da00727b673e289c934a77ec9db3272aa2c640348732c19eb8b96ba14f6a7835

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

329eda50449b40791e7b67d78effe2af_JaffaCakes118.html
Size

213KB
MD5

329eda50449b40791e7b67d78effe2af
SHA1

c5ec53b4c97dcaaf0b649ca076d38e4c21fdff8a
SHA256

da00727b673e289c934a77ec9db3272aa2c640348732c19eb8b96ba14f6a7835
SHA512

0fad8067af0e0b99672867776db7cead5d457338c0a77891191175b2ee0c158aa775482d0c11272e0b05ae64bfc8bace88d638a230afa1fe516e9033c64ba6a7
SSDEEP

3072:SPIobU4QDy4oSUyfkMY+BES09JXAnyrZalI+YQ:SP1lsy2ZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{629B4EE1-0F4B-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421562060"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28
PID 2276 wrote to memory of 2936	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\329eda50449b40791e7b67d78effe2af_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7177257ad5fb3209a51198ac6983dc1e

SHA1
d9076b2789c17ad9785e507a4975e70249c9d317

SHA256
53abe6ba3ab8580c822c12860796fd52bb7f20b499f42caa5290cdcb477f3035

SHA512
456c34e903de9c8ae9d401297fcfadee10a085f2c1327115da5e388921f38f12fdb52f4c78b4c384613da2760c0243c4fdb39ff723f7a1e5c7bb9622a04de89d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f4ab2867eb735064d987da7c16f532

SHA1
174bd7831b2624f97831d0e91e398e3094433f55

SHA256
400463f8be69577b44a58d46f6b8ce7e8759c4e4bd750d9781fb06116d0332de

SHA512
18f1dc43f15cbd039e77251e2106368bfd4ccd8de19e3feef589b7538a1711e568f9ab834fc22b4fbc9e5d3f4cbe595d969466ae0e2cb6976d1bc27bb4ace901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f503b8bc522cdd2584dda2290b5cbb0

SHA1
f78715384e8919f4ce33e5726cb8942b0c8129cc

SHA256
285c53cd0e2af240613bf721d152712307f74df9fd0a6217e89940b05482eea7

SHA512
8a1b5b40e3d3225e02e935599d19c55b0aa2ab5087db3d71f2687c3961644d7a492b987e42dd6dd2999c30d1a7ed3bee426f7bad54c2b7ab72fc1612665df89c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d5e48fc266e9461e6f5da2d75dd7a0

SHA1
c15027a09ab9a2aab0c2e8505eb0aa2ed2ed9b5d

SHA256
1c3efe2e3e9c97607086cd984a2dcae98a3226ac6fcd54836e8ba48fbf5ad8f1

SHA512
e5f106881fd5b1aa5516ca5c913be16270a1fbcb2d987a40dcdc61ffc66ca31f5cc4bf1cd0cec98adc00d5ff1af41230d37e26f76c96bf31b32c1326e882e761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5674d14d6e76b47c2ceacbc9d8e12658

SHA1
7d812d8110910e63abc4c9e5b9bcabc9c3731744

SHA256
cf5f04f45247bf30af91d07a183ec64f10fcb7a0220e204cd31accc2b8bdd9b0

SHA512
92bead42f8a4c3e5cdb05eedd7c2383fa044c50b0960fbfeda06c5c8f5ddb91fb20cebe8b26f87307a0eea7a4ba6e9c63f4504627370f34f1e7a385dae70db49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ca051fbe49f592f37e43a112b2ca0e

SHA1
a3661ecfa13f984e84e1ea087092345a512baa3f

SHA256
a0cc13906a97039e5adc681a20c2076fc4a7e98109c26e03d01cf6962de06dfb

SHA512
43ef86bf179b960b5202b6d2107c560f88f617190d6f6af524ace889743f9b96883dc6776b46113ed26e16c7e76efeaa1708d935f9c3fccffa27279b80b206af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f373bc807ece233d9ab31bb8b5f59e3

SHA1
acc2b506da98755e9a58174aa1b8856911e6ea2e

SHA256
fc04183e3469cd1a64dac35702a9ab2c9430975438c7fb94e4a5de27bab12085

SHA512
52e29e6e30b316cfd888627384e9a3953e401740410847d3120c967a6b9f5c940a261c2dcd544af098bd2b9653307061062b9f4c532728eeaaa9368f180889ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ec1b09fe95b836902470ce07e4c0352

SHA1
dcd73122616f4193c68ecdb4157e0b595c9942ab

SHA256
7d2e86f0361db50adf100b2d803f1d921e3da06b12842f991a13fdb1ae8b3392

SHA512
57944d0a25e538bc22b23fab910da2d3019e8670f509d159afda29b90c7becf3d339951ae498c6481ffe088359f0f79130407c98f516fdf873e4b3a57a823f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c23c2876845e4b8ef242d16fb42e1fa

SHA1
9a5ac7635111088d39b5852849ff1051ba062692

SHA256
22324bc7ee02b1c4218480c24f4b932a516198cf13450550df0cae707c4bfaca

SHA512
6a0688def6c30542ba0bcd0db9135f3c5afc0af1e60a4ff7e07ec8bc3114b9558dc3246f2658a99dcb725e4d9f314c8237f7d6c372a33bdd2f197d29bb829b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e70f4954df3e02f2e58b7dd0202f0fa

SHA1
e76c2078c3ea6f64bd960a62b9fc6b77361ef679

SHA256
06316cccb0a69dae0336885b97c41755cd0007b999196e7ef6ed0ff0d69d2323

SHA512
cafc624ead00da40dc32a58428bd00446dd2805d31c413f41434379e05ca26abc38f58a04b463064b1653f35b98238b73591f104ed2af8f6438d5405a7150fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f08819735a02bf78c771283a84d944d7

SHA1
3cc8031f3cc879d820b5aee16d791915ad3da412

SHA256
052d6380ffb67af76c751558664c54055bf5b6beace1112673e5fdf49fec99d9

SHA512
e2666f55d18b0956e3d240508a08ed33beab54c79634b4b053dc51355f63cc3a9c3cfe2e18f3985e1a1cc14c06228c2c80c9182dc41ba808a5d261b2549fc823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cb6f986483efacfeb4aff896b18da06

SHA1
c7d5318671fd91b49fa03c055d33918bd3454cb2

SHA256
cd3e3407c6a71cd44ead735cf75d36263b7081b3fa94e0611825f2495973f098

SHA512
f4d2cdc3a8cdf3c8b9af1091ec6f48493d999c28e26a0c9c2dfaaa6ec881bd3a71829fc780f723a4cc6350bf30db01686ec6ded563b94fa10f5fd997caf1905b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aae2173f2454cfbb7adddbdf38332a1

SHA1
76e00a7c0e4983088ffac9ccb02127244ae7aa70

SHA256
8b18709b32137e86ef9d85e9c1508396b00d33bf6e107c7828922f5b6f459f95

SHA512
c4170531e42b9ebaa43411e196a58c82e38d884c90d806e52143c06586b142ede9fcd8763e386974fc9f416be52291d730d70a94145a484368737230736219a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cc736180fbcc41fe0ca9740bcda172b

SHA1
f2d0ea088a3c39760628318e006357e7695842b1

SHA256
c4aa7662ba3487c5f2e1a4b11004899c4406fcf29e04be34d7bb7032c0197f79

SHA512
dd19fd1ec526dddcfe2ee177ca2a1df5bc5708e299307acac38783697ef932b56c339b29aa26e27f1279d84186ef627677b3c4c3dd677deb035fe1ee869a6eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ef1fde04b2bf18dcc7ef93b5e11068e

SHA1
530114e12c065e71721cb2dc85b7d8f62b14eae8

SHA256
7b5618ed2a1ba012f9c93d5ca2f67802224fe057c8c043b140ae3bb9eea276da

SHA512
1fef34bbdebcb702e1a62841b5e10bfe761ff0661e09258fa5d77bce13ab7f7f87c00feac322e875343062903db42d680af76e951d86b8d6fb06f2ee8030f6f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702638c12613a5dc466c7aa44a471c0e

SHA1
bfe663195a0a14f8218985c1fe15056eceff7d18

SHA256
f08cfd4f0a9e100f7fc9574e80139fec85ff42d6eac0eecadd9c70367f374bda

SHA512
4a86a07e717122844b85b42d6b264c6089e84b3261b8ff85457d8c26bfb4813b34472b9eec11c1043a6fb1dc0d1c4adcc8aaafc3dbc3b1d690efef0816380fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bfb87e09ef3c17ea51fd4045eaab17b

SHA1
b1d5f6fc68f9ae9c7755bf3a49fd74bac7c6fbf0

SHA256
7a9f98b40d6c96dd36aa7de4871ba198e946c0ef5d5694251fa3c0c32d951051

SHA512
ee9bf07366aa5e7351d3cdae08e5c3185a3d60d766b0cd6f60b97de8df291bf5656552a566bac34cad6146057f61a61697fec197b4a407b33a9a64f3ae74bfdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72f0862d494817f595d875179ab68bfc

SHA1
ce7f2ee1ed16d16f5641dd29006c7608829508db

SHA256
81d4952936aff0a76e04451950eccd451105d263b5cb107c6eee3ede058ad178

SHA512
d5759d7bca4575971f93a06c6456de2692f431396f3d25514df6b27b5fc4a5bf8ba3105b374935692b7caf8c030daf8cef09d71698b758855aebcc8dd6b6461b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
441b42d38576c281e29208edb120d178

SHA1
32f1d6754581dd8af417b6f081bdd1643225d08a

SHA256
602f00164cb9879cdeebf1f3c621a379b9b5e3c3b4b0fcfae17fa4b7d0d8a9d8

SHA512
a52c40e197736d45ace5ff282785eb4e1e7bb4c921012e09aa37c7dca76f25078d1f65695f8f1161e9ec2e7d0060b26d74a483348a801d76ca7d215166e927c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit