6227da313d89f24d99fcb327eea5b303b60db60b917a5af1987722db6ddd0df3

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

266387593e78d10d3134a148cf2d2d54_JaffaCakes118.html
Size

67KB
MD5

266387593e78d10d3134a148cf2d2d54
SHA1

42b41e149a47f93c612f67a3ca3e6a2df419c666
SHA256

6227da313d89f24d99fcb327eea5b303b60db60b917a5af1987722db6ddd0df3
SHA512

063b151f70b0038c61e835de092a1fb0ed6dc1cdb02c1583dc6fc4b9c06b3bcc2ce2e46192f9b5d66581466df5a3cf98418637d409e8b6fa2e9ef91b67ad95e2
SSDEEP

768:JiPgcMiR3sI2PDDnX0g6stzdoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8s/k:JV8TzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421358763"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c5b3e07ea1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005464a0ac917119b6f6d67ac787467d33f75d29e5532dac6c564824618874ed0a000000000e80000000020000200000001ab17d0df4f38ed88953fe60d29bc10a29b15d65edce88e6ff0916d0f282add3900000001b0a4695a057805671a0db37325a3d04e0f6f0e7cdad8b0d7b0c675fcefd236c6924c54403773cb210d9a77e19e80ce6c4757dac945c31e55b0d46d26379a7e79c40bcf8dc973064f3ceeb8c968e1ccb57632d8168b92460058a3aec86542f749eac3e921e62bfa601d28f16a956f61dcc26eae363f61f526e1e89630272c6a577f999dba4ad9c65e8b2ffbc5488242340000000f4c0d12b08760932b030548faedd799d29be7ce7c65da351f33589a95388235c7c5888a26867c462aafac572619a7a30a53d782f735373f6ba9a25ff683256e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C20FCC1-0D72-11EF-8F9A-6A55B5C6A64E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000307e2f25a67af58f2ec8ae8c5ddff9e0291954a956bf24eb12e4e774c84c727f000000000e80000000020000200000001b8abf4c25a6bc76195981722e87d6a54de0202ff73080a121314b4305eba1fa20000000debb1e9035889bb07358425493dae422de7f8ee23959b5b879b264e67d4aed00400000003554c7c1365c959222f8018f788722ba4222ace1e3d4210d51407dbe0023f6978d8460d84793b9ff2598990f602fb4fc292b8d6b0a75be5846593209c3472311	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2696	1520	iexplore.exe	28
PID 1520 wrote to memory of 2696	1520	iexplore.exe	28
PID 1520 wrote to memory of 2696	1520	iexplore.exe	28
PID 1520 wrote to memory of 2696	1520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\266387593e78d10d3134a148cf2d2d54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc17d5f6273784e705bca6e231ecd7d4

SHA1
aed4653398291235c0e9664e829a9c5646205011

SHA256
44f745b597b42e0472a80231cc945649b9831ddd701bddaae242dbe22973df15

SHA512
e72cfb047ddbc7374d9f1b23a106a5fd5571a26a055a864998d43e12da0078e2c209414222ddd9882ef446546576829811dc68d9d69e3d93843f293c2e796573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a06379882309a30a3d03186f691cd5f

SHA1
0c0c1b535c05efc967dc195b48760f18fa82c10f

SHA256
01894503e6d67432497bc48df7e18393caf649f350da82f3cd30caa07735cf16

SHA512
11c00602cee492746a4de62f9387b196d6d053e94688d810da04385a8c4e5a531eca93006bb30c8244f10bd4b42f098db0839fdce5614a45f5a27b00823de29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3eaa4b99da3c15d5132a5671f6b3e25

SHA1
dc141bdb5d7e2db8f611936c5575b51e109c824c

SHA256
4300cc81054837f58c2678ac758811e34a4a39152f622a63bb0f7a4be0b39195

SHA512
f4adebeb6ad3027a10ba6f73a24e7ad09f6997fa036c034be21888f9c4b66bb1e99e51d9df84f25e9660b87ba5b2856fcb37f4ae2718c9f625ee456b8530970f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30517cf93b8d5031694d94903f365d36

SHA1
11349fa8cba9bdacd904e100d7eeafd40d831a6d

SHA256
bb61a991f7195ce85d983a825090955d50b4a2ce0630bbb8cb412660d31c0b7d

SHA512
77ef7afdacb804c7f2cc66ba3e7ebd07567c217e5c2842bf3803d2d1331f9b6f4a81a6d137ada644320c22d7239205967c040c2b9bc103f5a9315e19dcb6dfbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a9da233f9139530fb33f3bf2d3327c0

SHA1
b20aa47c25e401ece95cdd12f9584a0cd9aebe2b

SHA256
c82f390d205c18b16601f3970723df6c444e16c175cb9181fe6e2fefa745e6ec

SHA512
f75560a541fe28fe51d41919fdbf4251a3a26ffeb59d28f801d855fa1fd2eb901a9eb5000539d3f85893ade440bb8dc496e9bcef8f7c47e45ce403330bc41bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04274abce2fc2d0ce349c056107b1e50

SHA1
beebf6fb2a7597859b8ae5a983da9ea37b677669

SHA256
be084185766ad85b461ea9b20f345b2a369d0dc8e0f2a7ae61a94a8cb348af82

SHA512
e6cb268fff99fd27f6b56c86fb8f6c10987683fcc198bf7198bd07375e2f2602ab81ab0d12efe792766a7ce276a398b13c14bba09c21f5ac9eefb4efe40a0a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db507edc2a4a0d6db0a7ee3cd7c72e9

SHA1
361210d3d6ea4b0c58bbfb14b666191db56e87fa

SHA256
5d144e031f0719261ec1fb0548bc0dab1fcb7c42975a3a7ac5be6d45b7b5acff

SHA512
4b1de31ecaa86a7359571c856ef226ab9534ed3114b0424fee4cd913af96beb19f82d9f35632b2755ec37b86f08ebcd14f7431d422278cd39fea5d5642b75949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
735a33e9b59ed5ba7788ba0d8a503f84

SHA1
054bb4cfd5efb6a45f82ebc010777d854b46c81c

SHA256
6f5418ed1d1a4a017e332636d5d0e004838f075ef6c84c1cc7a098a8bcc4e54f

SHA512
530132d535579506e92e9f49b77f1f59d01739900df5ca518fd2f90f85d7a36f5b650d19f488823951bd8b273bf60506facc171d76624fda4fe2b8cd0b97e9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9473efc46a04aceda926359e2f7b80b

SHA1
7e92bba4c317f3640cfa0e2b1297fca58115692a

SHA256
9fb0d99b5b1cf34e9a85e02e1bef57d67489f3b2cb2e4a358bdb96793e97aa18

SHA512
81c3844326ef79c3929da63a5593efe2de5d0c3f45e6f9036874f7efd5021a7cd950cad8503ee11149c09fb304ddf1dfffe69853067457fd76d8457cabb05b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ab020290bcadee63fb8ed7222e3735

SHA1
2eba61dddc9685409767ea536e25c18c96c7dda0

SHA256
7c073c77faafe03c4c9b2040cb3af15e1f6defffc4f41bc8b398867fd2ce6389

SHA512
d0d83baa2c0aaf6d3de8def5c21f0f1e878d4fb57631b7e2a8910443a5f9e34002a61a92eb28ba2461a5bd436ed10bc6a1ce8d251ef928dbcd1cfb92df1c7c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e08f57d83c4ec1a5f62a768ef3fa5440

SHA1
4b5df145cefb6a7683c2cfb1d3954c3e4e018191

SHA256
04cbc5fa41b865130c2a24a1e4e46c10ba81b760105cd20b8473f219ccfc6d29

SHA512
6000cdf047d3a3204b8e43b2a184e0c383f3e032e38b67b25105b28789167c9f4112847658cd82bb174d70d980b2d47ef67eed1507159652786e3fc8bb8229ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cce48e023a35f962c6bb72b9abacd27

SHA1
70811f15c7e734da06fc8f98ad854502b21669f4

SHA256
17994da925d5d5dbae6e252f6ebf8ee8416c342e3ae3cac6b197d80ab3caaa8c

SHA512
74bb8a2153a297e928e2f8bdae1fdd7d7a36a2f0424c02fe6afbd8ead5bfb3b6d6f028295546e98eb5a5b693360c2c2d1feb888825aaa8b03b5c7909dd1328f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f036d97864faea71c297ccf96f4c8a

SHA1
e7c8539ad22f63921f9a2e8ee9ebddc438ceb1f4

SHA256
2b451c51c0935eee36982ad82711fb95e3c5c18f9bf01ffa95f98f3c57e8312f

SHA512
8d16662606b3b6bf2896933f6e4b68cd23ad11b8fb9f095439bfc0ca534f64e02624e22e699c864edfae9223ec0111cd80672ef4871d2dde3c109cd34ac769d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58dd7acca3ff19b93f111b2f7e5d64c9

SHA1
16efe9da9a7265ff58b9f8b812bdf3b3d42e714b

SHA256
0e172bf26cdc5a99bc9317c0fc0d07e73bd83926c1a952de3f1dccb21cd58880

SHA512
c9e1461d6ac607e5ed27a5d5fd8d9d10fc86475e1dd9928f1fdb5bb88c78ef8bc5d93408721844419fbf08435fa77d4bcedb08c5e52703a3fbc754920bae25c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab39B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A9A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit