c490040b1f4438ed5bc8f4cf03d165a04b9e28c46f80211fb8f107324322590d

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e251e6a23756d092ac0ddae1c41c17d_JaffaCakes118.html
Size

213KB
MD5

3e251e6a23756d092ac0ddae1c41c17d
SHA1

9d1c03b3160a342e29e62878e58e7b39925bebb3
SHA256

c490040b1f4438ed5bc8f4cf03d165a04b9e28c46f80211fb8f107324322590d
SHA512

300606365327fc6b3aa85ff4b9556dabe37981a4450712d15aa849fa249c29abe53f739ee9841e71cad13993bab040f0dd50c8b2c6a4f34d86b35921c8628cdc
SSDEEP

3072:Svtf02BL6v/lyOuXT7NhGgyfkMY+BES09JXAnyrZalI+YQ:Svtf0KeEj7ydsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421743608"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15A90071-10F2-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2996	2860	iexplore.exe	28
PID 2860 wrote to memory of 2996	2860	iexplore.exe	28
PID 2860 wrote to memory of 2996	2860	iexplore.exe	28
PID 2860 wrote to memory of 2996	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e251e6a23756d092ac0ddae1c41c17d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc18906ad097056a0bd423b8f37e6b4b

SHA1
d1a68336d672665bf75ed838c52c54e56f405792

SHA256
57186815f6b96d8168e7e0a57d2becafc751fd39168a3375840497dca2c9815a

SHA512
97dc00d42d2ff6813d7f68e1b3ceda617cc6b291837519cf048c102cb92c452b4be4ec98bd1c95a23353fa5d4bb1b2b0a9b7526212a089bc43de5a764b3b084f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b36a8faf8a394b55eac193af7d8c8c

SHA1
a24357bbbaf1a2bdfdd6d36427af379d6a1f6f01

SHA256
ce1705825d230b9bc2f0005707784e28c5ccffadeac5e77c9875611084d7dcbb

SHA512
4999820b912dd92af6f35e04965ca2d13cebfbbe46ebcaa0dfb82137a346c9d806b241c60eb9fa89938f6ad13f48617d10b5f8e6f3058706c1e1d1f1dece8a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc0f97b25a0efa62242befc841a1d12

SHA1
60763a4c2fc5dc47b17e3b724dd18cecdaf907d0

SHA256
0f5be5f5fe87c987820d06e318481c84fe45b51b7da85365d765af3b9b256bd6

SHA512
13ccecbe8ed24eeae4073c152ac1710f441741e14980ba679582716b37894619297364c21ce42d745df9290600730309627205c1fa132999e70fd203773332d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb65899e9916972b8fcd99cc46d8b4f3

SHA1
31c2a5985e438aa09d758d5038d868f7d320c17f

SHA256
f37e30e53095afad4588532a93d9d1f56e5f8d5a69b34f8480ce9c4c6087e87b

SHA512
a1fefbad0a7ef2615e6a4191a78f5012b13f3528f3a336aa49e48c78363d91905516a0a5925d4541af398ff4a2016374bd975eb4a977d6823e1895e91006dc18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6a02a061dd4a9a919d85efae515b55a

SHA1
a15d7512507304d3dcaf3c29834646e2dcdbaa2e

SHA256
519598f68fefc1c8c5ae4f57c48ff3309ba3194ebca0265735bbfe922e4582fe

SHA512
21286dc43447dd50f8dc591607bccf5e359935a88e48953cf52b369ea0b187e1e223d21c0332b947c35862db36bc0740084fccfff5d6906b9d50c16a196b192b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b143c412af19fa4ad536e74eb4ef8ff

SHA1
026522c9915af2123855eeb53dbdf6e1b234ce0e

SHA256
69e0a86d3e2f8f65c4715f99cc41001f553ef6ffa897c7faf7ec6ddac9939aeb

SHA512
1d49fde6406f66296c01a91a9c7112a3e26ad5f1ce8ea74f2fff9c41c4a69c1648acffda1e71602a98938125f2de88f21541ce54cc1f9c27f2829865f76c3ff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86162a667a2a020abb39c8cd1ead72d2

SHA1
8000bff5ab82100efa8955789fdcad1f966efcce

SHA256
67ef1b6b6a4dda37912e96214ccf604262ba35ad787613b98d37da97e7a843cf

SHA512
0e19adbc3bf01c6a189f373d958445c9ed4461aa32c689b5521d4aa4e6d0dd1c097ec803303748880d5adfb3281a8a66d4893a6937c8c257f379ce461993821d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96f6af234a0e84380d5896becea5a59b

SHA1
935f282bbc7594e7b86d21dead0ac56cc1748ec7

SHA256
bfc2913e64eedd0bbb8a1ed23d3b45e08d98417f870d02bb0b2c3cd024b9da15

SHA512
f39146bbcd1b3a923cf575123ad2bc6196c247510d011f56076a7f5b0ba53cd56bcfbef719dbdbdbbbc602aaa810f53f2fc2f3aae5c94183c0561492305f4e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36f074755b5a196d633ffded27517cb

SHA1
5939ee051d931c5521e66cdf4708c313608b5052

SHA256
e2829ddb11e34228ab66c29945d5716bd9ff5da535d407e59da81ef3929abec5

SHA512
dc6666a063605061b3575f34314bc96ca5ca9e8a7ee63a8260d25bd81455a65cb5b41b8ec60208d49dddad229f9ec498c72ebaace4948bf1a4f62c8020349bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daae51c8f411b11ca955b49dd0a47b6d

SHA1
d881b89b493a215a5eb9b4e6dfea5900e6677950

SHA256
bfab8fa3d4275578fabedf8eab8674e732bc052264e258e232088ea9f6497d78

SHA512
9bf10abd92bf850e4cda1b68d6f5d90086bc74d40421db3e7344d417b835738423b69bea1ed9d44e9bea608b3d8fce6afcc1a572f904b8f72f472e17660ce84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a38a4e0acdff949b5cf129adbafc154

SHA1
393707c903400e23b39603b2ace7d1352906248d

SHA256
e38a5c43d7bd28c356fe8dd42e6608728b369dc76bbf4ca1cc40361715e0515d

SHA512
8e4dbbe546ccc9ef71c07aa5b202361cd691b30aad12fdce39b8a1f9315c5fbd4af99e6954a325b64e7ffb16904bb9e77d8b33ed2de78a9d6d70ba045bc99b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
782d9e9e8c65456ec77f968ee1e494a6

SHA1
8d3597c2466b6d9c2d5be4b64ac6e588da0aec9a

SHA256
b9e8bd1f31d567ea3e145d8431006ea6df62b0502b4cb76ac56feb1722a1dada

SHA512
904f280f42297dfe91ed05f3f2f3e837b3fb6cdfe942b6ad1fd64c479c6a2cdb218319d0802a15cc44094401d0e6ff4d704f9beb695a318c377c74d66ff2ccb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea4eb2a08339024b5d053d6d868df33

SHA1
4a7f2f3514276fe838dcff0b86484ed86a2ec9f5

SHA256
2d6fbe7f162a5e08e23c63fc3bb1bb41c0927056e3d55cda68fbe0c2b736449f

SHA512
707fd801f7d891a90bbea5c81308830f74145f7eb9cfb48719a2530f7cf5e0cf63943bb769d493404d919896416eb08c82a369077d867b16c7b8e1f352b1adfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
195b2cc23df2ec4a45efecb8da2b0561

SHA1
2c8971d93a1b094eab1142585909f3957ee771ac

SHA256
bc3098a251dd5231de4534757eabece7731ed2ed5cbb5297c66250cf8a9c05c7

SHA512
e64484d9b580a993ed84fa1e6d9f164d4cdb99249ff5eac9a5e3ec5be50443b7f7ab8e6e04331c362ffe1f84cad5363311eb6dab991c230934405f136551fabb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe1c72cee8e10b771332abd03745c0b

SHA1
ae475550c7c7d48bcbfa337444910f0042245887

SHA256
64e3ddec39fd518c9412955e05426e8046fdc72c7e951ed57cc547e65be2b3cf

SHA512
ff6283105bc8f681ec5300cff4214e6f0c6721102c417d2558ee67cf2bc1627dfc082d779c30eac998775f8c75059c0500af15d66570352d26bacf7d4af43182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
957a8a03c4ef3b47a0d406dd712dc2f6

SHA1
76a35eed5f885ea76c1f6040acae2d15555b3b8d

SHA256
be5b2a2d3f745586c1ed55464d632ac1bb65d79c3c9dc26cb665bb1c41d191ad

SHA512
c8f445000fcfea4f900a4e626d5b7780503b636bffc48a5e1bd1c87aae278a73f60b9049bce399f1d07a063a6cc68736a110504ae0d380df713213260b0a382a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b538d74096f56b79b41cbf31c3e1184

SHA1
6b55a181e40274f060f4def144a9832d46316bb6

SHA256
d98460eae00c60107c6df49bf545ca20aebf8af549027c41cb4932b2a470e3bb

SHA512
5e1af644cd9fee629f339ec3b08a9224ac65727fe9289cd4204f322d479444d7ad12c510d28b64519ef36861651d1e9417c9b1b31a33d6342d8418a48dd5c165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56f79141e6148051a4e5d7928d1e656a

SHA1
ad73cbe7881a79a08202c5fc0ab7f79f7215b6fd

SHA256
935f2b2da93ba1d68b39b84fac3ee4501c931c5f67b02fde79bf99d9c94e7d31

SHA512
98d22956fc317de63ec94e4c957f855b3414c32bb7b3efa44eff65c271866fcd5badf5fe852dc5934f8e2abd4d600a517f0cd57745fc5fc8178ceaf9008274dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D81.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E53.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit