a6401884efb67a9a3e3036176c85a9c77c78983f3858203c7a514b12009fbe7b

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46e61627b4dfb186f002bd444c39c8c1_JaffaCakes118.html
Size

68KB
MD5

46e61627b4dfb186f002bd444c39c8c1
SHA1

1097fa2218f4f674bd96d2231edfebe1868a5aa1
SHA256

a6401884efb67a9a3e3036176c85a9c77c78983f3858203c7a514b12009fbe7b
SHA512

ec7a360cfc9a12cf2933642a692d564739996458922c5e463a0aadff3f48d05049fb8d11dac4eaa1ac8ec7fdf9d526454270656ac6b39aea2b9be9bce73d65f1
SSDEEP

768:Ji/gcMiR3sI2PDDnX0g6Jsgjj+ruoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JRtgj+rfTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0219d54e0a6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FCD86F1-12D3-11EF-8456-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421950375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017a73b9d77dfb641ac09651b24410fb2000000000200000000001066000000010000200000002c3881b85344d9f300a7fbbc0d816e5ad6c13407a8a0a7d082b9b5f87505f21e000000000e8000000002000020000000dbd086635f7e9b0ad23335ce1b8c052893ac4c904d4eb3df60091098744461362000000002ee2e2e21cb65f3b334886bebf6e8a69c99d4063669d657357ac881ea1af6a440000000f481ad206bed1290ab6b88f409cf1aac9ddefb4ef5c139b1a8bd8e0a5aa9aa82d743326b6effe3ddd7e204da217cc3020aa395c6b3f3fc2105e083c426c6e895	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000017a73b9d77dfb641ac09651b24410fb2000000000200000000001066000000010000200000000aef48cbd6b51cb09157cfbff690408e8ff0e2e88638a2b4254527cc18089b8f000000000e8000000002000020000000946a92429c1488da4e57d3a828759912c8f5d716f9799bfbb2e638a971ae829e900000008a7a68cdcdab6d0f197e725c947360b56edf5b5c928d1f127c7082f4044021b90accd958fcfa9eb70e3d96b61565a8afe014d4702e969d173ded6fc04b2b096ddc14953524f0373e3d691ed8c9f6f2d8b74e4822a894f472421aabf19a107522c81364da841fef3961c36b2f37ec0eb14bcf6c943719cc35dfaa3648d34d9bb9ea276779ed7d418f606a0fa2f3291e854000000003339b33cf7fe4a1f75ce919540524f2bef605e971e28b65ddd72434c30c1912f9eeafe067be3dfc634d5c8ebaf75261eabe31bf74d785f633bdc0144fad8684	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2380	2204	iexplore.exe	28
PID 2204 wrote to memory of 2380	2204	iexplore.exe	28
PID 2204 wrote to memory of 2380	2204	iexplore.exe	28
PID 2204 wrote to memory of 2380	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46e61627b4dfb186f002bd444c39c8c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
50c308a7ba8ed8d2ca23cde142b51085

SHA1
507f9c38e85fedf3ab9149f6838ddc4c94248644

SHA256
1f559983f320f06ac1969c0c5deba2a354199e14eed158d86cd043e32103bc05

SHA512
01458a1da0e897a451b6228de437986c205edd49ed288dc2148662bba5fba756d59c2a1d9c9dc81bafaef98d9f554ef10f4fdb4b6455696f5f203a234940962f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0e9f4d088bf6c4d4dca494bbe81d5d

SHA1
7af42dee7e986b6d4d9a78fd87d6507ad1d7a85c

SHA256
769258e85f42ee56512055cc3a1b1e0603f203839d679c039130992bc908d896

SHA512
f8c0259992484df4b13e0801bee6d65713a78da303534ee89ae9ab05d6a8ad7e66d648e30035e769819263dbca1c9ce3432c9e421f37e8c82a01bc5206dda9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f74a8e4d6fae7b7e098bfeeac1d6fa5

SHA1
8bbd5812ce135aeb309562ae9741b300f9772bd2

SHA256
1d0b74ab5902e47725d763cb7550a1b282b19cdf68f8168f659b36696d9d3ae9

SHA512
c4cc06d88aa44796587bff259924f9ca8c41c57a00512af774b098521537ff28d7d82c179623eaa5a59c856348994adbc75148932df2e78a35617c29d2279787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3902fc759757ce3518a30caceda39143

SHA1
b633e5abcfbd23b71115d746e97d62e6713082af

SHA256
46f21e955eb1f0bf316fa6c262d745ebea9aa73b6fac6c3e525fe252c5d79c21

SHA512
780e8cecfb2185fe8922f64c9735b2f5391a52ffc59a48cb4c4bbac0a8073aa672fbcb90df9042e52e3403b625470718e4f0d5eaea1e07a7efe48bff9b3bfdf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06238cefd1d6b06e5133f6faadf97570

SHA1
6df3bb799e740fe2f7e55abd2c2c3d6ea0790f7b

SHA256
d8f8a9cbac94566c2da93038aadc0e3edfc0cdbfc70bb62e49e8c58539e1d4b9

SHA512
41c315651a30f85f0ca0a5eeaff4f56fbc2d17c5905d1b27792392f83daf9fc9a8c738eeb6cef68a2590fa4424989c59b47064822cb9d4493f50a60c7568a409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2096afd8264c33670b3037dd8f286a63

SHA1
05d10fb2f0ed17eac20eabb46f759502fdbd7b66

SHA256
d74bae44aa2d395c195343043eaf874049b0ff0a710996fe71975ea4eb9e2297

SHA512
57e6f9d6fd37730d8e6a5a0902d2cdae325cd976db20b6d6d416ae297244f2b4756bc758a78d42bad1fee5440b3b2d8b51cd2f20acda206a08c02f4bc2d2de40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7bb704b9c894170c69b9be708de3d1a

SHA1
837413763249a563234a49b40c2b29bad894e809

SHA256
b4c7b7fdc4c264c5cb807c36ffdd304429666004fe5c069b37c1fd9075f4ca2a

SHA512
5119a5d5bd4d0b96e0d9876b6d35f5f530b234f3c3eb12f88e77a9a5221d8e787a0b3897dad74c753daa807b8722da495858eba9a0cb8fed1f687090393201ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c5fb8117e198e2ec632b265ce41756

SHA1
2dd3d48e2e3fa844dc010b36162294f1ff41431a

SHA256
bd9ffb737dc6092d8c4098bfe94fa08a18b56d51b447dcb971ab8779534a5937

SHA512
09277cdcdb4f402f901723e1ea0555f699fc314a764022340a1141f72aaadf811002c49023cd9340bc2e44cd1278f5621740a78352bdd3220eabc82c899ad854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28672ee8d1f3dfb8002625bddbc394e6

SHA1
1d620339b35e1664860ff0d276dc22c8718d7a67

SHA256
f0fef927b6d43908c431e40af213ea774cb2ff6c016eabee4615a375542ec1e0

SHA512
45873ccb1634eb607d91c028005e60f69d3a83f3c84276632029a7d40d0761d393f94a6c110fd782d449ad562467ec7a14d6a9925a3a2cce45bbb7926eff0e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95fc0e124192f4d0bea946fa6fc4a709

SHA1
f6a83b760dbf616fe641de77d4dd815096218c00

SHA256
82ddefb03ae075edf51ef2c80e1361c76586e043cb3ad8a8d7816957aa67e021

SHA512
cb309c89c127d4c27c7bf3f7e44b82e601f65226377dda639da58bd43735a0f44d9fe66ec876661fbe861948be6d59c3804ff6bfb11d6e073d6ceef16d7d3851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbdf4e460e27f329cd3e0c678303cbe8

SHA1
fac1a8ed7f80a0aff31ce8e06a14102c07f5f599

SHA256
c538215d19c589d27e217850b94975fdff8eb95c4fb2a78e11c714c902e45f42

SHA512
95e96cc8de654fed133e288876939e72ab4a842d677be96e05ef27ed26288cafffe00ffc9b1254a94d12de67d33cdedf577e043a01f618f3691b363e88df234e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98e09453c1e995acf485d0aeee3a9443

SHA1
2b778cf95435c2ee1ac448d61a9044bde6581b62

SHA256
c38b1bc8ad13d2df91d6a9a7d224be722971bc386f1c29add97ebc13cc248e0c

SHA512
096095e8ecdf0c2052f30c3212810cd746900b7c5e8e43a27716ac598fd44ba44b6a7c91ba889a171f9563c5fd60a94980f4a77bf9fa0d27a28ffa6816988a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2311.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit