f0c8e08c103190e60fe3f3092db9d9b5effeaec26ee28a006da7dbbba1d61749

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3072899c18ebd6c45c77f9804f96e5f2_JaffaCakes118.html
Size

60KB
MD5

3072899c18ebd6c45c77f9804f96e5f2
SHA1

4495f63c9f7bba901a2a4eb3c6d24c2972a025aa
SHA256

f0c8e08c103190e60fe3f3092db9d9b5effeaec26ee28a006da7dbbba1d61749
SHA512

862a3d1162a6a598c45f2c57e8a6a27e02fc4f2437763b41b8be2b9727bb2ba3ba11c78f3563af89a88da98350f1b0f0a26a2ead79aab7eb328714662eeac5db
SSDEEP

768:JitgcMwUc9GeCSXuhv9PkieIoTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/IjkE:JTiRGsxFTRgec0tbrgamchNnWC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000053576dde1c357f144885d89937e30396736db93dd7638c72bbd94e6d3e03045f000000000e80000000020000200000009bfb8b806ea86a4cb2831d51d7082926a33a9fb0bd45bad1af39dd3742e514cc20000000410777a05f38e2d95efa3ca68f4505dba9bb781e763743f294dca0e51c41ddfa40000000cbafdbf6d1e5e8870ad7bdb36eae59c75f7882dc3f531268b9bfcb234dd80dc8499654a49e9d5e60c0e778ebe10590b3537eeb74cf06e037913e42bf7eea06d2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000002a0bc4970857245c6f977a96050e412eb2de7406fb1a3e40302c163a8f6bcf95000000000e80000000020000200000006db65a8ed9f516aed4e034e28bb3f324e1dcf26a8f15e433e985875c4e65221e90000000a3bddf096a8783efc41108fb8485406321972090fa63c4a76d143081dd55270e8e9e8cdad4b62ffb78232fab9e6999c1e33ded9cae8a80c4274d6a24fd9c2dc1806e2e91e1953c8b8ed5d716100c958310b1c39dc8f8d48f4b584c52a6953b3060a6b88d97255bf8fc7e64b2d8a616226d3791fc563c2dea8c8fd5badecf20ae542396794757a0510f3d41e9b99761be400000002db6874f71177ea64db8bdd67db06f2de598c039a3bb50a5445bc198fc54ae09ba1cb60555362489337d4c1f0c438eef2d32447632470e72ead93929ecf2bf32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421527535"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00269761-0EFB-11EF-87C3-6E6327E9C5D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207b0dd507a3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28
PID 2512 wrote to memory of 1664	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3072899c18ebd6c45c77f9804f96e5f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
622d258bd50a92b016b189b5b7f4fceb

SHA1
b27a73b2ff9e53fd6ac14c5791138384a69129fb

SHA256
0d61e53c243bc20a52f7cf15507b94839d67fd2b175ed91f4c9c55d1a0088a16

SHA512
f37b32d6901e33b2a9bc1833172352e34f3d6cb319ddba414f66e0e6e7ccf5ee57cc78d836be550447bea3aceb4b46da098a69407420caf06635ad4e90566520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
427676157bbc5981c6c507fa42dd34e9

SHA1
701d1d55f2ac0eaa77fab615e9c6e09cf5b2e88f

SHA256
23f2519e46f3fb0669b2f0d16539096f7796739820d23762d5289b2586c47dd0

SHA512
b5b47d28940aaa093181ac3cd10e313f766a3a3b364d7eae319f0884e9d81109b3ef2dfbca600da627b35941054d1ab7eb7a3b7c5aabf4ec2a057b0d5ee7d44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9fefe91b7f4b94aed08a2bbb9c31e546

SHA1
f728e5700e2f663f047baf1211a21151b20d2ef4

SHA256
75cac5b08cbe0a1991d892ec7191d63a9706d8afefdd1e3531cd8be32e3d3742

SHA512
fefa44173d6f062655402f3485cd7f3614b09afab65c28b254810cf605951fd678546c10fae9d0698b62e1bf8705a8b58dc0f8cac05ea1830dc06021b9674c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d626f207b3bc159eb72bee16ba241826

SHA1
cfa67b1bbf2dedb482e5f3d5b51e38033080908a

SHA256
1be2648e97ba75f553033618b9a238d2db90eebcdd496ef6ed6c783663a9dc1a

SHA512
bbf708aab761b3d1d34733e898c6005d0f487c39ff5d75d4b0bd12e89c94fd38806e580ba46845178aaa7d43e3aff0fa67e4edf98e9361c0e6d55956a4247c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
421197fe77249cba5dc2569d138c76e4

SHA1
01711d70cf5bbc8a9e223fca095d8449c562e46c

SHA256
5bbf091bbdf2fdf788752c4637790213558336d7ecd130f1a45ab4e2a1862850

SHA512
c0fe23e7cb88b8a985818198d405b0899d43c9142ddc6619bff218a6bebc3f7ce152c21cb893620a978d1194162362ea09c7296d810a5fe4c42761b127f1fc56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a9791821c4d77b189482d05540571c00

SHA1
f52cb365d6129abc6fdd1e4086f874435df190d0

SHA256
3752f3d0690b59fa065f85f84e32a4205efc74a39a429689d96c1ad0129136c2

SHA512
de291f00af1ff173af437f1123f76efc2a5ad7fde39dada93ab6d968cc80c6e150371e0ee592949ab8c6907d7e8daad05fcdc4b161fd5351497112ee5245e914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c269f65f3bb5bacb914cbbce451a0d7c

SHA1
16388b100b37bb7034a8b8ee68b43751e9bdc258

SHA256
f0962aed46033ae28d9063d084d03cc2c67162804abac556ee3a664c2119c573

SHA512
bc12acbb08dda3c0ace96eabb0bcd4d47e5b77adcf4ea13d566ba5dd02d121519330ca8f0455743e07658884b980cd38540a212b4689c8f48660c9e9bfa5f8c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3669b67a19a4fc1624fb645b0e90a0d4

SHA1
b5025c7f1884427477f16501ae9af63463c77dd2

SHA256
7623fe4b2abdf522011b2df769a3aab184ab4d1fe158b0c612668958b15ad0ef

SHA512
a0029efa5d0e9ee1da23f70af86e68918292da998accc1b546eb17fc4b9cd2e1d66a018f5014001a209b8dc7a50a17917dd80ae05d2939e4f0728f5b444ae786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f1ce149effc3f18819d3af31fc82bf91

SHA1
90b5f817c0575cfb518400dc7aaf568124eecc28

SHA256
cd6a3ba882d50c2e957c71155ea498782908e1ca42d16ddd7e88df6978b1c119

SHA512
1fc1208c3c10ebd9333c3f067580e40ef23238304c08e8bb4386bba624874f6dc45d1a5b48e70af380c04a5b2979f4558113947c13338d3534b862d806282b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e6fa0c8e7217f4795a833456f6e26c86

SHA1
2fe7b8edc19acfc52f7abcde40bb02af9087bfd8

SHA256
496cdbec07f9cbdeca4cd4e18d3c77a902b582c087a7cb78c9730d5edf576a06

SHA512
de21fbdb1959180b6253a7f276926c08e708d3c9a60fdf9c48a78ad46b6495a04262f5c0db69e372d42a5381f44905128cf7ff0ff36117b66a9b0fec018ed80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5204d866b9f3f5bfc17b14faa5d2190

SHA1
dd9d924d94396cb5f6b851c58b3dc77bffd99160

SHA256
0b8207cacbfa4e302cb6e80a2af68e983f491ccb455e74297aa08279a4750552

SHA512
f1fc537634d746a581916dc26ef88d5029b7d4cc2d0ba586a55935fe6e40fa71adbf90841fc7623769d8f1ba9280d64a59543987893779db678ffc7848c2689d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
97be42edb10133944566a46f3d39a0fc

SHA1
a77b8ed18fd863d9cb9a0d6d66d520cd12eed2be

SHA256
0c848828bd8770765921202fadd18f86a6e9ae8f1ee1a4886e5e5a4d833bbe8e

SHA512
28e512a30c2d384107099cd407b6e7c6deaa0f059698fd7f5b0f00781512eb05ef2206122fa7a63c2d4c138bc4e54c65b56617f2841d4dde446afc63b8d2870f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cd171c3cf6c66aac3f2cc4526695fd8d

SHA1
80cf7dc9809e1c4248e4f1487abc47bf20d2bc14

SHA256
dc015dfa0155c1171d13523c73336016e7d1cd63b758d626daab5499657e7307

SHA512
c748709c01af31d5b3373b79b1ad6f759e5bd117c7e8f072145fc1bfa13c0d8be886650c983914e5c35c32e9245c8dc20dd72efb740730b686bffc5508f9c893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
56759746109454e83787282dc4bf4af9

SHA1
6719dc9d93e206bdfdb0c2cdaf77eae66cf2aaa2

SHA256
511d40bcc616dce79c8031c8fec44f5863869e4c6b81bda6e3920dbe6d5cb1ac

SHA512
e40ecae8fd064cf71a7649473d2bd77d936bdf5031169c7e4658c836e3543c06add9fd7fd16042b159e765f60ca07906dc7b4428ed051438eebdd3e59e876de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7296151d821d323a653a763b4c601093

SHA1
8a5f435178bd21abfd18e07f4306d795043fa649

SHA256
b2390952667923849db974a03da515a49de04ff0b6b2a2532b6ea8bbe7ca40fd

SHA512
537a765c6e858eec624e484f5db2dd3ae87a93e9de9482a6788054ec3d10b19085bf307d265616df02eb029d53c3eeb0bc3a8628fd88b11ac76b319372b8d4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37B6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CDC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit