77a5f69dbba2c462bd0b87f329af805a79b12e3bf33d38098487ee0e6139cc78

Analysis

max time kernel
138s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dcf9011a7d2b986713d769bdd0392c7_JaffaCakes118.html
Size

34KB
MD5

3dcf9011a7d2b986713d769bdd0392c7
SHA1

295b358db4396e5a798e1bd88f64a17c3bfca017
SHA256

77a5f69dbba2c462bd0b87f329af805a79b12e3bf33d38098487ee0e6139cc78
SHA512

4d7b418226fdac8116e1ef56be2dcbae5d3dcdf7f298a6abe893a5d90510ed0eaf1292f5808dc5011618d3d6eaae6793d03a2253e40d3839e4c0b91f6e3941bd
SSDEEP

192:uwbrb5nFSnQjxn5Q/UnQienNn6nQOkEntk2nQTbnlnQOgucwqY7cwqY3cwqYQ/xF:TQ/36fx5/xhYVHgeynNj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{608430B1-11A6-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e03b2609766d1fd8670d69fa658bcace2f5b27d650290d63ea026b9c60717c8d000000000e80000000020000200000006d7feadde03f11745b207c94d54ad5c869388bf04b84b2205f455d95bb505ca9200000009ad418cf285549bda36b85c76af996a632407376da55a316d92cd58e930f3d5540000000fdfcefbf81b5ad93c4c43662949a119f4924345f8e31efdd6a3ac32461017e5ce4388b34ba7ce5c505e32614ecc5208b1c82022d9361efb70184ee17406a2460	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421821047"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fb865f9056d49f017d88ee7b5d3392228607afa9b8db9770d9150a3802bd47b3000000000e800000000200002000000064299068a4e33b20b70dacd3b0231ffb75442cac97bde88c159fea3abaf6467390000000f827793244d028796d951b18fab206009598929f868cca629451ac4457cb92a8873fee987ac8ac4b2f150e8705fe5e3e9dac3877888fa77f9f8ce562ee14b64fb461ef22a40497b63b6963a60d5c56edcb2aabcdd434883da9146077fe18fe055839398b0081fc7cd760f94ef5b735154f195c80dbc2639fb89adcd008628b4fa4d5e41340a6a1002f364019aa2b8851400000003fb0299362a00fe90a2452308aeeaaa6e7bf574c63f65fba6cdcd1f8d024671243c101faf3ba5a2d8f60b9fdef9e298bccb68cd93aaf4fc2084f439f84b68aca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a83735b3a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28
PID 2440 wrote to memory of 2712	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dcf9011a7d2b986713d769bdd0392c7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505094e0cfb6db7a290d1bf70084091c

SHA1
7d840fe1d66c7de2ccbcdaed7ad6e95769943e8d

SHA256
04a09be2893c908a75ac5808b99a855eeec59c293833e87b48f6588aa56c1204

SHA512
fd2fbb0c85bd1abbc27de532ba361c900a8e6a71975e73c090711d0861890e49ad00bf5b41889a63dd1fd980a4991b542f8495b69e85ad64eeb3077449fb9b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8155d82e585608f3eb5517a19e5b9b11

SHA1
d5a1de33631b4f2b9f84adaabc334b609f3b327a

SHA256
a4e2892330d7b5eccbfebb0b5f4f44bb8e87e40d9df313cd374ae4ee3616b8a4

SHA512
417ec04273fb47ca5d39234eb9b87253b0c91eed40cbbba3df12088af4b03138bc4be145ab2950bb0f9c72ed8555453d71a212858efbde87d9a9edc1f230235a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7be9e0c408952a07a2c2dd9bdafaf8d

SHA1
227d8787f4eb8135946bed994ef98675e1d15a5e

SHA256
f0728f1c7446069c1290466a79dcbd38726b57063536f458ff83ea347d2e2818

SHA512
c6c5cb37226daa413bd607063bfd0e92ed0d73cb7d3b6927ed30ab5345bca1f680a57a6f45fdffed1787cdca75c885593524e61629c52e6b5ad067d085ebdc76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d5a8f4eaae149345af0767d8ad4ba48

SHA1
501558a7189509b6b3fbbaa37768a03cad9cacb9

SHA256
67de1006f6603321c68137f40f71869a648b93f11a754962054ff710eb4de83e

SHA512
ec3fe7f5760bd90dea2b12e0bd97dfa5be4319dcffc4cf3594449f12ae49444985da1c2d83a1d4b672143d094ffc2e39e2ca2229000f8433d72675d02cbf58db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32c2e2f183b73952fb87bdbef7b825da

SHA1
869ee7703d2662969a43de82310172be8d498fcc

SHA256
df56cc8dd95ff71d32cb91005491c29661836c06b35fad69d9bba688073fdaa0

SHA512
8b94b32a884cc7c76834b460ad5451d00d2b1804bd7f02e1b615541544a3e922c0c98de1bd0d167fd62047118890a03811b5c23c6a562d97c50cf8b128266843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02a5cfd84509c630ed008a22fd91b2f1

SHA1
e7c2bf32e95ae8f3246cc1e3609da06a94caae58

SHA256
fd4ec2fffa3534a044a5a28d89a21c6671ec66248f9c0cd06a63d1aa13f858ae

SHA512
876eebfdd71c8fdec5b092e9b68bb0d10d2e90c0f9b60e0d3a17af5d20a29bb706358ee75c22d8c118fea15c9bd5a1cdede54637a66d030fff65d3951f29163e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9a507f9fc26e25373dcec341d3e3d0c

SHA1
0e9fcb806bdc88820525880bac619b8db1420d30

SHA256
12c12214028dd21170f2177fa879f5adc164cafa75ba7fef7e63b0d3769c75a3

SHA512
53cbd2caf3dc393a348ada06a163719a87d88ad70ef2e32fb6f066339bdf00c3eeb766b4d3816fc8ba4c47e78436995e18f2d8488dc7a4a150da763038579e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
623c1c5502a8c9e7bc7f1bde7e319f70

SHA1
f5166e4680a9390ae4d2ec287ad45dae94456d47

SHA256
66605078c311521aaa7e61b96f29dd8343b12c83b3e63756ae079c1078230ed7

SHA512
36620d16fdfd0c9a4ca4ee1faa6dd7b3670ee717400f4e8b92bd24db4bf408311c3c28145223a958be35a10b91b467dabed2c20ad3ae9b7c1b11451640002c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1c95dbeb595cd14bacd7a5a9fadcec4

SHA1
e2a8bc360b9411746b582eb06257fc0ba41c0df8

SHA256
ab89235bb5625ad0e6c27fa81ce0f0a642288bc035971bb7a53fc04684adb535

SHA512
d974a17ca20ed00f9a4f799a89781d037fc702c497bde6c7d8a2c7f38f758fe169eed62ef52bf1dd6abec014d705f73cba0ac36d9b14b9ecb3883f23ef30356c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24E2.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2542.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit