f4939067d373c3bbf410cd5da0c48fb57489b8fd177853dfe8c61c3dc2f6da91

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e95f8834fa3761428a1dd71d8373a41_JaffaCakes118.html
Size

17KB
MD5

3e95f8834fa3761428a1dd71d8373a41
SHA1

4321db57e81282a98c9463e98595a9e23a70823c
SHA256

f4939067d373c3bbf410cd5da0c48fb57489b8fd177853dfe8c61c3dc2f6da91
SHA512

7ab017ce542c284e717d43575f8bca9c16b7336eca53050f163deda5d712d912b778c8a304b6b22a8cc0aa91b9c0108a5fd760a2b418d9506a1735ae40e36e67
SSDEEP

384:8o0Rn7eelR+eUene7eroEeNeSSRYlfVGPeueMeXeWMezS:70F7ee+eUene7eroEeNeSSjPeueMeXe7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F648F11-1103-11EF-B6F2-56A5B28DE56C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000014a4731117bf6c7f323053b748f6b08f7571ab0eb9588c1da96556e40e637483000000000e8000000002000020000000dd120d9c8385ddd90457a5949ed636f18a1f971c1d777f03e668b3e016d45d5890000000bd724f3085dfdfd058ce5781508a69b298e29b8b80bbecb94c69f337354d9f45384fe6457f48654a561508bb18d1f11a7bc01d58d0c709d0972731848cf5fa8f35dc38c56af5daf09c157bb4e0227b8b77855e7b65d78ccc4f3182fe96e0dca804aae1592b8c1bf13d5d4b48a2e31148d4da5e60b7adc8401dbbf8bbf0f1b63c6db3a171705baa0c0a98ca74d00e90a440000000eec385cfa6989e4f0ad385ddfb438de6bcb54ace120c0e1a685d24245559825612eaf203a60b23ba56d9a20423e5c15f69ad144fe9bb50431a77f1cfffd87baa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000032b36cb69150997ebece16435561c0c0c1c16f116bc8d9a273442651b077f3ea000000000e800000000200002000000055bb6b1c77dae67d67d87325cf6eac1c8ba36302af0559cc44909323aa090a872000000086a55bd3114bdeb970b4247e7c20c5e692b2432db80d46c2aee85625f92e74b0400000006429dc890c475c685e0d75b3072343d431c78e4703a42d6841ab033261c5ba6fc9cd864a2b01b322a03941c56db7c1b3ad5e48766a4b4bb1b285da49cae40bda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421751060"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c6fc4310a5da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2800	1288	iexplore.exe	28
PID 1288 wrote to memory of 2800	1288	iexplore.exe	28
PID 1288 wrote to memory of 2800	1288	iexplore.exe	28
PID 1288 wrote to memory of 2800	1288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e95f8834fa3761428a1dd71d8373a41_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de41efa549a9617068c31618b54d952b

SHA1
56ba132326415f0864990e07809e04a1f0eaf71f

SHA256
f605bc21c07c686b842ea9a9d8a287ce08bfff2c8ba3d5e588e2d592018ce432

SHA512
6aed3131423d5ff95f70e47e9e17f32d6836b856ed715f7befecf066ddcc81d24e6d862353e0ef3e9c30597c8a2cf893a3671d440f81657d379d262726635755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b48166d47165c6122f9fcac3d3aca7c0

SHA1
cdbac57bd2b896471bf3fdeb30673c89515debba

SHA256
5613e055fdf923fb4007d76d42998a000c4dabf2858c07d1c835f7681e158373

SHA512
5d25c035335821ed412719d067a3b11ee59a155456647c82cb28ca49d3e9e6c57c3ade05c46e2433d3612976c3bd3e12b2429d931266362195cb93ab4ccf05dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8aeca99da9fbde18c5b0f1c8c154386

SHA1
87456c2c5b81a2ea1f994740598875639937f754

SHA256
17ec5038b2d3575da8461c2f77c4656390f947398c6aea01b2eafccd3e0473cf

SHA512
e4fe434696cc06ee6b818827c2d656555987116acf5a222b87b252886664a928bc35bfcdedf3786a51b88085101306420e0aa823013d54b213b63813b90b382f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0962a5795e95820fb08bd8dd2d4a909f

SHA1
4be67e1e0ee923bbf6d44b339603271ba4619ff0

SHA256
bce02f26d57c3af29dea09efbdeeede9e57ec083bdb2a9a133cac678efbe0e65

SHA512
9b9f3875b09a413c2ac816cdbafee2dbdf704b8b3fec6dc508a8d9caccdaca0ea501dc81699d9d10882e094be35aa1afe561bd057b6a09754437a1ed1d16db08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4d3c8af0a66c6c28ea46d3e9a88a9bb

SHA1
6405e25936cbc3faa23ba7c7f2801bd4ee175c17

SHA256
f83c8ca004efd40070c3a3b7d81b164eef4675f914ca5d2efe34150092340a5f

SHA512
69deb231aa65d48f31bde4f002c3f1d22cd8d295f109ce8e29160c14ba0f5d0cde6488b026f0deed27e850af120a96aa8c9b1f7882c93371d9d910e5da682232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
289d2c217d90e31428b16d77ccb0b864

SHA1
3d628e5305124312d6b73c18e50877f7d83c6d5a

SHA256
064380b764163e675c554a5ceddb495de29456b2e8ec21abca4d740766397ffd

SHA512
7a08817235023cb3651bcec750dc4cc6416cd5b461339ddb7763891121343822c543aa4bcef88e02cabbc08cb7cc863fcc4eee36aff0de4fc3810bcc557ff946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa48c4b4d442f43b19814fd677793c4c

SHA1
226b073ea999c4319cd3a05cf512cdeabed15841

SHA256
099da252961e0237430743f966f6a805ea78e0f35c05c89b58d7ca8913085193

SHA512
ff6ebc94ef590e79b714d83becf3ec1faacb6d07d369124e9054a7b924d545f978def1f10838ea68c366a81d8b3035daf47d85f45b3f2dc89797f3efdfe6940b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6a17bfe78bede890dfcb33a1b56874d

SHA1
931a47dc4699d88f9ae88f276e45fd0feb57510b

SHA256
1e4dfc986822f0dbeb91643448d2b3e0f62551d4a64407f3a0de1436048b5c86

SHA512
d0bdf70d85b8b122e75439aa832de45e6e391b33a632a11276bf7e49f00e13e31a3941847a5a3979966e3e5df36cf402ba661ff77581bba14e7f5cb78a0df871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4085eec8ef3cd24ffbf04197f99d9f9

SHA1
e463e1529ea20964de15562488428b30a9e9b777

SHA256
99226928adedc5e54a91dc346ed963d888f84388ddeacc2824d2dd1d98f61071

SHA512
14bbb4f55c55d0af8d17045d58204082b6664e020834533ca8335d952ec0052a275da7363dc5ce6cae022cf514e9cc1478eaf6bf175e5580cfc84e8ad31b79c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44200ebc777b0ba465bac3cc34c6d36

SHA1
c4905275081cad279a187e5075f1d489591c8e94

SHA256
c457cbebe84e9b93bb632b6821f9d8227f1d35d41c90f4d9c3b476543fa76919

SHA512
733f32aa6d8639032e33bf84120ceda19d3cbdc918f9f1072e2239e6fbd0760ef592a927ca48e83311b69c355b11bf0b1527b7c742200eca08975cfcc4e1f7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
575c20aa89948e916531642eb41aaf94

SHA1
f4b3bc4e1a763640c2d5931ecbd0388334b6d50d

SHA256
c427a3a9aca3e114b47f9a1c0823fccafe7b0fcac9fa171a3cf2af8fd4f97db9

SHA512
1c8d7f27853e56e9f6161eb24c3a484a7632ffe2280866705ba5a56cbfc5295d7f418696bb73f727bbaea68a236e666d6001709ae3943a667b61063a1795abc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fbaa5090684c299b6fb3a02b42488ba

SHA1
91866e7f15cbac39b6073d5b2dd171aa9ceed2c0

SHA256
2d9f978a9d52cc2306451543fec203ba65d2f6f54e81d1f94e470acc41ef6e93

SHA512
42a0a53291fee3f68383f434b02279d2282ab2ecfbe219fb90f5508b6218118d00bc9bf21e26558ce4058383412192d6121cb63c692f70158c3c0e49eb47f289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c1b0fb132b1294b6e37020c5835ee20

SHA1
0fce0c6be91cc66bc1ad7eb0497276526662d282

SHA256
4618e8c2d691dc0553da9fdc7d8733d6c05e685494c6699898f373bf3fe5801a

SHA512
e936267a50457aa7fdf16cd35ba7d498cacf421ca3a888e8b17e9745d98d59b83d3d1b3f078aaf2da57bc500b34a91b674586ce74d2c555806646912373a6d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DEE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit