a042f76049e7934ba80c2705abf038fa8d9a60af287317e2f8ad486a93d7bd70

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cfd7638a9fbd91186206e11bc34d1c6_JaffaCakes118.html
Size

26KB
MD5

3cfd7638a9fbd91186206e11bc34d1c6
SHA1

8ba81d1052ddd5ffdb8d4d829c8c7d2f708c0a1d
SHA256

a042f76049e7934ba80c2705abf038fa8d9a60af287317e2f8ad486a93d7bd70
SHA512

54ca4a8fbebd3d4c7a37a5e6c0cfa0b74e31bdff4ebec364b32828ac07be8620a8460e9f29fc9a2d01781504a35a5681feacd7fb74d363b75c74e778982617d8
SSDEEP

384:S1vNSpiRLAfG9MEFswUs5EYhu85eVpnrE27JOxoPvu1:SN08DhHcrE2FHPva

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421804269"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{531153D1-117F-11EF-8963-EAF6CDD7B231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3004	3008	iexplore.exe	28
PID 3008 wrote to memory of 3004	3008	iexplore.exe	28
PID 3008 wrote to memory of 3004	3008	iexplore.exe	28
PID 3008 wrote to memory of 3004	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cfd7638a9fbd91186206e11bc34d1c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40e24bb29d955fa8692162d2b6c1ef5b

SHA1
6e45ee5551f033525ccf09fd80a1e8419e29826c

SHA256
6406c79f11cd7a2ac981d7ac6540e2a2ae06716cd691eeed88d5f65c76c93f9c

SHA512
568baef01714de0d3f7553d8ba8c1c2dcf7aec81331f004cd34ad1d149da704c812d49b7653de82541ab90f582d2f9a670a80ac3396dd8798fdb3177d71fab03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0467622bb4306b81cf694bd3816d188

SHA1
47e4e650811b7d6f7d330ab575a8df9948c18320

SHA256
7586739de03337e6c25be061074dd14802b09cce71b9acf5e4318d5a06830c2b

SHA512
fd94ad226218d932c38df0390ec40a9d7ea7cc759b9a81c00e851c310530f2af79b4fb9db2fea721e50d850b1c3ba2590ab45f1e42fb229a7f1bb6e216464677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d89fa6daab4b64b702458e60ca650b

SHA1
8e57229478154b89c4a219aa535e8003043e3563

SHA256
1ba6ee36a3d90b5c3e4e0cd4f118427ffd23a8a21a6f5193157f68a919421207

SHA512
50dfa2e0150b5ec0cdd7190781c8885e739b03aeaae557df8e8688d785b2ea3e469bf934542be5654be820c2ad54556c61a7eb46ee7caa56bfb9b99aa2d12442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33ecd143bc400b1d6ef845e21ccae49a

SHA1
dd95923ae44ade4a0784ba6a50b0cbb3d4072dd8

SHA256
a613ca67ebd2e4a08e0e5a6594c0e51af6c61a1ae4f68595fe5994231bfc5074

SHA512
1d0cfa3422391a7b3dbef630da73fb0bc5a9b9a51979af67839ea1b71834aed6841b16e254200a95c96e1a6b54e44bdaac34236de23b20cbc6659cfefcc920dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99ef45a5a6cdbc2f5877638177b97c6

SHA1
4dac1da4017c40046636695c2c47c247cf9a296d

SHA256
d77703817ef7678bdd6ade2ec59878484ceeb113a24c53ec2ff23b40fcba4628

SHA512
f80bc493e1877d27bf9b796b0ee1603c4c161517029aca0e546835300bd1d24d251a357e0460c92544140348d3aed4a79df2e9d21d9bbe47e7d0713994dbfa2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
730bd72f79d06cf55ac5612a30ba19c6

SHA1
6a73fdae80ec54e2339491167813da88be5911bf

SHA256
faef9b6690e231c62b812a6291d175e8d6c25245ec689c2335158ca70f129da4

SHA512
caffc0b10ef845139098b7ad8ca9f41cedfb5368d8b7fa8cb071a2c3aed75fd5b6b8ef8bba40dfbb8126e9c85aac3870f11ae1244f72744d5b7350100d8d1515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd3412aa0331e7d83d4024b6a4658299

SHA1
b573224e0903b3f1fb3625c41e59816ed8de1223

SHA256
2936f08b080070d20649f80583814a0a2470e12bba6678a3c7242104c0e635fc

SHA512
d1c5f01b044937b328ebba3dd5e5297119c9c531f288281a6b5033dd519e2072cb04aefdcc725869b76a17f253e451b84ccbb9829c7ba69499782fa0f7d1fc83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3113112b2f69912d1ce3fb4bf4233222

SHA1
0ac3301861ce141cf3b2cde0f0f73aa83c9ea91b

SHA256
7a9e2928ace027ce2a5199aeb3b4a34fc3446810a07f1f3592fbfb541252c066

SHA512
bf8bed6b9e9e85a173050aa9e6765ab9d076bc0da1c93f120e1db3012894d4d4a06a5da49fe9f20313365b67d27420752d42f388c74d4ffee550dd061ffcf467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46b5e55937bf3c67746786d7bb364dbf

SHA1
467f20af8d0dec2d594a80a05fc6ccd8910217c0

SHA256
bdffe01df4e4ef6ecb2dc95c987b72aca604c88a1d78ef299cdabbf91dcac62a

SHA512
60aae635a6646b0300f4252b78a84ede3a86380c9e1d44521927af2e00eb4ed6da1c1f741e88578b77b6832ebf6f23c0d24f9ca83f61709c98175b9ab717c631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f490b7feda8b08ed6ca3f852947877f

SHA1
fb29d5703d0c79d611aa00ebd0917b7059d7a45b

SHA256
3d15208b81b0fe03ebdfd9fe758068ef00c4b5b99d0c2fd275d180bdcf1eaf21

SHA512
57cbee52f1053952eb08f27cbc27609d57ce3483bee80d3208ac296106e902a9722caa8c3fd2b11e9687bece67c753d1b92ee7c1a1a617e5fc1eb70846ef51c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8c29d06a9a3dd69a3fc8ab344658f1c

SHA1
1ebdfc9c9ebf0700bdc461ead80efaf8be3eaec0

SHA256
0ca4a526d05d7c73f381ded7999620a21d9e2a49d586bf4a0ddcddceab0204a9

SHA512
4f5bf98ab65380b6c9b5610703ee190396351efeaaf29645746472083999465da8b6702d96c6e4d51ec57093e750731e63193ee2b6666a02707fe256ac2ac67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27516ae4979beb35db499789d99ae897

SHA1
53607d4b8e3636836d3c7b7a95d5a119401c7350

SHA256
825840485c1e6bf7c73fcb94ef3e986fbd527d47693eb37958b7ca314f191a87

SHA512
160d48917c1899d69e4a25846c3074e1eb857acc1633c71c694ca7ad209a5087647068869b7fed6c99a6823cc91f0869bcd2173a4443d0eff82d787b52b199b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48042245c9bb17f34a23642166dc1f8d

SHA1
fd4639cd4beb974849aca87c9448aeec04b00b9f

SHA256
82676a9ad72717c9e38ae8cdac208937570454d02f68816e92686490602f19f4

SHA512
3651231ea9becbcebc95b727980effcd1ae3ce10b96ab23af8660c49d7be48a73860e5555378d2c229171665ee72575704b570853e3dbb44d93250e3a2cc3b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e26e96320d0d9cbc3bbe29b084d2e8d

SHA1
f847619df3607b7f48b14acd2472511ab6c4600b

SHA256
947532835189b6471cab82db80804cf935e73dd1e883c2e79467b8c1a7e476b6

SHA512
63449a012f2f3b6a6650fe09ca88fe48aa4094f9dcf5b4dc5bfe12226399b9b74c7c5033aac7e46fc7cddab7952bc35ebd88d957d92fdcebdab8d0b0ca9e1873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5e827b6e2293267460e77ad7d9489fa

SHA1
255ab4349ac678162a30a60120969e84ff92dacb

SHA256
673a07f251b8e76a6bbd7cab9360521955609ec84c9ec0844ea0365a0af677d1

SHA512
1c6ad180983dc63146557f987329a44b3a602f5d9eaeeca3633ebfa55860f0d74248537fb2e1842662c6ff65ca3c7fb92ca2c79a25e9ae39146fbfc0c73b82a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf173abf9dc5a85841195e9ca9590670

SHA1
4ac06ed46855a26e5acbf6aa2d365c19a47d3923

SHA256
8498179ea5c7814c42ee410ca7a219167dcc46c3234af7f6f55628b8db9a9d5b

SHA512
cc458c5c28b831cc7477182af990bad06774f6108a3e2052a00a8fea16514aadbc13a1d7ecabaef0121151913ff08edff8dafe2e2de97573b3520e7d1ca93189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a202c4b456ad5a23def2ef5103e16a70

SHA1
3c0195c16a99bbec312dc84439ac2fd762a355a5

SHA256
6b722337b7d7b9753c8c4665bd5d68df96dfcdd2597f2a7f05c8cc2a0319dcce

SHA512
9f48337c31fe14f29485baa17cb098541fab408569315da5569dd3609259e716564a3e9dba3b2d976c9553c564b1b0abab3b11db92e9325610522ce3065e7280

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1631.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16B1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit