e96721498da46bf07ee6ba6fdc588f5fc71d076f14701acd6c481342f77e277b

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f99751e9dddaaa727d184f19507a4931_JaffaCakes118.html
Size

53KB
MD5

f99751e9dddaaa727d184f19507a4931
SHA1

1c305948c8841c42933036bcdb08d8a1772e6cd2
SHA256

e96721498da46bf07ee6ba6fdc588f5fc71d076f14701acd6c481342f77e277b
SHA512

bbd183310d6541ebfc653695cec2a9432926efdc09c5d743f2e2838cdc506ec540004b1190ccc315ced9ac13621f62e04d9b226794f514b8a9aac450b4ee07e0
SSDEEP

1536:CkgUiIakTqGivi+PyUsrunlYt63Nj+q5VyvR0w2AzTICbbjoq/t9M/dNwIUEDmDC:CkgUiIakTqGivi+PyUsrunlYt63Nj+qb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1082406e1992da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{986C6F91-FE0C-11EE-9C5D-EA263619F6CB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000510f9e0b5c29ac28a065c91d882c1128939f202e6bda9ed55bf5b46e1f8d2160000000000e800000000200002000000041f52381df89dd1907003d13e9bef37a0e2aea7d206f8981800ffce6364e78082000000050b38a0b3e308392ac7879e7f40da20ff443442a2f5702a026bd95f84c292efa400000005d83ca9b2948b975914bd824d4ecf20795b285e373f20535f903239f4ada939210c88a6c5ab25ac3ca18d126b69c883322036991a3355983df21b40071226eeb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419665923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000388cc30cfcabaf12c48632d81050102da7ecdc4be0587c050c5ca44ca084f860000000000e80000000020000200000003acd91d7177121058ec992f29494db082d79aaa3da4924e7bec4df95f56f1bd0900000007ac2b7e932cb89921565a60178ecd112fe0a0ad548e7cbacec11cdf215bcaec3b9cf1d831e655455f0b2b86b92bae9d0cfc3413f3a16b5ca2f18adc7b76268a974a71f6513ade0122544e88e729208e9674efbbc774dbcfde1a57e7217aa3e243b25bca4513c36609970962eaeaa036aa1fbf3555e5556822f46481eb2c429b6182fee42c2f9cc579d10ebd115eb1e1740000000119c1bb5a6d933c0311de0b9b0b3fa925afa3a9e86f81458ace6d90ea1c57fbb3cfdd81a476c891a6c73c5b35669b7869e23871b75bf9dc4fde7f8bd32a79b8e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1672	iexplore.exe
1672	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2520	1672	iexplore.exe	28
PID 1672 wrote to memory of 2520	1672	iexplore.exe	28
PID 1672 wrote to memory of 2520	1672	iexplore.exe	28
PID 1672 wrote to memory of 2520	1672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f99751e9dddaaa727d184f19507a4931_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ff4e452f0404e6241449a4551df3526

SHA1
3c5420d39d79393f0fa8d97830bd24e2fb236504

SHA256
a1938ace42991d672daa3fc90349d082569d7ae6d6fb0fb06200dc954f40992d

SHA512
ecfc69e750d0fc1900dabd27383d3969efff4969d3b291d91d750ae29189b9f3ae36243512522077a8be0ac7a03c092ffa80b86a1a6959fd8d6453f07268557f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
496342c068df3c0e0da9d0bf229fc0ed

SHA1
e6ece887550c04601cb35c9c1446208a749aba11

SHA256
8d829a32f78d16c22df67961d6f2171b61b88481deefb4d08b540e638ab3cad4

SHA512
1f2846e4d84ff1ec1a18d5f1de4825439429528f067bf4758cfabcba886120935745bb76515b3c8a6a3d37f8df48ecbcce53b12b5924416fc654b51cad960740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62568344a4cfc014e31f2d287a5e9da2

SHA1
c3a8f7ba5bf5fd382e1011990c8600350eb6110d

SHA256
af4aea03dd1e78798ef209fd4075081e90d79b898e022fd26a3d5e139a745b6d

SHA512
a6551efe44cffdc08dd75777a4d65900b70cd36a42c81c02eecd1f5f7f11655eb63f0c6125257072a22da3465bda85bc3a44edeb7e006231cfd150de22fbf3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30f535fafb363038a996c4dac6357bec

SHA1
753fe2f9bb402fa8a46cf790974651d10b36eea4

SHA256
c96876e7efb48fa8f7036326e5efc3a6a7ef31f24a816efc07836d5fcb45816b

SHA512
e2477f16e0640683843bb377b56151eb232e4c0d48f86ace25de19bd20e5f29d9b19393e93047e1d311f19747f92ddaa992c1cb78a2a30449ee27361088e2f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c06d81280f3970d8f524a91ac96c61b9

SHA1
897c8b0dba4617abde20653ff95eccfedbca913e

SHA256
2e3974934c90ea53fb62d86bd1899e94d44c5cda55c2aa1eaa00c7cb586f9f4a

SHA512
8b2a0349f18985b44a28e9212677153f04aa62334fc10a3d0403208782ec6033ad27762d4b6db48f064c75cce4bd4bad207ff1b23951ff462eb09ec0e0fc9561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9566f441955a862841d4f5e20268a34c

SHA1
a5597a11ed0aea2cc1a74da363da5891e1c005c6

SHA256
ab3502e7177ebef81ea215e0f5b5f0c564236d75b5e285983b6a651bd06b3f77

SHA512
1bcac8f14382ca27799dfa687cd933265dae7056d0251d52c9cbf07d0074919d8fb7681b6060cd4673e553984209bfca1dd7b2a8c766b040c0e8fca81ef0b7a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d8e5493735f5e462face057993d0b2c

SHA1
316f795be842cff5a574783a5a5b601b19a8a3d4

SHA256
5eef55b5a040f9a12163f1eceb421358ec4ec6f9e0364bf4d3ca5d12cff30c22

SHA512
e12cc898eaad29cdbc73c56ebced5fcada708314c22de1b12352ce29f75e116ae74be38db393305cc28069db2687d43a87d42d0fc6614d3b48f78bc3fee61ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59df9cbfe7b6b6edfc1b9fa00336892c

SHA1
b698b084b0c5684ca5a727a82bad7dcd72e8e6a4

SHA256
5354e00ffa51024748102d843ce60605f107115bb3615d5e04dc3ee4051c8530

SHA512
be14958838b3ceaa46685a0bba8ac7403dce7d9da070219cd5f5e7f9b3924a2fb2de678583b306f720626d703a97e77dbbbaa26b4f6a95445d717d580f6a5eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa471b477cd9582349a70e00fa3cd7ce

SHA1
a25e7dcc382c6b64494e2cb10da57df461b25626

SHA256
29b65645ad8fc39f17baeafa47eccdb5cd0172fb9a0b25be4859987c18271d5c

SHA512
bf3352531ab0f2e721e0751f735f7175a4848ff9567ef082ca51c11781cc39071d0b81308ac3f47c90bc57c3c3cd11db3ef1249452675ccfade11c7ba2fe2546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c9785318fef0d6810c45ece90ef0caa

SHA1
254d6dc63beaed5af5df36c37e7eb05583fb66df

SHA256
fcc9c42167f04e35ef664dec91a9237cb54e8e25cd395011a027053f1a960193

SHA512
a6e1167e65218d401c0b9087a299ea4c638a04b0b8cb2b4fc238bcef7fe8b41ae6fbac6827a8127839ae96220bf178b4004b719ad3def8368f4e919d6e1488ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9cde93afac1980c72818ef50db936a9

SHA1
d670c436aaa73ccfb549ca452da3d9655977687c

SHA256
eb5d71c1ead1db659fa90bbd5da25f32d0c791382badcad41b6852fcf7b81680

SHA512
b179eaa4706afaadc28e330611333e1b66ddc8faf0b8345923da6e1ef9b16f60fe29dec73d0362186aa30cb262f8d252560f95d89bce1e074d302f093eacfd32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
802443dbf0cc404e628365fbd88dcafa

SHA1
ac3e3c17b4895288fa6be18d5c3c3b17f09a93c7

SHA256
b07b20a3c7cafa1685150cbc3eb15a85be390c6b0933b646c65cf9e7977abf7b

SHA512
5082c344478eefaf6fff43344be33ed8f806e180a60d946a7b1a94d67ed05514386047c6a53ef1c848ae699a19d7f187fa9d8e65f769193c8a1bbea7e3e79660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
027783d62233fda257482e73f31f9988

SHA1
f8b852b67f81296c9e75088473b0626f1c64d3fd

SHA256
2768a5c9656e44f3526120ba0557191db700ec8259aa45b4b6c2e805e8a57fc5

SHA512
6f31b21592fa530b6c6062dfa5216392a2208c66014aecf1260af884898bb884a00e13520fd5a46e849e5115d5b012a09a6201ec4662e84b82f73f35c273da9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1cfc29c0af8e987baf55a38040ec799

SHA1
0ca686740946c8a10fcf60ee82e2e9cf085571ab

SHA256
502d96ba047e6921e7277ffe4b0280567d61c82c798db66935fa65666f3d3509

SHA512
2c194293459474f1ccf327a006ce2c9667e95606b378a8bcaefd65946344b513aafd08d9b9443e1f0e0089400a0e5c95f97ada02935ea628f6995f90c7af4f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c101d5a86d288dd351abd1acd8771aaa

SHA1
bbb947d24367856a35d19f94175bc0707241efdd

SHA256
27dd4741926a827047e589ce9927e8e4e9b53b7cbdba56497d1b474d465f96ff

SHA512
6ee821e973122d0b60465f54abcd1f31d2e84a1c332773aa2b190cc6d00bb402b53f5890a43ea8b87889a605ab76b701e6ff66e9d652e02808a9bfee25610288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SZ2A9SGY\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6807.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6939.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit