9fd3112e5c1cb6e5404fc3c75b54f1aad21295d9b2a5a972c7a5446a88e79271

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d52e6961a2fbd66214e915a1ee51253_JaffaCakes118.html
Size

23KB
MD5

2d52e6961a2fbd66214e915a1ee51253
SHA1

cbc30bfeb39802e0bff8adab4578f8af91eb84ff
SHA256

9fd3112e5c1cb6e5404fc3c75b54f1aad21295d9b2a5a972c7a5446a88e79271
SHA512

415ea7dd3700694a7ad32fade553340e9c159d5be75ae5065c3cb3164f7debbc50041291a3bf1590f1e015a7dcaa544949c6f57ea2965fb93be4f5560de364dc
SSDEEP

192:uWvcb5n22nQjxn5Q/dnQie4Nn2Q5nQOkEntP/nQTbnZnQ2CnQtSwMBYqnYnQ7tnZ:nQ/YQDic

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b8057b4d245931e88fb8ea2beb7d600db5fd2a22d9fb2644eab2ee1f78a1b29f000000000e8000000002000020000000a33a95a46808738ff586a5086b33c43dc1e4cb7121fe417f22cec66b9b28e95420000000c4b7e1687a1ee1cd1bcf0a3683be42827998a83317fcd39210ca02b099d5a59040000000964fd8daa3f52c645a462576fcf98969aa9ed000b1216773397b2de72f5e2abb6300762110998b598e0fb04043ce3ef52a10ffa16a876ec9c950b0ca00541b06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421476934"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F8E4961-0E85-11EF-8745-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0582a0492a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003998dc8ef31bf656fb7448b2945a77d5bfb18db12faf4187a7b317775c495f2c000000000e8000000002000020000000fdb30c76ae3a6cb3b45533f768f24806a3383e1e361f457683c0e1e54638c5bb90000000b31892a2e984a00c941171c9e5650e1b5a87624f42cc8e560c12e1df95cca639929eade629fc6801dbfd028ead090286a3c2f3931e701ed5e4bb9a1e5bc42294846da78143de2907784536ecefb9d7f9b06b92d7b25512fc7594fa2a6491a4eff91091e08ec38b8a2eeb113a0a2117c1e28b1ba707e6a7bbfdcc5511dbc565eb44b1c9147fab80470652baef80e2467140000000d87f1ff76045f9f1314cf4da57d6cab348c6a0eb14ddaaab59aa43a372dcec6f8ee78fa9393e1f83c5089e1169f233d0257927d0102c3839d44a3ebbca9587a6	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2036	1952	iexplore.exe	28
PID 1952 wrote to memory of 2036	1952	iexplore.exe	28
PID 1952 wrote to memory of 2036	1952	iexplore.exe	28
PID 1952 wrote to memory of 2036	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d52e6961a2fbd66214e915a1ee51253_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60cdae5fcc6b9ee96957c8acd873ea1c

SHA1
d914ac5ec06eee0ab1c8788703bc73a4558d3823

SHA256
8474c4435250eb3e793e5aa02724f2c8606af10514f06177c597ba0d3978091b

SHA512
f3690d17de2532c9bba3c8361a936753b7d1f59923a7c9f4a7a40e9d42cff9deb45b21fe14eac117062b903b5baf0204c7a3fe75ee085e39c8a9f21ae43cc419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d1438fac2e84339d4ce54e3345aac56

SHA1
6d9d53d50098f23d821c0ccce3109440f51eee94

SHA256
c1518fbb4ed5eb55eb80b35e0b7faf1fe003556379fb6a3ef8c13acf82d8234b

SHA512
96f5c3e4afcb0d3249d5628b99893ec27d67915ac6c39ccbfb6a16c11259c0084de719d65a94d0885e883b8394dc7775b5c673f54c476283d5d1161040131757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfd4a173c569a8e78b81df4eccc42eb7

SHA1
ef5588f4871a58b7a3d6920d1c89a454ca3ded20

SHA256
f142cbe7870124dc132dad288dcd1c8af6b7d910fe162be6b1f4d5d1c886938e

SHA512
92724e7747086d2acafea9b1c0620b334ba744ea16058334e721930726991b69e683e8acec824e6846de2eb66d0165050e97729aaa22639becbc1bd09cc784d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b7ab26ea09906900e67037f1e11de7

SHA1
c88c12e70e0db45106593bfe1c2e78671fb1aa30

SHA256
669ec7b979bcc27bc26c1c8b629c877adef6a10d0a7dd5ecaa4e7d38cffe3345

SHA512
ab1d94de8e7478b199d0ec146c2358f8103a37a1c8208d1b02682912880340de90286dd09a5f7747769a78fadd29a2153280d54eca5fb3775c185fd2315e9f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
777c5ea9877071a96435b16d1e831d68

SHA1
6cdb9d7d80261ddd1737093ee4ab97ab69f6c111

SHA256
3db965a603a9c2012603309a2a9e5f45d47b2aa794aa9a7e418e76d6e39e96ca

SHA512
ff5e6ff66fb7331dea4344ce3c1dbbc0eef3104f7b39d7d2e100e5d31d423dd3cfbd492abb71eb5223679d09e241e3694cb2fe7a4a8b62349fc2a5ab14ae42e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
413d11b48c3b870213d7da8f2fb1ced5

SHA1
b3c043625e545d7cecc40001403b0ecd87b6f3e4

SHA256
bb3247d3590091ef34254d7c7384827c944b2c7cbdd7460953001814f6561d80

SHA512
014dc8ff7bccbcb8f308ab07fdc56b285fa44f549344c8b55b60991e5f6ea3fb9e156b544f58e23b35b5bb10b07c0673cdb731a78e5be3220a691d5d6b79babd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95bc6fa9c20d8a677f31cc1e93cfe2e4

SHA1
89dba2b08bda06e2ca4877c9cfc228332d9fd40f

SHA256
e5d60d2ce25f46833596327e6e41dab0cdea49e0b8887e445454922d011a691b

SHA512
d79c909ed8bd9456837e8b65200e3492ff9c578da4c9d17393d451f4c9dc40773eec48c297be36706f701af6deb0c38dafb3d2228ce03917d3ac45e868b343a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d92440c10c4db17646501876f16b4d

SHA1
b4af77579f87d88c2f88bdd90a3f8f104f3a9daf

SHA256
b1418651416e23c7aea34160b920915dc042f4aca6d0d9791430abbef9e89511

SHA512
dc2c0794abc22b37befad266efc310e837621d4b127657c5ae6c47c60dce092513dcccb0c69f4d2dc5de2774e848a929a753365896eb64225fad281b5619c5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86b5e4ca280c5c4c4d3598fc93b0592d

SHA1
055d2c2753bd2078e1a45c5d5775adf3b52d788e

SHA256
41108cef331940b2766e833f5993fb77c448b30bf7785e89c27c5e52efbab8b3

SHA512
7be09a70c04e7681298ff2041d42112b3669c7a33c860b69aac75d5e59719fe1c671a634dd1bca37ec487883da0db491a096242a86199bea8a77d0af0d5d84ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e164b4548bb4dd87474d14c8aeff98c

SHA1
7c7008053f2e1b371d46ff90b02a01e7537f2238

SHA256
66c0ba8de0bff2011f03b95a3f35660c308cfc364014eaed49d549bd30f21254

SHA512
edcd3165aa77d7a26b50e649d53e268cd482851791d84a0bc385011605fe88ef78dc4e285b369b9ade04707892bad2bd58a46e18755ed4941a6c93e7740f652e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3102.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3212.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit