3e98e00aec196b7f8c6af7dc867b4a1bf1c157632fc1a2b2ad0b7592d30db958

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ca76c7343b8bd593936054537b81dc_JaffaCakes118.html
Size

68KB
MD5

73ca76c7343b8bd593936054537b81dc
SHA1

d54f55ec1b575992a8c8578ce34a03b717e2e6a7
SHA256

3e98e00aec196b7f8c6af7dc867b4a1bf1c157632fc1a2b2ad0b7592d30db958
SHA512

e0d8bdc497c9f5a9835189a470cd7d7f137ac970dc0b228ea8f0a828174fc1162b666ea67fb30b8241df47125dfc32b8e1f453111284a23e41aebf3d6fa5d923
SSDEEP

768:JiKn8iGgcMiR3sI2PDDnX0g67BJNOzJTXDFTnoTyv1wCZkoTyMdtbBnfBgN8/lb8:JjDJVMTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b5e7bc05afda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f99de031247a49418952ec8f15a095d9000000000200000000001066000000010000200000002a5050a03c38b62483b8352367ec0cb15c1c3cb08c880093ba5b11b7c56c8ef5000000000e8000000002000020000000ad6aabe8ee46c0541d2c155333f02f002aa21a406931cd5e69f336237b329cad9000000005c1a8f9f41bd0796cbfffd67967d4bc2b7e69427df39432f617c8e1a937ebef5a5523ec1e1dfad3b99f17d42d21ad850fe07bbe9c67196feaada485027ca409a2603cd519278c2e61b4b4887747a03797a467b64a531d732dec4a9e8ff26768ea0c2da5fd15ac63c552bba24ec0178e0d456b146d1b8a0beb04b67e1fd180d5a4421057414eed285326a387296297f6400000009ffe11d5fce471e4a7ceae9210c57d75813c24b7ae193dc242262a4933299bf0facbfc35fcae933b4773802624a0f0b6a5fb0bb66bc0a8f696d4fe37314524ad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422846050"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f99de031247a49418952ec8f15a095d90000000002000000000010660000000100002000000085f529567f3a5be4b5adb6e9776dca4909882e51f46ae7f2c6b9f5a9e2658097000000000e8000000002000020000000c0e5d23b6a5e53e5b2784101cc65ccc7886c4a18dfade9e117220f78ac97b69d20000000ed6f3deeafb503f8558ff6a8568b909ed1f4f6d8ee528e071835bfa1e37d0e7740000000d20ddd409a2bf4441bee3e277dc227b9c81922d5e0539eb142a26da574206dffa981b2344880666cf8ed9d2dc36f07654e5fb46080d99e8c39dcd5e96dbc464d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E84F2FD1-1AF8-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28
PID 1264 wrote to memory of 3028	1264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73ca76c7343b8bd593936054537b81dc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd533ac895fbd33b82f506750155d66

SHA1
36551a3e585bb759cc81fb42cc15fff69dcd3618

SHA256
2258975a2bd84551621530d2ea32a2341424dabc5d7f914b34b542bac2a1a71f

SHA512
23a0b2c30c8216317c4bdf1ec6cd9e05c9d99722684767e7e227a68008e514cf8340dffaf172c4417f90ce6766c389830c44012bbbcb03f20716095bd539b99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eba8bde960b7736301c40cc229fa117

SHA1
c01f6ffb5956fba49c1e245865602c1928f67a3f

SHA256
88fdabaf72c8f377ba68b44c1d4cbee16d7ee471f5405662a4b31caddd572cc4

SHA512
cfa4e9327e8ccb638484664797362597dc30c926ddbf71bc6ee18f1469f2662d3b334fbec9d80350831bd9333957e26039cd09fb8e75ab02a63d7c5efe278e49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfbd5b6285cc5ef7118d63277cd6492b

SHA1
9619dbe50927f7b20ee9d0e099cbde1719cd1c1f

SHA256
6e7e78aa61d6b24e0c718f079ea5e4b1b5d9b17d2130e2328ded48413d4e71fc

SHA512
58299821ac31fac6a6afa3ad7e3e5d41b730642fb61211d152769ad33e4c9668c3fe434928abec172965b6ff387899a1592b548a05c089bdf31ac2c15ad30ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b3bdb9e885976efc6ff505caa48ca9

SHA1
68e5e2ecd592c8c29851223219b59f734f4200ef

SHA256
8676ad4a012068481510efdef6dd9cdf2deae0ffa05c12933a0873ef63a541be

SHA512
8f8e0ce93a73672605702ea7218e89e21f3f6e6ff11aea38180653b5c78223cfdf09885da9949336af8be40008f16e71f9cd1744db0444b77cfb80e0e3d47ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8fa009430c44a9da2c635c7df3544a6

SHA1
1073696542880b9108f0ee367ac9b71c5c9f3bb0

SHA256
c74a2ed57f03dbd44641db828a81eee12bdd74c9bb15ce2f235511b195a155ee

SHA512
faf2d67393933ee4fb93e7988a424204d725a96ff8678445b8e927ec97f84ead9def2b749e0d45b57a900d7d974ea5b1e5f75a179d7d86818bf2a56663bbbedd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f1bd77f76f766b3a013bb698de3e1f0

SHA1
34e1b6dc792792e11a073fcb5647c86f8f8ae720

SHA256
5cd9e6a26b95f509fcba9035a58a24a08d08674e6a4e573d67478b23542cd36f

SHA512
8ae0102089f18de21f2f984ee69282abab81d6345602079923dbdf5d7b862196224f52239b30cfdbc9aa11b2b61831808557e291b33fcd47d8b79de64942ca28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05fa4ace3513905f8e770fc65a2e3100

SHA1
6763e44b07fcccf7a2044010818e4f5794d171ec

SHA256
2e0f5a1a4c6e84bfe3ba133734ec8248f056a55670999f6785dd1bf410cd8963

SHA512
734e861f5f69e696d23a94446c0421f43b3ddd91e6a3f82f802414ca970ea7ab4d2d341c7f8bc18d94cdf3a71cf721d54d0062b912130cb03c1f4dfa3b54a84f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cfb57da23a1f91b033c4adfdd6bcc54

SHA1
1cb7e23b511ac4a70ff9c14c6d3a375ec3a0f412

SHA256
48a723affea897e544ad11400c76afa582465524237064477724ca323dcdf50d

SHA512
aace23d780f89371c2fa4544f2fcc957777e117d7fe0716fed6950b2f9c03cd96244e5ed06a39309ebc97f2aaa9455d1ee06b9c8b577baa9005fa15d02082ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0bfdb016fb1b906d49afd8cfd22654e

SHA1
4b420f9f2239aef2c6138a0c6ccbd6ce804f1907

SHA256
61b4ba7f1ec7fe6ec9bf54267563c953088d18a535166bfc03bc46c5e5ee67ed

SHA512
49188bb869b3954d9056a51a5126ddd389a2b4bd13038286094d19f9d1486ee5a04862f10e0d47704d5a4ce5d5bb41c518d6287d69a6e87a4dd4ea345c6caeee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
421bee8e4a14ba0d12da2fd0cd52a3dd

SHA1
5edf24be2370a9cac1b905c002ef6cfb4f94d376

SHA256
7bde51cfb861981d434a80289c58fb9cf45971425b4e51a9ce236af1f7af4dc0

SHA512
2809549d1b8387c6d198c37d1c71bc5b7b85b37324c9025ac754b5ec1d9e02721aab6081ceea9b4e0a4a3e33049b31218cecda8105ce6dbd3decf0c3e6c56760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497933e8c55fb66eeb3ba1486bb8b093

SHA1
d40e645749368b61fcba0c1a2e36cfe60865af21

SHA256
802f81a91e7240788625ad887b19a8b09607524e12fd25460168e12de3f9590f

SHA512
847620d5701a3e01fbba4e024f6c417d35356e048fac5cae961bdbd7f437b9278a81af9ed3b0ca0cdb09af2c6787fdf81589ee0e66e167995ed486c9e7fd3393

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CCD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DDE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit