85524e5dbdf2f1129e02f0a73b2da872906eae676a393f83b8ec9cddf073473e

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ec14c013a36b46d7be41c8c87653509_JaffaCakes118.html
Size

30KB
MD5

3ec14c013a36b46d7be41c8c87653509
SHA1

692095be8a26397e51852e00616f903a41f0fb8f
SHA256

85524e5dbdf2f1129e02f0a73b2da872906eae676a393f83b8ec9cddf073473e
SHA512

90c2d34d50ae3f26023474e72e76251acb7031a0be355f1d09f51cb015e11e2ef10d74099a95bad4d240437cf28f2cc0c31c83d1985291efa12b17b27e1d5ef7
SSDEEP

192:uWJn/Y+X2kZcgyb5nsEXzbvgnZhyP0g2nQjxn5Q/WWnQieSpNnv85nQOkEntQgLF:AQ/WUNQ9xYpyQ3ZbDAOpm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C7DFA61-1109-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ab090077717549d4209fafcd0d8575bfcfe754be53765be135ba06e856f85d10000000000e80000000020000200000000a321bd96fc98e0ad0acdb0f35902ea52ad44a121ccc0cf8a90a12bb233c71b42000000072991e7779c87d2146eac8e7376176f8949244932eb7a8ebdc28b0ceb6bffbec400000005a2d4dd2a4d6096c0fb6d72183475c8cd7d70a1df622d0bb824cee0587e6b0be4752260fb6e4cc92e78f790cecdedd7fa66532af0287ce2628d81ee818690854	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01e484116a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421753632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a88fc53a3af858313c193a3a17d84b6b140bc2c662a0e49bde95c8f8a27bb59f000000000e80000000020000200000004ad95a81b969ef771d41767178c256678cd594f7d5c205df730e5c3c630b543090000000f50087fac8e2e2fe9f1dcf105da45d4bb4cc06d6f21f3607b736581f78194723e5283f8a8d1aeaf56bf5aa906653aa84af3524c0e3c232fdb405df19b616fbb1b5f12ae64e6d5a5acb68a534749664816b632993fdd7ecc53ca90239fd6acc9dc19f5d1fc52f209884b4121e8cebec29b2654794dfa91ce5e23fce343ed38dbaa13cc3afa2c767e3167219e8c0a69e7240000000b6b4efd338fff70464b3725731cc6a74cf67b529eef8a8213c18cff3179c8a4eff0fdfca3986a8ce743cff9d487fd9a4efda4b49b60aab5fb58b17f14af9e4b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2284	1640	iexplore.exe	28
PID 1640 wrote to memory of 2284	1640	iexplore.exe	28
PID 1640 wrote to memory of 2284	1640	iexplore.exe	28
PID 1640 wrote to memory of 2284	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ec14c013a36b46d7be41c8c87653509_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5673526677e115f25e1b5c3d10518611

SHA1
07e9f613a79293afec61cbb125b8e6b4a45420c3

SHA256
7ce0363f509c12fc31a0165fcf8285a0f3f8905b05a62b593c5b0824f30af895

SHA512
78a17bb772a1cb0f671c0670cb2c25dfc21b139b885754999d93b967215a87bfb6fa2df3eb76037bf098c1512a18ac242333163996d8db65591cb698b576bc29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9828d71a149125a4358a3ba447213f

SHA1
8c9569818bd9b16c3523b66b43d6976e8152c276

SHA256
93f6b404aaf945da2b78ebe9805906ffa638c9852af61f0f4df1e27f2d4b0826

SHA512
7ed78949e5b0e8e5e805fb55f20f6aa1d7d19869128a0dbcb43325e8ee8e950195c35cffdc178cdd1ac0952222406ecd87b7b521bc5888c376a99a390f859286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81fb9672169f81939bb9dd2803bce696

SHA1
551f88c7f67fe46c731a0ab534b79ce97101522b

SHA256
9b9edcfd2fb0266e7dbfde7188e5b95452d2086ca281d9e28db9f9d4ce1e8692

SHA512
75cf1f6842c7c20223271744fb484c9783e065860596aef67b1e3ba01a64e4da10de20aa29655cb28e078c6dd504646617941f42bbe16d2452c190538d6b6d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd80b07e26bca067da6803afcad94b7

SHA1
ffe5a2937247eb8bcbe34a48ccecc50c190dde6d

SHA256
f1bd67265a16fa0dfce940cb63f006955de1bec0f76854e6c13ecfceb4d13925

SHA512
606c0b0f9e3b568a5df784cc065dc25c800bb2b69a54cb8a6fc43aa2a702576aabdf8bd731821000d1fea2a3f3f9e1e855831a6cc214be0f97be789eb00f7442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1489ea48d5248ec5e1c50a2c26b9ba73

SHA1
d4348a1e8634e7b668b2dd1770a7acc19c13f677

SHA256
c3758a5872bd056074d706bb26d547cdcee4a682f74ee4a930fa7f5a3d23d8f5

SHA512
79bd45379e4071eb6f486efcf8b26e089f51616ac5a126918070e741526c639f76dcc559949f82ade6a99258160720a2000c901a288973ebcc385e2b1d0e680f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6efc3f314931bcfd2edd4a47eada75c9

SHA1
7c62f8d6957fda07d01418efa507291679e4ed7b

SHA256
5c1b9328d36c991705f1c448a56d001a3d1493c3b63e7b40e7696211d1ec5535

SHA512
f797db2258d0d7e8c960bd10f78701fab50c9011dfe8cd78b4aa478027fef4d7bc389c6c7a2e2c6754eb7ecb1d9af5a865598f47b572af1290c40181079ada03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bffd44f85acca0f7e6e8f5aaf7afaa8

SHA1
b11f9a0f6734a0601d72cc5e1ac993ed1f766209

SHA256
2257906fb166ed3083c22d257f383400bd6cb08584c6ff860a9914666b542872

SHA512
a9f2522a5abbfc6f6058a33feac2bd5aa8f7bc017cf7f8cfe354f299799a3e176a121476cec9f3d7db730f861e6365c2b06d2256d5586137e70158a47a8d0766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ac0b872b50539479095149ab22ab48f

SHA1
809da7ef64f19d53a871139a64e0bc8eaf5be321

SHA256
1e186fa5eda88f5c1df92c8744349d4c488e45a6449e513daecea81c37bbd0e9

SHA512
ea517a234415756c90ffb923d53db69d2eea97a6ae871eb37fd958abb36a2dd7018d52c8d56ab0dc1a7c3ed000140369238e582e05dccc207763d9e8ae8719dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b004277eb51b04ce04be3e952eccc6c

SHA1
776139b65f34209a2a1022d2c84d9ba9e26e3327

SHA256
32fe20dbe542510ac42bbb7379f40e4b3b9d9d326c52c2239b3fda32e50943fd

SHA512
343eef921781ce5c0402a15881ebbffb07b3738ca4c7231cd7646bbd9fd54ce4bba11922d327e3b6fa1852775e07ed52b95fb3719340ffc094c58a98292334de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71dadfa2f270f04523385e66eb7a085d

SHA1
29a82ae464dff095c5f1ae70aa38213fce8f6a40

SHA256
37631cc9e94f0ace1d97a1a3c9b77ec0297a97d792fa1259155d68eff216a9fe

SHA512
09002b62fac0f4fbca168b2dbfe0b5b5aa8f19cd5691c5ec13216984d64c8d7d56687e3b6d6c487e0afe4c07bd24f188d8355e10a3423e37b4da818b93bc6145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae5431222d450adc5947bef8e6db17a4

SHA1
7400f2048a5642c2552313bf9d6ae18e5b40fd0f

SHA256
31d2603ba3e18f9c0ae84e91ff3ab17b060ae041cf410e7c59bc88fc32f3bac9

SHA512
2e865f31929a044765e54b3f99b1ae983f38ca77d781e61feb296a7020ab7b01d33b96b60429f44bad8a501af592b074dbbc1a6a71093b2c3f55d91c318883d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4675.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46F5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit