463620ae3c0d1ef862598544376a8f1df2b235239e015d9e54d2fa2b0dc8e76d

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bbe3a757aa04d870591a5120a5f3b66_JaffaCakes118.html
Size

26KB
MD5

8bbe3a757aa04d870591a5120a5f3b66
SHA1

56a0ebd38cf6485b200de885852771224a6cbf6d
SHA256

463620ae3c0d1ef862598544376a8f1df2b235239e015d9e54d2fa2b0dc8e76d
SHA512

305ea31686ea9ee96bebb25bc718a0da3b3f80dddac865fe927684f3a73997bfdc3b44ab2ca7938b331a13b39474629eecfc187fded76e1341e34feb7f41f927
SSDEEP

192:134rol4cb5n/nQjLntQ/mRnQieenxnQOkrnt0RpnQTbnQnQ3kRo7Stbo+EwrkvMN:1oro+7Q/kW6Dz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423436996"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF958421-2058-11EF-9267-5267BFD3BAD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2336	2932	iexplore.exe	28
PID 2932 wrote to memory of 2336	2932	iexplore.exe	28
PID 2932 wrote to memory of 2336	2932	iexplore.exe	28
PID 2932 wrote to memory of 2336	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bbe3a757aa04d870591a5120a5f3b66_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
113540cd6b4034a8b8b3eddb3dc8e4a7

SHA1
9ab52c9c33cba58ee7baf41acc87ee01c0b34f37

SHA256
efb97d0eb2ce955137d228f4dedbd9852856e650a16b46cdc6ccd419190e325f

SHA512
2e3291389c736d9774d4c823d82f12aa0083fa6ab839ba90fc9a4bce90bb644fd08b966c68eec3b0d729f7d8d1fce03aeb3061c98e9b1e02f4c684c5cc8a349a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
257c5a35a552179a7a4c7567870c5793

SHA1
e04042d2df3d2533f26f2c487038c67e2be1f890

SHA256
a253b23297687fe6c50f99d6b4470d9a4e480ede69c4bb4e14c6559857b03671

SHA512
e08ea959c209fd9cc2036e7e2ec969284c618483c9654425d2583da56df98104f0f88b8f63b8eff6663c9428bff1b31afbff06cb0adc3033a7208c5fae96cab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4991b3ccec1c504a550ae613e598f77d

SHA1
9f4860f8f4163f06f75f7b4cc95034d72dabe54f

SHA256
ef264bd2fda8cb3df2313cfee958b94e554b2b6209920e42c6514f1e3c552042

SHA512
721be4c6b16aba36e55e750eb95e0394a517018f22fbe54e3797225a5a036e3b7509923ccf61cbbfbd2830780877c347e13fdd766a034b6a8e71d79a83125133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
562264b58d58da6d8dd896bd1ee2d2ca

SHA1
1eaec7cac5bcafbee9618422884a0fd7b0066c00

SHA256
447c07797ec76f380738d839eadda5e3c4d431df1821543a61765675978d00a2

SHA512
6664ad22ee26fd2c9c9a873bd9b0ed5b4bd8a784edd8927f435bf7d8538ce513c760ac3e7b168567e947f93d438f73ebc1170ec0a55bc413cbbd030359663c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ecd0b3e599a3691161d09c9226a2843

SHA1
ac61fe22d0aa4cc25b1724fdd88e9ad54937ecbc

SHA256
f1b811901886b81c852a328be0725019bca8b7743f2b4507f19fa4fc12d9adb4

SHA512
8dcce11f4df8997c05a532fe32c74b908b77acfe339179cd872b6ba3ce08b0eccbf3e4590ea59f59ed1c154b65485e2c898aa96946e5d40103f11e59564b83de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6034784e40ef3e40fc7f2d2a8c1c765

SHA1
ee22b0801a222a53d6bb5b919872c96caaa759e5

SHA256
6f3f9bac273f05e8a19b59174689fb18e13bff594d391c30708bc984872ed448

SHA512
2644d836428d6080a305d1b4723a385907f3853a3a23bb110c5b7f97864bfd5a017138336859bb8b9afd759b64a728e69c0a8ed4416480f3b22f48dfdb2f4862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e48e79b812f04f60462caa4ccd27883

SHA1
02c787b0ccb8ba8b5e07eb00539c55b73dd50f18

SHA256
c939721c945dd8b21fd91f8d9aee18651e637cf11f326bc4de6bc158a3dd7101

SHA512
a029d7aaba38bc57f9dc8dd6cec50962aba4dcc9bb482a18355c27597848184d1c0ebea5533eb2cc2881f5765213300f2ef534cf3ae6cbd26e2b8cba6635428c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c999e4cee3f49aa9faaf516578f9ffa4

SHA1
8f3f2cb1f75bd56ec74284785b259ee8f97bf5f1

SHA256
3d43832d56d966a5223b85d2cf44ff0bde6cf6589d08051c4cf528e5f0c0c6c4

SHA512
930758f429a9da811324beb45543b23a3a94e7b446c510a021958363d9a4922dbedb0416f1705e0ee984bd4102ac64b1db1de52012175c6173191dab39069a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee56770798634c16d8b323b8b62a7cb2

SHA1
3fbdf3e7f55f9e2b9ea4a8e378b0df0a35991772

SHA256
ddeb32e52eae8abc82b55d97042698230d201c0ed5b9ebb1d5397bed13246d31

SHA512
88ecaa3b792d813f96017fea7d3c906759605fb90b76d49861bb189cd0a99bbcb17c7f9e68194054377878db57f4cfb39e8c19d8f27e61fb8e1ca06da0b4520b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f90a3a54253892e1ea6650e0c60048a4

SHA1
d27892ec14c404444b72a4f69b212dfd4b40b770

SHA256
aa9e5fa6a1f2598ada767716ac2a6395b778741b09f159068af5039d585c62e2

SHA512
5344793ff8e4fa705596d119e0f54bd2a7b4d50662cc6b594ee37857e2a0999411fd5a63e5cbc80c93224d4b724e4461a60adb656063481c1c586e82fe6911d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c5b1b103d6b4839e88de2184f94d06d

SHA1
4ba1c45bcc62adf016506963c91448d9d1049f5b

SHA256
d51f488805b6e035f540dedcc4952b1c6486523e244d3d4f08036947ae95293f

SHA512
c3e1ac3c0dee2c8ad5abfbaf2226a78320ff99f20dca3758a873e61ceb0709a7f238778511fac2dc0bbbbc5ce0af124675b5490bec144dad19f1a2c2de28da31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2f32fac9ee291667717f624adf98020

SHA1
185cb5726175ed0a537ccd5bbc578f930c935692

SHA256
cc9d0ebc63d4801c3a125f3c65aab0b76ca5e23974ca0aba367b8eccf0f646af

SHA512
0cf7f18ec86163f8ef7bd8739800cacf43b339d4fa9f06a8dad689df805d54aab609e03cde30e1f527136e4fdc34614e3ab98469e05b06116ebc01847dfafe89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45f7bd7f5f9c19419876d26d56c5feef

SHA1
0d915e0b139b89931380498f87014cbcccf4a83c

SHA256
662e9905dc9c6dae0d47f6cf09a51708cacf402889ec446a9c28a9fe8b965b1e

SHA512
61b7bd60984455873c6c028434a5a1dad9344aff0f0eb0f4d183dd07ed1618fe9bd1c3573cbf61826c97b56e9727e31ef6119efe4ba20384ad9b0d2d3d65b8e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f18b9fd8a6f11e36f2b877d224f4a76c

SHA1
377e7c16bfca3bb3b5500d17556190c8f98d398a

SHA256
8d55b33105273e643a6c7b57a250887e0f47e682735023d15c96b16d178d185a

SHA512
ed2b159375af323ea884bf77e25b4c1e8571b67fd21ad5edf528e9c1ab2d5e65c55d038df780a0370b29cd87eef1d5a64036c0b0f9ddd2da7b343d2e2de020f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20126e0db0fc0f0965e4aeb835fb8469

SHA1
811001df3f5c39e643a3ad46abd58b4a3ec79601

SHA256
6dd95e1c6846f311b0b1d29e6a2e11e00a586fb75e460a1649d23e24bdca37c2

SHA512
bf83a53da359bee2029658055c200feca36e577ed5c439d6a3425caa76b1a40e946d56fabf1ca07bedc9ee1dc69021dc96b29af80ba9dff9a976fbc052b45163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21735f0b06b9a0422732f8d370c6d6c2

SHA1
3972990b27d72c513731effcf0451e575166503e

SHA256
267f48a59e59912f83e4d01b21dd42c607e23afa2cc7cf7d668bc302029ceba9

SHA512
94ef912cbb78aaf121209a3da3f6879d8708e2765ad4e5e680abf98f70f82c6cb13ed215eeee6d2f0080d3ffa855c33375a56f5457f35993a2647132b0d7c4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
523abc7786a072396520595d93464ebe

SHA1
2f2586a793173a0735d94bde23efe94c80614d03

SHA256
2a720e372a26c0e2d791ad5b2242aece092498c7f85cc11c7f779b69d7e0738b

SHA512
97982f3b8a7fbe19aa3e09e63aa3daecbb955baf4a9af71aeae14a5de1eef051f7ac3c149fde87ec85e673c4212822e93c0b62d173c701be4427fe39df6f4fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db681ad0de48a68d55b1bf7c3fc7b594

SHA1
1cf6da112a1d94ab350c2430afdda0c1d3dbc930

SHA256
fe154bbcab4cb218ac392542a7c9025a74161282aa608b0c0e54fbbd6fe55629

SHA512
ffb0a1d93fe7ea8ced5eaf2984abf67d534916f845d9b11fcd132a4b08a2d98150f4619eb429dd8562808f27a58ae82d289241b2576ec2213107ee380dafa4f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC04.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit