aa67e8a066227acf1502fb7a44095a48045271b4b8e7d381785c4854fe171873

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ccd5b03ed4ec1e672a1badc7228b777_JaffaCakes118.html
Size

67KB
MD5

3ccd5b03ed4ec1e672a1badc7228b777
SHA1

75958774959e1f287754cd61bc242a919b57ffe2
SHA256

aa67e8a066227acf1502fb7a44095a48045271b4b8e7d381785c4854fe171873
SHA512

b1cf4c670035682187746d9e39fe7d19cad919f157752784ed1955c26a1ee802d753d0c90f2a527beb436da669fcf094b67f7666bbb2a9adc4917d4f313bbd62
SSDEEP

768:Ji/gcMiR3sI2PDDnX0g6sP674oTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JdiTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000006d246dd7272278d9c15efbec93c7ab6a0e2d6bf84898d36ebc2f9c8c65033660000000000e8000000002000020000000a60dad95b771502b7b8fe19ba8a09285a92424bec9b4ae63e94eb68de901006490000000622284a3bd1406e3a6c0126d0d7b8c37b2811034044acd8f8468fdeb6efbe7bf22ebc55b585895c20a5be15cd0e6f3de9098a8a5c7f1c12fa9bab4eb8963b824a6e42605c7a0f392d90b853a49d28eab58764188793ffb3cfae9435efc66689d56d19ecbad57f12ae3a2280dc23ef8ed48c9b9331ba5aaba633b07023d55b479a1cd220445e5b1dd845c6f28cc61605c40000000eebddf68f88b5a45692bf33f144cf4ea922df90b7980aca4df9b563dc94514baae4783811176ace65c88de8ddbacbdcbecc8aefccc2eb188203fd865ecb65405	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421800674"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706c5dca83a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3AA8311-1176-11EF-A38F-E61A8C993A67} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000000a3b9fe181f77d37256f9a5ffc30e2095658e479c53020471740c03395893f32000000000e800000000200002000000019d6f71995b7efba3b19583b52100581996d9c83203dcf96601d8ff29f19a2ec20000000cb24b98edeccd2349b7882bd9b0ad3cb76b292019a6d3bf51c7098e7f623aaf14000000087058359df50bb02c83e2e066917d30c4299337aec50ab562be558af1f1dbe55315ac6fb06a29a968f47ee055a1ba78b0344bff634c8b99274a734847ff4763b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1176	iexplore.exe
1176	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1532	1176	iexplore.exe	28
PID 1176 wrote to memory of 1532	1176	iexplore.exe	28
PID 1176 wrote to memory of 1532	1176	iexplore.exe	28
PID 1176 wrote to memory of 1532	1176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ccd5b03ed4ec1e672a1badc7228b777_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e90252c39966b4e6acec41bea19f066a

SHA1
52f2591925d0c51835f78177cd7b586004b1badf

SHA256
007db9a351c09b95a66f8fc8af2dbae5a8782a143eb9637cb5ed8b8f18760dba

SHA512
46fa63028cc7a3672aba919a644b6127530e7270c293ce6d4afde222fe1b532a8516027d9d17a066ce12f88386ed2b87aec4e5dc641081d4b70470f7896150a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c4ed247875971262fd2a9baef1f4090

SHA1
252f3c4d8e19f55ea311f65df60032aedfb570c6

SHA256
544aed4c9f0a5b52dd9e1af182b2eba31c9c2a239518179c392b527af5b81e65

SHA512
48cf8c76a919d6b3bce3f62f5e8045df95f758fc7f2a77029ef0daa31b6bb07e5bad91599d0e3a58b4b4ebe9b6e945bdf193caa3019aa951e082e1906a21ed76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fffaa859039405134dd31352ba5dd3ab

SHA1
b5ae374ea07fdb87a67563c3ed075d7b856c54ae

SHA256
03194a7af5853efbac48b140ab1eba7ebf01e8af694be85e454ca61596acad47

SHA512
9df3eab874604f8149674a9bc9c869b37e26108d58d0a0a3bb8e660cb4320db6c4b6646d3f50262a03778d38d7ccb39899bcafd68a6353ac962588229dca3807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45485d89bfd3f8e3df229de4cb3c56ad

SHA1
e79e6c75567840435886a824bf1e9f45675787fd

SHA256
0f5391273e01f0a818ea9ffbcd17daf2d2390308aebd0e894d69b61fefb5c857

SHA512
2784c1abfbc895d482e97022fc738ce2131abc61237423d4046e48229f296ad2aa2c6a1d51943e8929ce1ce9d2710fc628e8f6198a5553cf50344c185dfa865b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dca587b57564bfe2cbd97c1dc3c8468f

SHA1
61adaf7d723d1236bcb5341d5656a6060dbd43fc

SHA256
82b4184f44786a648465e2d7d91d2d078f9a4bf78b17c25005a307d5fca28ed0

SHA512
27ee651c0f527d224f78f32edc5c320de64adf74b84ff76cbbe6079dcbffe19aef79f658bef30b7ab3d5b98699acebb86888b5c16ae57fdb141cd59e2a28fbb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
771815e752e10b05f1c4e04a4879bffc

SHA1
c79efc349f5cc79d8fb13bba13eecf82a3cca9a7

SHA256
c99efaf54f6e37ca3eaa88980f3de48f2f042e82e80136d348ff3698bf9edc08

SHA512
ac5a2544329c8c68900690ceca3d6f6aac5cd858741d79ca8f33baa35f44e34d2ef5a96beb4b88b78fc97ecf0ab24ce5cad80541b83437d22da928297799d9b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff2eb5ba22363aa8f1c2e57e04b0d56c

SHA1
7eb14759889d889b64565f0535e4699e4f86b25d

SHA256
1c5ae7cb313e2e5d67e524cc9236b754b5e3d2626d8d66281c903d1fc42bbec3

SHA512
70eef8365a79a1c45c8031e8f7e7b3686416aedf0db9ceca71452cb4aed2df7ef7979f710234203c5020b4e7c3a23aff06decb1949bc5bdecd92f8dc2ab02be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b52466c320cc3e46910db33253a2d0ff

SHA1
e3d380f2d7c4d606ae85c6c639c8238cc40ba5f8

SHA256
8c3a9da5610b8ef9661ded7adc684ca161a22a41b0c19f0c2b7faadf279a1690

SHA512
9effbfbf157ced8adf0c6a58fea2b194129d86e098f3ab7862feb1cdb69f3dd010405c82eb6c5c42ac1c681b5d104a34a8eec88dc3e22e7adcdb501e86bd63de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd31c078e591e6a5b89c4d8f73327ea0

SHA1
e2f4050a9fd8e5f76236e00fa4c0e362a32d69b5

SHA256
c1c9db47effe5d87730652e2d480e2fc6fbbfbecca9c7839566b8e0730a330fe

SHA512
fe90dc4c9118718770d4f51f5a6e4a8ae8e43cc2cc867e2941dc4dea323b8c426f2aa421f5e703a7ac2993ee389e2ac3593b5af1e766a7f3404e68164aba7ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3280e575b92c24c4c67d66115940dd74

SHA1
e4535579701dede558715baafe9a6929adaaaa4b

SHA256
e52ce4c2d383a6de4dce1232daee0b7443e7725824883afff7e3b7c369c198cc

SHA512
c47d13e45d760c7448f108d93b6315940c741920bc3ec257bb25ed0923aae23ada53a7f0eee5194b95a08e656a5ca066b94fd881fe846b09352fc1482ad1d1b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361f34bdd5218ae98aeca2199c6a94f4

SHA1
aaeea38ae71e682a948dd7091dba4ea008adc3e6

SHA256
147c5490cab9bedf0b91093c5da51e8a39c0e1155f17d84294a551fcd96757a5

SHA512
f251212fdc75b9fb2fa578122007e703e62d7f06e7953a7760e75ea2dd4d6f51f13eb6a00cebcb563490328961455b1675bf04ad7af4315241f07fdfc96a3ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f56c8e462e518ae6b487a948bc1f8f8

SHA1
461816770dbe2b89e290b2a8f74ff9e37ad0878e

SHA256
d8648cfa398e09303c55ddf8d896a26bdcf935cec30fae4e3db750d96da1a09f

SHA512
b47f96024abda1b416168ea00887b75c343c4c8b1e27368d1e3e8dfbb710d909f35ec4c3137db90930ecfb4fea0746574d9f9e89cec156582f3810f7d5e5aea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar465B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit