757c430bc727f43e3d056094fb55f2f28d2b12760984ab0cd4c4839afd3a5c30

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3faabb0ae44c1cbbcfd60f0750d6468d_JaffaCakes118.html
Size

11KB
MD5

3faabb0ae44c1cbbcfd60f0750d6468d
SHA1

f7e618a4a3a8f9b38b8da33786925d5eb7ff77cb
SHA256

757c430bc727f43e3d056094fb55f2f28d2b12760984ab0cd4c4839afd3a5c30
SHA512

bf254667429c0972a2a3b076e264bccdc8822e9302ff0c1bfcf5b04dad18d5ba5170f980de022536ada78eada5c56b345f4107948b7d23d802ad6e4f9efe1d77
SSDEEP

192:un2RyGWa6bX+JL/8UxAYphGWG0ZEPBGKxIZmaBG99gpB+aBGl+ne85GBQbEDQHrj:/WOmgRdXP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421768245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{730B6801-112B-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000dca828b10209eeaa633be82be9272d5bab316c977a4b0846e78d39eabcf2c5d3000000000e80000000020000200000000db751c16bcea8275c3e336d31078baeebddfdb753fabb2c633cd756dab1b17f200000005ff2f69e10065e195c70440cad83ac3b43aa105e12d98c6f4f21794a59ebf24d400000002def72f33c423789754b34c360d1ccd93feb4d8155be03ff73f57ba215e32c0bda5e90f22e1b4959dbfd0727cd7aa98dae3360ea491a73ec3a8c0e08595bb69e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4055e64738a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000071f4964d1d6e027ff2563113155ea3776ca8ba2202a0a25d2d459211fbcbd541000000000e8000000002000020000000b5bc9ce8711686b49693481574c45379d321f9e34b3dc1a7eb8874906b098bab900000007d20b1f02c8486617bc6e03a533db115a19b1314cdde5d705f50c4ef58f807b2df62e2a19db27395edd3a850836a2834c18458f224c4d13facdcccc8cf3f445e96be070d87d3a8dcabcf3e7a46b21d2d1373f9c25c4601646949eff9e8bcb864791168e892dd8a90bf865a2da8f9723b0e6dc0eb01cdb3916bb64c5a48615dd86b055cb3bd3da6c6d6f3dcdf6a6aee9a400000001dc7c188d85fdbd08bc6804419d19fa3d897b104c5d071914d63d39588b99c60385c7656ec64a7b0905f28aca8100889bd229c3cbebcacd70bcbc607ad156f80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2456	1640	iexplore.exe	28
PID 1640 wrote to memory of 2456	1640	iexplore.exe	28
PID 1640 wrote to memory of 2456	1640	iexplore.exe	28
PID 1640 wrote to memory of 2456	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3faabb0ae44c1cbbcfd60f0750d6468d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43fe6a924a337078a7f4c18ef4d3bba

SHA1
fc2bad70db39722c41fe42a4baafed09330d0fed

SHA256
d0b6f2b1aa69349fe6cd1faf62dde9859910f82e168d5da815772ce6615ea0f0

SHA512
e15efab15dbee4b4287e52ae38eeb41a706ed81df79d188a9f6c4f1e88628a17da1d07e06e7529e16a3da763cc431d9ffcbff6e3fcb42a18d4c505292d77c817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab661db3a948095ae82a3317af173a54

SHA1
e152f89b1e919eb0dcdcc8702811b214c9addf4c

SHA256
55ad3f2fc8aed70e8ec8fbf1fc323233241dba783f17f7a11e2029a216b187de

SHA512
efebba1358cb59bdc911aa04ea06dd8ff1e4c8812b5fc54b960bb236902c21a3aca36a867c096cd660fd3cdb4e5bf7f23124e09050a1564b2cd07ba9d7219709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d32ed2269d73f2488cf69d454eda6a4f

SHA1
5971d5bb42f06bcdd6327d6d31754085083578c4

SHA256
20a51c00fa6a5ea404d3b8126ac8bbec93e96f6c62a8ee5d081791090b42ef7e

SHA512
3e89b3911da42dfc31bb2d99d0af0df83dd3bb647302be29582dfe21bc4b87370ecbaaec98ddf0672f25028c22856eb0403c6ecef96f2bb0efbd1ee8daf2b206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e17da5292a1922e123cf0218a2d4ddc3

SHA1
cac22088f6f5068de3ee181cb80932fe56464c5f

SHA256
e8146362d5ec98027a1a7bb26ea6051a4ef81e7b917599f67dec2358a802ae75

SHA512
08635dc87cd548af93cf26166bb10dbce3c5df8d78bb3e4d03a833059ffe90ca54fa654b4d22ab1efd69c8816b5c74e856760445ba0780de66e1e064a8e6f381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16448f7b6dabc810fb106aa38604c336

SHA1
2e1074d3dcbc526493dec85133d7145875a4c070

SHA256
c5e81050a3bccf4cd15afad994b47bdeb067f17d6a281955baed5f1509d522ef

SHA512
950338e62406656e08da866f176d753d13d56304c1704f499fea357ba22a852df32affb6afc6e3ba87516f86411a1bf4dcca1e4bc089a8f8903e767a8184239c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531d5c6bc5111925cac34c811c3f74b9

SHA1
bb9f6a508e9c427aefc9b669e4423c8a1aaeca4e

SHA256
e6d5d51282db6b1749581299dbf1c485def0d86ab3ece038feabf41394cdd338

SHA512
ca1fd8951c4f9aa0bed3a90010fd42437397cf2d01eeccfb1e36c921a9adda6e5951242567a7e2ce82b16700630612cb197aeb2ebf38abb135aafca6a8f131b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d741af4a207884d46a71dfecf3b93eef

SHA1
158aa08dbe94f2a6aec5158f7e71cb9695d0f593

SHA256
b53442349c212d9d07b16fe5cedc53a402eb89a6c3d479ca0488e224fb37b9a4

SHA512
5573d67837db042fea5a3b1be3b5722d472eb1513514c37de7ca86787ab9065edd43a0e9844b74b966aa891c5b9e4a4173a85c3b14d79e2523ae2acf266ccf0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bf71043ffd8e0179f2ecf219e0c3c48

SHA1
d77cbae9fedf6d31fbeec5440edc9144f2b2070c

SHA256
01bc17c12665e39eaa2335f7476ab814bc02691beff26c8589a1321dc93fa4dd

SHA512
0633f8c7232a72304ed6f1033e49832f82330078ae1fdfb64af3d676e4be8e6020e5d36cafc2299c7e32bf4d341bf80a1ba091098a01f5043445e3819c8f5ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84624d8a5c6cdb77c40518ed4f221312

SHA1
e16382e722ae0e5786f155fafd034e03c09f9863

SHA256
e4197b3670d5c129fe25dfc397fa34971765353c79619f2d92e4d8f6ab304fc4

SHA512
0ec182bf072b153a4093986b8d3cfc614f80a1d93e629ae36a5b8bbced35d7141ed851e9691b1af0b12af90545a9d78a08475d9e5432a35d0b942afc7db4b2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1afda49eedede7131051c4dda6348811

SHA1
b49c47b46e32a258a0217578f00702df7810fd2e

SHA256
8323d0ebb1f4dcbd6c48a63dc545939db4cf19e022a0f0edc61830db7e86815c

SHA512
f641cde82851922b278e06eff60fc93a8c6bf56814ccc5300f22b71e584a883be0949b1f64a96b6416f17900dcc165c16a3a0b4b0a371b706f684cdf30ba0e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A92.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BA4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit