7c76dcca3e40f46a4ead469720c10d752c08278ea7c9bd5c74713b743ce22222

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

002411399638c5331c824d4da0166b08_JaffaCakes118.html
Size

76KB
MD5

002411399638c5331c824d4da0166b08
SHA1

9d5fade6694c96bc50f997dbc593de1c37c0db42
SHA256

7c76dcca3e40f46a4ead469720c10d752c08278ea7c9bd5c74713b743ce22222
SHA512

b761426f2308de5e62ad3fc11cd3b7234bd2a618ed69b29abb8a9106423be772999dae13543224626095bf5155995ece3d59451a2e1f6e033f58aac4c5047678
SSDEEP

1536:D2uw3eVMf/stMf/ESuqIL16/pXSRUSgyFvTzrrBNWSfE:Cuij9IIRfSBFbzrrPWUE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b447e22e12bba0dc78cc0f75451c53d5648eb2a1ba3ff3def938a44cd7516560000000000e80000000020000200000003ff57d4b6136bac5ac859da06e7d3b15754cd9f71f45a4221c437388e4f972a990000000af55edce381aaed2c15681fee22bd8ddf456e558a878c7bc44c6e490179de3e58a8734ea015ff54c1091cb7c684cbb82dc542dbea66dddc48ca40689a7580d22d628c39d417cc88deaae974d85a0c8e088f63d2c257d67a954acec36dd0012d7b42c20af6a4ff437d1ac7c91aeb2b8f204be40f6832408cbcf7314d5c72625424baeb487819322db10936698390ad39b400000001053653a7467f59e7fe71785b35cfe73111e1259443f23997a53966657a19693d7a104766d2e878e64e5e74b51c2f69c700d7240651d1371dc1908e21602509e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29DE7281-034D-11EF-B671-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f308035a97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ec60c30f2170c13c7faa2720f40adce51ab12d91551c543c0aead1a09dd972f4000000000e80000000020000200000008bf373bf1a1d7e81a6bba76289a677e511901bc6fd8b4d457cb5577dded81a5c20000000c238abde315caf744b69632a64230e7e12c645f0b46bd0a45e8b4f96724f17af40000000b3eb90ac29524030bcc3bd2ad697bcf04020a2649f6caea2c778a16f77b5f7b9217bd306d969c36cb972655f18614a2fd9f4273c9f242ce14b9d68ab408df82b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420243417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2504	2988	iexplore.exe	28
PID 2988 wrote to memory of 2504	2988	iexplore.exe	28
PID 2988 wrote to memory of 2504	2988	iexplore.exe	28
PID 2988 wrote to memory of 2504	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\002411399638c5331c824d4da0166b08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b931824457087362395f6d51f0e334cd

SHA1
1367a9608a921617b535ad206d895d45a4593d87

SHA256
cfff0a9fd646380d532a8f00b2f2dad70a752ba824aa82f704f02cdb0057bef3

SHA512
d25e80cb46d73d0505664abc84bad4750736633fa978eb2871b825e676d3b6718a2be5540f32e61391cfc722e5297ac18b8b34be57073c798011596543e218b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ad6c359dd4345785ba7ae9f4779fadf

SHA1
a4eaa13d3e916930dce7b719de191901f5a5180e

SHA256
fa3b95cf8b6b4009986a7132d33021e093c0a28f954b0fa21c4834f4ecd30fe0

SHA512
4b96118335f18f8d83435709ff176a9a5809aae59143596425c4ab7b9f4c0215f2e34361a92a9072c25b760178fd85d8ee5895db8835a8bf8eb57bfa6e93d42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c599f9a2ace545b090d92339785e3af

SHA1
fac38fa4cd31b798a6844f99f30b9dc0ba32c2d3

SHA256
14f29619f3a38e7d24fe76fbaf3ab667710c59c90ff528a9f14d88d2e2574d87

SHA512
3bdd326dd3a5f9ea0a9df6aaa4243ca4aaf74bec6a461900e5f98ae0bf7d57c1336d3f59316b49ef6779eefc89ad49f434225bee2bd8f8e0ea08e37793ff1af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec838b82deea19d08e6ec7c2d92724cc

SHA1
35522d24c30c10b1b40f9ae1b55e5a6d84544ac8

SHA256
2c5f1880d6c97bd1d75f0b65922100ffdc99e9cf7a83be016f089f33b9de24ab

SHA512
9d75d2bbd8460c50adac79b6a3521f943f6208bde9fa1910cf208d0011ec6147a2f94f62d22e77655b79e1600696a9fcd49d13d3b5e54b04bddff3f7a23a775c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47580ee4e700ab4548ba2572fc2d4055

SHA1
ab0724133484bf3406cd3dfa018e068d7f106471

SHA256
d0e9806afbc130837e2694cefa49824765fd1d182c8a76d21699b2b099820ce6

SHA512
949d21249b4465c6c6aa5be7785b9b92244a9f671ca11434fd0356500b659df304526093462da2d4489a324f6f14756a8a651d7cd16fe85f13def51327a03e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd0d3c25cf93d7d20b3365373dd3b19e

SHA1
f0ca6dfb91ef3e64cc3d47b84b2c2602d059996f

SHA256
18980088d18107a6d1b44e5890af2fae540313cec72e0654c4dfb83b88dafae8

SHA512
d52ba5ab085ed3a378a2da115ae08ecd66f88f7fedf94fa293304187879115ad6d8a64875700497b778fa5ae66cc89dd9410f1b7789934d2067f3976b65f567d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e083b40aed404a52bac743465883cb35

SHA1
065136e0761eb68affb74b4d2f6077ea26c0bd33

SHA256
7fcfce9ec4147ac1dac4067a0e53186450a5432be2646444d80e0ec8cfcb9d44

SHA512
2db1ddff86886843e23497f68b752fcfefe3fc0849c6488d8637035ae1043e0562e2dbbc2bc5baa926b02aa300cb2034be071f05a8b3b9eb943b6eb7583d3861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de27868e211926944f05ddeda9069509

SHA1
c65929393795aed8db4f4c01497b77c7db5a8fb1

SHA256
5b23fa3d0c3d1b92591d55ace29bff5416058e42b90c3f34381a8f72912584cf

SHA512
2659f5b5d116bdb7336afd5f3670654f9b07f9c97d33884b3e1ff8f71003a390a59954fd9a9b727c590c51df720960f9f8207e2c5a331deac8a8ce77e01ec60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844b03d25d87eec6ad91ed6559338d30

SHA1
b6fe47797afae061f99577298d18ed8fbee00eaf

SHA256
b4e6caa9de551b7367bbfb2b42b8fab6adfd298311f00d49aab0838efc18d85f

SHA512
8564ef00d2d6810027b4f4f380da650173fe1fe013d88b8c86488fcfba54e3b6e5c7efb7b77a37f7f3e3f53ff7f0dd05e863368ab1cc5d480727d8ff12ce0f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9007ae1ffc3b040cef2ec952a7c1b4d1

SHA1
b328560ee3f1324f75620c3cde7fd24b8af03f95

SHA256
6bedf9025bb5b67b51c50f21c8992b9e56271a52b0e3fb5cde85e76c9754f7de

SHA512
49a3bb7b520a902d945546849e683ec013dfcfa9ffdab8c3ce62a0a62fca8f6b0ed27fb07cec7529f21e5203e2755bd5556a0433c844bf035ba2d9cde68af970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f8468604c233ed0ec36c58357685618

SHA1
4f60c63d4d22db9a6e3a593cf3909ad767b5f345

SHA256
3f18a8347be452c03e54c2e4594be8b47c13bed518d2e25ed3822988aa25f57e

SHA512
2c158b54b6d645b8b7c0f1d3d3361082e912e3c7e90584978651e7fb3546c5fd28c716726fab74adb4a30ef4ff71915215943d8a6190c522c2c146e658e2a5d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7687a8bb837121c19a90ab64c14dc4d2

SHA1
99aac57fc8290e8fabc1323483563d75b840edf3

SHA256
68eb0bade579a2ac305644289d3689631d43d7fbe4742fa62a2e1535a7b4639e

SHA512
9d0c18fe722261b1e3211e34e7aca6ac5bfdb3c152b1734f4bb846ba2b6f4f2b5f95b5516f28e21f3b817d2eb132ae1c8a6a5ec0c4bfdd85b492f55b8357190c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4ef34feebc4144f6536e4b0172dc3664

SHA1
49e3e9c29e5b4997fb00abce311f05822a463bec

SHA256
676d066fa690eb55914be2567a0edf2f4ae1ae37a2fd9c8bec09278edc740f64

SHA512
1e8ffd505325f2357f4a9b2d2d7ee63b457384cae041ea00b3b53aef874f8b12b412b70e6a24a16b1177693ef0e933e6ec499ab2f32e0f21f72fbd290c0a0a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEB5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCEC8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD015.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit