61edd883c28e6060aa2508024f26c3616e3393c2f8b65af67d55d012cc942072

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

422821afe18fc765fdd74094bc44201a_JaffaCakes118.html
Size

220KB
MD5

422821afe18fc765fdd74094bc44201a
SHA1

46cee7696cabc9c2df0dd5f4661a44acf0416980
SHA256

61edd883c28e6060aa2508024f26c3616e3393c2f8b65af67d55d012cc942072
SHA512

7b4fa09bee2f543e15dab18d96005d5da990f8a99e8ea26ed3b2f97383b155759baa0cd38c1bc537713745d00609dde73e0d9ebf498f6e9ca0b7f15bec0bd58e
SSDEEP

3072:SUBdKlDcyoZoyfkMY+BES09JXAnyrZalI+YQ:SUIKnsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{952E0D01-120E-11EF-B781-461900256DFE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421865799"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2556	3012	iexplore.exe	28
PID 3012 wrote to memory of 2556	3012	iexplore.exe	28
PID 3012 wrote to memory of 2556	3012	iexplore.exe	28
PID 3012 wrote to memory of 2556	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\422821afe18fc765fdd74094bc44201a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a69efe67362637d4676983a38cb046d7

SHA1
3a6fae8456468729a787663836792a0d1ae54283

SHA256
a136df78d202eea5397369398ea9f2069d9323eb0b43de68b8ad5d488fa2f0b2

SHA512
e9efc299625527812ad50cb150edc90de8f2f3447ebf8224052cfb86519613650ec62ea4b85f3689ca21d64b30b31df27f429aca76ee3ae06dbccb615a67d20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd1799ce9c817c91681fb4c705957ffc

SHA1
bce1c12be3290e1925ca655d49cc113c8a0794c5

SHA256
3a9ca553995b37390130c087fb0ac975a37346825fae221f3324987f9ad7186c

SHA512
e71e9ce34c2b6b0cbe56229d22ee45b1403c8cd86ab5f2c8e74929ff83a2c640d89b58893f411f1f76202ede1a89c7f8a3258faf2aa143201e10e8e588e0912a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de303081a34a5b693c86cdcf44a9c153

SHA1
8ecf4b110836f03e71c956767efd0661799edfe9

SHA256
71b1b48f4687ccaf6566348bbda18098f961c862a77ac282ca571a696bd17e7b

SHA512
4d78a7fce727a211e02b7b9a5ac060c6da92ff5fb080491911a0e801f3701305657bbdb3e6a78bbed8909f0b18926a5e17f06ceecd445ff54e1eb743784a60de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1007d927d59f4adb0c0f1acbfd75b5c2

SHA1
d379a520b7db1658e9d286c48eee25d5222d6d08

SHA256
137bd3a78ed30060f9eccebb5233ca3e9f3b8a697b4e2c922fecf33835a270e3

SHA512
cd0b394bad308b9d5b03f556dfa84624ebe3d70b39af2755882d36d985a09a9b4f4dccdd283c0606db6390be99900a5a0dee1839a7a098b878aeaa099179b282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f01e3bfa852b37ab73d22388a4d5f769

SHA1
1573e52bae56aacfbc1077e92a02e429f8fec471

SHA256
e01461564f76fc20cb23de7daeda6c1b8ffb8fe1b254867ab931faa175e57c23

SHA512
eeb157d4e6155b4a5b65f55a647dc31f72646cde4fdd400666dd1236bb590d35a5803875c617aabb4d5b7e7cf29c4af9a50ebaf90c6f4f9614fb37dcc3cd7ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e7ea21204a7f74bd62b89a91af0bc0

SHA1
01f495e30d9c2cc25799b032bce13834203849c9

SHA256
1fd7cbdfe36ab273fcbd9cfa47aa8958ee0af138b89fce4d919d30e57aa7e298

SHA512
163b06599b5fbe471d1c1ee6e4a57a05aa26ea53eecac1fdfb917b0225c5a87f15091ed2dcce2b1c2fd54aca9391b5e9ce83a415ca2e265905574f4fbc7b081d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c7a5be3e613c02217753a6a8703a544

SHA1
f5c1be8de28497e744a4c60d2afbbe5db5675734

SHA256
0fe3e9260e32b95f6917dbcb499d46e7b483598e3ae561ac1bf8905453a06131

SHA512
643cbe5ffef94689e22c4e9413721adb1a3dfab64eb5521802fa08d58bb6b9757f380918bde1e0f6af2d80fcb84ec70938fe56b662fe9aa1ae9407bdb6eaf0c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3afa33c4a6ba3ebaccbd76dceb6adb6a

SHA1
a85c8eb00c09ce5a090c88feaaf4df565998a64f

SHA256
c0ab99265eb2952c22c3366191ffa4294106b03d1a4e87cb622adf6b964d88d8

SHA512
9dee7763148333e1ca211f046385e8307f8ea227ade33c08682dc422d34019099dbe764b1aca1a81bc4e826ff41529faebc0b127613804f223b4e24a516d022d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e95a04fdd196d65980176b3fee5f3b9

SHA1
5a2405a613b3b428b10341b0d98f0fdc60cced5b

SHA256
de4fda5b132865dd28369aa48217fb3defd6980d60ab566e9f81d5a999fb79a2

SHA512
2c303298d3b5257e0b106f105cc1232e0fea226fe7f745b54c130a1a674a194ccab10e01323b3a41c991ec8f25931299c024075615c4f367a8fcda77e7c9eca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7679616932e9d3b94cfdd31c39df372e

SHA1
b720e11bf5a468e247d5683e02cf5d29ff58ad7f

SHA256
c5e184d8b8c72657ffc27554a95deb3583dcd3498a9102e7d5df53ff4ceb4799

SHA512
c5653d91a3d7097d6416553814b6e6509872c73198042832bc617aff91e5ef51841c6f0380282095a983df86a3f1e62d6921bac5ce7a0be94241568e7445f4ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f95649936d9451721a8652e22b26ac6

SHA1
b864688090742ba8266d29165c8ac3eef90d62fa

SHA256
5236b1e7d6a8abca7fd1d719841c7a00e4e59b469c01beec07418f08bbebdcb8

SHA512
0ee70751a20a07543fed39a36df76cfe997c55597afb1e385228a29f7891f44783e5aac952e518dbef8b0886794a7d55fb66be28cef888ae487c94de3670c913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6690532b55f46f4d3c668e9a94a175ec

SHA1
adf5cddd61e22df6c8355f14ba329cda2a73e74b

SHA256
31a7391db525133f5042f046776de3210b30d00b426b494a5de0257599e8d1f8

SHA512
f7131c5a588f41ed7a4e79069fb4e80d766a1945b2d0b33a4c91ed7dfc4f091b03a0cbaeb9981ff24628a12d8508fafce040d515b749feff33c3e45cd607410a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1685da5122c4eb4b2cdc4a930c5bee2

SHA1
6e72296dae01c082c994679ada7a2487e2d0d74b

SHA256
0f91c03d368aec13f588f60aed53dcb080d22971aef465c984a010b9b42804c1

SHA512
071619ad5899fe8432523d48ca70854f5ffea1396d9af7c2a38b540bb2f3dcff363bd185979c168267c501a66f35c22d025a0e294bfb6c6f20a9cbc269aa6e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
608d14bbc66ca02991243789e9eef4f0

SHA1
8b655d7eb48512f6fc9ab278869a2b736c6c80a9

SHA256
656ca5ba43fbcf63272032f56874d0be2a0584aac1221acbbb51722a605ada61

SHA512
1dd18ad404d3078b5fb3b77317477ae77e56bf213db3e7f516191b3d3da2789c1481a7424ea61aa2505bb7f8943b2ded0dd1809e11b75f8222738239e0f5601c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
facf87512c872718ea110fe941cce403

SHA1
58c5f4c785e1b79ee282c47872d6af5dac26dbfb

SHA256
92b755233a3cf9befcb63cb5a436f041ae842e9bd41e1306be3e268129b50459

SHA512
63102ddfd96d8b4cddf48226c89a98d4550b6020b8b3e22710afca13519145139e0d5760d9c0de472eabf41d34d42390bb274f73fa96fe219c73c70c7c6fccca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e069189ea5d9f7c0fdb416b8ed9e134f

SHA1
4d159748e195f725c425743c863fd090cc0ccbad

SHA256
c53f1321c6f70ae907ad21c6fa3df0a29aafdc83e5d591e9ae9cb211d358d19d

SHA512
b179d9890684bf947cdca6a450f48e1bf045283f18f718cc1a409ba0d53b098cfce5c1e4f6dfd10757b90c090a8a427ef5f6c534b17d8fbb639cab1f6e47e61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e6aa61aa5752b4f166a8b3f7e5c1948

SHA1
44f5bba290f60730184cc7cf70e2a859f18666cf

SHA256
260f4d4a5ba1659e0ab48177c06612f2f83e0affad3db13f65efe72028973752

SHA512
b0ed3b14cfdd2f5fb8a9c89adeee0ebd2c50cb5bebe458affe2ca55f79524b0025304cd2677975c77e455f834991bb6c9174549671a5b1d3e50df18a219547ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75677414f390da8a35a1ec163b17184b

SHA1
1dbbac63b0f3fa08d6eeedb5e2afac43eb27aab3

SHA256
6b4ae8f983200069f76a3c7aa9fed0c8996b838079831f3ce6cc9ba04406ed97

SHA512
93c28d16694b2a80007e94712acf5ec055f6de8581a8b3384c30b6e8ac1d57827c453269f79a59ae8efabbac1628395663461ba50149e9d07d0d11ce603c49f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0ba87f888530f05b3e0ebc98efdc60

SHA1
800485597e7792e3c42a0b5bfca3cf8eefcbbc6b

SHA256
c0244a3d7a95201b1a0d97a0c7ec48c5c0463a73930d0bf365fd18270004a29e

SHA512
391cf50a11411f11625eb859e7d43502efcaa6662be09a58042719c6d8eb933089c5b5802fe23045bf1c59fcb6c7fe8ecdc94b22e8c3a7525253b58972440c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab126A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12DA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit