630c1f35982d30b405e250345a6940816ef3a797eba229ad6bc03ac113975308

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

385c74f92e2203868bc9331f9c76d516_JaffaCakes118.html
Size

27KB
MD5

385c74f92e2203868bc9331f9c76d516
SHA1

b03b98148102f0c08b22cc6f6936b6cb816b1e1c
SHA256

630c1f35982d30b405e250345a6940816ef3a797eba229ad6bc03ac113975308
SHA512

75c363e48c52b6a14efadc5aad9a25827589edf11e5374cd3c2b3c09c04e9f3d4f609f7735efdcb4a53071349afab4c6970d764654f81b31feacae86e5b19e16
SSDEEP

192:uqSr/Yb5ny+nQjxn5Q/1nQiewNnRnQOkEntXrnQTbnRnQ6CJVevo7NtLFo+NzQ4+:ngQ/4ygcQ+qj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000b063f53602113f40fc48cace113d91c526d6b5bbe969730ba6765be8e7a0d17e000000000e80000000020000200000004284e70e72cfca208d88cd0a66541da717159b0a4b468c263867093287b79dd1200000001da02793403175998a36a800f50caba316fa7a918e37a61efedd965166d1ba9b4000000034191e5632e56970ea84452053017a7209a8b678ba3c4fa4339f09410c17fe7deabd43ee0260661955377a1f1006a7779667bf8955d8308d9191f834cba0d0ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a1b78d28a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8EDFA61-101B-11EF-A4DC-6EC9990C2B7A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000006712ba5dde7ec075434da1b6b3067d0db621ea87f5ae702eccb2bd7a0be637a2000000000e800000000200002000000098de384d2f1276e507054fcdc70fd0737f2f1dc85d99a535cb86788ae187bcdf90000000fba00dadcdcec6f01163c462e3b2172cb1946dc28c09181c41acdc42f7c7ea338dcff6108095785f16c9c28d144627acfcc331f0c6aecb99b6b881c5cf8f7b87bce059501cd02b6db188ee6e0830f3c760c99060ea9bf639aa19294f80ba865f0b132e2919f53aa1994bcdfe50d7b7722b8cd027c78c5143ad0a64e3391d7902c572f386aa95980aaaad0179f29d3fd840000000b45b7ca9c2acb791a4e4ee194ce15cb02b7dd1662379f9c17d4931708c9ed06a3b1c1b1f3d7eeffb57bdacde62d8ae7722a18011c8cd85a27d97d97c2b493d15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421651540"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	iexplore.exe
1776	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3044	1776	iexplore.exe	28
PID 1776 wrote to memory of 3044	1776	iexplore.exe	28
PID 1776 wrote to memory of 3044	1776	iexplore.exe	28
PID 1776 wrote to memory of 3044	1776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\385c74f92e2203868bc9331f9c76d516_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343c5bce0d2eec8be0a8f2c78cb475c7

SHA1
6369105af51321d69ea6a75ecc704591ea801041

SHA256
10563124846a8317084b1d362872508635a16b28d8a9b70f924ee4074c904ec7

SHA512
e49904ee843b639b847e2440e66a1b5d10d3e80d70d78eec693c116768f68eb76f291247a78ef77f4c2da549a040a08b71cb9fc35258e0f7a4fb8c0a47316ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42dcb1ef99bc6d0d2a20873a6ac420bc

SHA1
4aad84fc77fa0490ce4f5d343658177ddcec1511

SHA256
a210d81b8ddeff8b138380e7a5b8cae8b10fb346bd5f20a3cc6cde433e195eed

SHA512
d083b5584a8febc9c01fa9607fc2dd73389d9616863d648449fefd8658122e35793d16b30fdfa06f2b0c554007dcd1738ccdad4dd8ab8c3eeda65a50ae0617ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76eb39d2729a59cad4344ac3a64b9fb5

SHA1
36442c9a93b48dd22e86c73a0d56def3067296c4

SHA256
b80fd7751a1dcc2846141b403ee0522b47e60231e57e8fd6fcb5483cbce999d1

SHA512
968284901a09d70929dae6aec6537fa0e1be1c41c1d789d5a60d247c07c03404a4fda485e48ceeae814249f041e97b993ef7a7c1c37620594a82467ea86f3170

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10e4fac3f39185fde0c0691d9bc7a4ea

SHA1
90ba4fa61aa0ada315298ad56f4805575b14d0d9

SHA256
4b31afe033ee840c781deed4504f66e43ee016b8c3c9b641cba83a22e1288c97

SHA512
308ca8b7cb24fbd751bf938f01a14914db633f46c4af3b1455b5a1d0710030493212375d63092a60fed774f6055a7ebab8dffc04f77357b4f138d3f553ebb54c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba26ca3f4a320d4c143a32474dd4c01c

SHA1
7f2486b9592198f8ae754ed42b5202446484fe2f

SHA256
a787274912a14a75e9a3e4a0e263d115a870b25999d975d3c950475d0485bd32

SHA512
7a73ffd7fd2e4cbf38115c448e26bc582783fe8b99107fe7a0812027dfcd54ce15f7783f9286d0d16b4e0b9d03e2629bddf488a096166c3a9416da55ca1eb51b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f0cae873d06a349aea8814379a1265e

SHA1
aeeccf57123f1c1b75304319223e6a9eac33d0c5

SHA256
d7ef8e2be052680f1611799e665157d31b82dc63ff7fd97fb888a426c0be08ee

SHA512
20a7a320eb73aaeb5fce0b50bb13ac9ddf97845d6c25cc21f9cd792b295f642cd41d1105e72164174823b4eb93f6ac4518da6ef4dd29a6e77b860d681477cf6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44cfb5423f25528f2a75249ce5aabb3f

SHA1
afb4b1b97790a0f5df1e849ad760c937c6b90d3a

SHA256
84af5308ba730559445e1faaae75b9dde9ee54cf6ae50c5cf7e23dee47eafa5b

SHA512
9e96b07eaf58f517a27c11222bcafa7d816857a5c30f2bb0ab9af8ae3ea7be6def80f85e0b8e6d53e1901f29d7a0a7e4d4478fd7a86e87a80ae23121fb985d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
237663d2da94233059758d3cf220d978

SHA1
16da3e3ebfef0f2f0e9e7df7e46e3633a1c921c7

SHA256
81139238db80456aa3467dd8d4616d7bc9e20ec2aee1517da3b8babcb44fbd75

SHA512
0393dd559239b95c7a423bbf90e7c6a487bc11b92ba948df25eda633fac9bcc0d0b9e8bfb322226a00ef0c536980741275c4920b8412d380f28de0acd2f37c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6692227c9c8624f097c09a9c777bb889

SHA1
6fa5a83adfbaa5370495ecaeee1a53b49dfe76fd

SHA256
cd95e9802587dbbdc01700f634728a4aad432842fa955ea6449d7654fea626cb

SHA512
74d791ce7abd7efd131c989d132c40b72f1b8c905d3854b10c483b4864d2484a83f445b9af9f871338a1bb8e777d784ebd01ccf01fc1047c13d7d9d55660ea13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39447f85234803d3ecc1d4a79ca7bca4

SHA1
f44be2d1363f14c58e5ec3b0d8342006ebbc33cc

SHA256
c596537e9c83dc17b772197d0d2bf79a883b1b5f7f0aa04a620015b9864e4be5

SHA512
eff8c7daf3f8fab43d81e38d2e36d78eed46cf611f74a21ed8dd1912e1bd9c8f4e4f9a086e105218577dcefc8e9efbcf279aa28a0d562dc7b10f8039e16d5993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AB9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BEB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit