7bf33be33e4a9f3a432ea19eb33d64632e2394ed779b19746739ef2c7622f710

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3c116c5687bdba9d8c2f4c838a35f4e_JaffaCakes118.html
Size

139KB
MD5

a3c116c5687bdba9d8c2f4c838a35f4e
SHA1

dc96f70300de6d5e4a9b7572c6b6b84b9651c359
SHA256

7bf33be33e4a9f3a432ea19eb33d64632e2394ed779b19746739ef2c7622f710
SHA512

510074094751d0c1abffdf60965e841c456502867538f955646946835ffb70ee01b5149aaa639397798e99328680c7c873e8b96304b391f022cd245d49b7b17c
SSDEEP

1536:SeNgnu5sle7QEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:Se7R/yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000a7a14c834624840b3b24606f834b2e000000000020000000000106600000001000020000000b2c5949f64bde3a2514c80a04b0871dd17b998ad7db0e08baa9ef89b594aa4bb000000000e8000000002000020000000a87359033ff4e86f2f1199012c3fd244b642a9d1439b3bd6e1754c2501ae884320000000f1d1d9c36b7ae71db540d09fcc8b376112f39961522d113666a11c5f587552b3400000004cabc22cebcf128bb3f2a17764c409f8f4c0c3a9b32163fc0321a80ad1237d37e91ef10da2f312ebe12cf9f7382d1a369a33bd32e141d9b0ac085c1cad7df6e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424412907"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06c3f1c46bdda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06145831-2939-11EF-A564-5267BFD3BAD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000a7a14c834624840b3b24606f834b2e00000000002000000000010660000000100002000000093756008919aff22df924ed8120fe23cb1ace709ac4279c491279d193e1367c7000000000e80000000020000200000000529be47644de545f227af32ef4b5afc49f76b92908cf0d8ab7c911b3ea2d3d690000000ac3b08500f0a7a11bf7c77437d1e03af2d371182f6eac127cd297e934251cbf85fb8205f4440231544046c191bbfeeb495f8787c54871e31836f1934246fe71c058bc258d1c494034346f78bfd33dcb1164f7b629d3818f79d8e810812e19af6bfe5709162493d98fec5f0092d8ca0f704ddfdcaf0b0da8fe39c843082dc02e31326219ad5040ceaf2c7d131b2a10440400000001b886eaa506ebdcce154592ca5e47dc8c83bd1cf58b063e22cbf3d7451c34dbe43a58b8f4ea5e388e17fc54452e28d66b35594080d171a409f9816c03c16804d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2520	2000	iexplore.exe	28
PID 2000 wrote to memory of 2520	2000	iexplore.exe	28
PID 2000 wrote to memory of 2520	2000	iexplore.exe	28
PID 2000 wrote to memory of 2520	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3c116c5687bdba9d8c2f4c838a35f4e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7efd809c57c49a89e3a092ab3ad684d

SHA1
0dc14750a1c3343b08527a064d67de51d5a5c25c

SHA256
20db3581e77621aaefdfc6c676ff5d973feeff39ce96a2886c00bbdd306ec88a

SHA512
7cf871a02f4e3a97e0684e522ab7313fd15667525c68a5499761bf145c1065dc4b14c5ad1ab8eb1df7147927ef7fda4535d0d10afdebffed3ce5a2035b2d8e0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79646bbe995724d98f595e74ff0c2212

SHA1
7d179e736efc2edf97c7274f7fa48a24565209c0

SHA256
fe357984ce302d7ab78fa5873d8a79af9928f884eed63fd422addebdf5d3f71b

SHA512
e75ba609c52673faafb70bafa0d55ed4dbc4c19bd51ef9d2023765d727a901c5710e4cc6b053562ca237d3a2a9c001cd39643699ece25decb6beafb28557524c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1434d7a368abc4ad4d2f4bf16ff405f1

SHA1
7cdbae5a5a1e53b450b0112da9046a5505dc8c4b

SHA256
d4d2e95cf26848675d95b4a6d4ca4519cd1c16ff377c3a28a326896f570719ce

SHA512
53450f6aa5e3d714b2d863defe50ad2ab91a1ca27e2ede43a3358858e9f2aa6ab261bb40719bf4fea62898b4922607c3ef78d480a70d6aa4f6bc3558723def5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4d3d134b1bd201f0da3b02b0dd4bbff

SHA1
4f506432fa3df5e18dafd54af94a515989a64b27

SHA256
2574f8abfe1079036898cbd6d0333ee6c62a486cd05ee1b84100273b61150149

SHA512
b5a84317225b624646d6db2755604bff044acbbf9ffbb1ee089fd992c47e2c4905f2b414fe389e43c107fb846a0227429b89a134d08b0c37689cddf98c74ac91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cd0ea4f1389eb9bc5da6acd7d72d0fd

SHA1
830a01019614268aae1065552fd44ff6b7ecfe13

SHA256
4568dc651073cb6b2ec3f8ee99ebc072d05759faad7ebbf1dc788aad0e0a8629

SHA512
6c27efcea0e98089a17a179d63e690aa9bfa32c8fbd0e45d36f98c469251e77bd000cba0068ea81c2d0c8116e6334ddcd64a7c85878ea7ba9f45da402dacf915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8c79648f82eca8bca0794bf27848386

SHA1
f9577d3fe58604b8f80b2c7fcc9fe2b2b12379fb

SHA256
261aa366716a5eefb5dbea676d82e58db9b2f1bf5ca6d68d21cc17ba17be7b77

SHA512
21c8d53fe598bdfa87c4ecb9691003be76de5a3897953cc6db936a6fcf62d38d9ac2ea404ab6f0106fa9b9f07fb6ae8afbeae9ca65b7629a23427afedb0cbbfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
014182fe729d06a3307fd05caa38825a

SHA1
5eb39654e5f6b4a7e5c0e523d7c0e72e60f8e33d

SHA256
855b38dd21d8029a14dbe357f1479af4e8c0bc5834e23a1911799d5d58b96d36

SHA512
89ea584b50c84bfadb8eb9c143353c790a7ac2430d8e158357b0e24ed6ec16329ec71b06626bd7f101cb97695d1ebc3e08bb2c792dda9804bbf602e4d67a3674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d2ec1d6ae7758f35508b4ea98089882

SHA1
4364aafe744d955171a57fd971807138337acfba

SHA256
16d5f86b7298b918023ccfd04c5294e7c559af66ea78df135c6b3c38fe0eefc5

SHA512
2a28dd4b94817eb21df30d7589f1e4ed44a02b26d43dadabbfb08d0de1bb4a3543636cea266b3fa3968daddf8ea662de133275d8025344db2d50c07bb66ad349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2f4ca57dcdf7ec67d3e731a22f6ccfd

SHA1
7d3d5cb521ef1bfc875a49b41af951205585ac4b

SHA256
51e22c490b2e2e9cbffe407ef167b45816e4334ba3742f8aea229d6c7154fc7b

SHA512
afc6335af13ce9212ac97ff667f3316e95d2894319e67f310fa449886972bfae0a5e8de0120704386a52aa1c8b8fc5378224f50b1b317b42422444043f7997bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e03a2679df258422427c0bedc107b43c

SHA1
4100495876062a6d9ee494d4f4a4b32dfc94104f

SHA256
4c09c986364028eb4ac0b4b1bf00ac36a7f9a4c9cf4a5c8483d7cf640a07b167

SHA512
772e98134feadd15f2376146f781ff66aaecacc01baebc976a9958e95358c563c87bcb0eb4ad5f7628f55a9e16fc4c2fd73eec56b22aa7aafa3f23ab78a31b28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A8C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BBB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit