e6bde3fc4db9700ac4d13f4111a3bac07f2b88756ae0fefeb97bc346300165fe

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fda76ee9e2e62b2f5a31545aa1f977c1_JaffaCakes118.html
Size

16KB
MD5

fda76ee9e2e62b2f5a31545aa1f977c1
SHA1

d5452af861d78e752be5d9b34834a409eafc36c6
SHA256

e6bde3fc4db9700ac4d13f4111a3bac07f2b88756ae0fefeb97bc346300165fe
SHA512

cb66e243b703e2d369ea08db4ff324ceeb2c55ae209861b02eea408581bfff540a81c5f5e1c1cfe947c2646f0a66da01745440ef11bd043ced8e2eaaa33aa36b
SSDEEP

384:dtztc3qFHj87+stNQsNTghfuwQhn7KH2V:tc3qFHj8htNQsNT08pK8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000037f27728ec0b3e453fdf5d571ab10c232cdc7a2e9cc77f9c4a96cbb899b068c4000000000e800000000200002000000040f97856d70cdbafe1d9fc0d35b5f2547a1abc194d4c8848f8dbc1cd495d683a20000000d59e85e42bebfd67c15678b823f706317e323727f13f6896c72803f1dc0e339940000000cd1a5a08c5762cd145b22e3198cb74d080bf789ad0308ebef77ae0fe896ab2bfdb75f17982cedabd5e6bdd069cfe439b46ddbbf0b852d283735565381225627c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419809271"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8066d7336793da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000004f6b018c69edf79f5927d8183510748b007b95fee111a01f44cdc00fb7e76a94000000000e800000000200002000000092ac278fd81ff8b2a452f4dd4c7f25aec565ad2d30af0447c18d4dbe607c1fcf90000000bed02fdb1d6fb0a49a0b21f25887f67ceb369317859bc691591b5695b3197820afbc18a825afd2e54bd134e61446ec674758a7cf1e700c272cdf9e40243d0f617335ecbd234eac51d92847b10c45ba38467549e9a273363cb2dcf6657c6cae5b543de5a845664a758a4a20966341ec15aeae62bd5d5040282c90f5d6a3dc87c1c1b409ee0b631c574ad4b2168da2944a40000000a5fb99002b7dc89a676ab1f069a499400cf15095780b9a7bb4ae7b2f8fe940710dd1c31bac9ed074f5dc5bd79e25d494b38dcbb0a2fdd99ad749f5edfde6edb2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59C1D1F1-FF5A-11EE-BF93-66356D7B1278} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28
PID 2040 wrote to memory of 2520	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fda76ee9e2e62b2f5a31545aa1f977c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c4b67d76c35f86622b846553c6b1b99

SHA1
c00f03ad0c1a8e9254a73b45c913c3a35c16ac24

SHA256
e2a588305812620b2e002beb80227d0e300df004ce2aa38c5f92044a909af158

SHA512
7be71879a3861d26921feb35868056b6ba3a5a2af2d387ddc0ca9019895a1b21346849d72c848d9176ecd94075a128d039735f2c2bd041ff71de1fe2ad16ab23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f05f64246d34292c848a35539b7e5ef7

SHA1
10e8c212551cd2ce63adc21caf992b80eac30cf2

SHA256
e82c64a6efa51e27b1399b2c446be0ffe1b3d39c2207aa395187a3f9c14b8a55

SHA512
606b6b6280625c0402b0ee6bbb5d860a2f709f408e7109fb99e6e6736154ef7233b872272e6bd6de113070124df2b547a6aa3cc63c494f15324fdbe9b76beb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2e4974adb705328eb0b9c9d07064a60

SHA1
b7919215ff2371d3f1f0c84232312daa514c8935

SHA256
e2cd4e0afc2f16f1b3f95e67080f05b2adfbf51c6cb7ce9a5abd0deb54d495cf

SHA512
28a01cd1597e0b4862e423983accd4ba1dc5ad03b3655c79dc54048d124f82928ccc87b3cf2cac4cd74b59e02a6bc5bba87db8e8813a4b55501b9bc48450acb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818e680637b720fa320123d6df57d1c4

SHA1
e50792cd48f14ae3d374ef30425c1eb3723b0063

SHA256
af7b99c1abd4723c44c7021d7fb813be3908ed819065af6ccc94488c39335b00

SHA512
91619be21b385f396997802026bb69e494d05eb3a4ae9c575a9899fc399dc62d44d61df4423a7f0a58625fd4e0f7545411269cddc1492775f6e63caab09de5f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50ab86f2fa39346e7ad07d8028b54af7

SHA1
d75037ba821e4b740e130da82e3600a9dfd4ff14

SHA256
cd9df22dd0228afe8fd58e008c91db12e6bc1b9ce2df4d7db2c1aebb6376f12e

SHA512
88c64432a5a985c566a11d87581141ed81eabf33ce10f7c2ac17971d8866e514990b5aea2e21816b026f3754e9c6c845b567afb3009bb44a5f633bfad3a58846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b26c201fb7211e347c48d3ca84c5ecb

SHA1
88b6f0bec3f511465cd6e7954614da959cf9144b

SHA256
8238671d809b4b4caf28dfe6b950e555cd7ba769bc88a9500ede85c50aca25cd

SHA512
070bd58e8cfdf5996053c3006df54bed52fd6a2a63fdef080752ebede1c4ed470ecaf0403d1e56ff41efa28fc4a4e936702991f722e4f6170d1f2858413671b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11ae958269e939126aa4e9d1bb68e95a

SHA1
f90dc7b47d524e82a0f1d8322acb0c127a845464

SHA256
5d5eb610c0bec039a1c633898af6ab4bb234ec890cca3eccf00d3094b0ac2fcb

SHA512
e67ae12e9988e44021e8a9f9cd42b19bd919d83031205dad236f12288d80e9abb7edc6650c3f343f28e432597e6ee2271dc6ddfe716044435a2fb8d65035a528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c8fd73526adce1577e8c48d30ea273b

SHA1
6d53bb48eaf1eeaa8c347be5d62af704324b10a6

SHA256
43900c3385677b705426b8d2f22379f4285be2042d3efac1f38987d4cfc3fef2

SHA512
8cdd2f6fb1139aae1afc6624402817be86e142a2af01e9a5c185c08eeaa11d60389221f1cd63ced9a2f10a3f8150fc643fed45b4e547701f6678b57d38e5b219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
094e0e509c7c1f50ea1b9c5086752ea6

SHA1
543ae5779a1b5b4806b1b69c3013845524f1853d

SHA256
17695af5faf7fee9369cc86a56d7b24fe12224a9d2ea24b8ca45444a4e784b19

SHA512
b80c5c8dd4610a9019fdf218ff6dc1a50905eb632a503f912b40a5ebb79a5ec6ecc5408c1825a55bc905e68ceb5730471c530f33d4ef628dec7338324f9e5794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55ea194b4c4f0e7458c76e3cddb43c82

SHA1
fd9eefb2d2c3c4a95e8f206b3278ffcae8603ab0

SHA256
4c68bbd472acd2f719af7bbd224464c5104fcd9795adec7d5a30a08977f855bd

SHA512
f6f16bc5ea4e20e82e9c74d153fe22d659c1ede94667175bb380627712bc04058243be97615702db93eb26ff362b21a8be4e850ed514b981a13d5fd71ea513a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c061e3d8bc1474ca0458936ef1d8aa59

SHA1
103eb4a9c1083e1900203603526a3a3ddbb11435

SHA256
6cc1837bce5592daba6ccf55c108592766c70b808c0f62650b8a7225fe488bb2

SHA512
df6a978d267ee02e9a2550600c92e918d949acb440cc7df49de9efe3728dfc7f9513bef1c60708133c82e05248e55b52bca51fc5cfe59c569557dcdace4474dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df4c8e306fa8b4cd4eba46d6b65bcdd4

SHA1
9df2d6755a465ee4e7c8fbe6308c2951b4072998

SHA256
1f6b55dcfd33ac980395eb9e99d307b6fa7cb148bf6cf84a6cfc5fb6509c58d2

SHA512
552213c8af1e0ef50c8c098c204531f0993c49d69d0c848e56f78c1bd87cef157006723d27c584a0b766754d8ae0eb77759424fc7bbf636bb4db5fb44679602e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bcfcd9ab5548e3cae00d257bae66cee

SHA1
4e710289450c10efea78d5bee1072a00d1ae4dcc

SHA256
1bc8154f7e3797f5719eddcc3b6be4ce15c3f7e1db0154e23f4979d8391d6299

SHA512
35d9127bfeaec34d978cac9879cef601aec881eb8b37dde3abe7473c1d365f53638ba0ad46086853a02e0b07f3b4617f3bb1e154a6b4ff4afdb02e49ae816ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0593efe1916263a135ef6be8c4dabff5

SHA1
66f8a8a20c04187e83271512e35509664f41f846

SHA256
1c4fbc2d83f30631b5b37466e24136824edd8c448a3540468cc6e12f41fed2ed

SHA512
6be4980755cb7a9bcb4c38c97e6241c1d083ed37dfdebe2f70265fa0e4f110b8bbff23a18073fc85791147195233ea2e92737ae40d1c822a52c8853649f203b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5776.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6478.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit