f8658e97e45fec1351c071a80a3a511d56e61e12d5342024af565391b2b10f11

Analysis

max time kernel
147s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275b3a12db26e4507b8023f2c4816377_JaffaCakes118.html
Size

22KB
MD5

275b3a12db26e4507b8023f2c4816377
SHA1

c2dac0e5e70727549ce260d97bf91617b7fd047c
SHA256

f8658e97e45fec1351c071a80a3a511d56e61e12d5342024af565391b2b10f11
SHA512

ec42bcafd8aa0c5f9c5a8cb08e43a542425af532b9731326cdeb1e9a0ec81500cd270e2532a43f18d9aa3cf67914aef15988388638685159278acb036f7d3bc0
SSDEEP

384:CGtCYh2RCBf6pDdxf+sM4cu90yRv4LzKdk2j+qxoqaqnqtsu0ag49wkJdHmliA:CWCYhyGK4LzKR6dXAWnHmliA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0edb4c8a4a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421375045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f9d6957b4ad7648cbf90c161bec12c32a477e29cbebcb7b84c50b46588e7d4a2000000000e80000000020000200000009e2b75df29e8ba1f1cb29c3c210c1330b58329d3bbfc55cac95bece1cee5c962200000006f76488315635f23aa5bbb668e9f2fea22e7caea1c322149e40633abcb5a24b14000000050390fe96e976a4f0153902c0be32c143fc1734b412c6c86f073c6028fb2e838ebab065da3891af42452f74cf898ce5bf8285ed37ac6122198bce659976122dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3C3D8C1-0D97-11EF-92B8-52226696DE45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003f0b082af8ac2f9ef9d7295ee188a1b92e196a5a6d4e703b7560141a86cf5abb000000000e80000000020000200000000657012c4a541929215f0e163c6ff07068258aca04f29b1e8600f23949a48c5490000000968183a8b0934b250c2a6a199f8c9d27253b8bf8e3c7fb222eda005dffecf0463ef1eb47e194af8cfd9e6a8f5dad7422eb1b3d6a8375fb3e3700ee9b0908fa32b620d42cf3ffd77cf98404bd10505366f6bc3950a380e56954ded03365bc9145d6dd520d16b813228184bcc12ef962ae605f36a58dc885af7eafcb17f6ea87a4bdd7784a2e4aa5a6e1695456928b42f340000000a0f57510a5e7c4c893d7ab9b8cc76b70dc8f8bbb7ade568f4f3c689823fd2527e0425151ea1c5110453f6afb867555fc56ac971cc8b462739030a47a5c65fc18	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2712	2208	iexplore.exe	28
PID 2208 wrote to memory of 2712	2208	iexplore.exe	28
PID 2208 wrote to memory of 2712	2208	iexplore.exe	28
PID 2208 wrote to memory of 2712	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\275b3a12db26e4507b8023f2c4816377_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
350e753decb4b0bdae3af213dbfed676

SHA1
17c39840b3c0b98f6349e749d479f580d3297668

SHA256
941afc58b2287b30acabdeb5f8f12a206140fde2962dedd0205a3133192ff7fe

SHA512
4a5be41e4af1d0c651c97428eaf37a25956a70285ec749a645f3714367644686a5225bf95478e032e88c4c7d6b99f3b594f943b8be233d412fe95e055325f2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a55897f1a5d77732c4a5788f054445

SHA1
2327409ee9cfc85996871504dcdd2a75c2bd9b9b

SHA256
52633209e64e5806c64cf0f5043f4cff18c1a44ab77d15362e6962644334d91d

SHA512
226112cc83e2feeea5958d64b8ce7ea60e5d7b404c72cfab6f1226b280b607e919dfa664285aedc89891fb64a76aea2fa96903c2dfedc3901080cdecb3cf9fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2cb82d5f1bb3ff424a95729317ad80d

SHA1
d52344aafb3c1f5d7ef57b68a70b4d2782cb9656

SHA256
34d5eb16547f92b44dcf6511f8874beb052d923b64ceb25daec9f463d255eb27

SHA512
e5d92caabd5a81191977900d80d84687e256937b0128327c2a2eee8f55405e4c1e386768cc26ad71e7986df435ec07f2c5790cf2d341223f010b483ce986d70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
964486ff2246a94b6e3524032e8e139b

SHA1
e67a0c4ab3d0c40c8b85679f482ebe7a69a82825

SHA256
9369f4f5b6f932b43668d7d7d85dcd9263db3dc19c9400200a9e4e495e52dfe1

SHA512
6e9b25127359a460b8ef7bf029e1b5d3d80c827b9620a9755d13d2628868e5d370c49abe81e8b1906d09f0d2386cc695349d89cbf3326785b7af10e388aad503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07c0c1bf388290b5bf30dfbd2ae095ef

SHA1
2acd3e2b201d8b3506c0be5fc139bb896f6156eb

SHA256
57a58543091583a4385f7eaef053312eef9e6a88caaeee6b2fc9f6567ced0c2a

SHA512
7e6aa68a0b724230520184013249f68de06567720a76c79f37fcca9017375542f72391868ae031108d1e561e44d0cbb2a6d7443b2680b7921e92de9a60476708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f23eff73129ff0f68d132d7b7ae6ca0

SHA1
e618908d299ba7abf27c93b662d41e45b6ef7aa3

SHA256
41cb1910a05c3f227b4ca05c0076bd51c891a2d3c728a2b245938b63c85a7abf

SHA512
3fa993686da1b5725d2062fa6a90d042d3ebda1493096725bd308b4852caeead3eeab1c423498b16d6ad1d54e6af9016ac428d4483452cdd64a1423b2d192db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad643e6267699e711e3a71cc9c91cdbf

SHA1
da4526129eeb73d20d9f38da54d28b3e37ba2b2d

SHA256
7f0d8fc2e1ec11c0ce5b6db6ef362506033183ba6b761c2aa0be943b635c305b

SHA512
bd1daaf8ac396f12360e9df7296bbea0b9f995062fde224f495913d49421d0096f03b369bec0094c2eb32fd3bcfa0ee9a8903f1a37031b88b334c64daa1aec96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f7c8f8def783e4e61db7d0048fac5c

SHA1
b86cc6ae53f5c2f52ff3d5dcf1ba6f75460adaf0

SHA256
de49766f635fa343396eb4547ccaf870a7e2136d0eaac8da5c4fc4fba4853f03

SHA512
a848a54a574ee4fca553f1a39e3fbc6d3017d7d5668d2064280e1fae7901b6e274a158c63b0b79558bb669fb299a8b6b9d692a75fdf59f59d60ea37247df5555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7f69ace20f05889d5082b27e8706895

SHA1
fbfff1fc95fcc304a94d50ee67548c2172634119

SHA256
99e4bf58284c70a4a86352132cea7358eb2cea476e3612aeaf6a48eb052e61ba

SHA512
d3c5dfb3ba1d9a1a5113c5e7e8d40f84d55ed0fa19daafa25c48fe78795de7af5a227dfe48132d49ad1c4051f7a33b3c893ce1b6ce79bd52c04720124f7973cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ec873bf6c64562168dd0592c2d8ba50

SHA1
b03fe2395b87094446d7fac5835396536e28d0e2

SHA256
21b964a76ea3ae0929dfa06553425a57917feef917d07f404c52c1826f1064ea

SHA512
85c307ac37f867b0d91b4c1c77d8c071bd260271ae2dbcaa94db4d4c2feda694c366635cfbb008d0e080e97723819d166da3ce088946ebc7cf8b7001cd266a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d32b89b535751c6c36043b09571c44b2

SHA1
fa10636509d5da8d542b6d71ecc561941276cfc1

SHA256
22cf8f819b00782272f74b9e233ab0cb4b7017aa889a08302fe46de48ac9bacd

SHA512
b6563b2745e0eefce5789f6b21968e378d88a65927b9e612461a8685fa827d0560e9a0bfb1966539f52850044ce7ce969aad8b4a269abac56bab937cc24e7ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db35209cd2de597829e4c4efeda844fe

SHA1
86924d64f110ce8c15ee1f48b526be429ceda50a

SHA256
a2aca6f00d664895a1aca35cd28877762b5297b3b5bf43d46e3294138dd17807

SHA512
9c5245d60f5d8c358bf4018bc85e4b7676fcbab9322057038adf2b8dff6e40b8da3895d161273350915f14dc6eeb2bdbb8958744ac0ba05a2fa42017d920b306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0aaae2b6926eeb85c1ceb6fdd3cbe0da

SHA1
413771a866207c0b62de24b37575b4732f9c3f55

SHA256
223e0cfced93dbd951d50cce2279854b52362dca2efd068ff5bfdd8c63941dab

SHA512
7428f368317ad25e30f307ee0dd8e0597490218c179575b22f235243fe97c9830fe33b45b8a8cc3c5763b443b6a72380b95cd50a6326a6e10ca2f715f9b7afba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DC0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E91.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit