c38ea0edce09ff9e0ee2cc6472181acca1b637a4a736ff5ca1d0261672f2d71e

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

819ba3e2a3dbe7d74c981f62b018f1ce_JaffaCakes118.html
Size

67KB
MD5

819ba3e2a3dbe7d74c981f62b018f1ce
SHA1

9bbe56058d7a7bd52bae64903bcc3d01768b568c
SHA256

c38ea0edce09ff9e0ee2cc6472181acca1b637a4a736ff5ca1d0261672f2d71e
SHA512

e9a47c8c7906e96bd4ce4ab670927607bbc4db9984610dbf324c982ba202d283972695e47a3f7bd6e34ae62aff297ebfc6e7f455e7ed5c61ddf444adac4926ac
SSDEEP

768:JiKgcMiR3sI2PDDnX0g6yq16sMsZoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JEhTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9902EDF1-1DEF-11EF-825B-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423171912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b10f917b60a1644bb884aa89c9c00077000000000200000000001066000000010000200000005fe830d72c8548924089250d701c7bad9c0a4a9082d236cfd5b4fcbf1e2c44a5000000000e800000000200002000000095412849606b0f50234183c0fae7d5076bc9485b8ba5d14d8124fa6dde24b8a190000000ebb0ad587365a515eb8d8adf63741913d547924b4a2a112ee13a71631c59ffd4a8b8333f37e677f903b3e88e80a049ac088dfe7600b900c1e00cedd114516448d7737163451db1112d27391b4d07c6904d885ea8236cc3468491f4ae69d5722ec4c7761aaa9a7b4df856b9c71932850c69539835f9b7d5b4e97664da2a5e07665e2a285a5232b2dccfe4fd85589d41aa400000002521820f21182cb6b8e9bba9b7618e7ba8126e81c739959790f1e6fb7e6b262be0208d8163d8ec5d398b09dab01d8296024ac73418ef0326a5ef20c3c0608f4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50df966dfcb1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b10f917b60a1644bb884aa89c9c00077000000000200000000001066000000010000200000002e1ba6839ce6170a0cda201818f8a51b34205ee091078ea31804c3ef0835b2c2000000000e8000000002000020000000680d0d1b90f2315175ef770df298767c3e72d21e850fc96ef11cd5e0dc53eaa92000000024e7db4b93b1a3a65fae1c0f46b260390823283d0a54ea443cd37dfaaab8aea840000000d2a26464b60fbd2032334c2029a11bd81f1d91af611a1bbac552d94b19fc6016b94d87d1dfa55932accff76480e14c113f3d5b6d3079ace816781022c7035983	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\819ba3e2a3dbe7d74c981f62b018f1ce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3de1ce73500a96e59b114318ba50311e

SHA1
f2b5e2382c3aa40b2f31c87d8a9baf3168fcc68f

SHA256
611f7616b3817450382391b1a1ab94e65cf79dd312c4c62962fdfd9addb78bad

SHA512
d237da2705e18c86ddd6aaa92c8095f96fd37514e23676ddc561a687967b31fa2600e342527b7362d3067be13d82710f2727e64932b035cacf841f04df76a005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7382f477de889bfa1586974732fbf7c0

SHA1
266ad836fc9cfe1250909fa760b016ca534ad67b

SHA256
4ed27f15d92a89352b5e0abfcd6555b18c4fe0c0f9ab71ce7a8ab28211cdf70a

SHA512
b18192c27dd0524a50697c27d3e4504fee89d089f6e397daff88793ff1556835c86ad9dd6b1f86d1813ba2b192e5ddad0ef2b9183cd86b6e89378217d890e15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7be3ba10e39fa7d3786b67b8ade438b0

SHA1
3e19231cc44829513d3598556344800085690f97

SHA256
f45d339666328585ba5113fcc014cdc672d04f2984de6ce1b13e6705554d14db

SHA512
5792d10c273bfb7b4f2a2963bd5da43bc5eadec018930cf4908ea7bc6db5b1573c411663dce1d72dbf7543e5eb3736601b07bf903bb05bbabe244b06577b746f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4cbaf5e4b236c2a860c7f7184e822dd

SHA1
4d7ff05ee91047f97ca5b099aae68848d8a3d50f

SHA256
d23a6a8696ee65b436c29edc00af2e8a4c074f112eeed1f56e4061fb7345980c

SHA512
c181ebc12f32f600de0c5f2deadb8dffcb7688e9339c0275c141787f1cdd1c5b2a862f8f1f355d720f495d86df582fde456b76ddcd93a181a162f55cce35e1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5f4c01b0e1d3c0e6dac3ae86e25632d

SHA1
c91e214b964da2cc0d234b44399705f305650650

SHA256
29687b673e3e4a4616acbc62f4e99bb70ac6cde4c2e8d22bb212f92a0c46c687

SHA512
a268f439957710b69b6c22ff89f2ae4c1e8d45cf69a833402ae606fa15663f18530b2c7b8af4795d1c40dff49a29dfe345bfce07932187d8b305d3b1c92df1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60ec962fe3eb50da4d786af38018d5aa

SHA1
e3a3ccf4561a8372698768bc7375cddd9eb65106

SHA256
4171e1008fc23c4499de6c2a7cd1e07d57354e42247a495576954c1c9e564fd7

SHA512
44441e890dc2975c2b744d180c75568d41f1137676db862cc1ea9dc1d382188e29a1d3f7903f00b78620f20dcb7e1c699868257c0553c174858fb5c8e1185c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
178f94650238108e9275a1ed6eac1e1e

SHA1
a38c9f824c39b11d1b38c4e0df9a51a521d12bfb

SHA256
db30e1183eef360668b108beddc11a9d44890d996572829d528b0ae0fcf9595e

SHA512
6c6df09c2b185d3a83135b5e207fbd22dc68ac63baf0f23be7cd31746608190866a44dfd40a4c7548e9920760c547c007860fd8a85af8b4b602942774b992e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
712cf7948c49701999312ce068e50f62

SHA1
ac4124eb1fff13cdee67207e577f3f72bf03c522

SHA256
f8d3eff9fb2b6159e9ac19b4ed02cbac934cc5a8f7ebe53127ee5ea088ea40c1

SHA512
26e2776ff487670f6eb1c5f7391d52005879c3ad15d0ff18d8288ff940d22460194f97432bd926dcdebf55cb0dcea148399fdc098e9cd94c50332bc2da36f77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d9fb4f8611df77ecba7ec5a4a67baf9

SHA1
397c4f18492ff3255a0ce0a83e44c9d6da0eaa2e

SHA256
1dcdd5e178c621b1943f05f3a7f2b4273c2480d55753b7dc4d42a2557b7a476d

SHA512
4c876b6c04c3585e189ee2d8757a1dd01fd302cf6df27b3bde743634dfdb64b8abc34172153531cff851ea4ebf221607d34d98b96fb6cc86b6bab2eb985a7889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6918f56359cb9b2d06163cbd83f8e2c1

SHA1
50ce102e99fd402f23baebad43d9edc362d78c17

SHA256
2ece3a990e46f2ec71ab52509cb8af1c0f1de05e97f4befa9545dc4cb380b2e0

SHA512
d8d306d2f9705ea2e96fe725a229bb21a19543b793f0352ec8639980d70f2e1270243aec6def9415cf95fc4fdce510d45c36ff9baa4675aa14fd5c1503035341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39552eec9fb2dff571ef449beba4b41e

SHA1
8c0753003d992414c2630cd30a4662bb6f27bcb7

SHA256
7e72d8f23d14e15024d147758ca346ef3218b44f0e11a5f31627fa153e6fb879

SHA512
0f02b19415cec419fc8726e116eb6a57fd7c4fe519148e28158afca7aad625290bd349f4c408827d6b2505b5eafcec36e5b387f43c1ee4dc88abf52f6563cbc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91595376dc86e3ce870c6c3d58f0d04c

SHA1
b7b8ee6a2e06977cbaaf6dbf441056244f55bc67

SHA256
f34d39d65acebe5935f0707971023ddf4daa74de0eb6a4fe14bd90262f06896f

SHA512
96fbefb2bfa56cb9219114de7b90287c26a151fb21310baaabee263ebd315eb09a0e7204747f0f9f4319610629a6d0b4cb11c134a2162c1af34b38f341d2e23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4DC5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EE5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit