9f95a27c5ae5f9b64d13a55218fba919134f3a329d86431f7aed43a7c5962465

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fb788e73e2f7f6f7c2dede029b82c79_JaffaCakes118.html
Size

3KB
MD5

3fb788e73e2f7f6f7c2dede029b82c79
SHA1

af4a7a2d7247fa8a99bd32deea10a130012da355
SHA256

9f95a27c5ae5f9b64d13a55218fba919134f3a329d86431f7aed43a7c5962465
SHA512

171fda00043eb002fc413cc61c966d72d9e0e473cc36ee6978ad5280a2f68d7b978e09bb61d3a5c571b27e641d8326c8aa9e9d6864c28cc0c9f89687e0efa452

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421769072"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F5C55B1-112D-11EF-91A4-56D57A935C49} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d8ef96311aefaebe92fad04b5854c611d852bd06bb89e11129fe4f94d1dfcd60000000000e8000000002000020000000d55b5a5b4b050972d64ef63e266637074489891ff72c5e5e03f3eddd4dab3427900000004c7e48cbfb0f56b8e1b451ab88690ac899a86e08e2ebe231fcb07c9cf0092d4b13bc4e4cb2fd99477efaeeb60b10b9d0452761a35dcbe778b93cf271fc62140328bfb802034883f03a6716c4ac5fe07386e4c95e1cf82ddc493a20b46c589c3d21899a981c26b79196a5413fed5a90ee6b53f9426c28dbf23d78daf2342c6d3b88c5d258da0d5615cd63e4d7d13efe5740000000f4b0f539c44ec35a4908b0c31ed497c1402e8942498afbc1ec0242c9bcdb3adfc57fa11d35cbd517eb320e41f0a6be91fd975f91f99dbddeba64ee29627990d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f8e2333aa5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000006e0d5f12565caf191a30a0d9d11e02a0c81fc3fd12c27d28904837ddac9a5a25000000000e8000000002000020000000883b1337d8c94928dca51c15f88e71e89d0518cc1868ccd37a7bec173599d347200000005295ea83b01561520c1eb65e0d0c8043494a3f253ce9b63321c0894ef84ffb58400000002d73da5b0ae7d930b484674b50d360eedb0704736fddc99403957375ae32fc01a881e78c27b48f11969c5781b266faeb9b6e3bc6f2fe76fed8155199a8330963	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1252	2944	iexplore.exe	28
PID 2944 wrote to memory of 1252	2944	iexplore.exe	28
PID 2944 wrote to memory of 1252	2944	iexplore.exe	28
PID 2944 wrote to memory of 1252	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fb788e73e2f7f6f7c2dede029b82c79_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
543dc04f6908ac8e8bc9df8eb1c7d01b

SHA1
5ebadeff3600fd40c61e4830fdb17a2f344a8ca3

SHA256
778aafcd098fc3848c23ac8fbce6d9fb120371b881a653411466a9486b49f7aa

SHA512
7f38abe8c59ad12aa1b2594cc36d26c669ac803be3616b8e68c484b9948a6423bcc961e31c097c74bc3e20be027d3b0236c5e24870077c1054c23788127df30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a736c971e105a0749738aeea0eb1d32

SHA1
56b699e5eb23ee5cbf1263beb3839aadf6b63805

SHA256
9cbb17dbad69b2a434cec298d2c47b345342b2a000d8e555d51c62bc4941d57c

SHA512
3209c1e1b01ce8d0196be6ab3594d5515724bcd51507a420b6108d63c06c131a2a665802e112f2535c0d8b76cc49b0dc9dd97ca2761142fad9814c22ad3e39d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99507737a1b1e841877d556422b24965

SHA1
412e2ce489339b281459411949867beec9da4a86

SHA256
f3dacf2cd02f4500db92413e82b786da31cf88f7509a79c01b62233ac4d59b1b

SHA512
aff1c5a8f903388903b97de232d608429ce43c3d26df341402ccff4363009458158bdd0972a039dd76a18dc7525034fa5b79d7f4e2b234de0b6e07f0ca66364c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61dc9120ab3afc038e59b0e8873d9acd

SHA1
3fa40edfd89a0c5e4d1536ba7c4b9dc836f5e569

SHA256
ec6c1862a6daf9f03525a67cc9ff0d618696540f67c91572cdceca5fdb1cefc7

SHA512
a4b8235ea55f317ec17dd5ef65edb3dc3f4a3552ffb8052f3e6b0334fdc2ea6c1e2772c0fdd2a3139e3392f4a596ad3f65bd3e22768a116b6026c17c22e734cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c4ef8a91a2151727f7ab572b88b9d2b

SHA1
26773e3cd8f9aee22f3e78ffef56fa9962967281

SHA256
279915f53980fe1bfc1a9fee17d6416399d6b5b4a54552f879e7219af7b0d173

SHA512
11d91f0ebca8f130857ff544489d2a68340a29220702a8826640d4016dbd21e7bc45e9bac628b5468b14b4f4afaeb325d27a5d32d5fea047a1cebdd73c9421b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
719358d8f6f0e3627dbec49c90f5f267

SHA1
9023110276a0fc773dcc547f899f840c651ea7a2

SHA256
0a8d8104687757df9b105731fbf26a5b09305114c6443ed4333694ff3481f9dd

SHA512
a49ba54dfe3ad36106de3da6ccb8dbf4596c33216fdcaf6bc3512cbc647fa6688debf7e4b4b870eb281c1695cb053db87c463d5f13f88e198de9f49c84f98f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b257d3ea0871a81ed34f354882bd162e

SHA1
0a13f3214952c90c50deb7141307b6e71b9c1744

SHA256
0dc3475e61fb45cafa15ff30fdf25e151ba52d01f3ff18b22eafdcf88f06041e

SHA512
787c35d905884ffa29e2808d99d9cc57260716f9c25d6c314d7d32b0b167f4abf1b916f2574ff4a4085f0c4860286ddd3f54dc982ab27924f2501ca924b1830b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28f332bd38b355a879da9178cf4983df

SHA1
7df448214720a5ba05cf9143034f9be4e31fa7fb

SHA256
d5997f3d7daac9840485a2516a15acd2b0f05ff6535ef9da3d7efb69b6436f47

SHA512
cb60c207c9aae5de9772b6996edcf73d389ccdeaa152438954917f6e2a1a93a179ea758ebffd004745535d4b2a887230041f0cfef3e246c6611979e1837611e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b82bea19dedda7bddcedb9829aaa7bc7

SHA1
84526913a06b48143a6a5ba382549d5469c05c8b

SHA256
b9b5ed558febd37e21cfded30540a7f21fbcf0bbc7c77c8278c9cec576ba12ea

SHA512
702b6375513603656c4180ec968bcc3605f0fe80733ca3203fbd93a961ff99877a9651392a8f3082e4b95db1b5d320af3279e8ab283b469615c0e67ebb8f8b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b21d58eacb6b492ab3c88bd509e85edc

SHA1
f4e1df012ecf932334328f58147957f77ce18b92

SHA256
eb39a2135599c5500577810e9e2a6e8fca3db9d78efb65d11156a85705d2a340

SHA512
05689e5359888bebc2ee144b1429350fddf75c86ef7ac9e0958424fbc5a78d0b7e9673746e9e3a3ec88074d59c500ab78c2d305a0ec6cf03644a841bf4c5d0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A6D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BAC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit