3f2fc4b8e899fa4ae4ccaf69e0c90afb93781dd551a4eaeb46901e06af03e6f4

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40e37b79a622153a857d383f0d869807_JaffaCakes118.html
Size

23KB
MD5

40e37b79a622153a857d383f0d869807
SHA1

7b3354ce85dbf9c05068d8f9ca3c71215f1633ae
SHA256

3f2fc4b8e899fa4ae4ccaf69e0c90afb93781dd551a4eaeb46901e06af03e6f4
SHA512

3daa627405884c446cf7c5dad192cd617659ecf1be985ea27a3fe057e5fbbde8191b70f0f0eab7e45483812fe638e986048b550ab83a2da2f85b7bbd70aa31cd
SSDEEP

192:uwnQb5n0WnQjxn5Q/jnQie6Nn0nQOkEntZRnQTbnJnQtBXgvMBaqnYnQ7tnqYk+E:1Q/630Ya

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000af9a56d315d6772039acb95a9fbff02bb90fae954dce57c5195a290544e9eba1000000000e8000000002000020000000938d93571cef759aa36485a801811790e0474d9801b9a2ce14a919f7d0bec99c90000000e863743e09258edcb0c65a8bff4610e98b0ae70e3c410453c3b7202cf21bef10ca84ff89b71e2659a06cc7e9c03cbde43e4b4bb73dc1233f72749120b5261e917d6c91afa8ec6fcac86fbc2d142ab7af885c5df2bd414f7ffd19fb4a67f5e763d2cb1be580f34d9b60ff88e725bd862b52e457753fcc5063db1600b54f2c8940a9071a9a63af2606b80b29d5a2e6a60740000000edb787fa840c046531047d60fe3a55d6aae97acfb31fffef56aece3c5ebb9aad978a7229c4f372f05d0852dcb28e4e99f3c8011bb396df456e417797c5bdb0fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421837962"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5A520E1-11CD-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000d45c732bdc7c42fa5ee68ec22c046c39078c0f55959251d39bf4b916f110712c000000000e8000000002000020000000d29d9b79c6f205dc14ab0d3629ee3ccf50b756f33d57f4fba41968fa44a30499200000008cc94c8625283072aa68b0be4a8237f8b84ef3b1f32246e8739c3d9cf4ef42f34000000005611c135bc8582e04ff25f06b256cdf8adaeb3d81ae4cbe7bbc8e916f2fd1ba2c5d77f4447dce3e223d3da3df75c984fbba8957e785133ef7be0cb0403f775d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09c499adaa5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1964	3016	iexplore.exe	28
PID 3016 wrote to memory of 1964	3016	iexplore.exe	28
PID 3016 wrote to memory of 1964	3016	iexplore.exe	28
PID 3016 wrote to memory of 1964	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40e37b79a622153a857d383f0d869807_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9b79054b1a314d3e3d1eb4214101a2

SHA1
ef18e3358b50aa885b06f85359349ca0c0a31c20

SHA256
312226d87ce0ad705f8bd1ee13504d0521c5f7a639e49a996a631904b17daa69

SHA512
ae23842f0f0df704d88a0a1463d813eeb38117163efef1e81806d5bb761c8d3e3e80c0c31909cdac1ba0cd7257895a8c468195afac0becb534c85f508792ff55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4be0a8176cd7db9ec3791defc9a4e8c

SHA1
f5860b63e7167f70f20e25012673567b877df6fa

SHA256
9dfd003560fe4d042c82ed2f3e6605c9d8ac8e5dd420ee98461f000f81f7ad73

SHA512
612bd0a3bbb936c5449c90100cb852d5bba077e8a43b43d4dc6fb77defd349af08cb52e7c4b0b674d0d310e190be57f31d73f0f6ef41c119a319b57ab32a551a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c04c2b61519b1c703f2696005b77c161

SHA1
79bca871db41eafea45fe9abc4c824c3c85e091d

SHA256
2ba95137fd92f768d5872adb802c8114dc87eaa39855e1ea11a2504b9d29d2df

SHA512
fd44939e9163bfb158dd43301f0b1778f5de30984973ade38106f6ee30d3251ea0d864e5a497d5b1714742a90942e736bdbc409976e756c49e9d1f1ae594b20c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9dff4d8a978326050685ee5d97d7c13

SHA1
a858d952e942598420bcecf1756f329b9e606ea6

SHA256
5c32a52251b24340df6ef413f773df094a58242e1c3ed9c53e53b202cd03576f

SHA512
2c25c28c2faff0617a07ad598f3818650e4e3fcb211f03c87c10515f198ff2955aee74302fef375037a3cce741ada2a05159d64e277354930bdf9e7a6594b868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50667ad62ab2bfcdfc1592d57ddf6bab

SHA1
4818410a07c85e4d3edf090d2d013b6c171ef10b

SHA256
bef6fef662539ac075fe4bb3b3689065f462d61cbd040f9ae282be0f088a9d8c

SHA512
2ec5d39fadc5f9168757592e73e3f4e77c63d6e8cd1e5280f9e109efab3ac5c66f92d17cf6a1a1d3e8ad5b25ab0816d7f0c8f5694f7a31662c58f37c3bedfc2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb1162aed16190199c733a8c23da256

SHA1
055904bec96230d057eacf8bab6be07c4b638745

SHA256
ef78e875367a30ef4c541e644a22da04c20b24179b6029e9e35b341663f5b495

SHA512
2d8d21102206c408271200a0f0b97590a3ea423c5c5690fe5b4714b0912ea19a249f6882bf11133308f78219fd3caa3624b64c4d2bbbacfc7de675bf05119899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05567f1e19224ffdf1beaf9a1b690135

SHA1
32140ffc9d50e8e47f77b5e0dc3510a34fdc2b48

SHA256
94d72bb55ce12c68e85c5b3590d4745abb10b4853845c74a6b11af7869995bc7

SHA512
b7120dfa58413417f57543e7f6c126466a854b7a3d6241277887a37e31bd32b8bbbc80431a02e14700b1e4f597161c50cb968be443d4fb5f3fc5272dbb5d7ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b83282f08daa9fa3528c1b595d79d25d

SHA1
d43d70571c84a04bb2ffd3b49dcb2f57acfa0367

SHA256
1412698ca54329e5576b0998ebc5a31bddbcef90bd56980ef084606a1637d5d8

SHA512
a1287adc9e74ec6d5f695a8a8acbf66c4e06a1fd1ebc5d4c7f535381cf7db5e077c25817a6c0b57e18390319ced1cbcfd6b067fc8c94957b43a9673390a2744a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3662a5099c24204bc4f6c8e13d0dd96d

SHA1
d7146a6b30ffd5c8ec096a326ca077ddd97dfb27

SHA256
e192c29a1273abc084d01944af36009dc03573906959c154f8ed2ab3b1630dbe

SHA512
fb10b6e08e738353f87268844c70a370cf2a14d35e5c48cc3ab6db7d37cf6a4cb73a1b63cdf120245ea840c8d0ad881974d51f5ba3174c939df20655f74fde14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc9eb5060e06d60e206d9dab72f4f950

SHA1
65a36e2831b008678673feed3f8d5f1ec13a01d9

SHA256
6d476a583b2b16e5e18bcdb1424f102e638d7dcfbec5afeeac15b74ce99583d5

SHA512
d1fb94b8fa7808c27e5fadc6d91a7c970c321375f86462e1f117386eac0f6c863152f716e0b56fe3bf0ffb1852e2a94759c518bed11e38a420d3daf9c63fb3d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6999b790561f03c990a1aeb5e62ff7fe

SHA1
c5f84131365e4cbab85d673c4e15a41a11cfd83d

SHA256
1c4acadf1b836fef74226ec877b187ac71a05cefee6687a489ddfa1b13705ca0

SHA512
751750c381053a0ee4a7d3df191120574d3f6c915e61597068b0cf08e54ca4010e5553a41a0eba2bde94de6a9410819ef1920306f9f6e913aba6cdb9ef807ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c9a1717092ee9e416d1c6c8451637e

SHA1
4dbd585d6ea8f23c3fb13c6cc2237c6596e4735c

SHA256
bfed0562c468750a5cdfa7645b232c89ddf4528fe92c900a5aa3e3661cb0fb40

SHA512
f1d98152ca48064ae9cc903f7ff126fdc12530d954518d8f32076e314321f338c9a91c10e019b7d8b8776b9b2a724792875ba26367530c78fd2578438d9857fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8814bbc1277e945dbc535980165034a

SHA1
ffc776531ba80a3a4fcefc2eacfc7e31d5c3c0f2

SHA256
9b5a8455e1d2ab92b87ce87164f0ad71365de36345ff8f4014e50fefee77d01f

SHA512
921e70efe99bbddbd452c7cde6dc3f015046cf7774bdf0a1681e840fde3a715509ec47037390153856b2dad86cd15ac73598b9bbea86f4104fcbbf6c8fff9aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3640.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36A0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit