11b364892af488a8813ede58035d5b279fca10846595aa8db07cb280fa4182dc

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb1326b008dfe5a715e624e79bd3538_JaffaCakes118.html
Size

27KB
MD5

3cb1326b008dfe5a715e624e79bd3538
SHA1

dea72c189b69b9d6a5cc3df9356afedde857b90c
SHA256

11b364892af488a8813ede58035d5b279fca10846595aa8db07cb280fa4182dc
SHA512

088af46ed561d8de17de4a7691f0d1f2a3c76c43d775354338e9008e29c6c996b162c946fddbf18fdd3a095fbc82c963c03ca8baf1372d2726c76dc8fc5050f3
SSDEEP

192:uwncb5nlKnQjxn5Q/YnQiebNn6nQOkEntUynQTbntnQ9eHXm6u3hnQl7MB7qnYnE:kQ/YKJqhWSJqAM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF3F6C91-1171-11EF-A1DE-66A5A0AB388F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5088edd47ea5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e1e2a96df70d0aea1bae9729a915b2edf5ac84b183aaa48b08e59491b59ac9a9000000000e8000000002000020000000faef7fa485f83e1a74c2dfac682a0cfae79902feeb663475e3a54aa81b2fed779000000037b16cb6c01337a2fd8609831a0c49049385f30235addfc42f812765fe2ff95bcb8931a1bcc16451396325771cc3a13e7a925294038aea448b71df407be7d8913d033c29ddb67a4cb36c9fadb3fe9c8064283bb7368d2b21706c58f262cd097bb979304780018b144a3baf96c4ef0cfd0353008c940e927f5df523a6e43f430523c4fefdb7a1a1e95ce3f83c9d6da4364000000091ebc04c0b2bdc4256f7da67e2cdc939ff907faedaddb1b867fca9fe56b8611c5d22d0bf362fc918c30d25d49b10645366bec914061cc6fae99436521f9c083f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421798545"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ac2a5915bf7cba3c0ca55c14874e0a43753ed0cf13b583dc52132193c7fc99d0000000000e80000000020000200000000af94244a5f934a72205aca7547d38aa1969ce46a8e83a1584b78fdecbf14d9f20000000030306b952a4c473d5bd7a2de73909bad7d0e67c584d9e708fa411418039407440000000e349b63f419a41e80f1863cbabe64eedb5f86a6e28f976e7638f5ddd7deca02b21c2172ade794fc398c31cf9d1092b378c6cc288c535f25ad796a031a541b294	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2052	1708	iexplore.exe	28
PID 1708 wrote to memory of 2052	1708	iexplore.exe	28
PID 1708 wrote to memory of 2052	1708	iexplore.exe	28
PID 1708 wrote to memory of 2052	1708	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cb1326b008dfe5a715e624e79bd3538_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f53e948ea51771c17ed4bc2eef01b28

SHA1
7fe5059265992f8f86cc7364f066353dcf45ed82

SHA256
9a080787794f2ce243c4ea4131e912e8b655b4d65e68757013bb6494986d1113

SHA512
0a09710461889cd0c297ef08f94d46fef6648ed1c355fa70bf0e40173af1c783a6fd398cb1a4ddc7372eaf62ef91a0e81b7f68b40e50364f7ce00dccfec5c286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b502440cbe7cea5c5597711608a7e17

SHA1
59efddfac94e5b38f4b11fce90e50987ef7fe61d

SHA256
23cd005b402d93b12d2ea24d1fd56b5ae24c88025bf274a7eb9d4fed2ceb7395

SHA512
9da581a46547ef4d18fe53ad8a5863ebc2461d1a67ca6ab8dea0763658d15a05e24197934441353e3244974708343d873e558873b63200b81b787219805c5436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e28f24a0b5324e43a90edc64363ca7

SHA1
864202d958d484b739aed515fcc8bec1bddeb32a

SHA256
7f01de4a413d8ea915894165cdfc017c48c11d2086bf3c575e6290e57a21eaaa

SHA512
89beca55c8c1904114f238d95058f119ba5ddd1b64b24c1d8a2b8f6a5d2bff30186b55bac76349b39b8f338b7e4a3a76cfea0e0f91cf3f7a90af14e0dd581375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5508da64b409d0f0dd3080305cde546f

SHA1
69d392f84938e6999cc851c90942766ba433e4be

SHA256
2dcf1562f267fe94b354f717a1eb8b79cd53a2a438da2d162c0f9910813227a4

SHA512
ec71e859c36fc63bc8172c5dc68de716eb9c7d5db26d77589b1df0dcba9514500821dec1111399ba518714eeedd4974355932178de592709c72d683d5295425a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1304dcfb7b4fc984e0bb245e6942227

SHA1
096591071278cc3e57c6bd2ea1ec5b8693e71fab

SHA256
1587e0333aff24402904a654007eb3bc3fa9d7ef2408ff73c9bd81d35b3c5675

SHA512
0bce1f8237491d1ed6f8d5f83eb451e299326a8df727adfe32545c646452611d2ad17269d8347ee11d782613332330ad5b21c9748417220ff43f3a09cc702d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6ead878b4c415d438502a0e479c4a40

SHA1
2f104b2252aa45ddcb9e0d50395000b73eed2bce

SHA256
7d7f6603d91f691ee06f74f24a51c62e234383c65e2b1b5338613019111c3f84

SHA512
83c9bde720e9cba923c0ab175ad87a7c7fc79263711a8bd112ddb54bf0c673cb4d60043a427a0c454886f85430f00ad5e5f18adbf847cb24aa0a5f0c66d01f7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
735406f0055ef40519511abe560c8fa4

SHA1
b947dd7a333837f3e7d012b15b174b00be981f99

SHA256
55d93b89ad3455c9848ba47db19b2a212fff72f0eee174fea1615e123160ae91

SHA512
854f58518b768aac19aa7288183a0a6489b49f579adee9d31988ac2c2312531e1f5a8f7c189f0f9950b50972c809f4de4904595e02ab9566cc4e892904c88a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ad6e4f31eb1dea04221f9b1e739ab6

SHA1
f531996191e75738c75be2608b208d56af3074db

SHA256
c74215360e05516ff95273fd1c7dd6db6f222cbe5ad189aae2bdbbb8aff5fdd2

SHA512
b757701aef6beb57cff5cadc205638633dd038b015b608317fcff367811e1505221f9ee97c1c1ab216be24b857a448b1659983fd59b922b56c4efd6df5663dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
579fda63c9508fa95890d2c531201d9d

SHA1
af0a5b3e7bc1ab0774a384482c33de040144b3c3

SHA256
c967c4788a75beb857a05941f5199c7462d819043b27611d6c9e2e2cfb8baff4

SHA512
9706a56f0808019ea688f676f6ef8ec0d08ec6773361f474f0c52ed64d463beeac8196580f3400896eabbbb11c8223ef966b6e005d83b4342cecbc8937c9b282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49066ecd6f6e9d3e92d95784a2e5f2cb

SHA1
679bb159512efdde520c73f6d2eeb6ee38ac6701

SHA256
aab0768a2dbbfa9734d37d1268add2a50056689e35923b6b5e1a9ab981864206

SHA512
e46a730e4323fdac9c76b2b4f324abd9b911a73de3636759e481fc8ae7150222e518607c34aaf06452af46f231dab7898e15763cdc8dd451796ac9de663668cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11faea4effdf3a784a4d00d0eae4d277

SHA1
d0a5fce3ffc9a86b5bbd774a7f73d62e7b140b7e

SHA256
25b04374a076d8d6dfcd7827ae124efccf905a82daec4f7230ee6f9bfae61afe

SHA512
ef22ddca46aef5fabc0924a6efaaea7a2598b5d374e28394ebd46769bb069da209cb3aedaf6704fa235de4e7d25e112c3fb957044c523f0b140140bad230225d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f335259481aadd900d8b332fac1ae5ed

SHA1
8410e5e926b8513e9c0518232ea1533e1919c290

SHA256
b94b03d4708a382340b06f5c42bf462d47a7c05346a571924d9fdd7c38df702b

SHA512
1b9fced00815487a36fcbe95341b5f3094e2d3ae0874fe79ead87e38cf54f03af13a68bf09c85df83ef1a2548f09c6c9ea9e4d99a97424c13faee4e7c2da5d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1465002eada1e5c612000f0436540f53

SHA1
00d08ed70ec3c2549f32907f17edc0b08fc28c8e

SHA256
6ff012004c0399dd4b3f64cef9a233b391cb751a2349ae57c30cd26a647291ad

SHA512
92815785972fdc409d9174657bf5024ea0df24c5fcbf6ddcf9d542d6c1b3e29655857a7a6658b26ec217fb5e88abced4cd57c78949832effd7af1e66a4bcd02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db2bb8a2fd8b3175deb40f09d7aa06c8

SHA1
27ba1744e37259f014e6e1fb426e24e27413893a

SHA256
5cc6598999d8bf7bff4b04c3fb566db4a34a9ca08f1a2aaf158fcfa0539ed038

SHA512
83488e4565f10ad139ef3eebbfc63c4c7d7937b1c83118e44c8bf34aa8bcf898d4e22c9ab36a07a585d96eed0f955fa54480ae6c0350ec043f93dd70f8c9582b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5341.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5354.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit