0a3eeff17f71bfc6dbd82752048d8b3f1749d266f7b56cc8726b27ae815041ff

Analysis

max time kernel
137s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69434ce5a8d2acd8501fa4405a6bc8e5_JaffaCakes118.html
Size

7KB
MD5

69434ce5a8d2acd8501fa4405a6bc8e5
SHA1

ab0c2cbae3f8a4c94514fe85dfaaa7a8b29f422e
SHA256

0a3eeff17f71bfc6dbd82752048d8b3f1749d266f7b56cc8726b27ae815041ff
SHA512

0486d2a7c8fc996982a04a25568d941f096a219e508408617f5402334a841a03165d1b7aacb97ca7778239df26cd5bcd9a128cf96af6d8f77b916521fb17200c
SSDEEP

192:9B9fo8tgbW2ZWEMJNj8wqoKlp49+OnjqJUXs0:9B9fnr2Zajn04e0s0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40faff41afacda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422589008"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D86B501-18A2-11EF-92D3-66DD11CD6629} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f9887962ecd4340aa3defff37610606000000000200000000001066000000010000200000005a40a22d8c833b4b8bc7653e0641e979e2badc1bd426c28b90bee49c9a12ff28000000000e8000000002000020000000fb6ad6f7fe5b4dd3cff46ac30a74085ecebbf7d1baa0f542fddbe7ca0bf1a7f190000000395d7eab12ca53d8344140fbd01d0cfd74b5ba7f59a1476a90a2d4708d9083167adfe5e960934575d85eb01f90d1bc1f6b69b1a502a6b45ae852117300cc2ace3e5a3862ae9dd86634e1f5607bd472c6374ec39db0826bf7b112a28d58885bb635ce0c62fe1f12724a8a7ba3c7cfaa823953bf5f02453e2ca72a56649196372d4f849e02f9438de34f6056588c1a9a16400000008074979223836eaaa3010af7cc78fc9b31a181c08dfc94177267fa4570138470351197819990ba4d06f1d312a5cc672ed91bd31ce3138139c1835bd061aaec1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001f9887962ecd4340aa3defff3761060600000000020000000000106600000001000020000000c29b6881d70924b8ac8dac6bd54fdcfca3fea9d04b3cf740efc42e879ecb45ad000000000e8000000002000020000000f863a85b10c5dc9e6f07b43ea4d43b2c0beb7d1ad1fc2f79ee3cc345d6866b2320000000c14003d89bdb8c6090ffbef42b03bf45c8a4baefd8a533da2a4fe747da51ac23400000006600e16b6d5e8f85611c81e831404d07045f4bff488aebdea2e65a843aaf8f4ac030a3304d042c5c08abbf00fc0ed9041443d16c729513a581a858b59779908d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1460 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1460 iexplore.exe
1460 iexplore.exe
2008 IEXPLORE.EXE
2008 IEXPLORE.EXE
2008 IEXPLORE.EXE
2008 IEXPLORE.EXE

pid	process
1460	iexplore.exe

pid	process
1460	iexplore.exe
1460	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1460 wrote to memory of 2008	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 2008	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 2008	1460	iexplore.exe	IEXPLORE.EXE
PID 1460 wrote to memory of 2008	1460	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69434ce5a8d2acd8501fa4405a6bc8e5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d64a054ae5d255883f5ee4cbd8d58c5b

SHA1
3aedc1753e1ac2e0f8eef6b14d39cd13ce94da85

SHA256
c438acc35818d9fb090da13769b2a1d5313f55322ea0433724f921d827fd36f7

SHA512
25190e3ab3baa37105abcae047f540cee6edb554c6c84c0efa03671b54b6289abb2a7e7ec48e75ce97cbc34e34f08772362577126fb54f3b6e796fbec35cc7a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f525553ef8bd83092c297883d8008fe

SHA1
223752ec198cc76c42ff6aec218ecba90545b665

SHA256
a6a7430cdfd833b56d7fb895bd331963954f0ef60c950adfd9142875111cefbb

SHA512
75fb6c4f94a91aaff578e3b702c8da3b340f3fba2dad65593be62dc8a8f6a6cb1669e2841ff05a0c94b4fd0d889af9010cb4dd6248526b6e7daf62fc9f0e1de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37611c200de6caa0179c003e20c073d0

SHA1
f70f87cf4b92690f81e97cefde6c93e48c336eff

SHA256
18231f5add0c6d4a6c11d07543999bf7c9e2a9c82f8b4cf3fa88200fbe864851

SHA512
76b5b213507d7182e1785694449f5dded4485409c6995836aa99d3cca0887791512eda0edf25c6dd1bf62d7ce387d0cd838ffda8bb7b39b3cc09c7bba2218d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6603c7baf1a705f4930451a35cdcf64f

SHA1
af0b9de0800ae6efb96aa5193055d76a368b78b8

SHA256
d78ce76af632e7ac90556f21b7b6356fda4363d8fb63eafb702db0667b847cc1

SHA512
6f7e835ecc285a177c53e25b56b7334712acd067dd7ae92c1990316ccd803bbe519e5a8ec424ce64cc42fc33668fd4eb5f1a925d4f9fdd6f46ce7f988dd46788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0ce9239a44926a81c660d5ef1435fa5

SHA1
46c12b517c7a9f9d3773758264915a3f8bdf3979

SHA256
1cf25cca16e69dd11b9666853b7ac2d92c2cf4e9199f786a34ea7d146b30719a

SHA512
49825d9b070b79c61471386909cddc575f657e486905fb450fa30d56a322051548e87d712dd4a43dd1da099998839bc840aee4cc510fa5919fe48b7332d626b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc40b680d9fb8889bc43e30c7c40a531

SHA1
709fa78fd55211a8bef2df0231359d57f9d89583

SHA256
17eff535ca96fcfd14e2fc85b63db0736d69c85b1f16133cd6758199a4aa4e4e

SHA512
2c63ba79f005029565c52d6c59084d7143a70cb9211ec5b5e0fbd98638aeb4fd5b323282dabea8f8f7847b837a6324d11c4e3b5b656d8f15270f068dd45faff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcd1eee55c7eaca6bcaff207bec7be8d

SHA1
785a6be0fa6928ec4a6ef5de54e1cd3040e5430e

SHA256
85262b682a7f93e651dbb227f91728fcc3f56ccb6265b57c9c77a710532434ab

SHA512
a90518cc7490db90e9fa8da037f1d2fac396340775181b99f89becf00b7c27e59a7f324934c067933a1cd1fceba0aa68416301d9bf82efea2113ef99755bf9ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9805c1ac906cfe709f70167252653483

SHA1
21569845ef089d62fb826da39faca08d3d8acbbe

SHA256
01e1180de0713b6e063fc09ed4c70e31bbffded4d04428724ba459f32f567af0

SHA512
6e539aa46642ac9b0cbb6aa93b6c17fc962f2e72d1f707b5d6e321cc05e2dfc9f12c1987eb4fba24f848611a71f96009984187077f4ade935ddd44e25c2fe3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9290f75f91a9e34704a23d8c8266267

SHA1
5c98478490209230c24c6423740a8d2472ee6e2f

SHA256
da8bb00419a818bab8362653116409c59cb4123f07e89e9ba7b012bd6b887781

SHA512
3f685a7691c9f610efcf5d38679f582997ad96cd8ad6fba16d7d2f0d1fe4e89266b116c29e8979727e93fc349986a0f98e504cdafac6cd37983fd7f65f6dc301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dab359ab04be068ca413cbbe21937f70

SHA1
e8f42f59df7f113d1684ffc0269a604386048d3e

SHA256
f947f66e876a90e75e53650ad827dc3edcae27c5796059a54f7b6ab5660bb63a

SHA512
7e5af24ea103dd62444910ad45e0b269672154fa57a2a3fdf96d6583cf4aacbe8e50ced17a5ea442adbe2817eb74c2c2df5d615605ee49592dfc6bb61d0b48c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e66d97467d683422bc2cfcb17327852

SHA1
49f9f80a8efa49b5bf5b94a5d5c4bf85700d249b

SHA256
8ca2f17d5c940ba01971971fb4430b6aab8a685dc29ad59682f9f2d888fae285

SHA512
f122b5959f466a499bc7d71ece5fe3173da981f325efb2474b81aff4cdaaff25865f702bd7152b6ceb551016149f3b6bf7593d28b9c8789b7677d3449460cf54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e51b3c611e268a7e8086e0fd619daada

SHA1
c2a86773af3445bf155f25c52314d8d63aa544c3

SHA256
d6a212143d43e8b3f7e46aa08808dc3410b61dcc1e057c53139cd00a4ea04ccf

SHA512
d90cb436afde1b291c4ce6ef3e49d714e6309fc3271dda0630618e6a77ed673ab14bd842fa8be6abc4b1c215ff7fc1e9e3db2c9daf41736fe8ca0b2388d2567e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab390B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A7B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit