16e7362af599f04853c03962b411aef840ad7cc2000373b0e77509746451451b

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c9e31a4f16b9aaf4bf2585ede144b6_JaffaCakes118.html
Size

23KB
MD5

03c9e31a4f16b9aaf4bf2585ede144b6
SHA1

7ff2054bbc9ac9bf4541a8b252e6a4da2a81fc36
SHA256

16e7362af599f04853c03962b411aef840ad7cc2000373b0e77509746451451b
SHA512

c0de86fe1e81547c402cce2e7eb6e051784d851eeb9264b0d1b1e8125c9dc218eb482323b2189776e86e81baea481e4b8de4aa6bc3587620c39a922555d544c5
SSDEEP

192:uWHcb5nmunQjxn5Q/tnQieQNn/nQOkEntPvnQTbnxnQ2CnQtCwMBwqnYnQ7tnOY5:vQ/Dao

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000002a22a373bb6fb3072da89c5a950283e2ca1089c05f9237941f25b80b802b0cd5000000000e8000000002000020000000fd39654dfde8c43567a6302f42b2347f10558591ed0980128a60ebfb87b3c74820000000e7a2a90034759c87e0ea5b5fab7397536a490e3a075650b5e55470d61944db7c40000000ffeded17826f41bd17017d8e27b9d24293fe21e2d4f61705486fdf7584b84d7b02b0919e6941c03508634ddb63b03c3513a694cef55d01d64933e9285081f981	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e020e2eff398da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B39FBA1-04E7-11EF-8B56-EE69C2CE6029} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000005f933c68238f488b901604bf4847734d6acbd9564f2a3dd7ca533080919ba17a000000000e80000000020000200000002b8edfdf2a7f4da9897edd5ee9bf686800d6b83c256ff655e00ea8aee06b86279000000044a76240698e77af7a75bae6eaa5b7b38c4717d2b19af380269e7a290049ee5c36f32e3a01bf3d172e83d2d8f1267abe2c7cc96c813c4848988b6ff9f72cb5af503e2989904c37c069576f34ad5caee3baff84fd47eb09da3c23a885c95ba28f0c0e940fb3d7310bedf43bd08d3e00abbbad4389790790aa2cbbda2213fb389885ff674334a8625e38f603bbbe04c29140000000300d9c1ca8579597da292fc1bdf5796fc759131ba364f67a24e7c434a1b8a9c6a88ff0d98d900c9c3d2a3c19bbeda0bda0494cfb334a300bea91d48f9039653c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420419479"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2240 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2240 iexplore.exe
2240 iexplore.exe
2212 IEXPLORE.EXE
2212 IEXPLORE.EXE
2212 IEXPLORE.EXE
2212 IEXPLORE.EXE

pid	process
2240	iexplore.exe

pid	process
2240	iexplore.exe
2240	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2240 wrote to memory of 2212	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2212	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2212	2240	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2212	2240	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03c9e31a4f16b9aaf4bf2585ede144b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31254aecd72f08a8c332e48115549b3c

SHA1
d37dffab44082c94ca2dfde24d966b5552690b5b

SHA256
690dbfeacfc4638d66f956eede5ebb24e07a43a54090e456200baa8fe7931c54

SHA512
85fb7068e92888acbecaeb2972bd085f738fe4766bb014991351965a0285be7ed41261f2f322ce97491fd8d549ce028b853d34c38583ff3ffb2558cca0933bd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee3b406885bdc14ef0f7fb181ed0944

SHA1
be74b42715b2df57dad9bd0c62dd78bc910ff658

SHA256
f558eb5fcb8d07b0f6de1ae5965216dfd95fe964b7a5719cd75e6b3198b6461a

SHA512
869a773777d6c73c4cbdabfa5ad3d8a9d4f942ee5f434ce05e5ce386dc028873bd2dc491bbd08f6595f856577f5756a2151efc84a866670a02254603d4ed1294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a30083305ed3f857106a41c5e7e98ca8

SHA1
eed1735d4e3821590fd8d99e4891b5e66923c8f3

SHA256
457e354ec9d746012310b94c9576e126da5990b8351c1fad58f0fadfbb624343

SHA512
2cd303b470f9f214167bb17c18674ebc583ae0b3b68313ea80cef22532154ed5ab55b023f5d3690585b34d9c8d22940248fc9950c52a49b03068a49f8c8e4ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
571a803b9559f38e3dcb8739bf268e2a

SHA1
a7a2df37f5e532392d77a65171b3004681d66b4b

SHA256
5e457f02c26efc138958f6575350f3e0938ae328574eb10eb0c53632e828e58c

SHA512
dfd6ebca52dfafd0f2a4e2484ab357542ccf8cca2f06ab5c98c077911ac8212de2dea2e550220c0957ff7117c229a5b2dfa84b37b361fa6120d4de697f8d790d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcef11711329a2ee53c16cff9590d045

SHA1
8a91878ab6d1c5a4df33a96aff79c01c751474eb

SHA256
bbbc8bd86d6312f07ea0dea060a0ada9ec757cd2acf2026d8318619aebe6ecad

SHA512
86dd58b1655d2904fcf118a0f8a263970071668be3c01e0e46dcc1e125729e52ba381b21c0c7aa3a057fd0876c3f2d87f3742cf3a6abd10ed30c24116281a79f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cf5a89d373bbe5c57e26e75892fd39a

SHA1
4d378da68b08d844abacea3047a4682b4443ef68

SHA256
8da405b158c40f6afbd03e525ad2f83acfb56e17d3057a26eff0bc2c945eaa55

SHA512
859aea4aa65e5e41a3d395aedfe276769c60d2044fa4b99a52396fd1b3ba24430a430353892bc19364280d2c594853951c5ef912b19f8a66dae20e5f159c82b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
333d822c38595b1dfaa9efa9755e7c36

SHA1
844f893a9c920e295c70231844fbd4b709bce4cd

SHA256
0d4096743e67ab7f56f586dea0eb2c02b1e2ebdad918f90f30da64fd919bd650

SHA512
fa7db9d7afc5cbcdd3b740a9aacb0289cea124cd83e8d915fc3860a6beb1ab90357fbc01af82b6bb2bc98a30134348f8209e2dd3ee702d26a5492a2b0ceb3089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d0897eb1f22ee16a28246a24f6cf4c

SHA1
d5f9b30df4c9084e5e083b4c7500f575b0db28fd

SHA256
a6ef4a6029f0c16548d8a9e4f7f6aaae065705ea570dd4ca188ccc761f49abeb

SHA512
3eff98447d7a8776c3de26375a7ae8f04ba8c956705f6bb28dbe7d35d17e2a4ad5fd8c6080764e575ad5656f6e0ea525e06beb4c71703c21b4b79ab1180afe0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b8e148215141bcbd451d093a4aeeecf

SHA1
b12f9b36b247532875756ddd43c13b402dc6ef08

SHA256
563185ea40d50f3ad338ec3ead366a8920dcd7c0333d3a9b7fddcab3ca67cbdf

SHA512
c2ef5c9bd7ccffcf7cd01d526d2a3996a57087f0fedfe9d551e82b97d6b45810b5f2368107e7c6d7b57a04a6114657f9ba0a85e69e4e519888cc7b35a1880f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2768362333ac4ad937b96c61aa8d6ad

SHA1
fe6286bf583cabbfb2c5026d2fead427d5a87153

SHA256
3c164a9a243381a692b507af7b5258e0748331171515e5e1e2062a8cfabdb3f2

SHA512
8250fc762f493fd7cec6c9ed6ceaf56eda471ab2c202c273a5f0ddb25f17c796c63dc6ead42fc66ee9c2b8e111d7163b552cf0e632fec92aa4fdf5c7b507cac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
129264870eeaf0b7d36d3cd1556b6644

SHA1
22b9bdcf9ff9e747c31d3e25e49289290c606527

SHA256
d788d8b488c7a9e1df56a688068ec8c6339c5bdf73bcaf9584415da440091adf

SHA512
163ad120327c453b6ba7fde93121a9ef12dd188cb588d387851e9764131bd9143c5f50322a3c48da97207991bda4d3d50eda40c2ba242a5b0f5d2be33e130108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55f2ec795481da34da91bb6ab841518d

SHA1
d1d33dd45c2f54459b657f0d8a8b36652e16ac88

SHA256
4d281b2292721c16499fb3c925cf6137650dfbf3e8f132b549ae619bac7e5a10

SHA512
41f0b873667b72c3cd86bfd6eb215f887dcce8c54c32432705e0b9e35fad9552eaeeb73126d60152b1ed115cade2e0802ac8657dd461abae02e03232b6c825ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df97e6882f93b9b17a670f9ee4f72394

SHA1
a08a6e3e4835a0d46b0b3a5e4781731e46814541

SHA256
78fe2c1ea14d5b1340e79abe9adaebfd1b98f3d2a031e487b6b775ad542ad905

SHA512
17fed86a6a9055da030289c5e74d615be01b3c966ecc570db23c59b708c0268ff4664290e5632004d93d003ebf57e831db317512d905e5512955ace857e5abf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
800b566f753fc07d515dcd1247b70207

SHA1
2ac22e0c22b1b2b3eed56ce3707d865794cf91d2

SHA256
21f3f9657381893c59a3afab78b59d87930fa7bb8c6d6896ba3f5013e7a6b20b

SHA512
5c581c6a3f8d05ca5252eb41023511df290b4c791a6cef2f63ea1c7fd43a1f088643532562165947ba596c12545104c0fd9d51b953d7ba469ac9c40806a9e206

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab257E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2661.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit