43e67240a73c2725752b1f10bfac68ff0ebadc04aa500d3e7923c111825a9cf3

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23894c472c931baa5b1403a20dd1ca01_JaffaCakes118.html
Size

41KB
MD5

23894c472c931baa5b1403a20dd1ca01
SHA1

ff6f4630f365eeb73084559ca1c5a4e43b0bbbb3
SHA256

43e67240a73c2725752b1f10bfac68ff0ebadc04aa500d3e7923c111825a9cf3
SHA512

13f1b4ab5154b4b9d595ebe38279ee29957adba6b47590036b153f366b2b8b8cd8eb6bbee9870fc0560dbdf4042b1cb9a4c3f4ca24f64f1964fed16cf9df67ad
SSDEEP

192:uwbCb5nb2nQjxn5Q//nQieeNn8nQOkEntVRnQTbnBnQmSzVxRoNxrNU0zPl1qDUL:WQ/12xaL1jvKruiU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5000c90a0ea1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421310300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000024a39a6e7166b12c8aaeec0a8e0bb7e0e7c1631812fe5b3013bd169b83532769000000000e8000000002000020000000e7786f9528b987371be66f8eec0d0e4a354f2f98b5c432bdcf7922834408614020000000ee21f9d8e903a2aacf840c8242eff35b6bc3cad0071f6420068da0c86fbd148740000000cc606695a3228bd7b8725d151da3352b2d074ef3dbf45e4e040af8d7145e21971168a63d722a97108d23c6d6c37b9972a6865555dc34613954b9906f9ccd148d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000074b4e20a20f15664df7dbed96976dae480274ad970cdf074672a8100467ac10a000000000e800000000200002000000049f2489b57bf8ae027366270cee8d70ea4c848b26a3f5c74e11203e44a22cf059000000042dc13f65ed54c75e03216663e25789557103157b6d1865ee1e98956ee133da63abbfe5c9196824073bcdb076d5748f1a69b8c8413b4f77bdf086bd929ca0dcb7ad53d89f7cc3135d0a4d6b4b6ef5332349bad30a5f7ed5641d36cffc2d5839258023f629291b820b3693bd6389d1d81e46c42f4925e3e7e09753fde73aa960cb2ed0e19b07142dbff5a1324370a4c0c400000003a0b7b384d642013ddb91e660d229fc87558dd6e6f99f64acbe23fce452766adf01f7065a2f6260ba0e538137e9079ef246f228841714d34f1b420fda50085de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35F95DB1-0D01-11EF-A564-5267BFD3BAD1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1220	iexplore.exe
1220	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2092	1220	iexplore.exe	28
PID 1220 wrote to memory of 2092	1220	iexplore.exe	28
PID 1220 wrote to memory of 2092	1220	iexplore.exe	28
PID 1220 wrote to memory of 2092	1220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23894c472c931baa5b1403a20dd1ca01_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c082e89250ff9915ec349638b41c0e7f

SHA1
efe6c3f6dbfe517226531b2f0389f39eb5b572d9

SHA256
f51c08f688e15217f20c0e8892a9e3826cab541e298b4f5ebf0cea93607e4b83

SHA512
932ba0c09039ea30580347156683662160e73fca8e7e4c5ccce1b3a243eb57b8dff1fed5532faecc4cae86bba8b8e22c0f21d817650c12f6bc791503be551d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b30a0f5abef03c188be0f157703bb4b

SHA1
63212d5b0e543b7d8e8e3069f704e444a800b8c8

SHA256
77756e7fd77055d7cdcf7284f5bf247b59bef2228f1fcde6ef86e660b24d8008

SHA512
23e33e9bdcf317de155b448c4f1c152a1b3d02d076578a1c67dc5608d84205836367c4f7c16bb495eba1c05d9398db3baa923ec903b2cbc5d517da78def0e03d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b6712899d7746c6794c68bca7d62a6

SHA1
8ff8a65056836562832b983dfcae469600806417

SHA256
c6d3939c6db8dfc26cc8e4a35b5f4dbdd699b24c76af9a55e0a8836681fc8c85

SHA512
9f2e79b364bc2641268062df458a58484cac51cbcacc64d56094de38d47b08f585710d9a480e37b7a84b826fef734a83bc2a816b0acd97e8d126d27e4a732d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4911bbac0de88750025e1d5608157ae6

SHA1
851d9fbe27f7c7345c8674552c0b33b253c904ff

SHA256
179df13b959024e773f8f14fbc690e4d30421d5ad372f970e9311fd81653c147

SHA512
0c2d41b425399fb72b1f27ba826c61f1577452e3c7e1b84644342048a5c068a144f39c9dc3f029ec45ca1927ba0985fd72b34d9e97db16e6da23e10d9fa19599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451458a6587ddbecac9471137e2881ee

SHA1
c0c1a55ae406cc3ef329a98d888dae142c0da83c

SHA256
235d2bbc99c1104a53c272762310adfa8c136fa70e9abc857946c42389afb37c

SHA512
52af53cfbbf8913b787ce1f5ffadabcd2889ab6b16bd0c9af44aaa7f9936606210ecd00db3af60c960f846494a1bb35843ccd5a732f9653f9d6f61beec8bac99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defa204b87accd8333bf76ef54eb2ab3

SHA1
e175cd3b10c8e99a7cdf3b930d1ead36539512f2

SHA256
55cadbe9ed91e8ea90f7aa4b8e24f4ef699c555464064b2cabb3adc182f6abaf

SHA512
786c4dbcf7dec2fe4feafc7e0547a28a4c277fadf2f02837c41d60af58fe7141ce71d854d7eb852b6f50d9d636b3d72f411c068978139f9330b63dc13c7dfbc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a85a191bc2aabda9e40328d0104a0aa

SHA1
f9524bd5a691847ec66b90575313fcfdd6077c20

SHA256
e724ac59c9354ceff8f67a26515d0c4cd1025da334dfad90e0a05c8e4df540bf

SHA512
c7603127e6ba1e2642225669b2ce929111354f1591699914e8aa6e28bb86e366e57e506a0533f744aa3c95939e07e08034087a94712a9ef26c4d98d96dae2e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2feeae0d8708c3cda9ff61f65b7964

SHA1
05874fbf11e2c376db869c47dfa2c3e81fd223bf

SHA256
8c4cf3af70e467119933d0df39212b96dd044579c083d55811ae374bccbd244e

SHA512
3aac7cb2179e5f64d576e9701401505102dfb62569e3ca4041ac75a286810f4d2a47671f26513ef11b3f6c134f5e338385a60c30dc84330cb6977765e1669b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28abf34dfad34a7bca2c8b286d13a897

SHA1
adbf1483f15d8e30712427351bf5eb7785e83ce7

SHA256
a8cddd2c6acf32c0dcfc9e03c1dfd81b24937206e7d4544035439d6ea3fcdc78

SHA512
2adeb935fb8d85f5f4e4e702266a374e172b679381780bb0a453c49460f5a1d3b91b349875724b8e74b6394e683441f6d4859b9e928887b66539d7359786c0c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df329ad5220de7b542e800af649d280b

SHA1
8871fb3e5e7582a68cacfcbcb4dad10269814483

SHA256
23b57352768b26ff5f7b2cb2d0d4fc686d149fcde216013d78161c8da6fb1e4f

SHA512
89afed3098483083845abed970782f7bea73fb8453e94e42a91d5d547785e6eb486dcf0393e4a1997e18de9824e541787f7cf4f72253c27b0424cd9c364b00a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4398.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar44E7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit