3f3c058b23a941a2675fb11245c74438fb9071167f5b45639306e8541c0f47d9

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b76f76c20d474683cc851884f95d0b6_JaffaCakes118.html
Size

23KB
MD5

1b76f76c20d474683cc851884f95d0b6
SHA1

69a40cb2d9989775ffcf24173950cf7f67df7fff
SHA256

3f3c058b23a941a2675fb11245c74438fb9071167f5b45639306e8541c0f47d9
SHA512

96bfc2367380dd38d3e63685e787fbeba6d843f2bcbec5078830d4467e679aef5b02792dbc00d475783697f44dc261abe8a822955f1f43ff2804bd43d1ebb3c9
SSDEEP

192:uW3Yb5nMfCenQjxn5Q/ynQieJNn7nQOkEntqwnQTbnhnQ7CnQt1wMBpqnYnQ7tnl:MQ/hI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008ed0aa7a916d3b4797b7acc6442368af00000000020000000000106600000001000020000000cb592c18cba3ae3dcee715f2fcdc84d03d10393e48cad4aec8d67f6daa2ad360000000000e80000000020000200000000bec574a1455309f1c5f43ecba2c7e147a2651930cd693abc6f43d1c4f278d4090000000472942fc0b1d454f675cc21adcee48eab4224e4e9aee4ad9cdb6ff14617d5e4b9bfd03f852293db2a1acf33c7c313eae0fd0505ba0064f0b93d26c3152f2be79cc3bdd5a4d057411703e68aaaeb0789f82bfb7856bcca84921a10887d7cb908eee65a32282172c703f20248ac63a795fc81913b6e149226fb227124f26961b1d133d72051192cd070baa8db7989e6149400000007bff98404e64bfa3029197e8bc670636230087db93d387a0bc885d3005e15cbdb3c2a602664fe1c31a753d30de9b773a68e2900a99f26e586cf010f9cc57abf5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008ed0aa7a916d3b4797b7acc6442368af00000000020000000000106600000001000020000000bcbc42edb892546dee1d581fcefe7759c4867ff1f29b6b323f0faa18e6967e80000000000e80000000020000200000001d4e8545f141cab09cb5dd2c47bef72b4f299c13a817fb60d91deac8a14122f320000000f0f879117857e5e865739836675e42e625560e66e9b9117beebd46869dc37fe040000000fa0c391dbbaf7ee5ed4e066164cba460636efe538059112e60fbfe4187ae8b291c8b557de8b5a5a5ca4d6fa3dae02a2edfa35e6eb3a67c0fb77b56a62313a1db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63B949A1-37AD-11EF-BB01-66D147C423DC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f46a38bacbda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426002236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	iexplore.exe
1800	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2372	1800	iexplore.exe	28
PID 1800 wrote to memory of 2372	1800	iexplore.exe	28
PID 1800 wrote to memory of 2372	1800	iexplore.exe	28
PID 1800 wrote to memory of 2372	1800	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b76f76c20d474683cc851884f95d0b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38efc1c1d06a55c44073ac5a619b11ca

SHA1
c148bfa9d16609024dec75e394b7b0527d16a26a

SHA256
ee65df08178c6fb400d5f2a86633db38ec367b8f58f29af9bc9bca36b6ec829e

SHA512
8f0f93c238b2703beb03875c963762c9170c7311c66b82699b9d12e55c5fc4779a1f6f8f2dec7f751fd68e4314defadbbb7a2045b3938fabd22bcb3634021c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eb358f97f03a8a1f882ef7fef71ccd3

SHA1
dd7136855351af7011d1840b38ffc50ebe7c2229

SHA256
a2b2bc486cb30f2353b123bcaadb429cba1a07bdeb26b2717919fb22b22a044e

SHA512
2c16ea35e5e74a49c3ce37e6bfaeeba8525e0d574b77a961e75211ba01fcb8e3cd9e06802fd3a5cac9a4bc2d62c17cc47f4915e675c65b7594cfdadbfb14d2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
607c68ac7453f38e535aded0af362a70

SHA1
09ade73821f418139353e09fee27787826c6ad46

SHA256
a9f56fdf3da3afe2a39ac1d4b1ad0ffc768f75d1768aaeb2e2fb4eb7985520be

SHA512
4d9343d2062db8069a7ca6b0c866159236fac43a0562570dae9c331799c2ec072f7c7520c4976cfbe56fc7a8308de622b84fd7e0da5fc3bc4de4afad8478d87f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50b29835a30d6168041e1bd7e53adeb1

SHA1
bf64b319aad9adc48870ca1c84b4344078b4a883

SHA256
8a30528ed3cf07474db54a1c2c69838a7e1e64b457a63f680854fb0ea7f62673

SHA512
27e37af2d6218930ae0d6e901ce826e456835d1361af9ba0ebbcd5eea087c5d57b4a2ccb799e7b714e4f20ff548703db9b05a81904ddf3f305313fe68c633b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ee40e6743a812b8e5e931c420dc1794

SHA1
6cfb9c860c01cd6e09b44dca069e0ae5532e24a8

SHA256
3f05515f7f38c85b0ccd8870ee9aa66f14667032d6ee7ccb9be9e3d49444b045

SHA512
3cfd4012f7baef00715db4cf7e2d6145fd45cb4057098bfaec7d9669b9b3ae21ad8322e77a9c0342325dcc74f9cd95b37f60ab5d1ba0aab19476641b4084ddfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e55ac0b30d79f0deb9cb6ceb1d6f4339

SHA1
61b5e9eabb33a989318a6ff2ce2584a12fa7737b

SHA256
7e9a3e761cdbe82449b52195703127c6cff4f98c6d2125a5970f3f254db01a65

SHA512
a2ef32fd24b9700c507da1e5b33853fe60df81eca649f7c279c8bd1ca920ff50d789dbe5be5d4fab143bfa28897dbafe9db1558cf1abfb766dd75d39811c8bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f1d9e0124475529eaa2b8e3685bb72

SHA1
97e39bbf1b04cb58e2f92b73e00bf9571619bcac

SHA256
44816d99f4f5754c224c0f3c39b567e8eb8724dbee9b5384b0e4f2604f579a4c

SHA512
2527f693690496d3bcc73437c606447da78bd2ed3bee1d03a8127dd97eac5675ce3710ed9bf82101caccb1bbb2ac699ee00972b6e2e8ecc2ffa8f83e5d87d552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17f58f42a2a609244c2bfc007f839b7f

SHA1
413c9a9b142298c3307af78b5417c6cbe01b108f

SHA256
3fda2d16b4f60aae968ff61254c1b8f8ee8762b0d62c17df7e818e1e065d1b7b

SHA512
a62248118745cbbae5018d41817d0912b388dd78924c16bfe507b551d3543838193abd4bd499f17a44b39cf311406af0cdadd6f741c817b6b770f6b746564a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
524589d1bcfe783d1a700a2896a636fa

SHA1
38b429a632b7cd1f32d9537d649557f4450c0f46

SHA256
5bf7a654c44736cc151150576e1b5a28658fc5c1e07f6fadba34396353b2983d

SHA512
679dbd85d3d29a7dcb9c56936e428261aa776aef0c33e9e8d9a81bfb1a7efb71444e137797ab490f8c6aeb4d96157193bc059c275a7b93e7334425d3745a93e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c5accf7b720ccae5b0bfad3fc44fe6f

SHA1
2c33774961c017e7675d29a26149f2f053a706e2

SHA256
b0478c5a0b3bfda1d5d51e579a99776b99ade74e6b1dd3caa95aea9a76aabfaf

SHA512
4248f244d09b73429d883039c1c759d45c3de091fea98901f022174766906e8c0b79e949e3c3b020ddd35d7dae6b48cdc2de1c19e3bce621e5caac32df045cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ba296b3939354382d6a6ddb78b2440a

SHA1
0066987fbe4a26f525903bc5a8f9258a0a5aaa5e

SHA256
6decb83056f40943c0791c91a1d4c85df52e6a585617f537625b51c332619d96

SHA512
0c23be095313cb162d0264eabc4ebd4742f29192a31b439ec0627352b7a14be7522fad0668de0f21aaebe780a977916eabeef53917fc4d912c09f7cea3df41e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A3D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B3F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit