973eb62b1c3348839357b65c099d688ff33e71775096e4546e081f13fdc89f35

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1effa24b3270492e8aedf6a29a930ec9_JaffaCakes118.html
Size

29KB
MD5

1effa24b3270492e8aedf6a29a930ec9
SHA1

f70c4a0a37d9def19ea2c9918444d22318bc9238
SHA256

973eb62b1c3348839357b65c099d688ff33e71775096e4546e081f13fdc89f35
SHA512

cdeb217e2a0ec8441888def9d965b56b561079cbe5fa803f55525f90cd24ae8a8a4050f36492e18648d36665bc68d2fe4f04c9f41b34f9b155935087564ee91c
SSDEEP

192:uWjHb5nu+J3nQjxn5Q/6nQieZNnBnQOkEntCMnQTbnNnQwMC+AMH+OhgamdMZR99:c+qQ/gED1xZ7BLP9QjfkiscGOO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{310C6031-0C12-11EF-A34E-5E73522EB9B5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000a9a8844151b5c792ebb8803a94478ca5f099ca960149cfb34dc9bc18a24bdc16000000000e80000000020000200000005c28c68d65f945b3720a01f0ddbedef0e825fa42a7dcc53201dd68be0b179c9820000000cf016f20cfbcae4d494851de4b0c17be93f9dcd80bb6c748e9172b3079fb855d400000004fdfa234ad52376d30536b71230a01fead8353cb4f668fc928365bbc7b8bd13d6b7b9a1e1ed1f9ddd585f0bcda61e2b6503b038e08bcf51a0413112198382d2d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401e05061fa0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e1e364a140fa25a652d0d5dd89dfa80b0c9fa599064957ca88d89b522a1f0912000000000e80000000020000200000001cb937c8a9be502a8d9b4f21de904be64a759a30ac40e90b6d735ae15cbdc41290000000f02910cfea44e45e9ece9db1b452a71d832f8aec7558b897467297ee245dd510f4d5a3aa56694875acc1a0447cc4f75267b8a593452dfe82c9e24ea981c488ed8a786a18f436e35c54e162948555f0c3049361e44554367d1b2e7810df18ca86d845da71da864dd8ebd17e3a7bfb75b0be605cd789eff702f88da8b2d85b806de1764c768908a42a72a9d5eb461830b140000000d3d57559930b11385bc9325506671871ff2ffc25afbdb02dc148b28381c0c4d5f0dbad89344b7e508c421ffd52c3b59ffc3be74e2c18a1b9e5f62f6f203c8cb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421207642"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28
PID 2184 wrote to memory of 2200	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1effa24b3270492e8aedf6a29a930ec9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12d5d1c0efe627a5dea29293037c5af6

SHA1
4470b9d300898722ca6d364d0b0252d351d38265

SHA256
f87462b2eb4b96ad702752150bde1fc406b11359bdd92a4787a1e7062055eb3e

SHA512
a464474efdc0ac6356d6523f602604e4d4b829faf0e1afe58e165b3fafdf6ebbe7206f16c595d9159f721f9a2e424b94041392c81a66c345aac26a12cb063f94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adfd3e0b8208815c1ad70f9539f1c5f9

SHA1
5f115e168da113376840d30ab9e73091a415139a

SHA256
3fb2aab7a3cfa25d857704ee660da942e4410acfd1fe8ae42927234423e6b221

SHA512
c4a4704eeeacfb0c7ea58473e6034a56077777019f7f003f2a58b44850e11f1723b9db0f3610c896e4da8f8132621863203268b903b5998f28117fb6b8ed3111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7256e02b34e07207f3130e3619ac3767

SHA1
cd20d5757448c0766a6ce4b75809f0efea517a16

SHA256
becaec12042a827165783f6061d7aa3761bd2dea15f89bcd4d8439a9ad66b8f4

SHA512
7c3d78b9dcc99b5b2969bca4a29eab4361cad3424619596506ec68b43d223246311a6fa2f12b1fc165fee0895663c72e01ec2009f2930ee00374b3c9e0b4d746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
335b6395cbe75d7d9720c93e341c076b

SHA1
4a5a4dbfa60eb760cf46ff670744837cee203fbd

SHA256
f3a75fca26b9aabecdc006611c7acf031c3fa7090f121c061aeb767ca5acc533

SHA512
a999882a46e6548ce432f4dab74ce8dfa60f48ec930e4de4806feb2b8fe255654d186ec052a8f8213d7e02d94cdb2875f0367a90d3cff5a75da43e03fe8eac02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ccc4d43a5730971ea24a43be3795892

SHA1
dcd5689708467b4422d5815c00d2dd7cbcfd8705

SHA256
8ba437572348ee05e5f349ea115408c0bc74d465595f254e36d0b0d0d799af4b

SHA512
491e6426a2ca882f4dad84906fa3b1df8ffc41c0c46c9ebc916281a8c24e4a21c26e9a26a64c599f2c74289d01023517711a384ade79a3f053a0ee9768fca009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b36e0e75539542ee8526d96c6b5c2ae

SHA1
f1827dda968c623e6994647e7d0d23ee4bba5aed

SHA256
30a6592101b972464712531b801a3ab75ebbfe2313e2307d9c3e8c6e15ef5493

SHA512
f696795a9cdca31f64c8e2985a0a419caf25a9efd738773b34fc746a93bc8621242894a6834f04ab6a0f448213ea711e3374187f5bca338278fc5e059d067073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d42c460444618e0e56a66a02797f57a

SHA1
3f54bb727753cb9c7e986c8075c79d4bcc58e6d2

SHA256
96e582761912eb926fda1c6a2729ef31e03d122f608321d1f3d77d62ea5b9f53

SHA512
92246a43839f9010b61c6f26716d6a43f581c72ec1a22cb775047647454be46077fc66480f2f64b39594bc46d81af2ec9cba57ebbd8b3f478d4d6c07e6529104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6fe6edbc816cc93dd8cb101d595ca43

SHA1
109a4a97db82f9724089179290bad3b550ae1372

SHA256
94125173b1802a88db47fd9be9e11ce99c30879ed7507ab55aad762af791a544

SHA512
f7f6b05069a338c5c00b73482b94a5ac4a5648d970637090d3040d1c46055791e97a79432a4a896eb6acf02f36db4d44f3854bc8bc8010d2dbfa03f29d045e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac389f77e63b551ced310e795ede5795

SHA1
85b5cc6f48792cff18c06d4c996a006fd64c51b3

SHA256
5771d79685fe26abf2db51ca973903c9ad2db5f2f26d9ba653ef203dc40ba8ef

SHA512
4577f8593cd4e4848241f1dc5d7ab2d76c9929499c089cae0b788c477d9247505588e9ce68fc2840b66267afd90aef7a029ab7ac99cbea738c208f4aba23e6b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803b154fe36e1ffc31ce1983c0d8690a

SHA1
e69f87ea5056a63ba5c401d06aa0e55357a96c1d

SHA256
7a091ca28b93211a89dfbc91453fd465916156de5c55707eef9d1014cc1eae26

SHA512
e755df80aa9c3f4c4fec5adabdd70e2e844a4f7f3b9d0a69437a15aa8f83669236348803757144b9ebf2b7440b64800607415dcffcb0c4d963b0fc5af2b08b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46E1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48DD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit