3ab9168ac6208f2b3340281c12530ffa9587bf767ba8d58ae216c7e2fdf56acc

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

306c050cfe383c0fba48d06452a924ee_JaffaCakes118.html
Size

115KB
MD5

306c050cfe383c0fba48d06452a924ee
SHA1

a296d116cf75ba9f85f4c025ff9607173d2f1fe2
SHA256

3ab9168ac6208f2b3340281c12530ffa9587bf767ba8d58ae216c7e2fdf56acc
SHA512

0af3fb8841e91e3949ecc4b8ff71dfa17efeebb75c5548ef6a7d406cdd966a958bbd6805315dff01aa92bcda9acb8612484ba3238f303a74421b661e4770a180
SSDEEP

1536:S7CXjyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:S7CXjyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421527136"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11B193F1-0EFA-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003e874cc4296ee342864bd2cbfbddf746dd3c83eedc7956f0070d52b74f2c202c000000000e8000000002000020000000c423ba18646d311ef392a2e4e7eca82d63f434ac13c90ece1e0340d5da9c3e6e9000000066367583f8c3aa5649ded319a8458835d0a493a3a0c8361aa807c90b058179cb058a3cfc5a3d935d6b83d52c104a337761a0f0bf6f84d0e5bd79572ddbf1e4882cbdb6b296e94a05b64ff3733dd5db5f295da96a75bce9538e3fedf6c16f1b34b220a5c83e559794da3fd00acafd273364a6a1bc2f295cc9b7677c2fb9658445b03b843d22c62cce5ad8098ad382f2394000000039fe23950d33f3efc50015841ea334544931fc86defa414390c5093600b4c959e5dab3fd8fda93734c2a7dbb07d516f965679ffe1163cd0fd06fd9405f2ab74c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000205b5cba4deafdbd8dbd5c0ade0f44c8dd6e958a0a7419f4e2fb8d888ad69f4e000000000e80000000020000200000000bae046e52b77d360a7231092e75c52d202976948f37c1649e3b5de85a7a208e20000000ae73f784f05a483f331e91067fdbccbf3bcf5c9d2cc7a22f2dae02b873efda62400000003f6d0dc653c747a578cd113bf15425e6805442a2b27bf7e0dd069d2246f315ff0e2bd4e5d4a9944a4c8c23293be55b61fdaa04704448e2ac206c8491000ab776	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606953e906a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28
PID 1860 wrote to memory of 1636	1860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\306c050cfe383c0fba48d06452a924ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f02b837db0fb8b6d09cf84892a74fcc

SHA1
b180182372ddd413c3b40ebedc502cddbcb88655

SHA256
bb1e1cbba78ae07b82cc35b5740208d3cf77f4352dcc967ea49236fc98ae1f1a

SHA512
cf933cfbe6bc7928a92e3cdcd5cc167e7980bdf40c930ff7dd4787cd4ed86d77e755b9d9a0c95da1250887e10ea892cc92d81077f3d4fd5cde6229ce2a9b9440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76ce362f30b1f283c8e8f77db3d171c1

SHA1
0b9656fd70c1e4999521036ed24519a9ff058e35

SHA256
6816f245ff5c3888e716e7d781bcb82a83ad8b1c8da8efb57412e33ff193b3e8

SHA512
97b49686b177e8396839913144492fc49335aa0617ad0d7f555e3106112df71f937f75b0247a37df36b867065e178496935725011ef2f289f597eeaac3df3df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf054dc6b02d4e19a16891fdde4a123f

SHA1
e08dbfc0b3a7ed4e3de71c2c346887f02be05485

SHA256
3081b7f614613e41809db3ba12250e99e40a62b65c858d20a4f965cd76a5b236

SHA512
ceb3a5d8e62d8ff985036cb1e2cca56e4454c5624ec67e002aaa13125c2e68dfd82c268e4785a0e2e518228ec00968c31bf68df6627a835d44afad8080c8124e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
100e3b5fc49c1ea3bce3d89091676947

SHA1
a1f385063e1e765ef60c89453a84cdc7649071ee

SHA256
de94d679369e069390764e5c4dd445188eefef4bc8d66331fa042e9552c38217

SHA512
aff8d39821a5bc42d5464e007b8c3e123b09201269a33a0e2f947d316372d386dec2f915bc9e975b9973602c6c8661e33bd0d3ccc3e74c09465d024244f638eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd82a50295a8ea7a84df07eb22ad1401

SHA1
4faecd64ee46ad6379d7638e71d3333b1bc6eaf6

SHA256
ecef88313d3a9e7d3c8380802cbc522825efa2ab1478b3f28ea79d7934a35cbd

SHA512
7ac30c0c10b78b7d9732e86f5920de1873fe75b1e79ddebbfda67ad1776b5d1d5c4a4559d543405fa981ba785c6d03f8418b632dd8d837c7a0529a444952b35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0146522971fc55bdb320df4689927462

SHA1
6df094820c7bd632df8789458384ae021613053b

SHA256
8fd35a83e719add906e88d35ca2d309940eda2be5eee1cb44df3f89c9a267095

SHA512
430c71aed843230b53e43e723ba33a0ff0a428c532eb6f38ebc32fa5b9465d16ac5bebb0133bc56a1d83a7471336203143272707e5bcb9b91aa08345b09bb147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ee50c291888ead5b238b043a5212495

SHA1
12119d686a79250dc6910da20bea561db12d2bbc

SHA256
b7c9702ebf894f5b92ab93d0cd61b59c96f3ae01bcb7457335afd7c35223d04b

SHA512
c72e3d72c009b98fe09b7f3822d79573d10f0b343701267649aee6857cb99902e6c620c25809900796ee1ee1518e16e1b69e0e222af78043a86108026f9fae40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af58cb5addfecc0485c4de164c0c8da

SHA1
6a20ca921331bd94aa75fa350c4905a959641d6b

SHA256
2126c71f6d8e65227f0b333b60543be73f34a8449e86ba1d78f416c101d5fedd

SHA512
bb4eb79db9c684d3698c24d50f73bd6818fca895ac7a3c6e2b12776b554f28dc27223f6acfc07adcc1c677d39752eb9b2f7d5d6e44ca94828e289206cf665dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e9e396bceab06c5bc92ba7e794951c

SHA1
5d23c02d11fbc7e7d5d43d00d1d88d4c93ff91fc

SHA256
810081673b4f6c601aa632d0417a2f6027a3a4c5d248b6aadd761027458b7c45

SHA512
5c0ca405897ab85db016e40fa8104379e974851e671f9e33b402ef75680e5728bc274307ad5836455bd23b29394a556472fe82a9602c07dfa9a8ecb86203d159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12af5b7047981f14db6fffce96f4ae92

SHA1
2ceb6d4fe6edf0f9352dca48db8730e8cbd60888

SHA256
c07213ab7b55d5d66cf739c17ad3726b913591580be35cf8a0b73bf839926472

SHA512
8a7fc9aeb275a92ec217c32abd7305f922b652b0b407c0a5a0232650d6f98b5814417685025145dd1c99d851b51b0f9919868d5250ba1fa5c62df597de71d39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea04cb97bb1f0dc9a5f71b6b0b4d77f9

SHA1
0b2983eb77e6b30f7a308e2ad2399f99b6cb6481

SHA256
0f0fb833046097a6b7a73288c87f4fca800af711e1e138c36d95b4380024920b

SHA512
ebf7fdd85c16bf81cb436b1b58057f4bd87b4df897d87da414685fce7b56399a9cc2450b6e50ee9fa276db6d0bf7d1babf0090747222b2a59e02846ab44e36c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1adfe764f962d948e8d73dab51a3c779

SHA1
d793447d41949b3194201af3f2e6eea0ffc0f01c

SHA256
abf1042751d823c7880df6e65a351cbe88614dd841e7343a917b5019f793067b

SHA512
191f3733111bca1bdb97be1987cf5546543d6a9e1f09cb79a4e9a5187b894a4d02fb02500b8f12b7a1f29d1e5f468cd33a268d3cb90334cbf34ac9bbb98d7f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
458a3d1113fa17ea7b93cb16e374e3dd

SHA1
a7c389aaca3bd4d62dc131870495157f6a1dcaa6

SHA256
6d9902e865a266869feccd74fe6f88b882f47348b6de096d25d33d3a5920338d

SHA512
0e7792bed323bfe9387de6a7239cf96e9e4928332dfdd5ab384c546b3e1877f01d8de4db01edbf91ee1410072aa81711f968a58c3704240d95a79f4cdad6f1da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cce00c5329476187cb7695b4458cdd06

SHA1
b9bbd089a47588d9de333680723b19412e7a4a7c

SHA256
0f70f9fb649e34e9f96141de81c7b8e1d7ffe757c32f689de328155c91fb0077

SHA512
409b444e69d046974d94d866efc820ec8c5801fff803b9ddd174a595a56b8ffaeca04eea26394a50bb81d8c244c193fb3685401338b0916028ff6cc7db5a22f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bebcb4817e8109b4111f8e9a7a6ad616

SHA1
4cdd8b8cc75fce96c08772e8ffb44da84f3ff0c0

SHA256
3972d8d0e74c499499ec31a0a0cc3d368e3a207e872adff73bfb7f232f9b862e

SHA512
84bd87652072e2df87eab505f98fe341b9f68c221b967cd0dd1c608d952e034b83b44e5b02a8378f72fe8035f96cf79326a44f84d4fa8628ecbd930c5d90c06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3257.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar326A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit