eb1823e2df77be21cb05432e2ecd15b8129849058b6bc8765f5aa094101cabd5

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d17317a3bba55e399195a6b9d4fee12_JaffaCakes118.html
Size

23KB
MD5

3d17317a3bba55e399195a6b9d4fee12
SHA1

096b6496732d6e6cff1c152812a3657d087220db
SHA256

eb1823e2df77be21cb05432e2ecd15b8129849058b6bc8765f5aa094101cabd5
SHA512

650006ec4ec0bf8fd638ad240481e575324d5fe0593333ce46a89f12d52d668a0b2e42cf642cce3d38699541e2826c6c54c45b5c39c921562f1eca635638f7d5
SSDEEP

192:uWHQb5nStE6nQjxn5Q/knQievNnynQOkEntcynQTbnZnQ1CnQtnwMBPqnYnQ7tn7:OQ/6E

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000d169016f475a5c8bbc7ae63603065e8f1898026c1267be6cff5e48272b7af01000000000e8000000002000020000000da785cf453b833e21b6b12e7e7259bddc2e95c4adeff7480954042e8119bd8e9900000001586559914c783add1fe0ed826253bcab862dd8bf4247615ebfe6269cf2ce527a6845e6807bcbaf9b8eb11d19e2247580da490aa7a55c0555a3fc2f5b03e8f2b5b630e4c2ab7f4615edbdeca025157500eea373ec2502e5211de7bd7be738ea74e5a88da86f56c305a5ead3c5477532762f45a8ecc1bd17e6c67020c7af9f33e5762b8ff4f3094168bf0fb2eb0b26388400000002fb3d6c3f7dcba7db06525592424310d5b0a6929a53c7d0a057d3c92880a3fbeb82c7ebcd5de3b37b47832c81cacfa84e720e7411f7c614391e517840963138d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421806153"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B53FEC21-1183-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0699a8a90a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000007a7ef58f1cdcafb8fffbded16e397cb84b9a8161940f70a64800ff924a0bf4b2000000000e8000000002000020000000b8399b75f1c68f74a1d476cda416ffca8966b98ead5675186195784d76ac9ef4200000007228cccc19933a62e69e5b2ee69ebcf11f550d6a6c1f231647e40816d138e7f6400000003c27525983e73111c74d446c259af60c810bcf93099913971735ad9535a02458c3a55b4bfb2a8e76e01d1b6d24aba29ccc415dca9b16d5c87df001ed74d33da9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1136	iexplore.exe
1136	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28
PID 1136 wrote to memory of 2256	1136	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d17317a3bba55e399195a6b9d4fee12_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1136 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f070478b20e69df29931cc160a26b93

SHA1
7d14573f6a342abb16a551cc443459864a5e40bd

SHA256
dc9071edb122859383f170e2199b94b574246606b0a850ac67c63cd9028dbb7f

SHA512
9145edf2269689c92c6f00d284f41c1c0ad8a34b989fc5ec8e6610595e466d7a40a57484e37c6b601a20634c71687111f11f7797c210203bd38af128286f6691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd513edc8ac62ef53c2501af4673a290

SHA1
3afca7f519c66cabb3c77fc818744b758ab31c79

SHA256
2f8048903b5e1fb6fcd8d9214eb54dd8402be73d3a9374cc6a8d60b478f0cfe8

SHA512
fcdccb2cc2c37b9a14ab600cd115f433a8645c2a46a6a6892851597829f91b82807607f3a3796649f35bd00f113f02c2f97767df63a95a6b0b87f363da806c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e26dbdd58657029e97d4cbd6e4078ab

SHA1
9a1ec387de956f92cffac6239adc6012ee55467e

SHA256
170ecafe7321e218b2035ecfcc71fb9487dcddb6f22decea4c4463630432a00c

SHA512
285e56544c519ede272a61f20c38a43098149822b0aade9501f2b1858e0cd8c0763855dc3879dc9461984831c510d06ec457de8ecdbad5ba1993232b6f580e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2da2174b8bdc625d33ec269220bc5e7

SHA1
3328f80dc57f487e1c1be8bde4f800516324c86e

SHA256
43731b3e0af74012fdb5dd6f814cba646c1378a0461f3fa8ced3b38f90d83d98

SHA512
6510eca9e6be7c236bdc98d156302afe1256c93a437771da1aa64423a4265f32da2393e62f7099bf946b3d35fd8a32cb689767ebfc8f5f6ce837ab06db403031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93af4c3b414fdb3543cff6a433a71403

SHA1
a326554cd6c6df191eac830c43804395c3416d54

SHA256
6a1fee741e811d4aa92cb272f49fa32bffdda58b5746d30836011a1400468311

SHA512
085af98d18fd674ee2f9ef10c3c2f6c866e27587076ddf7a92afd2282620a22a51bf8191604063658f1a9f4d6622d7a33b5e22e9568822ae228d08fc2d83bba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08cfbf6d177cb25344d433cba771e2d

SHA1
9ed2a927c7dcaba587ee4f46465c0c93b59355e5

SHA256
67fd3877c4edee43d837e01a16fbe776df232d5503fdf7012032bd87ac81b4fd

SHA512
a1e5c5a7ef96a0d0de545606776f98de65d8a6213da683dc6ca29d75d6c9640b9ea48f7756935b0ba63f698f5525413a7d9aa36a7885790119a0aba35aa3887e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dd247a8c1680f049b015e815546be55

SHA1
36d86886089091496767249f90566c79d5411464

SHA256
30ffeb5a7466361be34a9376c7c9c99edd518a19fbc9eeb047f51c8f182c4272

SHA512
b04e2dc77b67e0373df9caf1c56357fbd84f080ba9b22f4ab6a5dad4f30fbd7c8b30082693d1b937ec331b83fcb3a2602b4908662982b75f93affc605a5ba0b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37c1971d3201e56732a748d56d071ae4

SHA1
a3813691ad5a177ed18349f1b9ac2f03f81130f7

SHA256
8a7bd56d70d4eed5e65a8b038d521f94ec39c40637b816238333bdc1ed654642

SHA512
f5bfa7a7c386e29a4e99f2e0e3ec9a00007d9f678b46b305af10620cdee550fc47c0f016ddf0ba48c1803591953206a83e73393f82b00ee5a8341e73110d0286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea679e252d045d4611086b393d12978b

SHA1
4d1528b460cc860c8dcd3cfa7719f5bdb70cf3a4

SHA256
0d8fe83a45de094cf6aebd5a154213979e545b998db4d8616ecc70b01a3f1eff

SHA512
411aa1d77ded5e111aca487ce6b7ad0b1bba0259d4d8103c0648c4879bd052837406e8dfb8037bdc7dea1ac213641069e1c7f801ca6d0b8f5faa9c0dc9dace79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1f0d693d048f794cfcb8cce863a8d5d

SHA1
5cbc0923d4777f6fbb8b2164feaf70ed39a68fc5

SHA256
96152ad00ae77e9b1277364e2f3e7347d4bd766cf5c81e8238986a59eb603574

SHA512
acd29e6b1f57e0571512c7605142535d69e13eb536183a25779691aa97ff050c64258c983e0534ceb1454fb988dd7b46af3ff5b5ef7428ae0248d4244f849d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0fff84285df158eacf55925309a6505

SHA1
c9e6bb4cfca1ef60093173baf17b4566bb0c9851

SHA256
f0759de75358fe968c96fb893d2df68af0f08ea439ee5261c140ed0a9e470a46

SHA512
8cad5d8375afb290b2d6d48be05412e4d895ca116de1c40c49fa8ef2f8be81a3cf7a3ff89154a4eb4c338f4b6cd14ec0f5cb1a2e5e01d45be67cd29d19bd92fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaaff9901e96ff485125bd4777863671

SHA1
a70d63362bc52598dc962afd071259447ccccd4e

SHA256
b7c7cfb4e592ea832ec4496d5dc5627b08fd6778e9e2af97df56ed1f6a3a5ebf

SHA512
3b3a43880ce2b6fb987f19aa6d7ee4cc4730332e5d7b453c6580185a39a1cac6086498e947c8bad57f29c95d8c53067db5dcbabb79ed2271cb3a7d1f0cebdf8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7741a5f28d9797a86336de9c0ebacba1

SHA1
4b7539b78be7c6beaffa61a1237a24251ea77096

SHA256
fe00f90ed7eb54833bca0b212717fd377e2652ceb7102966a66897878d1a1731

SHA512
9c14dfff199002a019ebb3d1920467a68e4e5ee6bec83c56b0bf64c2ee06b0fc42eb39782ff5bbbbf542de7ec51b84c482ada83dc2174e89f6a09f08496e9ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d795a477f7a64055a42eb9b1fed158cf

SHA1
c422846fe2b649b6bd7b7b90f78b1a1bd5aaef80

SHA256
2cc9f6a4273c307c9961635f0f696842938a52514c94b7c8d5492285f3f9247d

SHA512
5b321e3916ddcab91d370a1b990d508434edaf24efb94125ac2a16654d7e7b35485a09b2f89542facc050ac0380a8668c354b554452a73ee6df72acd2bd15465

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC87.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD98.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit