57d2476944a39992b4e72d10d8c38dfd50bf25c051537bc170a9ec22ea3db163

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8921be4cbcd5de66c5207a74e7049074_JaffaCakes118.html
Size

133KB
MD5

8921be4cbcd5de66c5207a74e7049074
SHA1

53ea2989124d115e047c470d67837f83aeed492e
SHA256

57d2476944a39992b4e72d10d8c38dfd50bf25c051537bc170a9ec22ea3db163
SHA512

1124a7eef8464f108121a89c0a28450c1926a8a8f161615a87481692485d19de6912b86822e2de6709004aa59c76758535af328af4551237d2d3fb6fdbc69fae
SSDEEP

1536:SLnHkiyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:S7HkiyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000313ee118c7494f4aaf36728b87c5457b00000000020000000000106600000001000020000000a3d6ad6acce147fc2019cd18bed90a8e210b294ecd29c9af2a76a74ce8931ec7000000000e800000000200002000000095ad7c99e24857aad2352fcefac66d1a0fe713f991802528c73a6003aa3daabd20000000f71f284661383a1138d19377c1c07a7d224f1af0be9293a5d30edb83f09da453400000003e97a2492f3255db708674ba1519c1f04ff6914adcf15c290debf19469df120b133ebc2c0f316dce3a8efefc6f2d7ff12364177276997fabaa0218f734725e70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4001199fcbb3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423370844"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA7FB8B1-1FBE-11EF-A4EE-CEEE273A2359} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000313ee118c7494f4aaf36728b87c5457b000000000200000000001066000000010000200000002021b117dfbc2d791bb0ef8014bff458d1f0aa4edce19b90248788ebd7bae2c3000000000e8000000002000020000000c9e71426e260fc05ea96392f10a4a813b1b08f8fe6dede28d02ae969e3f63b4990000000b1ab4b88a43936e188ee2aeb5e7f7cf274fe4aee6493da930555330673dd0a3a899035213b4bcf0d3161c4cab7eea5003663215eeb9fbab6e25f07e00636cce6da3e11fff8790415fba9d1c4c710ff6a0f4537e83d9c8b168b839b4ca701349859da71fc4e63562cf3aca01b7b92f4e8eda83499175c678ad90b8e5ebf585747d27d9a6a076280ab2829b6109d3def2040000000ca2281f2acf009c38cf3fdc2ecafab6d3ce2cf28c4a61bd26153bdeed2b4d67ae77585beece8c4218a2e0a740c74b69672fc8a7b40045740a96e23219a31c4f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1228	iexplore.exe
1228	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2796	1228	iexplore.exe	28
PID 1228 wrote to memory of 2796	1228	iexplore.exe	28
PID 1228 wrote to memory of 2796	1228	iexplore.exe	28
PID 1228 wrote to memory of 2796	1228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8921be4cbcd5de66c5207a74e7049074_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b850af86b3386675a6b944a696af57a

SHA1
a08263c2a3f9d3f25f18d887853b40c5b2211c26

SHA256
067bb037d228fc9f9f9aeeb44f7e5a1792a7b8e786753066a88689d190434f34

SHA512
4bcf4de3dafcbcc96eae7bc4a85d0fc0e56e3df2417f78f11073abbed13531f819cc2e188c6f234347643dc09b9fb230a3f71a142f939dd6eccf863e699e31b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7420a6ea06df8909b1020b6c6c0f93a

SHA1
75883856e0c0d3275cea82f581c5cb26487b553d

SHA256
a8ca55739e438e2f309c0b978df680628f1905ff552e1083ef7d7738af40b380

SHA512
be5dedb8126da2b3de22ad1b0303bf5c8a0e97ff051ac22b58d88ed76ebfb12dbc4abaac3cdff3a2cf9eb92aa3611785d480a341b52fee2b7674fa4fc856809f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c224a311097d6ca6692274e6d19b1c

SHA1
ad58645b4e0c6c4d50306dc8acc6b626410efe90

SHA256
168e1e7f1e8cbf9a673118f6f5ecb246b2b1e34400db946a7a24b202ef6cf390

SHA512
35228298addbead72dad7c0da2a21c1f75c9a0ced32e30635f2eba40fb58c056682380758a37b147cbbb1e5b664d0a46e2e2338b624bc705596e30daeba726a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de4c95739bc33fcbaeec52d396e2460d

SHA1
ce1fb89de35612db01bf8ca4331d347072c9b7e0

SHA256
16b43e1b01b348d5ccc43679e0544751c1bad30769585a852c9836f8bc5f6309

SHA512
f5d7ad5d1555e5373ef850a0bb8f65b63696905333b003b876a4af422dd457ea0fa48781967b0dab06ff65be8e599a5315f221b361a99b7d7bc5a58117f9753f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2954dba3987b5ae6784ee67e9b347c

SHA1
5b5c0b749cd6ae44efa6c91f03a1505e489a5ffe

SHA256
628a6ed73a20d447f2006d05fcf48faa4b279ddf790299c94bb33a4c5669559a

SHA512
e513a4072d8d2d9490fa085bef02db673ff3c49326ac1ef41baefb014dd8c3ace55a26586b702e2b79aef3a3670ccbe4910b080aaa6f5400b9e183d2fbf19ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b21e0cc7ec30a4045b92da3d55a02b65

SHA1
a0591c4f32262a42f193fcd27b203c23a6188c5e

SHA256
422cfd2493e7151ae4e65a0c0ab49da573a8e3d922dfb4fee058b6c47da075be

SHA512
2fcc4a4325b4563f5b8470a5d0ca501a20dc05f450ded8b8e4cc038d334fc0536b6f5bd61992b31422a91b2beb3de1268992f2f28f6dc94cec0d0dfe35424f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa9bfee9053a7653817836f79d55b14d

SHA1
c7e7dd2c0699b84b4b2ea151ec5634f56c5bd490

SHA256
d3dad5a81f3a0487f88d00e8ea887e98a47018ea47cd2973723c4619ae932ddd

SHA512
3a8303efed36d7a17fdc33e72d3c12981fdeaa6494350c59965793e2998b036ffd29f9092ea61ac039100e61cf6e84c978408c95306768033d3e7675fec4e34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e6c2c371328c8b3bd9bc2b7db5cc4a6

SHA1
7badaf5b924d1b65db4fa8827d4de3aae4bea473

SHA256
b1706199a8600e035994ad643081b323f49bb4eb0205582f83e4b6c1b78a426b

SHA512
2f8b026f57aea11082fe49e7f8d141d5e26c62af37a800fb999b295ef7b2507533bb4e143c4ccc9c314994ab28ed0df185d8ff2363b9e0934dfcab285477b12c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df1d4eda8adeb185927a51e7313cca2d

SHA1
388a3d9cd7089b5437074098ed570abebe8811fb

SHA256
e158f4ed0df8efee27d969d3565b441dd9c2822fc6f2cc9838153ea51413f426

SHA512
3fc157430b3736c0ff8132f796eed3b6f66a170fd67e330a7a6b50475bda4ca47bc8cc0c34c7a825fcb6675dd7c0c7b5bd103f70dc8721ce34bd1cb3d814f4a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca8dcb3444f3f0831f83563f2a501fb

SHA1
41d9f42f62eacef63b3a1deaf436130fe036adb7

SHA256
a23b2080c24cc8a2ca363c5f9bedae4e4326df763a2a32447138e88a8766fc13

SHA512
8597c389c6fe936218b73845dd78c08978c04fb6e856bca54fda6972708035a9f2379a381f4cd34818e5e74b1145aee090d331f645f9f53289b15e0f30d63320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef46a43d75b7ba6e1770a76fa8c9c3f8

SHA1
2371065e37b18f20b5a1a412e084dda6fc828e55

SHA256
3cca7bf5a717dcee289afd48ed70b6ceeb2543ec5b9f96a7bb247b2b4fedd1f7

SHA512
fbdab3b412b0df0e006b016066b81b0ee0a4ad4e49ea31f390ce44714952eb5d184db2d2832a7e4a3011342d761ee65edebd554128179536241ee2e92d5ffae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c9f611786e3893351eb659b4ae5a783

SHA1
61ce0c50df7ad3b5b52d4d9ce273e2af46200616

SHA256
b3627247f13b8eedcdd87d0c1c03b6c17db966d2206a0b45ade0ded04099a7f7

SHA512
9e6ae130a8fbd93b003b8a1101f2b9b03c3298cb9f42f033a98fd705649949d1ba0194c5d006ceb1e5595c5eb7562412110ebf611d07eae1c9b77ed97754b092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf5577ef93e10f1891d04c01abfdb86a

SHA1
3014c05d39ca2fec920392db90b2c636b7e896c4

SHA256
755191df79a81f56aa2f503f3cafcc0c8a0431f246a19c40280653f2c801ee10

SHA512
00e689335c9b5969961f1f7858c52f57d5ea839ea2d4915f8102a6e65ef937c0ce0f274895e285e9f4e9dc19740a8794ad45d21b56a477882b9a2c99773609c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffc656aa5b22ea3e9c51d6eaf5f8941d

SHA1
e9e280c0ab6bb7a344bdd58a193218f385be1bc2

SHA256
9dedb097186a6f7356ab477d8c877438d966b81bdcddf10342577c9fd39b54ef

SHA512
adeb61823f05ce40ace020646827dde00a47e60f8f582f316dc3ec948330473f6100f4d91898483c57a09671ca8b41b22733b16d3e97c068cada3f7919792d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit