cf3d9249366f477179446b2ae765ffed1876404d77dff54d6a69e6cf6ec15178

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

219b68e9453edb7761e7a9e2f057acde_JaffaCakes118.html
Size

27KB
MD5

219b68e9453edb7761e7a9e2f057acde
SHA1

051860ee21216a36b8af55e9e9851e1b699ae051
SHA256

cf3d9249366f477179446b2ae765ffed1876404d77dff54d6a69e6cf6ec15178
SHA512

86c337d509f995aec361b6d30f42948a3d3c397fd4d8d5206ce620ca963982a90034d2cd2d41c42ac0d01e9c8ea4d5139b4c80d48797f7e1a4d4d94f8a1f8824
SSDEEP

192:uqGD3sb5n+OnQjxn5Q/5nQie8NnqnQOkEntbPnQTbnJnQmCJVevo7Nt/Fo+NzQ43:ncQ/dygcEam+t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3564111-0CB0-11EF-9EA5-C6F68EB94A83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0050598bda0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004ab375289f8902185fa1bd49d35ccdd9abb63b23f84b7c268af6054d97f4d03a000000000e800000000200002000000056696f969069bda55bb9ceac454f74e8aa56435921461990cddd78377c76a81b900000006f521dcae4e723afa3761e5f4dfbefc9f57ac2d175c28222e6df3fefc722ccadabc752dcf47b3a8a61135361db307bac5e3715efa1e78951be1f696972a87a302817d9472442973f53602797eb593b700dc09c8ac478ded369a9fc0684c0aac5c44d2b78b7edd474256e0c8a4b51c461ecb63e6a16ca72ac42b04051bab033ea429a02a22ebd7fcc05d9bc823ea5ca3e40000000b52b74dfabff629ffc1366ea221254f006d02d99dcdd315165f231d84811822c44ca2e66812fa2d42b245819a02184b9726e29548bb09b0dce56581a8afb7488	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ac573b5ddb7631239f8080d9eb69828a935d74f45d21dedc4d2e79a41a9d3117000000000e800000000200002000000063267e65fe3e249080ed51517fbe061d9cae277284f2445a17bbc1730f7ff8eb200000002d7171a981dc5a0351391ee5aaaf5dd1d1a8708ba14cbfeee2ec0903d5f67a6e40000000101f1318540fb98ff3f6b0fcf67461327b0508ee0d77e5b323af9f47270859835ffcf6685d00b8a253a8c57d73b734358eec2e977c82e84948a66b8939ba54df	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421275748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28
PID 2744 wrote to memory of 2540	2744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\219b68e9453edb7761e7a9e2f057acde_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f5faf8dbd2e2334479083bf10002d22

SHA1
cad988b9cdaf9ae034e4227b0a2e686794fbc561

SHA256
142d559ba5f82936d7add6943bbda454ba47aff0019c171eee794d98ba5b11cb

SHA512
7c21b9e76db9f577a254e813a6f8e674e9daf5ffbcf3984a659097aea9bd9e5f8cfb78f02b0905410785ba054ca9d9e7450267aa35af97468141280b7e28439f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2487b2db541f7b964fa5bf7e6db4ea36

SHA1
6b6bb5c9e38079642d5976fbadc0c611df12109d

SHA256
cf9c9731e3678d93cdb96f2a222147255e350473ed82b3407bf7d9855ae6378a

SHA512
1468dcc6166ef1db3dc320f5a7fc4e508b33c94837819cd24becb3fca5a3481bd3ac70a200a98b80c1b08e2b01dd8154e0557c5c94719d537c42e30dd96a4293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad7b9d15ed6cb980427ce957efabfa1d

SHA1
c31c4fed8f71fd2399e705501e1d475ab5b95341

SHA256
9cdbfbd4b99fe692908fe2ffcfac3446669501aa91b653ea9037935056b7ac9b

SHA512
79c10a1a463406c079bcd2f47918188d2025ba0538cfaae2c9a7b0f36c8d11e3382862a48a5bd487e78983b799a5e9ae8504c39c4624aa13be57e4b3fe66c356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c5b995566ac662ab6f5b55180e94af4

SHA1
66801b9fc70e687c46af8ad93ef1a6e4f3c3c571

SHA256
3a5875851a3a34f082ecd0ec13a4899a37dd8de3eef7bfa4ff1a980faf5b7456

SHA512
7c2c738f7a4f608910fd358771ac03cf7bf4df9d727331fbf15b164158f2a724ae36dc66713b72d5c0f5726e5a9d64da4d55a9298354897d9961909ae67e1ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1afff4b23afbd84b9145c90d3c61af3a

SHA1
eedcd5da7d209242c4e51b4ea01522f477268ad5

SHA256
725c0d1b93a7e4fb1789fcec3a5a390f8790775854e9a50e0df8fd5bcc3fdacc

SHA512
b75aa15f1ffc6ad0270531c3c09b881d2e7050c67c9dc2ee05606069de528508a8139bfa409e19fe61e8b6a331d94ee61ad2d99462e24e6c11c56b956cab6478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d78cffebc5f71a6fb4a2cac9d9a1fc55

SHA1
70e89125865908c5ef19457721bdc2ddccb4300e

SHA256
bf7eabd90be3d0f63cd3f20ec27511dadf65e0e014419c4a131612eb60a34b31

SHA512
24142f1b85e6ec3be82cbafd218887747718072a5725ca9326f2ddee9f06e92258e6b7269203da878e6431c38309720b9f2d0790b94f25d43084b657272e4f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1249ce792bef4af7c9ce1ea70b335ba

SHA1
96a3038d4210b08a31fb6ac44777da16ff3acd72

SHA256
5747fbab48db5f2e0bab67a8e25e56877befafb233293eab74c6b79b9d598a15

SHA512
79d9b066db23c4d820db26586e0ac616018434245ab78a7036593313982ab56861e4c323fa8623d5c4af895d3290a955c7271c517cf9a090d0bbd6e3f44ef9fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1672b3eb0b64e0f99b8b765ad497fe16

SHA1
ef062d83ef052e9de2e8d42a7dd33ed195658c1e

SHA256
85b3042ed7bcad9189cd771630b83cbfbe9cfb4885465021b6a297945ed31715

SHA512
99971d84da135f5fdd46b10f681929d92d218091e7eb2cacc460af5c495fc2cd7adf351de6089748c36f7a33d92d863f23f52b51402f85cd35f9e0e8c6060135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01c63f0e8858bbcccaf9a0422a9e6b7c

SHA1
0def013409f3154c4db36d337ca40af99d4c4f36

SHA256
eb10ec8c4642578fe228578da191d2b3a9db959060f643862fe721ad6f50dbf0

SHA512
a3af5bda7f9f5f402da5b8604ff7d2a13beda0eff519c13e0571bc16c9df102941ca763911f29936e37cdd5ed5d7440b7cd323b2aec65f2070cc69c56d9777be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55e7b0c0fb5d7738c018b41317a76074

SHA1
49fb8c9f76cf9fd0bfe53e7d1bbfca4c1b83e997

SHA256
49457cd5fda2e0c8be68fc67c94035006114a6c684bf05aff29969e784141c14

SHA512
dbff1954e4bfb43c8898b8b8e5eaa8b19e84bdcd548f36dccc37641b177a5f18c3551962df465aad046c4c1155edab5288d92400e9a11d7c665083b99d3e8026

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20FB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2288.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit