4b4b174fe254fe91062d4c142360d4bb989f656016412383eca1486ee252e510

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c70e9ee6301dc941d70ecb5dfb09ec7_JaffaCakes118.html
Size

461KB
MD5

3c70e9ee6301dc941d70ecb5dfb09ec7
SHA1

c327894b44d24853d2259d2a4276a865d3435ac4
SHA256

4b4b174fe254fe91062d4c142360d4bb989f656016412383eca1486ee252e510
SHA512

08343ca3940e3ceb9fca16f41ea5a4db0d955d13f7506817af16d74bf3ac26c7b4d12e702f10ee83ed1925cbd3ecdab5c311e74df5ac1d2d648f3165f7a1c1fd
SSDEEP

6144:SCsMYod+X3oI+YhsMYod+X3oI+YNsMYod+X3oI+YLsMYod+X3oI+YQ:R5d+X3f5d+X375d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A983AC91-1166-11EF-9667-569FD5A164C1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bc4c8273a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e9e3e7a1baa48327d2ef3ff148953af1865936bc59e957db9e16457d9a15e1d5000000000e80000000020000200000004a58f9b7a0d449fae7a53f353ce4a4dd1325035bf306b71a4abd394750ef593b200000004b5587d82c688a635bab2999154f2fd4de6b443d3ed64c0ec481b923aa7527b94000000027818143628e1cba30ccb76f96730fa9d8cb0e1b151adac45015bd23499a6864264fb0f916e15bbdd33be5d47e67674500fef5723dc7d03e0dfd5811135a40eb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421793679"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000006453ad02e38d5df28af82e9bdd607a2055b5c5e320cac6d95e18be0236808578000000000e80000000020000200000003c14529afb2ec5ee88924c0ed2cc45234f1ed19887096f8c9988318778b6f22990000000d3a5e11925ac2c3a0059fa1d1ff22d3717d7031f9ec65000671f186ea49490af080b03130f97fceb8f1ac5598633a0a96d6f9657ae0712fcd1fe993a24cca0aa88ea1b970254cfa0df85d0422390ac199980a9ed0912bdc65f5696762d0f2a4235d5eaafd26546a3377df23c3522cefa2260ea913fdedc234a88bb563818ed68ff5b05087348d571c6f82a22d477cbfe40000000ac88c36f9295025abe2f6e6df593c86d0081b534a71add0b7e308f26efac2eb872538165b0a9944f5e874d581da31617f9046bea5928d40b1de08e1472d48b37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
940	IEXPLORE.EXE
940	IEXPLORE.EXE
940	IEXPLORE.EXE
940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 940	2772	iexplore.exe	28
PID 2772 wrote to memory of 940	2772	iexplore.exe	28
PID 2772 wrote to memory of 940	2772	iexplore.exe	28
PID 2772 wrote to memory of 940	2772	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c70e9ee6301dc941d70ecb5dfb09ec7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb1b9f984bb13210a916573c8e0c7b9

SHA1
2c04cc6e2d14b24d936b2ec6292a21d944a42d30

SHA256
a5d65f16cacb3b1c7ef588382da4ab947a2fa3df01cd6acd22ead9056e4fc522

SHA512
268ceb82538c9a07d63714c22629521089901eb745e28dcc79bd2719c9f8ded0f511f33c25c71ad3ee81daa3a04f841194825008af2c456586499b151396650d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46aacf36c2214106b6fbe1a212f90c7f

SHA1
f5c7afc9a09cab4c3892ea203a485018b90b8918

SHA256
ff272c63cd55595b4c4a8b4669940189c2d4d295cdd30aca857ef4aec525b1d4

SHA512
f4098cfe12afabd3b71184e13c4f70b97b188384c98cf990b26448714057c9f64c7f45d9711923c72a913dacaa25f256c77d7459c5551be910d4d812462b0549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2d659bc617e4fe0826cffc031a35a21

SHA1
cdc0b3e51faa0678260a138ea72af1762a51a850

SHA256
19c0e342352c4f13016cdc9f6d3a6b4f9012bf4fcd97bb57c9cef2ff045b2a15

SHA512
d716013b3a29610849dbb7f06a904a82da64d98b1767a7dd264b2e67b9003fb00c01489268a2ff2f3ae0a65d4e01a4426d519816e152dd028309a466af903308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3d36fb94b0e61c882a8177342c1262f

SHA1
6c2277ea58260018567b7ed397e40242028d1cc0

SHA256
8c9170fcac38591f519e85846b5343c70cba307032014966fb04113ceea26a1d

SHA512
fe8a939dcb1fb9532464d90780539beaaee7be0087631f2f1ea7adcc5b1111e0fed0880ac8f5b675eaff277548b9c1e82a67312e9f9094163951e73f6a311b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b56729b7076a921996eb6ceb273399a3

SHA1
8bc85052b113d80a49874fa4032160194d98f605

SHA256
780a3b65ab16a3b45d25db3720b8a7bd78b8e50d0b95eda1aced1e5c131168a4

SHA512
e262d3a1a7e7806c0b30a11f2cda4622ceaec18a53d3cd4ec8df23d701ab99ab64d95a9f86289fdcae72d0f407a268732c1a7e3d62d12bb5c54f625932ce5376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53676608c620c172245714f0e5de715c

SHA1
8c21ce37063e2710311859388bd9b5e78c713264

SHA256
1cf267fbb9f1bc993d3289ce43a73b36b910e750e4f9da40dd337c0676b03b92

SHA512
98c1e1e777709de7ebf56013a1be2826a0eebbeb971c00a119b727b4e4094586e41c0296ef7e76d2251382b0bb52e52e1a8b98b90663d7f0fa9480caef2e4004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20df617603c9da5c414669bad2b35386

SHA1
858ae59d376e37712314f9a87345a503b46df717

SHA256
21f63bc7f410b97172b236d76b5a864114ab2c3a92ea5fedd42205b77a257418

SHA512
f7065088ca27fd54e7b6166d5439dc41296f77f9c45f62f3d9dc370b0a41cf7910063765d83b4b35aff67d7c0253382875b8eae1a6688382858b9272b4ff2de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279536ca2ca0ce52f7efbb54f5d75871

SHA1
7ea86c73831c66a153acdfe9be56e4d58fc4c118

SHA256
3e781a5fe3e017d0586c94b84bd34bc89a909b353b552cf7ad26b21900e07340

SHA512
0b6455f395c74d4e7250117abd73180fb2c621335ade648d869e2f730b37dcd3b9ddb17670263e5dd4271cac1617390a0c3326633caccb82e9458e14052111d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08a2ec9faf03c16a0f303f7933b1d8df

SHA1
f070caba079cfa535fd8adc730ee553003481b51

SHA256
e51dbf3357630d6ae9ec7de9f0a2eade0a7826e170b84943d4eae956ada7f558

SHA512
470f169725189b029f99af08c5e02b34fc5864ec432965ae182488917ac1bc9da443c7e0ef5dd65a9a5bba5f673959004d7ab91d93dc4ce7aec3b70a61e6fd90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90ff58c7b521cb67ed696060a97636a9

SHA1
206ae33d4d91384af3c96ed8d335efbb27e3074f

SHA256
e9649e2c5ea465734d1e8a19abc7a2b039f354e77bd1ceecb09936bb523e2928

SHA512
7686a00a39b6f6288fa0379e2b9e22ae06ba542b5527714253087142bdcdc2952ddc74047678b9f671c88742ff386f6427c950adb5908e7c2e8f1e5f54ae19d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a66a6daf937b9aa54775a4435d332cb3

SHA1
2473a07077dd9846163bfe27fba4c7ea71fda2b2

SHA256
85100aac3079cbbd21e360d46164f27d4ad8ce508ddc98dbfcee6c7050fadb24

SHA512
0adbfdbff372609a5a7df3a8b976395cd576aa5168ad86b3c05f05d0f35bda5ce048737ec57f135d9b35dd3094f4cd8cf33323664d0312ab1393d46bd25cc878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
363f74796b616cbd947275b4bdb90057

SHA1
e5a56087af9102d209d62b02d25e5e41f5383a98

SHA256
e8548b782890a3ce68e4618b421c770a332a4fae3b911296f8664416a4b6cbd8

SHA512
e38af27bd2a7510d95ced0fd02753e5e1493656a29582314b62423698d3857bdcabacdd5a30cd3610ddcbd21887c1d02c3eed68affbc2d4713aa812219cf58a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96af759499c51bcfa9f296a5eaf59f49

SHA1
4dd36da887e154a1196540f58a06df8cbe23884a

SHA256
d936079becef36ccac65c018ec661f14db88812283c6e17fe997aec954feba3b

SHA512
79e98420ff9036267c936a8e0e4834b74017f81cede1aea63d8f79f2c7bff25eceab27e4e456aee0e252a57d780feeb3a83ac4996571845cd33c95a81624968a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005748b7272fd817557b5adcb005bda4

SHA1
8886cc81ea6974cbd4c30be49eeb39a397b9f090

SHA256
1ce9a5ce5223efd0063880c5c8c6404acd92af667c4da6cb9bc58dc40dbc4270

SHA512
65385ad40c4a87ec1631e05a27972126fb18b7b4f4b42a7dc499a8c019eb2cb743b4080a417b6703d4a480d97f559e41ec8fd186ac4a45891763e2662b58cfb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9720753497bf5e4cae26f4f188bc1b82

SHA1
9fadcc717c7ca4d73c0b9ede6c8642b8d11b9556

SHA256
8b526e5acbbec5522e42b6d8a2a1f486013c00b7eec580941b3813fa29b22633

SHA512
5c173f389d1f1bdbca734d108dc368be62c5ea988c986b16f57a316fd7946cb7cf7e1fd48ef3698f18775026149a3a4c31044c3c8137394f0c2c04e4fab5698a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22726d4dc42568146a155557c3400b45

SHA1
2450102c77b4708c1ca40437def41d8966e206ea

SHA256
ee3a4dfaadf12aff9f8c8dfd0445ea9321805003493a0b3e8cc451efc46f89f0

SHA512
c9e4c2162f29382902b87660a4f311674cde6172b79ab4691c5370871dc82cdbcc80e0f3b1f870a75975a991bd9b8aae9d86543a3a05d15470ff847413be5aea

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD3C.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD60.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit