d6d7e3ca48e935ce4a2a887187b23feb74b028b9aec0ba01094771a399d2933e

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eb8ff26481fe1f8e15c8bdc0521087d2_JaffaCakes118.html
Size

14KB
MD5

eb8ff26481fe1f8e15c8bdc0521087d2
SHA1

c48951def8e8f671f6bafad064d52d215cdc6bac
SHA256

d6d7e3ca48e935ce4a2a887187b23feb74b028b9aec0ba01094771a399d2933e
SHA512

0c7f3467c0153824059338823b66022eb517f7f8cbc0892759beb60092431677f1e5f4bccb30c6dc403aaaea63e603b5662600cdd05da15851c1be5e0a466c6e
SSDEEP

192:/OAc0aHK4OMM0/eqcl0oiqUzvzV22ZHtrJJ3RgdvTGABekOImQ:Wb0MK4m0/exlSxFVQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418930516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{576CDC21-F75C-11EE-A6D5-5A791E92BC44} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f45847698bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000006f5af3ca66e24e34022c0ec7948e0708a7728a5f56794d81e91909323cd1d99000000000e8000000002000020000000c3fdc1363c22b6b23b21e1cc295b8b3e34964bcf54f63e6149f6d5b516c9a703200000002deedf828a499ff741ffb97380c27bb60f0e259d014f4bf173991a379f44fa6a400000008a14ff72c56afb04b7f5bce78294189b03aed6568b3d2690a229e8b1edcee0ca17fc5946ea5e654c5192a8738bcdeb6aded09f43b274ceba590380434a529eb6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d4319bfe8c56c8c407dca6b8b3809f204ef52fa3249b10f6d6f3066fe3c9bbcb000000000e8000000002000020000000133de7063446c9a80f5bd02a1f05b63328dfe792ce7379e49826d90abfaf486b90000000ee85b6139c9ddc26193013c77838bbecabf2e32d4884806aad11c095aef88e86e8f9748d1cc71b388ecda032cae0168b53dde29298aaccbe5fe318265434f15d0e5e1756dd38bb217bba273a9863fe7908910bbea3b3e51681bf1deabb759d22cb7a7660aed5fd266c33f1c14d93ec7cff02fe44296278b624607f3320bf55145666e1239675f1628a9b139e34129ef5400000002a29d4d74c4b1448bf8abf9c198feb3eae41abaab1aec53243fcccf1480e6522aa747c5e991ad9c3243e05e8c41d463d531888bb35c77159e584fb168cad60dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28
PID 1640 wrote to memory of 2300	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb8ff26481fe1f8e15c8bdc0521087d2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2034ce387e9e6c3d65f9602f2c8718f1

SHA1
6c11c03d98ec5a189d4a306ea93f2331294f0ea3

SHA256
ca39a6705c6b9d31bcfc7b7d128dcb580c1d931e3f0b98a7733ba3b007fdb1ac

SHA512
b24112ea7ba29db118052997e1577300204c81cb5a0e9011e4bf3d377419e4b7a448ba0f4d32820eecaefc1ca927e2590dcc10c91c5385856f38094e976e4c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58bc00421d41d24f459c145da7e0727f

SHA1
786c1788216956a8e8bcd4924de0757971dbaa24

SHA256
66c445e165c8a0dc8b94d4944ace082e4e30f678f9a39eca3579e6b66405f4fb

SHA512
7018a050126b51559f170abf0935ae6bffcc20698fe21712a7e9ec01ddb132992254e239574f77184b2ab15bf0f44568b2469b5f1fc11d1f88e7a10b8f397625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a701465c4ae1dc6fec2896541a2a6d4c

SHA1
f7ad39730a364cb5fedb7d00d219bbda3f33e311

SHA256
a327032dce803e38025d085a59baccc03d0c2a074e82a121ea00306b31059497

SHA512
c758b1006f83f4ca1b5549d93ec38eda693492d1b5554fd020f9df0f82a2f47b77b301cf2549c75ea1f58d8c21e04d837a1768f36a7690bc6ae7e43c6fa58bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f6564e23e9a3ccfdb9b240342f40be1

SHA1
407d78857432bf54207b342f35f316d635c4ea3c

SHA256
d90c3197ee8fca48e401aa92425f6b3c972ced1fc49da31c489b1726a084f79a

SHA512
67b4e71c44a8a0aa3dd76597f257d126cb647b5234658d908a44c45947e523c35e7c7c567fa6842d384c14b10a54ac75c7438c2529f65001d4daabad5403e19d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a30fde80e3827e0e04dc47e44c86110e

SHA1
d65eacf5685131f70a87465210223eca1331e279

SHA256
1c20b469fea3b669b2ca42210eb0a6622787d88eecfa654fdfd425913b78c853

SHA512
a5b933e048c4cd2d28c5a5df6ee37583fd74f4b63dcc98fc8aa7d6265b972ec1762bec0db398005e4bfa6d7c712e6c2dd9a3e3f55ef58bf3243e41bd2056e6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4ac2ec9c44d398ceba2a84882ad8f14

SHA1
93ef4bf95f10861114f7c5eb1370c109e8cacdb8

SHA256
8b82153f7a8700fad46b9ae484ef35a38be3023d4901f5f13559c49711704758

SHA512
7a1667561ea7c3c97976de0479e24fad489180704d4033fbe9a8a31a6513a64da254f270d562afdc3d16d854e08ceecc2192cf6a9b8b6ea31c669a9f7a489f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4317a9fd32301adccee35d563884aac

SHA1
2c43822b1cc49f295e044fb1bd9b1b1c44aafeaf

SHA256
7558b16e573885bcc3ab89c792d49e38a0c1f543c8f5abd1501e6ea472174d5e

SHA512
bf8b602ed500786534939437c00668d7d0920afb3e646a363ad1976789e238f0927af12c6e93522fa8562f93aa2c8a81c37ff5bb4c483dcee9ae439a30476fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce10c1be72818731eba32bb2437f65cd

SHA1
807cb180860270eeb9083f7fb71d0c9f3a8b6b4e

SHA256
d9e530aaf06311a06966f2f8b7b2c744cf90d75b5692e89ec7d6efbf03b91fdd

SHA512
5ba3390fe11b693a23d897455b31ddcd99f48672de9536c1763a04a39ffb1334c53abf005ee96697bc2c304004138e085badc1633fb5a8c20e80ed14923af2d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
591738260918c8b51fb06c08151e70b6

SHA1
ae7a36b69403212f599795f9c3880efa22dbdafd

SHA256
4c45f43c270c37383d4e5112d3b40849d2b6355dc4a7feb14b1d497459cf8df7

SHA512
06c469f08d467982747e7490e9bdb4c2ef12e7422a0dcbd472772560ea9272d484a4aa899ab96eb09ec433ad09e8c852f24c85061cb5bfcea6d1647ad5d53e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6763ec5398d1ee861638e30b0a301fc1

SHA1
2582feb6fb352cc867587616fe6c5e4c7611c38d

SHA256
eef9572ec945d834330575fa5adfe206a698bfd76cc8c96f757bca0d6d0f7027

SHA512
3d35428cfe448412c0081d61b947edb518987f962654744833f531aa077b9f008e615e13c5b9cf5e7f6235de1b5e1829311ae09e7b8649c2d1b6cbc955f8d5c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b622fd2b77239885f7572a987bb70edf

SHA1
b06e17e008a92efb1bf7d9477e0fc7728bc1265f

SHA256
ce66801770109821c152ea383ca97efd79f1b3f5edd19054b63edd065ec417c1

SHA512
f3d84dec9e3645cca10077957641c2ab81efb26a24c063e468feecbe922ffad33ace4702f2a627f3a8ce13a99dd075cd9f1ca06fa6f0ce4c261c9286ca50abea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a04a077852dc8cbc1a6abb59c44ccd90

SHA1
c14d8da0451171adbef9d4be73c22d6f31d42829

SHA256
7b0fe1a5bd44973ec95a55a3768b6052e1e2d9ee8e336e6631a2789eaf482e90

SHA512
4ad810928cc56bf83bc1b5553fc58cdb0545ae501e930a1697c55695c6b20d41da07e2516617385f89b6782dc91c56945bc119440b2f8cd61ebac5edab256767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b1ef2818610ca9b698a1d8972662d5

SHA1
2806f18d8270cb2c986bf8aa8d14f8026fbe8c93

SHA256
c9b7c1449ad703e90b793fe504c391294af3d9918131f53f9a52b27a21aa73eb

SHA512
ecb4b9106c9a1d988bcd8b8de174b70906f0e5ad49c39f740a223a2f14dfb436c3c59379a29f8efa533ba8742fdd66d9625a027c0a2c226f9edbb584a22f12e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dcfe203d5db0b72275b866832835693

SHA1
e490cee0fcf816e50e8d322c6cb6ec4d3128da2d

SHA256
da46f7878a78ebb4cf0df102023893f83055597e35b42e1e390a93fe1980fe2c

SHA512
4730987a1b5c43177f8f2346de487e477c71b3e7ce4dd5b4c38da671a1eca9b49ec6c04d80fe4f55916ce16ea61f518575ccf1826aa1d1489f6f49a26f3f54a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4272c7705a4c93b5a436d460dce25bfc

SHA1
e468be4d2f99885ffcff5909b5b1582f71f60819

SHA256
a219a7293c3e84269a64c0172c85655cebdb360b136172d3a0c853ccdd14c48a

SHA512
c94d22baf8f8c823f90516abea60a67cd22daf04712b2e906b6ca32357498c9f5cc1539d48d9b46c191fb09255b71ba2345e6ade7ccda8f6860c56b911062a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39dd7c8d2e8a6920b28263a1b83ecadf

SHA1
9c2620e0367020f66cec211238a219523a140492

SHA256
312004c2e73129bb44fcad000f8346cc6299f136e9357eb830853eb58db0ec3c

SHA512
876d63c2d9c99ddbed38482f80f5d0bb961eef182bea2465e49b7dc0706d3dccf6455953299cfef2fa3ba53d75ca2c2a2c41ed93705745b6bccc14bfd09a004d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab72B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar745F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit