4dd33def60110e8c1aa2ad7cb4cb82455573a77521ffa25623246549adce3e66

Analysis

max time kernel
139s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281aa80cfdcdbeb05f163011c61f7398_JaffaCakes118.html
Size

67KB
MD5

281aa80cfdcdbeb05f163011c61f7398
SHA1

52f10dc0fbda0d3373f144bcd1faee181d4cb8e2
SHA256

4dd33def60110e8c1aa2ad7cb4cb82455573a77521ffa25623246549adce3e66
SHA512

a72b839e967aed487164e7073d5d3cd8a1f1219f7208ef0e079db64e8fd573cd93f1bbae6bbfdb44af68c3ab22eff430483795068edcb88aeffa4041be66b12f
SSDEEP

768:JiJEgcMiR3sI2PDDnX0g665H8bZvnoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:Jef78lgTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6B75DA1-0DB4-11EF-825B-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b108f3768a0c644d25eceb3ea5ec00f9759fd380fe1b53200772bef2f07a9bc6000000000e800000000200002000000049ae6c73fe01646565d7ab19ca5b53596f14c1a908c136496266558ab3c7868120000000877e5ae1bd7b25b19d4289b09ea5520259a2bc83a7436358f23a6ff6f8acf6ed40000000ed5c7487b3e1262de04d441b71cead2a68336d22c6ac1a05148dcdab8d74c4159b6dd1ccd677142f9971f97f5ac9f92afe652434948a9b95cf9a9f32702353aa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421387369"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604f727bc1a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000bd9563c33595598f646af823b80c1b033493b611e2b2bef7b5646a7821b2b0d1000000000e800000000200002000000092f0ceb6cd57eaccf39bff54b275f7c631ccd67d8c7e92d57e4f0a6ee50928429000000065f40a5e1c63242d845e29fdec31b0650b4f386a1d4a70cdc794b81ad0e85e9248a4f9b06eb8371da3660643b18d4dbe4f4054cddffa916d7782aedd2d849e0de81a3c166f0893e02724b01d7c5b712c28bb528e32cd3d383f0f549d8d9e47abfefa64ff87498d6e4b9f72436615976e5fb1d064e1b988eb4ab52c86545f4b3cd363434d643293e9eddd42a366d1a420400000006f61d6e63d9c603422509ce7fa786ca1db4f4477d1d1f801b430d892a8c6946971944efc472df58e9ba08a4e2b23d33013f3b79c6ac0b0f1af96fb5db36917ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2592	1928	iexplore.exe	28
PID 1928 wrote to memory of 2592	1928	iexplore.exe	28
PID 1928 wrote to memory of 2592	1928	iexplore.exe	28
PID 1928 wrote to memory of 2592	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\281aa80cfdcdbeb05f163011c61f7398_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4e792681c3591f74f76145d1ef95c6

SHA1
968ab24819b6bb850eaa60b2ed0e90cd8c4f84c9

SHA256
e2491a879d4adaedcb5577a851c6e18efd1d258fbfbc3fd0fa6fff07ea9fd6df

SHA512
3fcc249ebd3e2e440e4c1c541fd01ca7b0b6b60a58a614e9e69900cfa802bebd436a903007bd67897e4e4c3fd8aa6e6e1d6aa770c1c611ca5bed8f1021bd8e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a36dc213cedd7008feaf80e4e81e863

SHA1
19e4cb4261a67bf66aa6e783f7d6fd36aa74d5a2

SHA256
1d4d7766ec3e0ccb553e5dc8f36e9908ca9982436c4eb657408c63eac8bbb68b

SHA512
87f76cb8623ee96638f3f2ad6d258bcf878d229b6ed9c3c873825024124a93c1db290ce9e2ebd5cec7b7a0ce45d388d278d70d31940056e5f4da80decea7ebac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f6d34584351815b57a78316101a55e1

SHA1
57c1b37de9feace93b6fea4eb5dc27612121144e

SHA256
670a7aa1285b67af62c6ee1565e187af332b657ca806a58dd6456e4b455d713d

SHA512
5921eca98294bb689327de154cc7dc30dea71066434594ff45e23dfe55d6805d1a1af76be06cd24f7dd88e8e1017acff483127023f1032f13c9502c9ee264ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb5ea28f3051aca959edcdb0ac70f42f

SHA1
068f9e5c2ba5b4ffe642d284f3146b6a40ca062b

SHA256
9a561f26cafe9cd6fbed0f73408de2445c6bd202bca155b02b1f9419d653a847

SHA512
d297641f27570010b300c31f00741627722cea760f1cc9a5c5d8cfe90de9d746a65bdd5c9c42a7d77e6cc443a68d8e5e5bb617445fd3674c5109f92d425baa57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505afbb8a87889d055a530fbcf2f574d

SHA1
6ebac9414753a9b6a7b8e23440500b3810f8c274

SHA256
e575577ad4dee8c572b7deb50802a54c76a99dc9d62f3c236e9e08f43dd56ea7

SHA512
5d67353bb645ddda55e1a90720b49ead25f9c11cf6b537ba9a2d2629514e9922c654b0d5cbfabcefb0505ef23b967f46972c1e524dd7409cd66cd1ffe018ef07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c5de63666a06b3c163cfbf8af45e6e

SHA1
882c7ee34cac63b30c58cc78280893bd7e63a3f8

SHA256
fbb3f84266d2741282cb54e4a9a320f972b754c35620db826bdc86e9195030a1

SHA512
c75372691fefb88a19a807c90dbf439a863b4f1cd487cc40404a68ff562e47dcb5faf8fecf5fdd0c388ff47ab68f1230c17f2f59b695b9e0125431ab71ed8f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc18cb219ed8e4c7e20b44bfa3dfe25c

SHA1
ac3fddf48c4904e3fdfb80778f763ae0e61dd662

SHA256
29690f3b2696948cdabfa11be4d5bf5a5cb3e3627d8b2c6ac76850e89579f0e1

SHA512
3ee21c8c3d4a0f68c0b193519aeb01343741f009fcfc7ddbf099a2230e96ad7e9f0b2c4534f6fd3f0a7784b7ef18a2d0b691e7922bee79be0737491c2f01185b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3122ed933ea7117a0565e230d2f7502

SHA1
b0749d69e6392d7c31ef785ec44117f0d5809a0d

SHA256
3df4bce12602b4d3d0109122344f50b3f805185fc5a5017eadc5f84c14cde811

SHA512
33e83dfb056af6683f94d1d6a6d4e761d30ab51300fe79607bc59a8cccffa119f06aa6bf6b03d1e006d41d45e816e1de054c7801582759442df4d2d36c811cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec925947c1dedc8b908d1fc3924fae80

SHA1
2fb93495d5c6e19eebf4f2d149b43794e4787fe4

SHA256
e9aac00c66a1da0356e94d57d8f25d265c90124f17f1d55455fa5d0f75cc93aa

SHA512
3e3f4f896dd2ebb4471b4db92ae338f945c54c774004cf919f932b598f23d35dddad5d73858abbf2163c5eb98285d60bd4eaa5ea4187cbb6f0d31c8a5ca20ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce329db604e39b33f5e40e9968e948e

SHA1
7be7624092e7b0ef146d5010b51e9751aab3cfc4

SHA256
4c58a1cabc3a62988a2fe478ad6ca93d2fcc49330fb960a550ed70a460df0b5c

SHA512
a055ccfd921cda9a2e1fc2faf5fad026b41409417cf0aa48102e8b3a962c8b3f954914cd94ef5c6dda9281da936a049f6802aabdc9e1aff155c57a7d05e82a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4379.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4489.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit