65539ebedb58057cb3be682d307baa17d277bf23fa38b810eae1594b4aad5d35

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f7077edcdacd4a201bb54d9edd24954_JaffaCakes118.html
Size

27KB
MD5

1f7077edcdacd4a201bb54d9edd24954
SHA1

4dec8dd51b8e24cb9f515c14ace77b27e1d38098
SHA256

65539ebedb58057cb3be682d307baa17d277bf23fa38b810eae1594b4aad5d35
SHA512

2b2dca444f91f8131f2a13cb5a95f5aafe0e316ce17767a0ef97f030aad5f305d7a126ed66ad1f5c5bc13af7def33a156305e8e906215129e1ea121c85934b1b
SSDEEP

192:uWL1b5neRnQjxn5Q/JnQie0Nn5nQOkEnt/LnQTbnhnQyME6RnQtGcMaANWcwqWMz:1Q/ApuxxQU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08d46c336a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000027599b5bc63167c6e524bff8e867e7c42b75491c1496eadfe95e482fa2fde7d7000000000e80000000020000200000003b2f87bc863d1b1d0087c076c790bb66a27d2ebf28730fec769838f6af71516890000000d4d5728ee26c8ab7cb655c451204c284801500bda486b0c4572be8ba2934cf2a3645bd2aaba763c0d1354fadaa4f51d55ec9c73738666da1a0238933b603ee643ab98f311d680f5b1425db054dfa034ed7065bfd3a052bfb49cac3975b35268427d3e1784e283d6644cdad49959186b51445c46ce689abb7d2c9c932f992d47d476d22d7cf7f2319eb6a40cc02b1b1ca400000000b1764d5b06e14a0cef5977854ad98f922162ed97a8acb3eab1a3db9cbbe10a0f69e2b54b4c21d82d624dbc389df308145d1b416733d6111c87e172dd82a04c7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421217841"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000007f5149505bb13c7789b2455ef8eb2f69ff9254a6a451258cd5370cf5802a7fe000000000e80000000020000200000008722c71b42dfcc5a6c4164a24aeb562648880315dea4f1157e6f235e185a8ac420000000337d67292ba68d08ce408b387841312650678a602e05d882927ef85aadf6bf3940000000415aaa3b0552c91173fb1f19a520bc6dec28f45353b8ea4807387584e97f3404512d4ab0836bb783e254a04b4cc3dcdb3e16021586e3d9ef324e0042c1d09e4c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE4FCB71-0C29-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28
PID 1688 wrote to memory of 2732	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1f7077edcdacd4a201bb54d9edd24954_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3d8e51aa8f17c01a2eee26feb2e9f2

SHA1
da35dae85cfc55f24fd1390c7f9c57fc36feef66

SHA256
1b12cddd3e63a4aae736fc5bca9684dce1acd02a738f42edf4232f31932deeca

SHA512
d08dc9e6be24f6ac6f46ef1548cda54aaf68e908216aaff7cd75242a6bc2dacbcc1d8625eb9fac7e2b7193d4310450b99717865dbeeee26592f8daf3f23006ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20086b7294bd2a786101e9e41ee26cb4

SHA1
633cfd93e22e877c0a73fbeb6650c6e574240932

SHA256
7399db8907b65e8601328431d9eee89807b093003e4484b7cf768aae82eba547

SHA512
8c66688e70a1899368db008864eba61a2903837ec14bc73a27b414360ea5fa900de410e7b64cbf82d77030474d2f5ba64e6aa42dcc317705304d11b687d6eb54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e632944b95d85cc7954416fee5dcbec9

SHA1
832f94acc6f0c95037f3be5372c76bfb712a1e09

SHA256
dae4b99eae6f77c1a159c7fb53d4418a014c2a6dec16727ce50a7be0dbf8618d

SHA512
f75ea1247283bae67ef13d178c8bfcb90dc4cc74acb2ba140757529f603b1d87a42eb8a8da011aca130ef34d488512ee2b7b37ca85cb042ede2096dc29dda341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e66790664b05c8f596404e8ff8bfd2e1

SHA1
0f648357a98219cb4b508e203abc7ec7c833cdbf

SHA256
e003d29b8da4c55cc3d3205f0ff144cf637aafbc6212ca221856dfe1ec9923d9

SHA512
3d7e47bec4fbc052bdb6b19cf3cfbd2e9ebe272e653e164353375cfbecbd7a9ef9284e645b89118eaf35232aebd6ab96243d934763d2740a249ff88e69907724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b7f7112ec51f3d78e50b9cad84e7725

SHA1
d663bb14b5405e1f01c3552a2a18b49639876863

SHA256
f8ee2e4d743ad24d6e51d3740a3576a854f92e98ece5f251f69d69e7c15d3569

SHA512
89eb0f6f11c73145fda3850ae1487220527539b8e331f2ece8a29962271df998d8757d0688b1a4b907ec47bf392e373f27ccc67b0483b04a2216e24a4b69bcb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ba5506a2acc67957ca6517ced27e4f

SHA1
9657713b3d0736f576a190dfd6e8b31d85af9366

SHA256
40edd381b362bcdd36d7e375b33076c99c43fd8a127ad631be9c2fdcfb690a13

SHA512
c56c81cf1c57b68894467ede3f9d1789e344f21d130833158d1ab37995b320868013ca266b966b04fb75b746643820f2fb26c5bedce9ce2ba96409b1d3a5dc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b5f27bb507cf360a40687d2aa48a41e

SHA1
3365e4c513c9d3fed0132b16ce5896d96a14cc2f

SHA256
e2826030c343e68b9e0ff85b3ba0fa742ab79023d84b0f2624fb0a817965b145

SHA512
272749209a3bae4a1af28b1c1c08ae9a4f362a570e0ea28136584d210b14a62196c983a7ad91d6b406e3c2674f104716056943a8956e0c779b199681cc81ec92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71710191be08726c9b11f3f4a8fd7b79

SHA1
9a4503e985800e5a722354b7450284fc607bbce6

SHA256
8df10be26c2c76c200b2505ca0d45dcac1ad23fd623f1d48068325391da186ae

SHA512
6655dbfc3f6965d2db84a8b164b784f0bc6d9ebbb441bda7d64fc44e97ef8de71fc4c213f3d5d302fae923ebc7556cb7c73d3f9e62e894859cfe3b9bf7a8a902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a709031632610b3954f5e71cc85429ea

SHA1
d1131fb7816858c87f24a1efb1d3bf5b21e2c8d2

SHA256
279d9f6e5987f613a85513185f943e1f840f81dd812503b0eb24395896f28423

SHA512
782bbf009f1d9c58f3548fd9e663202946bfe4b455ef001971bc0334a54a0a66dad1b8f87fddc5f9c27b7f609d69217dfffad90b411fdded8594553ba4606ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83d8b91e780d04099f537a7740b40540

SHA1
59fb8184731528247e9a4b27e4195947e2458b78

SHA256
d45bb7a3eeb74675997ac89599bd910fc850ca49ba9e13c3f27a1fb3702608e8

SHA512
1b2d6fb82aedcecfae079e02f853b362d1e1410af755bac5547610e7afa09742b108697f128e586378b23e505c8027074fbbb8616408a6217f2dae6f76bf1a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19a42afbd41b2611f25a8f4797cd4816

SHA1
9ad9033388787fd1a3c8664f90665ecc7923068b

SHA256
949266fc15dc9c0add3cbee77ba2c7b232b87339f28cc4f6f24e8221bf0bc794

SHA512
d51de72914edcbf431ba1a8831db93ee4a3d84e20ee4d8765c68c26eecd42424c0d3c76daa1e0973b1b3e40b72ecdaea59d355d0c2033934df555529aa04c6bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbea6ccd5ec3b95ea47750d89c06d909

SHA1
5a6107e4c60b7901d4f04ffa14c0f8b1c122c294

SHA256
da2dd79178a4142dcce040f73d994c5b5ca73e3d02fde5e1f0ce573d844579a5

SHA512
1ec3fd92db5fad21f2e7fba909f51e628d07b92745e985a2dc477f671da954a0a5a4630194235ae6125647051ac61eb5d1f61932082617b09cbb76371e4c36f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601c1f0452b5d660923a2e682878de72

SHA1
94be41291d99603f853e3ad3886c93509e3f6676

SHA256
5a78b443e01b70571dda60bb66b01a0808bcf47445d7ec70b36b571648c67f88

SHA512
f8b6a6f591ea0e9ec0d20544c0c8c66efca5a4e5c2bf8cd31d64cb9dfcf7bb99dc13b74028704c9aa34957b7790ee1dc8daf836228546f713f37f6f07f26574b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab366F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab372C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3750.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit