8d188bc6758d5e908cd27b9d895cbc7902d764a220eb5aadb93da709677d62f5

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66ea2c45b335d7273f8b9d1a235d01ca_JaffaCakes118.html
Size

23KB
MD5

66ea2c45b335d7273f8b9d1a235d01ca
SHA1

73399f2da2dddf20b2379531fb67a6b5cb05129d
SHA256

8d188bc6758d5e908cd27b9d895cbc7902d764a220eb5aadb93da709677d62f5
SHA512

ef6dda6b91b7e2c04446b022b5afb082b0f63b58b9c7c97f12cf2ae9dd05086238289172f421308ee7aa1e51fca04b76d896d3a958ab5859415bf61a086905ea
SSDEEP

192:uWPAb5nGGnQjxn5Q/FnQieYNnQnQOkEnt7rnQTbnhnQaCnQtqwMB4qnYnQ7tn+Yb:rQ/uSK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{438A5051-1824-11EF-91A4-56D57A935C49} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c62f1831acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422534818"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a3ccca2c10a08478c6202480669a77300000000020000000000106600000001000020000000427df0e293b9f46c08a1d1c72fe4555111210ddbbcc99b75deff4dec1bd46573000000000e800000000200002000000012aa156caf1a8c5adfa9f1718fcc1901e2728afe2dfee7f170e5191ae3e83dd3200000000ff840e07b5cc681f2c166dce0c6840d11efe964803952cea3d064791711f1dc40000000593bd09c45d16aee5cf8d27ec15af264300e3b46732edd6055c7690881d44c13c9d012ff6ddddb57416ad25679df30c46ed8802d06b369c6cb8263d8f13870f2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008a3ccca2c10a08478c6202480669a77300000000020000000000106600000001000020000000e0ff22a7926cb46a33d6989246f742460f4ce159c442f97aafc6aec7e110552f000000000e8000000002000020000000d4e2f896edb9051ffd337da742912d2a60aa0d96a1ac885466118811be6275a39000000056091ab9bda6ed174d5c592b5b06a740827aa52fbb10ff68050256686ee5f1b6543c66504f7e9ce2a08161de4b8a2b2fb2530d954b83edae0cef93461c608a0ec5f5560998b9c9da8c9817db2e5ff132ac29b1b03ccb70c7a0aac90548f6a6833148788686f7dd9d605284127b0c41f6dbbc023323b94cf071d6eeca7fc1bcea89a5fc7d6aefcce96ffed523d292c9134000000046a2137cea6ec25c26c8b9fc21a49c35b585a9648a81c8acdb73046c1e23ff2a7e58f479cf6687fa2d28cf00598ffefc57c93bf6716528eda01dfceb470ec9ec	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2172	2936	iexplore.exe	28
PID 2936 wrote to memory of 2172	2936	iexplore.exe	28
PID 2936 wrote to memory of 2172	2936	iexplore.exe	28
PID 2936 wrote to memory of 2172	2936	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66ea2c45b335d7273f8b9d1a235d01ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d3fe546aa364c794a3e0992585bbefc

SHA1
0507922f11a0982c1c94ad405adfdb2cf9bd6769

SHA256
010cbca6681c7f0facdc53cbf7610e3b4b0311b5d4f4522685b76c4c23affc7b

SHA512
1bf3a0924cc02a3e1bb7d0eae5c4da7d4229b4a54314e8b99b90719bad39897ff267bebf7151b40d7b99511dcdf64db776c0d9f491ed7a5cfd652cc85d124cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4abbf19a533baf1c874cc0947dbfc9c

SHA1
490db973dcc89a7b5e650a78adc8ca7a09cf3405

SHA256
7db3f76390cfe76b623cb0c7b3468dad1786834d0d977fb0c760d3a46a39d3aa

SHA512
84d68febd978c1bc9fcb5a13202a497e507bfa9f88b1d7da1c23d399ac633cce87a86aa6f52f7b0099f152b17e60378cb3aa096c207e4c89a75b9c3a7bcbd0a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b5efc86fdb1dec5780757a718d9d403

SHA1
117057d5deed70c951f24c12d9665ea96900be4b

SHA256
dc490350c0b00012f23e1190a4260ae56c2fe4cc69aeb55ffcbb625fc9008bb0

SHA512
8d46956bff7832f60d27bef2f57e257ca6047679b66d8fb32d3fec206ac744072db964d5d5a2e122338a6db140ecb56c3aa1897e5d62653ab761f4017db365f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1803d6ccb4559fc059b59d0e5ecb06ee

SHA1
3f0ac81a9cb1c8a8f40eaa43cd311b4388a6ae5a

SHA256
0a8e67bd6251e2960fb972dea464e0e47e70c19e16c4f12a60a3602fda4062d4

SHA512
4b8feadcd1a8849126b07854e5203c143f333cc78d6d5c87beea88f1c8e4837903682e299d5bb9e7ae486e93c58de1d57fa41a29c30d115cf97d323ad916804b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6621cfa218295e2165462c72d849fdd1

SHA1
2585fe34aff24f6e965e5ea8495b79985e3aa51b

SHA256
16579d12c7ff4c1638447503bb8f9053565f57a6d27f70c080a2c3d96b73d277

SHA512
cd310646cb5cf8054e742bd040d6c4c4a1c0fac0c251b1640a11847822e152c9d34eb1886f3df40a39caefdf8466ad9fa8f9368264e010553e3b42356c47fea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f9832a7ad04df899bd4d8abbc98787e

SHA1
d6bcd362a02d4007f2d626b15632c001942eb32a

SHA256
ce842222a30d33e2b36638565a9264131132d0d59b9ebd2fefbda1db2335a9e5

SHA512
329f17ebf2e9452af90d9eb492dd450b6a261248988b24048d76256c8db290412b1bb088ff6186d6e53a9baf6a4c446de407d0cf054dca7ada0bcdf27710b85f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f76ae5db7325b99621ff66758930ed4

SHA1
660c6ae1bdf04bf77a1cf2eed1c45c45901ec633

SHA256
1d830078993b1e2b5eaf225acecb00e98d9393e84ee7cec27e9c4ff2224b2979

SHA512
be84a2df606be25d18df92b244d1f5e5cf955d3bb6fbf555b11c704052150314d3a73e8100e9de573223f50de278062b4817b5206be89edc55f5d8e8c86245b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7e400b35b946ba9aaae8e9950d64b95

SHA1
f40e0ab33ad07949b29d6311af9cdd7247ede6d5

SHA256
93b270278dbae08b48a7e9a7a7db830f13e452d69a4a58c58a9130d69be46265

SHA512
e9144a03830f7a5752747932f9f31a4ebce9300c5a1a554bed603d410adf0e6210f3e9a950c5df6b5ba4710c39f86c79a57db1cd46ef3cc33563d09f5fb0f7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bb0fcdd45c7f771fb049711c0649b91

SHA1
3f39170ced1af9025fa7d04ae474528017488a58

SHA256
a0ea58d29756ad0d933d7436271b147d6a3d151b82bffcdb982a71884231b4e2

SHA512
ff7dc2b8981b8428178d3cdc3f4258595c0bbe898c5e01301d1415525ff50404718b297886e54a6882f7ac9c0c33bb7e5c1da23510b8ae23bb35517631b96522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c6473086a8127842ae12c27879e0ae

SHA1
02ab6246736777d4b65d8df40c7cc6fa9bc63704

SHA256
02eb0130658256ffda47d7a235d5bafe9f2ed34b3f6e8333351d9900418e84ed

SHA512
773b007f585b79ff17a500a2c16b1b1b18edf835a130fbba2fd39cb8e5178370220746864719287518f176607d999ae05045e634f1a7ba98a53dd4c3362564dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f577b2fd314dbee024c24f5bbc67d07b

SHA1
ddffdc9558d1992d1742350efe3898be1b63e121

SHA256
d8ca83262a10d66696f12b395af7f5b567445c78ced26d554e2b0649bf2f2225

SHA512
3de92da917d7f81938e9b053e3941a9f1f9fc9b8269395219a0c87b5eab57ad13061870df78e60fdaf857711d65a49bbfb4e07685a0f30fc112002a348c7287d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
075774c7a172e18add050a0282165ae4

SHA1
31368fd31e73b882e5628e72f1774bbf6cdb575a

SHA256
cd331fa4de318404efab511f0bfcd96e6b6a14b4299e31d76db6c1943f60aaf6

SHA512
bf74bf81d05565a085d22bafd999bc83911f26a172fb9e1f5826abdfb305c8efffa2e0593d1fd9a22899cda1121c86efe50bc364e338e03576727a1f1d418f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfd1ac0a79549f4bb618be1abf299ceb

SHA1
a92e48ef6ede47adb331ad587fd51e8365aa6490

SHA256
1a7d087c9ef3506d79884a8a50c0288f866afd8b9b6f9e3a556ba49e00454ed3

SHA512
0789ea44650570624d1cd599f319e6287bfaae86205068986ce45aad250414ad39ec874d5b1db381b508f8a97811308c43fdc406444e5fa1ba743107b7fb47ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B09.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BEB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit