0f63a01f620e9d96edf2ea6110591439f5284bff2be992ff50b57a9957fba803

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2acc768f72f35721819a5f495e830264_JaffaCakes118.html
Size

148KB
MD5

2acc768f72f35721819a5f495e830264
SHA1

815fea6300adcf838b5397ed00595eb2e1d1d8fc
SHA256

0f63a01f620e9d96edf2ea6110591439f5284bff2be992ff50b57a9957fba803
SHA512

c0a4ff304d2d0f7b14393cca2b69751d07ed394fbc53f9fa06ea6560b80ed2298ad76165af31a96e965d05ce5984068f07816f2104bc26ac366e17c59866e030
SSDEEP

1536:SpPcfqrJUPXEraMVMWEr/A75Xs7UblPzIzJ5DG3SUS9LuaPwgoyLi+rffMxqNisl:So/SzU0yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704c5c5a2ca2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421433270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85CDB241-0E1F-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000002e3ecd293643710384a3f92c9942c89741f90899f66e717e1fc4261ba8f27686000000000e80000000020000200000007e46a5cad6589203d5ac3200cb50438a172afe6b8ad930eb14528d8cb47dfaa220000000149e0e3f6fe677b69912fa9d9ddfd0a974726668cfe9326a35b2c83f30bbca6340000000735f4d6082c9c92e7776e1ccb833b5870d497a52c2efdf03b574e506c9691a37cbd72d58bb409f0166c57505e52526fd9c537eff53a4643aeb8c47632d256ac7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000053ef65db40e5ced17bfa62c5e8ce0a4172f5b6742fbbdd50e64ac90b8f8d9300000000000e8000000002000020000000170e37006c525bb22b6124af534f64c6314ffbf936e3b4ba8de4b3c8031a29d29000000014e55a259943511395b43b2ccbfc6ee93f4a954a3e4a8efa3f5ffd790103fa041b2166190fabaa53c025663984b6d66267eb5ab4da90ec7d039a1c7da09162c29a859ad5cd45bc8fbab6ca1535860a2491b9f88fd21ff1e28d7250be191babdab3be0b50706599307bc044fd74020fd644d2ed94976deba597f58ba01df44d0f8814f5575a6bfd499c59c61d4aaaa09540000000bd69093b93e717e927027dc7363477e364a623940352906d60ddae592b7a19c7a791a007a9ee47758597281df09463ea9e2f4c2ad5cf69b6e269c56c10dba815	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1848	iexplore.exe
1848	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2936	1848	iexplore.exe	28
PID 1848 wrote to memory of 2936	1848	iexplore.exe	28
PID 1848 wrote to memory of 2936	1848	iexplore.exe	28
PID 1848 wrote to memory of 2936	1848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2acc768f72f35721819a5f495e830264_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a10080c607d98622682ded6a0fff948f

SHA1
85589617d4e60edcc5e2c3921be086392118acf0

SHA256
b187890b926618756763230d4faaa764b716ee5121088c69b488a0ee20a265a6

SHA512
7889b8a3fca19bbf668475fafe9b66f9f8d8807570017a88fb465039573f34e3dd1e81a37a211e864c00a19e0fb41b97b361673ca4dbade10e1ead730403bca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc758ec5d61eb71ffceb75061928d35b

SHA1
22eda01f4c35b845cb3e694cfd4519100233a38f

SHA256
2b2f90bccd318dc8fdf1b4d0e3be9ea6db0b89a6f4c2e0ba21d7583b5584e009

SHA512
9ea3fa3271ac2c03aec614b617ec7a6e9f9d35e945b1e73847994790cd32f4199de05eb16367164e08a5724032326b06bffd8ffb1dc91c7f637f3716d97d818c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df5a618d7a4c780435dd1ae4df7fea3c

SHA1
1d5fd8ede9dc4b1a49ba07c53e5c6ad6edc8df7c

SHA256
d97193fd48d517613184815df31cf2a2749d2aa99c2cf03ee2cbee3fadc47979

SHA512
c99b415872ef2ba4772dc499766a4f33b79652f4c68ad96b31b7155c7da5bfee86c91331f5ec1b41394794cbf557cd913fe5dc14eb47088c5f1aec24d3466b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1a2e544137cd78788b860e6c942e07b

SHA1
9657792cd0a720f2493a7ea5293e70d5dc8207e7

SHA256
661e2afc5c6503f4b79eb5227dabe34018b9422cda9ef7ea2e6023b9553fdcf1

SHA512
f9d06d4fd538b778cfe1fc8653b8b04269dab17d4675d582ba572bda8fdc0560c0b55501df5f3e11d748c98021bbad241524c798bc3f431e2507f72895dba3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ced66b3d97d41e737382601c0c46f78

SHA1
a32f0edff9fb7c55ae0bf35e44d71d5b91c13acd

SHA256
f710b69c8e73e6ecddbf0f246f911eff19bc94542b1b4da261165b0bb711a955

SHA512
051844fc805a80c132ec88f2371192139b901039d6f09147ecb974c0c7d7c96e288fc3950c72aaf5ee34e6a3df2f8f8d6d15fc56498ba635df3df8e1e781f2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab63459c8cca5750142a15cfd31b0e61

SHA1
b66c5e8feae93961c3da73f05672af983f2b14db

SHA256
96896000da5bb9b63b09f557ef1ee5798b51af629db0d55981b97e41e072af29

SHA512
fd694dc7cf3e85880e3930744f5fdeb0f68014368920babfa9c2126a5195e22526b6b1f9446d2d602d6847cb9899fd792ec622bf361a188de78416a2f9160c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
397c3cefc59bace85349adf4e62a1915

SHA1
39bc2dad160ee81d0a3b2b6bc0dcf382f1ff512c

SHA256
07b1262a9b4f4a403df2fb9963f094d768f69ff68290079865195f2a30d3e8f5

SHA512
f4fa60dc381baa2593d59e94a1185df8312fe5aa3673bae53d8f0409e906a03f642938323bced8390a3a27f3a90733cf5730fbe591eaf329ca271bb0c99de96e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d74aa0a28f25537633ac91ea669464b

SHA1
eaa27cace92a16fec261e2929d407dfc264f93e5

SHA256
ba7f31c39426dd3546ca0bc1f5db2c1c18417f924cf708cca48c986a79d44ff3

SHA512
55da038c3064216971b271ae0255a4210dcf7b60a2e0bb2974057ff4123062f6e2395166553353f31b141a891c3d23636ba0f1860923b9954f200c0082a8422b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3fbcfa6554b7b3180f92be174e53d8b

SHA1
cea072e6f22999d189381c763d91bd4c5185b0a9

SHA256
6bc6395145ce7080c055e2a4603371784c93ee5a8a9750fd58fa83ea1ccaa39e

SHA512
83dae3e8d4666bb6dc9b42a5290c0254aa82b7e84664c6be3c5b01404c30ff1d04dbbeba6b41d5e7a1134f114f17ceb42c1b7967deb84a06d6aac4cb1d488571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
995d25a7da4c12799897d632757e9f4b

SHA1
8c12b5a08115505800bc30e3fab0d3cd19e27b5e

SHA256
c5a6feba1dd56d24db9fda669e622bb9ab3f2a0e2d955cb3d4eab448dc6b15b2

SHA512
a12eec31584763f4bcaa0ee7edb5dfa938427e10c268d5189275c2765e85313f41a31eb3066a91d53e64f37e11e235474b0a96803612f0095bf5abbb57cb11c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab389F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39B0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit