0efe6cf323e96ab0e3a9c5077656a494d8a75b61d9dfcce3fc10cf99feb9dd19

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ee3727e97ad5bee727cdb7bc227f7b0_JaffaCakes118.html
Size

23KB
MD5

4ee3727e97ad5bee727cdb7bc227f7b0
SHA1

4bd2aa927f0d0084b20c25a1b5a88d9263113516
SHA256

0efe6cf323e96ab0e3a9c5077656a494d8a75b61d9dfcce3fc10cf99feb9dd19
SHA512

a078f25118bd5b7965b90755dde5e27ca859712c62d8aa43db3f900f9019cdf518082333ff66f276e87a4af733e0f90e9e07fc53a570959f170f3fd6ca4c0aeb
SSDEEP

192:uWnsb5nNSnQjxn5Q/wnQiebNncnQOkEnt0KnQTbntnQ9CnQtrwMB7qnYnQ7tnUYj:AQ/ohfE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000ad1db961e90e73ae7c6c0ac71042943aed4ddbfc2727585701a470dbbbbffee9000000000e8000000002000020000000bed43fc8decd19a8cad00c8e53a31a78bfb0215d69fba5e299b1ad8c75889ed820000000a6a66040b775d42afbb7c16eb47a3ef40cc7e281e4acc6a4c146bc8b5848610e40000000e9e23e50cf0ee6468777c82cfb0cba1f6250ba9b4fdb731def57f547b398e8d2332f6709dd297a702ea9e25ab6b329b1ae3b0ff4222027991331c669bd53e8bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000068101315d56381a3d39616b4f2895c5891f7fdb72ca90041168339d5e747c9be000000000e800000000200002000000034e323ba9b7d320565d3408243447e7229b58df813d1ed10a6fc4973832c98d4900000009bfdd914fa0ae5016518d75dff66787dbbd82fa845325b06e7edbccd2173679c10d22d2048be60c7e2dfd26666a6909007f357f01a38bf5d6828b2fc44f3520e07bae153819b7b3dd0093e86912c149cb89654b10a0caf119095fd0c4ae5521ef9cb24faac9e94818a6ed8ccffe98a6ed39ed6a458792dbd5f67b088e59967a8d2fa92f02b633983ee7c9ccdc6681ab64000000035ac4396d7903529064a40c6ae119f100f3a2f0039e701bb9f6d4e6678a1b53b55f5609addb166e1e3c15c4f1637c0f21899737ce23024a5f1a13d36c886b23e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0086ae5627a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422090822"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81F33E51-141A-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28
PID 2700 wrote to memory of 2504	2700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4ee3727e97ad5bee727cdb7bc227f7b0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7915bb027e566c87649e3719504f2037

SHA1
3049ef585aaecabf315ead3905f6c69f63eeefae

SHA256
3d2078bba5779858e535754c8543036b7ef596033dad67898c71849d5b7ab43a

SHA512
8aa5fd3a71bd1d88b30bf7f4942e0d07e3ee71d1c465d5621e6800cf06d3f55471d5c41e395a01f97063b6ce7538f6e97a9a637616ed868f7c6fc690afd50fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf8a1e27ea8fb2b5ab769c54e4001e81

SHA1
933e55ff0e19e4a262c05c4238f84d8f797c5fbe

SHA256
e9dc34a748c7ac00cb7d851a29b032273b20f5f12d392efa278c6519f9c0cda3

SHA512
46bece14bd48828319dfb267ad40d5a6f74b7227dd41e640ca8821dcdcf3fe2639679d1a98fb5ccfa7c799cd69a4bf893b726cb4bb9f44d4de1a6b807b85df3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82a63eae1a3ca8ca7ced6dcf24c47109

SHA1
ae4faa99001fb2d9bbb5139fa215a8394969b9d1

SHA256
88c65fdf5d4083bfd63706aec24566e8a7da76d08037d2cf36f72f64010044c9

SHA512
c3f4d16bd30d7a045c89167892669ea72ab86e86a53e27297e5b375d8c292a8182d7ad4f454265d8b0e19107cab9ab6a66150caaf7a4bfad1cdc867f6e0bf10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79846ed7ca761d8e7c875bf208865eaa

SHA1
fc14dca6ac8ab1f389086c42f3b1f84966ffa55f

SHA256
6f2342ddb2a1ca0041f4dd7248c4604f4bb94954fd08f301ed15d29e93441cb0

SHA512
588b9e62140fb2f9010d4cbf5a346e9e4dac656e08555f4c4d8cf0c4a4666692036e6f5ebc75a667ee3edf46dd5721822c29c770715db25dcdfd8dd7689c3b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc14f3b78b597a84701743ca4ad80d46

SHA1
c6f7546922be91e09850fe4facfb71d3cce255fa

SHA256
57cc23c5bccacd9b99978a9843426a23d22bd4b53b8e8b2d3c289a3ed66ffede

SHA512
20856bb3674ff01224f7c585ebc5997a447dba090121e608dc7b715a9dac97796b29529f947f7042e751528d9c7abea4817e972fb1a8e6e6a8132740c069c897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
419456ec283cbb2d6892cf8bc6cf413d

SHA1
66d9ebf729ef3c422995d49bdaa9f9570321596e

SHA256
cc27d44964c759b88b7e844da4abe191b2cc10e75306f911759f212d3c65ea69

SHA512
778b67ac338be106d24e589a581588c816f3e011bc767c67e81e8a6213cba7416ca736ba43344f46a80ead95f0fcd0c17c0a09ff84281f1430898690a89b9b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
759c84c89f955384404bd930ac4da2a3

SHA1
0ec2e759fd7e7e59083610f7dba2dcf176ce8f35

SHA256
ce5a16cf3c10ce19b9958fc066964d6d54de8738d255b078e9e9592a2547162e

SHA512
bbbf94d798b82334573a81a90b828ab21c7d56a78acb3940f7e95f094a1d017294608fa5852150063f3e399683c1cc2b7ed7dd8bd7311969ecc6ea3d0c363862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ff9f8dcb629cedc80da485fc104e310

SHA1
682aad5e0505a78a32d51235d898140f707ce9b7

SHA256
459375a77fe38f2b6095f7c70338d838a3a5b733e9c0fd73e521d910a8ca5114

SHA512
58525469930993faa07f225065d40dec10198734343990125a816dc688d12407504cb7ce35a2dbdd0086fbb6ed5260d964cc0f9f1ae58229cb108a5937024d69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540a8f0ff97c780f09aa5a0063ba32a8

SHA1
9a8bf1033d0483afd150402c6605939c4e42ec2f

SHA256
202bbd8fe688691d2346fbe6b2a23ee84a0cf43cba23030e5313ca15e540426f

SHA512
74414143ace288c510e0dd18743ab5c05f27d924d8c94bce114be9ae8fdae0440c7c8b60bf60424487e28642ba3732fabf57412c0ef2ed4432c59be3a3ba6a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db68c7dd7b24e876a2e126c32b150c0a

SHA1
ddd03425caf4ee73b07a74a9f4f8468cfb9f2c86

SHA256
22f5e35a6f13e7e76d1aa6da69a1d605b96f798f4fa25726bc16d16a54bc5712

SHA512
131feecdb1297a6bc69a53a6659312ee6cf8239623b14d1b8d7ef6355f210043bec4bfdee20da6aa58a12fa0a59d720803681ff58d206d3c1f79318eafa0a88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
019f8435cf81571d0d707134ae8e2c30

SHA1
e1785d9e061c666d60ee8f4d88bed18d6748ed89

SHA256
a2a2d4c024c0dae966199b895b8cca3a8572a24add9b42bc63db8603d9d4c832

SHA512
c546d743a31b8c03bf1b3fdff77d53f57ba5775407c3d4db47eaa7266422bc935b6428e0390ed515831b7cd3c55c521c0a9b7577774163b9315e1f4c4c11adb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f2039181dfbc794e80397b2d8a313b0

SHA1
8acbc37b471c4e2eb9b83572bc857b825ac6d656

SHA256
da64022f85c80c0be85ebc3148af58bbc3efdf4a194703df9b7b8f1b984e4743

SHA512
f8c3f99e4bd249b65b0c3b6c8cc13e9a797c44970b918f064d55b1439dd5fa6583909dd0f9d9fb046ea4054a7e2e783be85f2d0702bd1fdbf339267cccb40c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8e2528941e567f61b5006e1af3efd2

SHA1
3c0d2c263f8ba1c9d30ae3a8248fa6d53f81e515

SHA256
47bc2b3f1a99b96651ec234436ab20407ebe998b560e3fd3ad56906e51620b2d

SHA512
c505fba0e622931267825285c303549c425d40db4d8716b0dc5558d5a128091c600513daa69a3f6ac368d1599a3cb1a3399fcb35bcc54740e3331bc0cebab8e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de2fefb25576ec6d6b16d134c51773f8

SHA1
6c76bfb56d0456b9028aa5761d46eefd939383b6

SHA256
bf0f2a4a7190766d3c3561011345e9375cdbdac009c278e94d6a272e6d42dcd4

SHA512
96a9d043c6439587bcd16ba20b0a4408c691bf2c73e6d921f1897d21b890562583e4efa48d00f99e818e4908784caa9f02b2d2758ddf6521c66ba469b3c0eb3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E5B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4026.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit