94f5a0777160ec5ed6b8a41474629e20724bb3dcc361d62d09c1ec363930f835

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20bf762b6b362aa4271e6e7a2db10666_JaffaCakes118.html
Size

37KB
MD5

20bf762b6b362aa4271e6e7a2db10666
SHA1

207ebc93a90b611405f63d49345457fa365bfe5e
SHA256

94f5a0777160ec5ed6b8a41474629e20724bb3dcc361d62d09c1ec363930f835
SHA512

27fa7a595d84caa3fe94657b12f10751d74c4be1115825d074acb90faf9d5d0d4ed52e93ad82bca782ebc01ce0031fee55f774134f8403d9bf361b552c7fb595
SSDEEP

768:RiPXq45R3M4pPBeJHfPccEdGeNQErQ4QQw:RiPXq45R3M4pPBeJHfPccEdGeNQErQ4i

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08ab39386a0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000005675265b6c82e0d4bc80d67930a634588ee53f4174f08ccd8f224d2cedc174e8000000000e8000000002000020000000e87e1494e81e3b1629ba45713867a16b3dfe10ff82ea1aed7e28193dc609293e20000000fdb215e8033ad512ca87858d8893dba26a8d13d24afaa06ac28435680d9710204000000021648b9fddaed5f3fb299714228d05c4d2b7e0a3580947c8cb826828ed8cb8f7937de9930c44afb60233bed27e06163b1b283ee4f2ab9471c8e55bf1c3f7662d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421252118"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BECB2071-0C79-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001602f3ca11008b4606006dd183f6d11ceec7a6101429a2b3510f54bb091778b2000000000e800000000200002000000017e6df12897cfcc93a38c1d961dd2d8ac990dd216c362861e5cb952deecc8390900000008c675d4bae8fc45ef042d7d575ddef2d1badb1e7f1f2f28807d4376216edeb420a687916a419f28a7c07d763c0c1adbe47351c4f8a6bd4432430292236370cacbe1f688072a0d509a2a5c6566ba5a22dcd7e6cc5d9866be9cb1e5687ab829ece5d4273c460ffcc7fe3b10a5788fc40dc8ac6d32879471cc300c6afbbd96cd68c36fe23f2f9bcfc3c9e10d573da66c1f2400000003f561c692db0a676fb4d2e7d02afe435a9349ade85c75d8c1a7d4b24567ae62f8a29dd37d5991a2d90ae1f9c488ae1b4e6cb86f0bdf07dbd4dbce0edf26fee7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20bf762b6b362aa4271e6e7a2db10666_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30eb388c607c8ec27142f52cdf012b1

SHA1
be20917caca0e19893eb6785d268798a06ca86f8

SHA256
eae838d515a3b039efe763bfa78d7886249c9706c731828371c6a4f159f59248

SHA512
6f549f93cb62ce0d0515879f48a59a3b3157d9395360f95a3e949b3b23ac91271f35d6096797e84547d2393e51d45cfa4e9b3a2bc7fbf057f87774486b3177b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21958a9dcc0a0825092c7c40fd975491

SHA1
d16dd4170213f64e49b3720260a3b00726fa9e81

SHA256
a7d7f035a2bd61deb2393a1da85edc9710539bd82202163f703881fb253c1816

SHA512
a0712c602d536908ed1e7c24e4434aa87773e3279f90a7e2075acd34a05b5bacba23ddc6ffe666caead6c520c6744471453ea3e3b2a709a316c83670a02133d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a088d570d8e23da50fafa55803f2111f

SHA1
9a9d8db2211a2248dbda8b508d48128b277a7d72

SHA256
9e53644b3c9f3913616f7a68bf713409097363652e274d6559d547f50444bbdf

SHA512
f7dbfa10265790a0d385e2be15827905ec3b6fb38a33036ebe028cc7f28ee2d0719a967542758c0e9845a49794704096d90a24e07163af38ce711cef74e544ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf39d8d8daa1800571132fbe4ee9995f

SHA1
8ef67f386bfc7ca7e7f34f11d2e3bed17319ced3

SHA256
0d4d0f44dddd653ad47695e4ea54168a78570fcf89baf5924bfed4a43458d319

SHA512
5f7cbccdfcdee64312dfcc6fcc6ed3189624eb3f2f0eb7e5b84f91665582496d4922203e90e70b447ee09e35d9c36c0006311c231017876da8acb0ea4ff439eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed8fd5d4fd3be257abaee9f1e943d69d

SHA1
c6b733d870c123384378297445ba3a97f21da334

SHA256
b1f9741cf607faffccb9ce54b176f64905c8e436bd4bb282a3caea387be2d6d2

SHA512
74594a3267b5d587ca517b4b1ad3de841ede19b4f9f0752642a3f7cbe1889545681b36d0b15c3b3813f281147f587d34145020f7da98d5a4b43c5b2572c84bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9db03d237b3abcedee856efaf65109fc

SHA1
1d2e330b247a79a5d0a71a837e38d3ec825a9326

SHA256
9e7b673708ef389a6d7719e57e3e9f8b4646cd039c408e3e7d9f78c2eab10548

SHA512
4a20890b3da2ca5d67b52663c9a2b59454fbaa3e23a60eb027ca6d172f5316758b6c4e69329cd1bf572f39fd273a3fb31b674bf99ea457ab093839f31c2fd068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec6e3989a326a826a95f60511fabb5c

SHA1
c0ed33b8e60dcf8c34f747a867b9eaeec7fc7653

SHA256
5cc1ff533fed42ff5448104b547003164bb010ec764735a7a6a25a76f97ba902

SHA512
2e030135dbab4588adfd6a8f851b1e1beddedbcf91f4e32cbf0a6648e4a83dc714677762318d2927d6ed7b3ee61e655bdea80b20b46a2f439f055ddfdca1321b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4cb2df5f97395e5cd9aeba9dd6f8587

SHA1
523f60c236ec5a07b86eb935b409c31e4064896d

SHA256
ab2db7b55d68aaf22540ca3e9a76fc09a877f0da3ae1bf28a917073cbfb78e65

SHA512
eaa0cf7c70287e47ce3e3e539d717fec6001cf0c6d8012da96cb5afbb7ab55095161c044ea928d98796a4d810fadc15720857969f8dfa726def6c6176d11fc1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c67599550e6088cb1e72b841624158fa

SHA1
2c67d8fb3e2bd4ae9518667fa2463b81f61a3554

SHA256
6d56a86bff53aca14bfa9c50bfbf2b64d2d51d1e4e43981a0146c32900d06bb8

SHA512
6d94a6d8f70a6c46123c2a2a19aa9a7496ae6244ad5dc743fc8830a383f14d81a93b9296214ce264ef6640de6034767098ed3f46a27b38b1048bedad20f455af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5696566b1eb8b238f8ec7abc6e70d8c

SHA1
221a4bdad00eceffcbc9c1d7962919785bf27dbf

SHA256
84895c6771158ad65e891fd3fd51a641e0a3c8a8bd86107f0e393b61ccea0e3f

SHA512
0fceb53be96c9f0b4cd78c7a03265117ce22d4cd90f509a1140f240c70a1941b35087b88e74089d7fec982fad4b6fdd6ae5e73359fe028b01faaf1f5be487df3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a32f6f043aaaf48268e3cd2bc04a01

SHA1
7f1cdc94677b234ec48f61911443bce9af4425d8

SHA256
7d0689d28df18e2fcfc18d242ac8a9e088fe711f2c64c26272fb17e772ffcf52

SHA512
ea5d6585764958dbf6f25c1af319baf6987354b2c1986ad8ee12c828b004973ea9c344247d6ebe31d56fa1b23f110f517df38cadd5331847d70a72e7286ad592

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B17.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit