8c9a5bbd6bd2ad5549269e0987eaed473c8541a865ee1551d83a1db0bd28ce9d

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d4dd1381e768ab1d0d02fc233859682_JaffaCakes118.html
Size

16KB
MD5

3d4dd1381e768ab1d0d02fc233859682
SHA1

3ff6646fdf91be26e7f550889003c57bfc3f1c06
SHA256

8c9a5bbd6bd2ad5549269e0987eaed473c8541a865ee1551d83a1db0bd28ce9d
SHA512

21806ac62ab572eaf9ea64795c622fdbf4552b217bd4700fda0c0f361f817fe4cb79f914f0bdbc58083dfcf1e76c53b85b24db09817ae70d6b3cbcf47983dff3
SSDEEP

192:SIuUxx08KWcWmbvycGJ/bzGRa1WwVIkiY8P9rLN4hfzsEds/YhNjOfsBNkwqY:SIuR89J/B1W+i598BGo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FB324C1-119A-11EF-9001-CA5596DD87F4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000323e3b66535d5825dc5d5417df1f4b8fa1f5a6a80013179730a1e9fa45689ff5000000000e8000000002000020000000800814c69b5eefc0780a8e85718c3d286acdd00037d2fdefa91f4b084335b32890000000e6b55121d1340ca3de8e99ef85cb342e5221a264704791b7303381910ea1666f59ea984b8d3a2633476bf67e44c922dd7cf40e23157dc968b7acd773ca17714b417d84548359c536aa707c3d546ad16b4ad0d04a5ebcb76f717575cca0a6ca0d2443b1b29f633ff8248620620bc5d11759abb241858dcedd705fe28bd2f86bc5db2de4eb4f773f3d87785e3c16674f5f400000009dab5e910816b0a9a7742043ef4d6e033a4a9e542404fc2b996a292ab81969519805f3633dbf949f02f4a6ee3405de1c8d76058979f6c0e06ff9241389cb1058	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d216d9cad4733093214bb29dc89f87fb9ce0edfa8bcafcde24ff9bc408052e27000000000e80000000020000200000000f70f56b1dc673a32eda67f12ad236de87f03d43689a0f13cd88c389ae8943f220000000d6ac2fb99366c76d0c07b4cab774eef422f188ce4208161090bc5625de5010f1400000001f04c60f20814e01646def45ebc4e68057b7e0d9c3b1fa16714fbb54323cea208c3ed6bfc459bf5287b1a150af5f2905b5366f3e1c0b149d98873ef3cdd909b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05d781da7a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421815807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2968	2896	iexplore.exe	28
PID 2896 wrote to memory of 2968	2896	iexplore.exe	28
PID 2896 wrote to memory of 2968	2896	iexplore.exe	28
PID 2896 wrote to memory of 2968	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d4dd1381e768ab1d0d02fc233859682_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c0e7dbaa2ab7327d209d945c2517ddb

SHA1
b7ef9656f856567377392fe7a633b8a2ed6b370f

SHA256
7a71eb9ac940e6cff97c9da843cd3f997d1f7e5ecaecca9e00a4e0e976d001b0

SHA512
3a1e39eb84251cb208e8d9f8722758906c3ac45c9d54960c3ac6cc5a7eaa20196c8f21965e38c8a5901f76e1e6c3602aaa1f0e628a723002de4d6cd4a7ff2166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be8eb14b4769c8e7170e8eb5bd1987d

SHA1
3d8fa75af972601924a60a08b56efa705f7ce5d5

SHA256
e2ded9b592a5a6e18a9a2de2d7f5f774ee27612bdd0f956cdb4580462ada5fe7

SHA512
76165950ae14cd23f1a39d9fc278d632c6fefc002b3d4cc8241d9bd514b593e4716f85f397c887b89a802033c38383811bac4eada3839ae105ad063520d14e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b05e3167bb35a4581bdebb73650d2a

SHA1
2af05f90f4ed4b23a9c13a233d7505b1fe299f21

SHA256
58e7c04dee877dfc66c75e1e0e80e21745cd0593e2dfc7916a99961c40baaafb

SHA512
e6e4806c289430646840d6c4e8ff4aba971840d96a25455bd011773b87ecdf319f32f1789b0659b97db46b98442412e7ba9874bbf6c9cf7762fbf77f0f49bdb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3a44c66e0065afa904dbe9eaa0681b

SHA1
1d12b2c84df0428554fd2b2803cf9ea8ba3e8522

SHA256
eef2f03213caf7c48d4ac3da3746646409d4637709d4b33e5232c521d30303dc

SHA512
9fd644d5fd723db7494e0a6a4adf61291fd2315f0badaa763bf55fce8dfbdf771c61f9181c97052560430e0263ccf306726eec822959b74feeb4f1e1bafa6b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
779aee342f12dc007b14796800200264

SHA1
afc30bfa08144777cb2c63c465efa0d0b4799d7d

SHA256
799284225c5c16c397167625cccdb67b188813f097a46a2e2f5caf01758ad1ca

SHA512
931930c26c83dce15db702af5e58c1eb4f8177449a234273ff86da5520dc0b9bcb09cd472a365fbce49e2d5b64d8882b26417809bdded08dcf83941d2bd203c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77158ec52ca3ac399bc067cc4c916c00

SHA1
3e51d400b87aae90edb9f6a406bfc0302c6c60f3

SHA256
fd692de68b68217b6b23bc7e6654361f3e38cb94eec43c1fc44517544ff29422

SHA512
bd6f5544f4ae06ae031b2bdc84d208869d1f666a536238ff153685e2054ee1e5a1685749766f2eb6345dfb75b8d0aeaf423a95f1cdcdf521150521ff8aa11d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b9b1cab60c8b6c87d8e0ff8f39934ac

SHA1
df11a45d84fe6a66377b7420caf7371cbe82910e

SHA256
8df4522aafe3cb0f876065db59c96c4b46240be96684bb5f0c31cd4d185168d4

SHA512
229aa1b59ee6f2b9a517a058db5d0cd435b4d7e1e06dbfb49e055e870baa3ff1629a25019d64fd5cca5a6790ea523b167d7012a82ad1c77ec751e89431c64f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6dbe07ce32757b19513f0f560d0d2d4

SHA1
555f50edf6f1a8efd9508064da10ed34243b4e2c

SHA256
bea138afb97aeab22e1ace7307e3eec59680b5160a57e355597eecc4e4e99516

SHA512
932d8a3dd85a16fef6a33c4c15f9ea915e378c27ef91440bd9dace638233ee64ec56f29f5a346ad329fb22489e4652af984b950901bd4b8cf8c931a5b0a99e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ba1a594af7f529fecd683e1d0423ba7

SHA1
730f85722f4a5c504645966d9e8480fb5fdb7bd5

SHA256
848f260e11b1f406451f9242d4aaf192e46050ad6f7b7f87dca9cc548afe53d0

SHA512
414a8036da2ccc0cdaa02d21f162aed7b62b2786eb16c48829ca624c6ee0b0a7b0eafca7ad1741a87b2efb413c06543811a6129f851adfbdfd510b2854eecbe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74d6936417afffe16af7cf81cca4537d

SHA1
6d3dde90a9803bf23d96bfd820c685c866b42e3f

SHA256
033e954155150815bad1b20a66ef81513c4e9d8598cfa851fbb4367cab410210

SHA512
b5553512d120140358fa7ce3f870db07aadb38a35e8fb43b2e43bbabfe41e5aeffbe0e6652d24e09dc61ad03702390a84e99265f6724baf7bf639e761d27be15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b7d2f97418eb9acf27607bff6b7913

SHA1
2af7df8a2fec83295d42cd5990aaae4846263363

SHA256
02ba5b22ad621c4d340154fd79e13caf5a716318c2f757e8e1d3335839508091

SHA512
52807419f321c06706798a7ffc21505bd06c477f2755746c8fe637762f33501fe9767cb4bf09fc1eaa206b39ec66e5e116fc805078dde58cbb9cb9842c1ed479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d479d0c55034dd82fa47cfd67aee5553

SHA1
fa3e6768ed74a4aa6453d6a8f77ba07eac9e5332

SHA256
9945fadeb9e942f9c4887afa0e84cef9f991aff1ae829a15f45c480ee25c3189

SHA512
7e17f653c13b8ec178d2921ba2159ac8045476acc055507e1e8d0f5ce53b93705f0146e7815ae1cc8d8724c7dfe16f0f2c7732faddc2472904fa27e7128be14e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bcbca6e1859b98ab8fdfb9d8aaf1c53

SHA1
57b154a1f35eef2fd3aa4e1349edd0f2de53d28e

SHA256
70c34115a643780ef8fdee98b6751837efad1f40f67ed360d38874e8757bdf8d

SHA512
cb65636e810a8dc96d3289b95bbc35d890322ce1caaf4a02daf53527f41cdae5d452afc87422ffd9f83e1f4d42253b13b18be942738728b16ec35bfce00c5683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba029e8199e45f324ac5715a119916f3

SHA1
5ba5c147ef278e9b52b782c1fb6679a8d2a9d865

SHA256
60f799281479ab7b416d14d448dc7dc014e2b9fa7c522a9484b981dcf24bb687

SHA512
12de5f70754f1811a28c417e8954a62559c728f9b123efe07d931c46cad11af2cb1f73cd2b717d146f2d232e981019e01ba9cef36c4b6c50748c9275a4ecb300

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDAA8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB8A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit