e272969759ad3f0eaa7353ec63e275a6d91bf29c8b8979a6cc9feef15e
SSDEEP

384:/Q/UTdMagChsIwS1NARbCILzyBdMV3f0B7sMHPAL1tp/wnuHDE7Obh:xTTsIwquRGvdW3f0BsMHPu1tanuHUKh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4016c25cd6a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f682242fd1ce52cb096708c87aa5db3b13c0bd445da434ffcd6eece914176b1e000000000e80000000020000200000007756b1ab04dd732b7a637f949c0ae0ba0a1563aa70e300e655d00c8d13fae1609000000075be2aa52cb638065fb3b29182cde8aaa6a57182807488e1ec662c885a3c8510e3578cba6bf7aec904c673192413d417e2d695439f35ec93217f3f8ea4cdbe3cf0eb44e0ef8d86b4c88845b726030156e5efb3feb4cef4cc7eda9d3bcc75561e750a5fb824c9be601bb1947e7ee2572890876248253f5f3c510b9e44bbcf5f38491b98c796b2243432dd39b11d3f164a40000000c1389e246ae0125c1a37ab9438253613d799d90e812669424710eee2b4816cf69542a41dfbea4d833d4ae513ba2f281e8306e998961df836b5ca13399cf27504	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421286385"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007f39f796239a16750d34f652960e709bfa134795751adfc06df03c9830b58a34000000000e8000000002000020000000cf3e25f18afea1f09f6809bcc332153e5fafe784066bfba4602e73fb0331b925200000003b999b5d2d990a220ea3f442e09ae6c91769423100348879c511cced008ea7594000000059a1aae056f6942ce6f530fd07c97af13dbedd9963aee73f1341334de86d5af5b922fcf9c8b577b0c95d247eaa9b82c7df8eebe7b17ae22f357a71b41199c23d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88130391-0CC9-11EF-831B-46E11F8BECEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2988	3036	iexplore.exe	28
PID 3036 wrote to memory of 2988	3036	iexplore.exe	28
PID 3036 wrote to memory of 2988	3036	iexplore.exe	28
PID 3036 wrote to memory of 2988	3036	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2232882eff853d0ca71c4e2784a6274d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca34c9e4bbcf9f08945954ba19eed40b

SHA1
f529dbb664fe3e0366b1ee52c7eef0a67e6d1b2d

SHA256
f0393c35197bcc32b0ef0fb833cbadb90e3860bcd1a15d6bdaffbeec39f20df9

SHA512
fca2d4f842b1ddc760c20c5f949350b49f32f3ea05d439a4bba253329be68660136190afaadb768039b8ac3e942e2768fb2ab99cb9a4a1d86ced7c8aecb94a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff3831386b70311b43fd18591a4c0df

SHA1
5fbc995095bb8fa285de1f0953e11c1664a91dfd

SHA256
474e236ddc0fc5df09e6a7cb975b4855932c8dfd716f690b64a33a7fd0e782e0

SHA512
4067f2e4c95ab57adfc8b65fc42802f78b22449ab1a67b5d8b433a93ac10467c84a6fe7412b360caed4838a65a61a7b5bde1c5f274563940f93e5d78fe6bc297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e0c81b4ed7508eb8b3f3151cb1967f

SHA1
a2173a9f2c4c3a4145dfd9f08de14e44fb63265d

SHA256
402000c8a66d16761fa22d94878ce8316d8dc627c9d0bfc3a8c400785f8d28e2

SHA512
53a1e59aad9f9a29a94ba4c4f80402bc6eac6cbe355c1776ba10e5915ab64f99bba97f49f17265600788fb0156c886ad46966c8103d50840808b24f8bf0e81bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47d6d763108184b82212e107d4bfc8d

SHA1
adb90f79772009208a25f2a6b60320e334cd13f0

SHA256
9369b19f049f22e6b71db490348596292e4261890b73478486e932a3041cb2c6

SHA512
cf856628079036e4bc1df2b7372da81eb1055a773c11903f98f5a51b96b5e1289576fc908625db9f2a129311c1d1e6ef78aadbbe35d613898178028415e6c84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57e7dfb61169578eaf95cb26cd1a61d0

SHA1
df4c30916cc4052331459c8fae87b540eb46725b

SHA256
d9e3343280212ed49b0d257f22a459eb61ac436ddc8d865b63bffd26e53e3e1a

SHA512
709fa627a615a1ec75d5005546a39c527f8916cbe05069b832b78c4a1734be6e772d644c2c2e07553a863c1c374a99b8ea1245dc0bd2dacede41a60d8d08ff12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee5d1f96a26602c187c25e04f9fb5c59

SHA1
b512424ad18d3b5035026e68777b39ebb63affe2

SHA256
81de74af6f20d516136a27ea3c00d63a9bb388c456b241b41ad90af3e98e6cc8

SHA512
5cf39fd17857b632a2eef012399fb2b18c8d6ad01c3300867fd0a9e0ff3976afb4cd700c14657f6c87b7919d6a845d78b0e0d9dcb1cdb2672beebd58c5d5b2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a41cdbdcca82ab93b30afcf9af900b4e

SHA1
82001df38274d6d51ca68c16f60266dbc85467ed

SHA256
88131f0a180449cc61b10929b83059f4774f6d0a4af8fc903c9af376062d516b

SHA512
9b5745dddc014cd7d85d387f69ce24a56b2e24959484e6d62ce7e2eb562a586c3cd531d676b16a065d2eb39c2ef425e49897f0061ea646ac07b64eb06cfa4d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d230cecc5463c56d5e84989180f977eb

SHA1
66a78b76a066f1cce5696dc77459537f9abd8e9e

SHA256
b793101c7a3e07bc3e19f77cd511fc74cd256ddd3005ed4eb8439638e6149cda

SHA512
1c098ded00f557bd5139a7892f6a0bf8c764d6bdda9d3d83711ef519d79362c43b3a8e0b35f8c37c3ddec894c63ef8b038caca8f1de2a145c71c3cacdac0b985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b846d7bec9299c86c7ce224aac633cc

SHA1
a2bd0d29073c8ed5b3d984f6daa61f33356fd43a

SHA256
14c1b6bf6d2001d26a4de06f7b1ccb081f381ea17f8344cbb56eaa6c33810210

SHA512
3cf78b738687c7bbb56f7acd063c9d72b805cfc9aae7889f67cc6038d23903e011fb3e4be72fdc2919a191f762c821a580122cdb1afb515d40cd75f5b2060e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fbc31fd209ebc411a743b5364815423

SHA1
d693684b99e4bf195031c0719928f46f0caac304

SHA256
daa5d22c027186ef46255670ed681ed83f71054c3df0f8ad08e5547d82a3dc94

SHA512
c2be4dd917c98b20f5589711c16b0ae84fefad089f687f3b1a73a9224ac60b46500f1e090c7c6d191a583f4aef7f5be0396a8645002e7214853d5865b8b36fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3758.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3888.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit