d743f20c833a3df778a7e6420a5d69ce9cb73784daac869dd3f4ee54ff4814d9

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff90ba695a0cc24237ec2a7632b4a79_JaffaCakes118.html
Size

4KB
MD5

8ff90ba695a0cc24237ec2a7632b4a79
SHA1

6f837bb6bcf94393e7c5f14d187fa6954bed3d93
SHA256

d743f20c833a3df778a7e6420a5d69ce9cb73784daac869dd3f4ee54ff4814d9
SHA512

d841671ed1768c03175bd73fc35a77f8d34bf3dd5c658e6cb8127b5338dfc50d75a4cbb14cc89f327e802d06d7fb52ccc00f20796a1cba8620ad1695e76735b1
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oRzdxNjd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b065a4a37ee39f6333e523ae5db3ff6fd16ed709bf4d5a77febe0f825f712123000000000e80000000020000200000005c0659646c3fd8e33f0b1c6db94608397edaa4bc114afad9a723d636a1648b9c20000000ea8f81a9885779493f719a9f919287d84fc52dc86fcff262d39bff189b9c56d440000000d35c68280f54cf38351a86caae902162ffd00e728ac2d08031055facad1d7008ef62741a06679492f927376be9735b12c44dd30d8d3742c004e6f727c68ae2d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423536809"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35548891-2141-11EF-99F9-4E559C6B32B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08dd9094eb5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000001a768009948ce7106d443c11e5d9b65de5dae3520f3b20ed36e6595f747f5c03000000000e8000000002000020000000b9fc7fc2c7c8ba91430df3e6fc866e8600c311b86c972e0f8946d761bf3b34e690000000ff71c1e0c10249062fb191a05d51c97e8e3ea59e56105d8101c1f5b135029795d4d5e9c0a7e0f0b873c2a610eb9a455e3b576b700a4c58e1ea4aa2958e4f02ec42c98c84abb02698c8446e4e12dfeaa1af8d9f3aa0c9265a5125dbbb560d52ea46727b3d9a90760b302f4d755baeefd3aa82a50f5eca96873504d156e03d62287aa8285a12d3aae8237a4d38359902c6400000005703f0ce73f07c0f1edf6a32cb689105a71df38094969688cab754cf8cdc61fcc956c35e1549550b3b5abe84916e5beb9ecc1e00afe9499af630ac06e391137a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2996	2420	iexplore.exe	28
PID 2420 wrote to memory of 2996	2420	iexplore.exe	28
PID 2420 wrote to memory of 2996	2420	iexplore.exe	28
PID 2420 wrote to memory of 2996	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ff90ba695a0cc24237ec2a7632b4a79_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f7e86d589bbcb8e949ba44b3c1d39c

SHA1
a1fb00f1f2e2bdb7f42b62437ef0b49b38857476

SHA256
89538f168b549c2b584c98647f7957b645d2f830e948f89edc096852c863b882

SHA512
a4b59e4488544b2e22f8026dd63f41b30829b2b3b7129d369f5aa627ea9133c2815d535a199d831fdebd57b3bc60791271437fac4fde5f2b58522ec1f0b0e5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc44a3e710571b741f9d79a50ba4554

SHA1
ce6a680c2dc702a0fb51a1fd5d32afaa08c76a07

SHA256
4711902f5eaddb441bbac5ec471a0089098c007bdf5936a5cfe1625a0fd9c308

SHA512
e0d7be5b7b1ee783b3e72af2075aafe0cfe6838e27e149bf942d7d4d5a481f41475e82530730f37c976b7216b5181955b010fb8dcb21de2a18a9722877ab78ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07dc169e9ab478e1b0b7874bceb43802

SHA1
b4f221fc8b44de06e869c5af2a0874b4b3dedf99

SHA256
6aa05555fffe3fadc016c8d48211bbaf815c1117843d142bb0b9f1c8c31b85cb

SHA512
c0840b518a8d5865351f71b84c75ae6f489e2a0483b3b21dfdbdeea5bdbec2cef05b7aebb2839c8acfa78f6976f9906bae7b88dab46cb45f9df2e6d560cf657d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2eedbfaf9320e7cd24bcbc7f8a96024

SHA1
3880febdb1948fe38553957b918fe20c9f2a770c

SHA256
5203d70d2febe0164b252f0c4812dcf0c6a7739e629271799b202ef3b62ed5e2

SHA512
47b8818e083948cf02a4799f8116743ac3f8f061f7bc3b02f1b119853aa122c98fae55dbb54a83d06392f60f13fead636b775b89b833bbf657692e018622f301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6205ea82fea0c39b890c4caa4f70b240

SHA1
a065d935819df7a61acbec25dc1cba0b7b33df1e

SHA256
b05b67b46816a395ea889d60f53adc97a4ae118f1cc27217f240e830aaf2b3cc

SHA512
06baf39d254f02312678ae721846be6011801b18831a581a8b060697b1d29da93cf1b8c9c67060512cbe47d9a52eca0f6eb8b9f95f8347645219b9eb5338e511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95bdd2690a2313d8b460f0bf6e924b81

SHA1
6990b46b0a2ec839af718ac8bed350c7ad8fa934

SHA256
467585ca3c8952f4325ce3f827a2119b75199a82960f83cbf93b9e4b93b7d307

SHA512
5972475fdec2d3cfd23c2a1ba89ce106120d80a6a351340863db414065f84bd5f703e385b798d155ccad8cad6b0603a15e5b598d58928003ba92839dd262932e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be7b4f3fd11c78f115842d1d9c54f562

SHA1
1ae4605c88299396b25f4c89e372b01e2a323417

SHA256
9c8a4da42e438409ffc5c1f8bdc486c62245e2ae633ee4101148182ab599f602

SHA512
d309902de84dbafdd6ea409ac57a67263f7cff30031a97070804f6a16d88fe8dd5bc21d5f063ca387acac2bd8e0f5ba1d2442019f81298a8644134a1fbcdf978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a85268b2655109f3695206a4c150551c

SHA1
b985bb21899c6653d743642c28535451268d6426

SHA256
4b3eb3b135e0e3ccba0a4f5818a8f344cc584a879920166795caf3ecfd9f1895

SHA512
f5b64b5b1932ef360dd8d104055669be1ed32937b84b60644956ce9bd1eaa581ecd7473546d619132efdef37189a07d838e439d5e1e5b43b22cf783304ce1d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6d1b473016cc46a757239646e9b5e49

SHA1
fc2b5127915e2e85cf944c64dee51ba05eb632da

SHA256
fb0b075802a09f0af10bcbcc6434f6cd9a9d038377fd0517ae38b9808a46382a

SHA512
6e84202cb627944981954dc522f0cf1cd1d790f59e41e00063c92d3de47e01d5e4801890879ca6364afa57229d066466a89792c802e813da06300ee00e6b12bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4202d4c51b510181aa8999019327dd55

SHA1
4fad5c84cf22c625c4d7fdaab44b714ffc7d9bb5

SHA256
a9f1d44508e606148208d9b0b1f5643fdc39cf0f5cf4b18f43a060b6b3e3a1ec

SHA512
a8d6294654d5cb4eac2a202e56d4fc859509a0f4957080d71905af34b991ea987a4281824b6fe1cccba0c064202fd7210fee9efee206b684253f337fc7ae5bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa72c3743e7eaf7f89244b58ad60e9c8

SHA1
f41ba6af5d6743bbe15b3dba65219c7e8135ce22

SHA256
d979cb6d8786aab926a7234bc9440ade20535351b0af72c79cd10f430f7e1d79

SHA512
2e1d0efd166aad0267126ab1b826e1719daa9cdc05a5059b0fe744c1bdb83c1e95d7e976576edb76689765407625affce6efff8043e51a02715509bed7b0f73a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
801947b9d1aead62ef81392677589c26

SHA1
ab35d4330b9094f3978c98b47250d21f86f571da

SHA256
1654877ff57c174701e00b0cdd922cfa948ccd7eb93c266ccf2c38684afe7f19

SHA512
c6f25534dc348df37590ad2ed2e5694eab10cc38ca83d3f5181758ab1e073b267c9d17ab38bd11c38aaf5183bda3f98eeebc1a970b3d94d260f1437c377eafc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5907077624f22fdd4b88e4d327b4e71b

SHA1
0671c4167fd8d283cfa37a5c728118aa928b7458

SHA256
3f5620652810ae9daf3c7e369b767c49367e3d4092ab60f5829b062dbd52cd08

SHA512
42095faee804b66eab5da8f316b0018e064c2b61b50da3f2f70289eee5d0267ccefe544140b4a581a84ca33083330d7668041ba6746c604906f613468b03531f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6baeaec9ddd8eea91d0f9d09000456c

SHA1
753d5617d92e2a05524a53f5c36eca79f6a82a86

SHA256
70093abb04e5e330b9f3f7685f7cba31323350927524294bd3314b4281420e5a

SHA512
67772e2bf2e236e320b63576bacba659ce19c4ea605c61a605b950fec25162c2639f7366066870d739526de671c48ad92016d7e9393b19228f1c9f3e3699ba07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b231c6771591a8a052aa454c34b0491d

SHA1
b964df34f0ff00f2ebd7bb1e47c1f6635f21161c

SHA256
99618db05c276f204ed745dcc99dc10fce4d47b285f404a4a2d842e241bae0b7

SHA512
54f00e0c242792f0bdae534550115d38cb7598cd57d2c35dde62b611ba9c73d93a134aeaf093dac2608d6c6cdf6207941e9d5ed74b5ab91630fbb0e366440e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e27cb6688944359215d7701f0c2a9367

SHA1
90ea6e5c6742e857bf20140f2d5dc47cdd6ca4a6

SHA256
aaf5873d3c93ca695129008fb2339d3fd25592a79a1548c13012ecf541e65ea6

SHA512
ce1cceec641d88eca0d224c28927028bb17d8f4f7beddb1f14d92781539c1e9f2e402853636310fe5efd81d2ade9b1365fa8357192e5af436a444b9015d83dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7f1d511ac0bed22521c0f9a68729c69

SHA1
84647bd860601fdc5ae53df06ff39c76f7450553

SHA256
709e681e2cfd47662b73e9ed972504018719fd3442f6b0ea769776a51eaa793b

SHA512
f8d2354155def42ff22f16c4126d5d0ec4f5137e77dfe2610b0df8c07764cf9ed1265d5672ee1491313bf44a18f163d311fcb09a242eca29e5894bc7100e30f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit