a42e7e9c022c4ede42fa5328fd2cc614175c271eca9cce126620acedc52a8c2d

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c36dff51d4269008a009b9a3141bd1c_JaffaCakes118.html
Size

71KB
MD5

3c36dff51d4269008a009b9a3141bd1c
SHA1

f182e4d5e451b23734d6bcffe7557041d9eb4897
SHA256

a42e7e9c022c4ede42fa5328fd2cc614175c271eca9cce126620acedc52a8c2d
SHA512

94ec33329567ba68cc2ae3368466e4635d7debd28d093a8f8176a61ad76f509291aa6b6b902f8f08a2d81be618a3a7ed7993f7caa80cf858cdc1268ddfcb7f34
SSDEEP

768:JiIgcMYRdsI+mInDD5BLd0gGez8+7oT2gwC2aZZGMdtbBnfBgN8/lboethcRTQFy:JaoTr2F0tbrga9nhc8nhVW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301908ec63a5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17543BF1-1157-11EF-9E06-5628A0CAC84B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8e77d8c4c49c2449b9e58b624a1663000000000020000000000106600000001000020000000e4eec517e6b1e567d8b545b85e3159987532e59b30d7228fa6fe1d6e7f6df11c000000000e800000000200002000000065c61942067f66656303afe2271fe8ec747312e642fd77017f6e81a1f32448f79000000001b8ee1347424dcfa9c65919a124d8e5c415fb1864ed4b7124e98e98f54da0432622a940813511d86b455e3fdb8429ac1d15bfcf12fe202358b5568a1323465dfa1c2267abec0cc93e82fb759b2b7ae11f20e618a3870a150992b831267b3aec160d263abbc2f30cc14545559d0f5cf042b1e26cfa3203d12d3023ccb78ad504e1b8bbc015a9792f637200fce0d0435740000000bcbcb30f62de3bddc03342d8b4f000c43927c9d8014fff6a33ad52659c1c7c0b99c80fc0ff90c93101693dcfc3a76d7409011867bf2f7086a4f44c6f94458503	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8e77d8c4c49c2449b9e58b624a166300000000002000000000010660000000100002000000058f56c2125dc55340c6b1b66dce0f8ac5b35ce788d2657d49e26213c0aecbcf8000000000e8000000002000020000000b0aa7f7712082bacbfd4851ada41a139cffe438221f3c03af756b7cf2da735f9200000003af9db396a7cb0e8f1c07ecdf69cf93d75d82538b6d2c6c7551faefcc79864e340000000345bfb0d07462dc681c6d86ad0988fb07996706a8634b2416013c495deaf85a0cb70558573bf1fb8ea66b219efab274071ff793cdb857f69df1ffb305dfac4a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421786990"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3016	2364	iexplore.exe	28
PID 2364 wrote to memory of 3016	2364	iexplore.exe	28
PID 2364 wrote to memory of 3016	2364	iexplore.exe	28
PID 2364 wrote to memory of 3016	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c36dff51d4269008a009b9a3141bd1c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
6bfdc1f64a5c43237ad9889aea6b1e6f

SHA1
51e73259258895d22e821a312990d036e57965e4

SHA256
82f4e66ab31ff31eba5e73e19a5ae87c0dfd7ea00174d1c4ef6b3a7a4eff188f

SHA512
f468941d4d7fd0bfd7b34469dd1d816ebee5d6d34bfd119563a262007cc87dcfd9a0b25bd96e9b1384ebf968a50b60fac0f453b9be69378a60e4f56656233b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dae5d26ae153e52b502095fc39a7a5d

SHA1
d30da3b1959526dbd639f80f7b4c6b2e23efe848

SHA256
e869c4a334d4ba3b736312fd94964dcd957b2080852b634474884e2e3f93002a

SHA512
e9a35ea63077e9aee160d931b1155e6aeb067936551d1a5c02fa7ea713f37b3027f2bc2fe8b4a43e19db2e137f7956755abd53adc947f87bd2594bb6ac319fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8340780258b6c0ac694eda17063957a

SHA1
8c5754da423372d9f95c9297ef109145d6b3441b

SHA256
530ef4a9dd3a3c813ef579e3fad69cf2fdebc1cf005b3bd1e8c08a1363243603

SHA512
72d88d9ba8d8b7e567ebf74e8100cbf8280d66658620a2565549c2bf7ce0802d6fa930f9fc081070371dcd2b9795c2889a0f2f18c17219bc7491811e93e2ffcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0d82dca834f29a3bbf9f460e1720604

SHA1
56130459e5d4905fe27daf5ea04125d821eb9ff3

SHA256
7806a5cf927361fc4d5fd342df6fe1b6eada58b7ca165a7b958309554ed92ea9

SHA512
dd55314e6f5ce0604830b824b965107319a21c8a70ba7f344e3b08c3eb78c3c239c136eabd37bb99a4afb450807c68fbf95901a012d051f459d951d5f5803952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c1b87c2a76baf91bf2226ebbfcec35

SHA1
e290df2bcc1432854aaa7ef4ae3140e53f554537

SHA256
5cc825eee020d198529eb06c685a071558598d231b641a1d0c2e44fb038bf0a3

SHA512
8897386b5fdfcf186553b374c2fe280288b075f220303d22bab14da59d4d47884b560c169b34cd786a5b7bb9a3a5e9f95b555e9fb2d827cecce81078da6a6b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a96808d5c69746c5d67077ab575fe6

SHA1
2378af5dee312260e9a8ccfd819ec4678c46382c

SHA256
87ce0b6e3d86f9ebeb3d8f58578bada1f24611487628a422dde98120b9453017

SHA512
b7ae6949596351db191551453569579b604d76ac86f22eaf22638f409b6c48a267fe9f1af62158faaedc8e21be4d36128604cb9a168c8149fe81dbba98bdad3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ba7fe5e43b89a7838098d73500f416e

SHA1
91848a581243be913475e6832e166e993ac974e2

SHA256
9a20b516140fd0df5c495010ec704c7bc188c5058d591c4d403308a5545bc33c

SHA512
73443ec8a32ea0b037256ec246ecf18c80555dc9fd5c4cc44748e4fea0bf897482a697d7bdfc38cb1a50a0d25f9a03f6d3be9e3660569eef11bfb0f853c49710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b3562ecee454d9da22bcc379769e021

SHA1
6c52b53f2ba21cc20e0286b7790ad9e1485c3393

SHA256
1b6e949ca8e7ce954dcb89a3abb471320a8c3182903553c37ffbb31a6f877472

SHA512
a12c7f62972c800704593a112398a073cc6d04e06bbcceeebf5b439ba888a7ea83e988848d037ee84116f5af0ff4a5148c4ce031f1e224a7fe5f7a403170e08d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4b504dd334d8a276cc96b13314954e2

SHA1
e33060b636482199303cd6a3b5752d931be3d56e

SHA256
60aea4d7ff9615f86988a25388d021d80c0fc5e72925d53e0d81f7a2f2e313da

SHA512
5912249d9dde9d04bce54b3060d90f212530dfc89018b1662715cf897b09e2ff7a3382505516f2769ee98d823cb06fe11ca90e6c3f5879449d2009c4f1e489e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a8a9f74f4347c816889102b3e23c7b2f

SHA1
bbfdbcd5ff5468fe9af9979cc4fee5c7cac242a4

SHA256
fe3f64aa87438fab0e27790a430603e90a0f402ff9638f0dd3d01addd9d840a6

SHA512
4b92e8302eb3de2c60c6e85c90ea153bb55aa1fe660e288dca02e4689c0212b572fe454e913fc66d276eb392322ee43061ec435a07f25f870fa32615b482e69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2014.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit