411e9d7bed8ce80ce0030a146f098021d2901165c2cf4348ba423f61efde74b3

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8eb8e98e1f4cd8795f0c5b0e80ba7736_JaffaCakes118.html
Size

213KB
MD5

8eb8e98e1f4cd8795f0c5b0e80ba7736
SHA1

795aef7d3412d3eb847a40f55960de9a420a8bd9
SHA256

411e9d7bed8ce80ce0030a146f098021d2901165c2cf4348ba423f61efde74b3
SHA512

64d2beb9a7c477612a496f6ce3383d41b9c6ff5c423cf7319f2d58722b7711f154018f65ffbed2d4f1d013649263d3b25f7dc52bca91a8af0859c88dafa4d8fe
SSDEEP

3072:Sk0eTPcwLzrqaJyfkMY+BES09JXAnyrZalI+YQ:SkthXssMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423507812"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B130F0A1-20FD-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2120	1640	iexplore.exe	28
PID 1640 wrote to memory of 2120	1640	iexplore.exe	28
PID 1640 wrote to memory of 2120	1640	iexplore.exe	28
PID 1640 wrote to memory of 2120	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8eb8e98e1f4cd8795f0c5b0e80ba7736_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ffbe644164866e87ad741ea529d1274

SHA1
b44e0c1d94018a3e89beec4b1c80a3ce1466f204

SHA256
583e92396b618219fd4e1165d4a727f117162771cde46d20efe52dc3ef5e4d5e

SHA512
90d0a5cf1c634b352cd3e5e7270b71974446eafb64f58f0bdd738c210e98779379b33cbdd58ed5d5fd067e8d23de741f967e9427f40849b07ad6ae0757f62767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb4128c70b6e8121159b99ed44b93039

SHA1
a7c5d1a37c18b53880ff8df10ea54c2861a99a55

SHA256
e8b9733ad13ed5975993a03b79d390abed32f3f6a5ab985db5e6bc9772046a12

SHA512
913e446cf664d35dcd2b26614aa5dfaa470c0499f6c1744df383e292e08cc204098d95a02bd9855cc4d5325f3bf2cb74c2d8d56b3c5b372186f3533a984e8551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247b34116aa58c027bafe99790052e63

SHA1
8af59e09cb05146d2c552130aa902337810c0819

SHA256
bb27f4e755d4eb381895bd750b1e6b4e03e044e89013119daacb64679748a60f

SHA512
a8993bb028f25ef0c4632b70612ab0573b942742437fd585d09cc44e4097e6219591f35d0d5118aa47b95f6101aa650aaec500a741ff12c9c5bcb59e2575688e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b91ea482f07e4435cafe836622632720

SHA1
3b8ce91b97cacc7461a5676674e984ba005eb595

SHA256
009bf2279c2d3ac4d548302303c215b419f7e73b99bf4be3d3ee9d6201918001

SHA512
64ec014f305b2fe67fe5c9ac38d14357905a1c720385953b550e607d55066ec0a14dc95af4f90c875ccfb0fdb5f716fbdf2ce01153fcc90d08bb47f352855f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd2409d0bb071ec006993ba69a9afdf9

SHA1
188ae3e1774ef3f783226b70068ab12ec7787f2a

SHA256
e86387e8e4c58fb013ab712c934d94c6d65831367be65d4675e75fc87ba8c913

SHA512
ebf9d2e1ce169d5f798826bc7d01e4851addabf7db1d70369338d26a5e6594d7d931e89d9bb60dced479288c9e411b3ae0a939b4b7d587d39c824bda1545de31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a22abbfc1541dce0ce7b8a494e8997

SHA1
28ebcc3da8992e55baf97e01729e2f8ce2717d1f

SHA256
0a7342825599dbe06d37dba2043d1a7a09a00ff80ffc70d3dea9f0249d620438

SHA512
7cda3adb157f9b710be9dfcead45a700e81083ff98f50eeaa98d77f264a0bf7bf85bfbc7c9299e879f4cf9ada59cb2a0881cc17a19b666d4853613ca083f7436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09bbb879f1c60639f6e5b47d492b549b

SHA1
9729496d8f1172d08530e109da00895a86500a94

SHA256
b6fb47f54f5254e3008b6f007041c7b7b8e3507b04ec28ecff7a8fc7d39633de

SHA512
e2ebe47a2e6d7d193177768fceebf5072ceb14ac31fede6435c0f9ea9430d454d6089a3b757c4c6d4bf7033cef0350bcf808132b7f5f7c6e0b8a42c5f6135c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b703ec7e32a63ad95bd8b4641967e1ea

SHA1
a5395cf95c002a600f302bd7ea48fadc55e1c120

SHA256
7fe8b6f6e9ecf76ede6460d17abb9cc2a28861c56988366d66e55e5d15361e3e

SHA512
13b1d6698b2b68abeb07c21e2fc2ed75b64942f06a4ba380d5471c950001616edc309d2ceb439045b16b4f50a355f4e81e25a04ff0a674bcc1aecd7fa4456bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28fb575625a3c588578af1332fb2cb3

SHA1
9dba6401c1ef6c04cd0027d48509b3f3c027fd43

SHA256
9c830659bbfbc80cef6bb893d13604c92fe5ea3d583e3dbada50921e1a2f8453

SHA512
b29342839b73f2491d377e7507bd444bb6535c1082c963e835c6853da9815ca1d53ee9f9322a717d33df49de5f8e806727a87d4d5c5795a40b24084d8269e510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef290dfc7b30f7eacfb8c817cad0e1e6

SHA1
cf2c6fa746c4c660fcdf72335eb99c80a47153fe

SHA256
12fba1da7a4e749e32815c41f274db937d5bb85c98c46a6f213f120a4b31ec53

SHA512
1adc92e478c8912e715397da268fef379ce7dde23b0295a17397652051f7a132a1ed74460eaa38b5559831f392a69ca17425444ce60a520b08f0e8181e620d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f481af15939ecabed1d80105bcffa321

SHA1
07d51d9b2458b7abe943c2e0ee422848a7c1d7d4

SHA256
e10833d1ebd046adc7c41c2e0042f5b785efc448ed0251c245ede48528fb7190

SHA512
2b5d4e18a19307e2e8a223eb8f2dff3dcfc8d2ffd43c08f20a785dc1277f4ed5b88f39300b4f493203de5010445132c89eb80ce50d9cde56e8582516b26df615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e9635fe474983935f172f3c4a221093

SHA1
142caad2846b877dee1fc00a7f338927ac369955

SHA256
dafb334b3c1707c952caa9b1d3b6f90ef7bc361a6047c7bf82eff453e19f1198

SHA512
ac724cfb4c12f01f419157810d4b9bb3475d8bf3045250757fcaffcc55edeb54436ab8eba45c99085e8799ce2ce3140605f5fc3910a5aace1c632844e32878ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b89ba7ebfd42e5147817ebd12a818b0

SHA1
5d18d28cf110548e8b8f63c482c24d176a5eb000

SHA256
30ae265aa387a4909d5644d761e03c34c9bdd7a5b35453c3571f55a0631557a9

SHA512
a6b20ba9686232500174d3f167eb405854ae27215523ebc7553ae306ed797f6d9541b27915b38cfa77ed4ac9ebe1f135bdbf3c7c1017132bde23a54605058f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f5c8fb3ab88b07ad4e4cc1308505e09

SHA1
4e447a1f91877263661cc62a56fa2a0e97eae0d7

SHA256
9eb75d103b9a2a526a46de2482dd2c0ca4e4062e89d1309bbfebf333284b7bda

SHA512
d25beccb6987b4a192e1bfedd76eca4971551f9bdd984e76ae0b6edbac82e9a7fcb38b9ea4b67368303061256aadeeebc7071b8ce3283e5bd735aeb8bc63ee05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97775e9005c5a95fd154c366051d5e64

SHA1
f0a914a9b9de47ee173efb78deed2eb17b405312

SHA256
67b93a6fdf9df4384106c87ceb9fcec8f303e40c30bc1ee549ad97797a1e670a

SHA512
b4fb8f33c0294aa89d179597ff62b1d1bc4ef730dca6bf70feb9900aacd3a3945752cd794d6b4e6b369a1018ba53285c208c08a2075b30da458fa55bf39257da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e47f41eb5b0e6d7bc07b575dc2cdfd5

SHA1
a792862b4417abc0a2ba0f844330d042d9647411

SHA256
b2fb2115ff79bc84ac5b6af32e70d5125b47669188577f87512c906a708e5e22

SHA512
917ea7d90903a05b9aa6b7d1d900943322808019745b60ffde23934d8abf939887a3a0506d88a3f1c2da06e9acacdaaad2acc50b65678381fc88e007990331f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c38f222f2a7ab4acde2761fb846dea4

SHA1
2d89ebf37280288d0f9770256256968674946e0a

SHA256
963d784053311f613cfc6be4086c160378e04f25d65c09ecb1e64298cfbdc1dc

SHA512
1cdcd948feba3dd1ed79c4ddae89a5e852ad9de2401e0e4e68c9e738930033c2f38ffc44f6684a80f30ec9a984609830240453c9ad53c1fd462bc90bd5795c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
348b58a5cdf2e340e561cf91a7c21ad7

SHA1
68c72c5e87c057c2ee181101d4eb8191e35ac46b

SHA256
44305cc605a7d0ec385731142c91df310d7968c20b7db25550f7239b7205ad81

SHA512
7ee4fa631a88a8ef7ae91bec7492a5390443889f3f3237a0f1b1dc3b045a104eb3177e208e9fb736a8acec19fdbef77ae0b3c9889484597d6ab9953e96d40922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e75ad75b879d6fb73d7ae34bc73124e0

SHA1
049079d9d9784f247d95e0f187cc7643a106df0e

SHA256
7e25d09eb9945c959b7d298ee5a56796357a5d439af0c59bd46482e1f72a6c03

SHA512
cb999f87ce95604952f26b3907261c1e956b6ce360241f6a083ba29ad78f172d8666fd87b2a0746b3bedac4f00971aa247f0c771faea4b96e15e8df0c19c836c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit