626d6e022b99ca0d9fe2cd5012a252e6835a84d6619869d499647477258668f2

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c1e11af528942bfa217aa26e6c4978a_JaffaCakes118.html
Size

124KB
MD5

3c1e11af528942bfa217aa26e6c4978a
SHA1

91a78b30f2687c17a6a7be5539cb7533e7caecf3
SHA256

626d6e022b99ca0d9fe2cd5012a252e6835a84d6619869d499647477258668f2
SHA512

d9a2aa22738da782d461698cf78572cf803a1c6c8e6ac37d808b1b8fca521a202f0dfb904893ab8ac6f802e0d7cb02456ea31b88e41276697145735643288c2a
SSDEEP

1536:O+IADyYYclgcWTQIHfIwunIjh35YmPJVSpZlVXVTVPlEF6GY:O+RDyYYclgFQyOV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600e0e525fa5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000041a64cbeb5901b2b8af0d47ceff2c1af6c04f6a60c9379646585c64d39e8db81000000000e8000000002000020000000e92d7625542260786b7681776e73d81a6c3c810cc79aa4881e34dc4c6f94184f9000000067997ed14d2c932c8d6474532b5f8759a96dafdc831ab16f71649ad5a9235808fcebf597d112d201f0ea19c4a8b7b6f9472ec2a7a7efb84e7325f82264f2d9e13c0e812f13d3575d30053ce4fcf368b0d40e2a8a50dba50327376b9a540a6bf407f6198d8a7c528931afa3d89b84f0b966be735c6d42fa9f22a131361d48c3b4cd993b36cc31f12885242f1a8186df1c400000003df86521e7c402c3f71b5069140ff330c962417561d95dc2ea5c09adbf0e0b3c337ce0a049469955ee0495f3c859854e52215388e9ac8ea385b8ba802e5165b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D87F7E1-1152-11EF-8840-6600925E2846} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f6e139581027b1e59cc2a6d1df9b40bf9e431797550aaf1d658205bd9550fd5f000000000e800000000200002000000028a3f450aa80187f5f523e96890d7f337d94a7b007e871e66a3d2cae90c7f159200000004be52f7b39995596a36990c59d628ab3aa24a4da28bee6b43b156a2ff28bd65e40000000614ddfc0d6f9fe17a3e7f1f74e408b819b034d930f42da497def71a28eae6bb9596ec8f4e396253a9cd56398b3ed0659ff3e4f49021c53b5e424318c6dc9bb6b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421785013"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2800	iexplore.exe
2800	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2724	2800	iexplore.exe	28
PID 2800 wrote to memory of 2724	2800	iexplore.exe	28
PID 2800 wrote to memory of 2724	2800	iexplore.exe	28
PID 2800 wrote to memory of 2724	2800	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c1e11af528942bfa217aa26e6c4978a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8c831c7fdf68fecb2cf1febefabf8b8

SHA1
49e4d625c6c3dce75bf17f6d3259e26a97ac40db

SHA256
7e2a0a181702bf76ab3c38b5c1ed4a4abfb1fc51b8732f1fa91348bfc12640e7

SHA512
253c7e6cfb1987713d84e593192fdea4e8afff3ab7ecc67041ecf147b549f25c609f45a7229181fb6e159032dd74ae7473a2cd77c004211e68cdccad6237a26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e43be3f99f8f83b15cd211ad3d69379

SHA1
1900169fdc06d233da49cf27f5b1046dbeadb1f2

SHA256
9114c2d7a73b36c0d0aacd6f6675967f431e6fae8e25c88279db8f0f2d40d971

SHA512
23a67c88f26f5162c1ff0a2956997deb644b41d9b501b0dffe2328f77bb5586595492a80705d0e0465774dd1ce1341c6d51a38e6a77ca768415b443fd3bf0dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f145700b2831dfba3949c7660dcc0f7

SHA1
4c985c16cbd6513760a951efe63680eb5028362d

SHA256
129a6f2150cc10333b88f118d685a02124b38bd54e7ae148edb0f2f284d30cf5

SHA512
ae277bdca2dbd3fd8d83169a66665a0b79f7eec2e1e1600b318685ec4a476fb827203a84c8e6d10da2ab95de96f8eca414df46d78a4380866d93638d292133d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bd4895e96ba782c113e77b738db7db0

SHA1
06b8a7f1e066e60565ed609f52c90ba47c7e3ed5

SHA256
746597b3e7a9616b6815cfe4ba2e014f6ef2b5534edb9cec062424753e25363d

SHA512
806dcb9cf798114a077c4e76a937fccdff345db4231d2a4075e73d24ee71a0240a1a1b0f1055fb11117e91d2e0c0e292b054f58f49911418148b66a57964e4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce30fd3d36d978d2db7028e75f8cb2d5

SHA1
0c8a417928c49dbbeb66c3bbf598bcc61029c34e

SHA256
64cc23875e07b103ebc591e7b0dcea2cc3e0fa294f4d5e6f89c7fd9c85d05579

SHA512
f82e0534f6c2ab60abb9286325fab97185160c9b3717141ccf244c3f7d0185435ca9afcc9c1a09085f42cae5d11b160d0930be9d0fe68768720ddcf57efa3552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b34c34b9fa3dd0d2bb0b7b67b88c58ab

SHA1
7b22814def5e83cf8805c5c8c588a51484734bcf

SHA256
cf7b3340870908c8873b8cf9e2eea9a1d4472abb601235da7d4689243e575f6e

SHA512
879d112af5f375e233b3d4622485916e72ac7e9794d629905d65cb65ddff9be5171363b5080683879d372c994c906cecb014d7fd816f3f92635d4d6556756cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58139d3de896fbe6f882080bd969c169

SHA1
dc37e9cfdccf745ebd5714bc5d0f2ee3dbf122ca

SHA256
dca4b242eacecb0efa3068a230a32d8cf62fedccc225903e37f81ef5752369d7

SHA512
427d4253b9cdf59b8e839adad97858a90f86d2fde5f4378ddc35d5daeb8c8b48f1024849c170f4b8d4f2b6743ee2228cba5f1af6354de80c6e1e765232a835cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3ac9b9a96dbeb10b1d3cda83f0f3d1

SHA1
20924dba70cb635b80273960ca3f0710afa315e6

SHA256
441c0e01500433bf97a2dd74d0c731a8553e03afe3ac79259918e8cc29605cf8

SHA512
afbe4039508ac886c79563ac5b967e3b9edfe8a68e0080f31b9e89cd71cd014ffa498c473dae1ee00ef0c8037dd14aa8ff057892bb018cfb2591ce4534563389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbf85c57090876f404856befef9abc0b

SHA1
aa4e99a90429e7d301c7760684c5d351e7da5ffd

SHA256
1248c9293eea4ffb178af44023bf0c70a171843cc718f55b43fded97205604c2

SHA512
45225a1a5b4c81cb39bab31ecbd11c11485ff7162db75f4cba906b2ac7d4fdd39fc092e17c52d9cff42315a42ba305dbbd2a065bfd2e8a212a6cd3cf18c2dcd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78da6e633b66a480c8a576884412586d

SHA1
a52a97533a72c11f43bd2fe5ca69ff516ed8a6ee

SHA256
41c383dc023b83e9c05276b0a2dfad1e4db1a9e259ff26a9f048b2a3b7cd3dab

SHA512
c0c7fdba0eadbc2364d45e79bad257621ddeba295d8c63fde0d1436359f344a21f767ac31a4ff0c4b89b4b91f5671012e473d4b5c526471a1cec467d1f39df57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dae2d7940c3f241bb97b57c94aa4221

SHA1
7535c6168e1c54dbab1e18b24c0a53b065d7f9a5

SHA256
bfb09f50c34fc1dd0fb93505995a3ce6fcbdf278d570b3e0708dbf77678ae5cd

SHA512
45a652470ddd715382bfabe67f6530cb3f53c03448145baee5eeaf3532df46cc9fcddad7c2bac24c09eb79a0f9ab6657cb0a0f93fde11bb4c00a1beb72a49766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d8883b3c2379eb780df5d8d8bcc8185

SHA1
4949964eddbc76463a0f6c0191ffa12c903f5ec3

SHA256
e5b06599b54fece0d542e9faced907eba30a181914e88f923a31e1f91c3ecfb2

SHA512
714ed2e21689ea35dcf20635dd5791b1ddc3296c309c930159b8b43b36ed650b09321b879745c0a9acfe540296ee467ad6cf0b131486eb2a34a62caafe5bc460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ade64c01f9da17e5f02826a97cc852ce

SHA1
41a0589eebb068719a77a8fc37bdc7e9fdeefe47

SHA256
e337520f39888af4eff6158cf3dcf458da2ee9b89840ea35cb0ee893421d5685

SHA512
c59b485c099d69767f4bc1e89a706854bfb82cac575297818bc6fce5ec4ec8798d30820e8f697410952269ad9e7e0f0775166c56070d862c5580e09eb93a3811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68b4038b21d7ddd949b2b90bbb04c59

SHA1
b38d412c2a0ca81e7cd2805dbb41ce00a2e9fae5

SHA256
a06866b081c4e9f28b980548ac63e2817cd61ee9ae51e2921f4158d16dfc6437

SHA512
d82133a4d8fa1312bef0e77b0edc56b328d9ba07f502499b97d29d7022e76cb7dc773191f47af72eb096b38d56546273554233638e7ba95512f4720047cb749f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11f057f3024049f9f6dba5b479476678

SHA1
8bef7fa6b862da81df4b4510f389a035f8b4a858

SHA256
2a8a5f0c22ed56f9c7fa512ed3e48d4826871e0e513cb7332634a8b720906315

SHA512
8ca876448c8b624048f52ace43cb4abc2ee7d04340abaab26c39199a2ee45ed8d7778c4017590c20f9b1b9f2b6c8c4271899ba13411a3849f75cd68679eab329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc350796e5e712ab54a02b8e1d64bf13

SHA1
4bffeb6a1d6b88aff8eafdb0381f94d70308affb

SHA256
627a5cd869129eb124d4acf238addfd4825c6162cf9073d9d929874067c23dcf

SHA512
3258eed969ff2df64567d644f5fc9b665a874b72ac5cb13fa1b4b5e072fff74428bc3a78f1647f0787218f28b5c58038e64c7f0c5c900176cf28d3e3a88be32d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2510.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25D3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit