071e00fbce2f7e82771eff6d0adb8255dc116dba67ba07c09693853c8d91ad36

Analysis

max time kernel
138s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ebbb15a3efee08c3e572ef480e098ec_JaffaCakes118.html
Size

10KB
MD5

3ebbb15a3efee08c3e572ef480e098ec
SHA1

ba645f5d984576c43d263951757e505598442076
SHA256

071e00fbce2f7e82771eff6d0adb8255dc116dba67ba07c09693853c8d91ad36
SHA512

a0b196146c5e5ab9103b1b9ff1dfb6a3783caca01633ff6af64c699a8b7d02f84292e43320461b2e3cd67b7d908b9285d12fec3637b7e00ffbf501c2a5a0d7bb
SSDEEP

192:/5XShHrOnSkabdT66h30Le0qeOwVwR5sQ4IjLUTXJ+X/JikPwRneaJJ5itTRVTKV:FStISJJT6q30Le0qeOwVwLsQ4IjLUTXz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80233a7215a5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ee6a4b86714c82f9bc3cb657064120fed320ee0f3e888dc3c358a355a01efc8f000000000e8000000002000020000000dc6f9b3d3b5afeac7e39b4ff91a844fb786c179fc2b47adf358b5c3ff9d5161990000000f51fe7d91c398da8dce374a5c3d58ad2f6638e9b457ff4cc15c25c57db58e00cb5c695f7c1cc041b626b15e289e352a95c641505e5e92d42cb0c7ea32588a0277f4a36bc42c8482eaaa33560a0e626272b1580f6edad38e13bb316ff26098fbf2d36e92217d81f98668d47a5538bf54cd9afebb636fb1c040e0abacd13d14b6e995cdefd1d98ced90b3b89ffd91a562840000000d582368fdd805342f12c831e3d0cc63c7e536aab161353928b126bc9bf17ca0addfb83391485c89a9bfa72c40008442e94ebc6b1dc090153534b8cc49552e9af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421753284"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CEDA021-1108-11EF-97FB-6A55B5C6A64E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004be3d0f3be5f3abe89ddaf0ab7afd0dd6f38716bd327426d8bf4dcf4851fc608000000000e8000000002000020000000effab7c0943f6d5e273914f08134c9ce71ba29601ea4ec0ae5c3790ef4fcd971200000008985f5677843a5c8dee7d2467c57007de887602b95ec7cdcfe1b15bfa966241c4000000059d111dc0f2c2e1af96233729433320627666e83be95c43161f18c462e0fa458f99771437d0ad9288523cfa35224b6f385685e9d25f30b3da5f63f3de197883e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28
PID 2648 wrote to memory of 3016	2648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ebbb15a3efee08c3e572ef480e098ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754a332b619e80d0ea85571180f49ab1

SHA1
d19503d07de551a60673fc76cb291c08f8983927

SHA256
b93a81753fcd9d972de05567198f95a5e54a1747b04e50c7dcd98ce907686f97

SHA512
d4646ff9c9971153c0008fda8ab9af999829897b1cc5c6bfaacee4c7611a90dbf8f623ef89cbbd80e693bb105280141fc4ec70dafbb7ca1190f6b74527fd1cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ff8b16ab2b8e20683f91e72aafe77f

SHA1
d2b9a2b51789f487d395cef5ca86d7e51a91356f

SHA256
68903a975b05b434202fa72f54d62b2135d49c8519ba06392c8869b325e77cda

SHA512
00976d4eb80b33ea8e9dae3364696df15af319460244e4a50f9e29c3f7731237f1c55c628762302f2a5171384777ecd3cda5aa7665065973b0a3216025052f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bdd038076a5c89cdfba89f507b7a1c3

SHA1
68460f08d2dab14ab831006b70573e8eda040c7d

SHA256
8f6030ca2309d85009692989e93a1b5b7084de02d3f59e1e8724f793842b9f4b

SHA512
994742e862713c3fa5ec07d31a3ed65119099fa7b4c5595a043ec4be0b27951851082113b671e56291e8f6136898b73080ed851d6dd4d0e1011156c9e5308409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7e3e42fcde1adfb737afd61a041fcc

SHA1
62704e483c7f00087f170389c902ba926dcce0ec

SHA256
e7d0f297e28c5e9b26908671fcd6defa96621813b8a6a84ec1118e052f1788b8

SHA512
042f5398cf5ebad65a82bb423324b1db6e07d552470c12a79e3a9a122fb2509ba5156deb72b165aae04bf4e9b9850c2ce94c74ac503d8519f35a75e549d9e6e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650d07ed5c59ef8b754a735b43b3e84a

SHA1
239d2091fe24042a208d48718988d07bc4906b5d

SHA256
cdef8fedf79921eac0a4a817fee86d84b4bb4a310fa037bf6357c68d7c0b7795

SHA512
8cafab39ae1bdee2c5531a5631977658c2944b3a0ae56d84a7cc2e8ad9cf85517a6efc918a63d5db8e088a9131ff6422b62c96a3f2ec3aee56026e8c50981947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52c6101ec3f27bfd2e925dc3a09aa25a

SHA1
aae7b9b26c7e16546d6d89cc8dbbb8011f7062e6

SHA256
732f86a36e0a490639476f9a1af7a4c5d820522db2d4f6238219193a5c063971

SHA512
4db0ac40cbab7df7cf27e1e3ec860fd7932430a6defff6f54242ceec621e8d8f827c111e3861b8158f8ca30f93b2177efe3a27f1da2bea7f42b433a421259fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbd74f2b98bc4b01e0314bf0dcccf476

SHA1
160d3e10caf12692fc5272e23cf1dea0afb43206

SHA256
35e4d22d31e34510ad8620223e6fcf413119872f61b8118bd9ac01575b80f3dd

SHA512
4f5f6dfed66ce55bf19b6823a35a650e54a7cf343dcca09b049414501f04a8f2296948014065937f3a2ff70097ab93d7cc823c50a3dfdd56690362225ef9c486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64de689b54be1e9b9e562d243cb77aee

SHA1
03d4e282794bd5451182fe3b9b9836b134bd1481

SHA256
40a1c0225e61cb960eff162b1ebf08bbc7cfca016ed3c23471e578908e8bff48

SHA512
31acf1119e8f508e03d0d32e215ae96ad9da757f3bdd986e506937c4229e930d434b01ae8863d794c7b3662b4a44c8b2f91b2a662277c35b54aa40b09257b8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86bc0625f8fb9fe3fb1b0d4ec8038d55

SHA1
801d7f9c29b0ce5c352da9b318863df3a36aba1b

SHA256
528d115f8cc0fb675dd4e88f40228f64e55c9fe3381e9f046e9639c87a854ebe

SHA512
f62e2f307411c976e2c50f6efc4ad0222b7371d9bbbc83016e93147dfc135c0e3df69f08d9ccac9e764f4a360380feeb450b6d02d0def842fc31c45781afe7fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83088ef29bbf723cd094dae8558e1588

SHA1
4883d6ee8aec8634c761544679692da22b47ad67

SHA256
e6dbb317265a0ee9951af3c7897034dea520160b87ff2b910566dd71750280fa

SHA512
c20e5cebb45b5b4cb0d451967f4fc53f967a19ced70908cf47dfddcffd1004adeb7a3b7284d7668b4fbc179aa7a45dd6e822ccf6ca0e397b536fda3a5d25948e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
662c04319972c72096c030f03083e546

SHA1
8ff780917460a9d68fcc2e9b4812cf269316696d

SHA256
434d425a8db6836b04db5a16799ca391622530e20f06d2af4c427931d3f8c16e

SHA512
7fff0842a76ec54e2391be4ac3b412156983aa4679ee3f393520ee26bafd87a8987e3aa1b1a5a249fcd314faf26ef821fd11c77040ab90875a30327dd94b8aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfdfb27adb02f31fa96ed85de30edf9a

SHA1
fc304120a4eb44ccc310621a03b82d54a9239b01

SHA256
7c4274eb8061520ee8c09924859fbed9565853173dca8b6a9bf2e5a8f9accf8b

SHA512
7667524ab7e955459e0742ee9f5cb74debe9eadabfc1e9641759b25f3c8c173ed0d354c4fa4a302401e5dcb063af63b9b5bfbf83b93cbf8474d3e202817d53c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB5FA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB748.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit