e55535d1b2786722176fc4acea5054456cf02a934bddd7e3973b2e333c24afdf

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

121e63150be7ed16d03737edcdc430f3_JaffaCakes118.html
Size

461KB
MD5

121e63150be7ed16d03737edcdc430f3
SHA1

e24bbdb54c092f9d3cdf41fdfb3f91355701d7ab
SHA256

e55535d1b2786722176fc4acea5054456cf02a934bddd7e3973b2e333c24afdf
SHA512

cebcfc45e3726c562f9cf98bc0bbe02b40a8586ac7141ef6fcb98c443ba884d9348dcdd35d9cf845d122407206416550eecf22b40a35c25c3d7d3f8b12c73a25
SSDEEP

6144:SAsMYod+X3oI+Y15sMYod+X3oI+YvsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X395d+X3d5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000548101c957922496b37e6c3d93fb1890c1b9324bf9dbe80a621215da0ba1c49000000000e800000000200002000000048f748bdf599d874481abe2fe8219a3c896a5a1296b6ce2b052218488de4a9759000000091d7c4f89990756de8aafe3151ef94418c760bb0bfe30edf03e0263d786b13ddde784cca5036ee2180ab4e68896061bb8edb7e7d2a72acdc8d157880c8c9d71c7d7d90b74dfe3a1d5ee43bbb98984506828915f4170770e623d6805b6f28b7afc19bc47bdc865c6e5497d19bf75a0d46918591c22d413185eed4e5aec0dedbc98c958db24e9616413b44f8a8ef263fe740000000119b2d853d4806084bc9708ab824e02feb98a4a09b1ac363438986c7cdd458fa1a650ffed63430b3201ad0e728e18d8d6249fd678ca86c42159100a38e8bd3f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420977075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f082dc34069eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C5D1EC1-09F9-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000088703db49bdc9bcff57f5c6efa35912cef11b676ba2d33ab6edeb51d36693f81000000000e8000000002000020000000173f21ef35bd26a87b3a314e4d010b9a7f32bba32b02c8b832d442f803b7ac0d20000000159bc735f69efc2eb019ae0b630f0739571dd7afe833d03595767087fcda491d40000000bf5986b1945eb821a8725123400ea3bd6379c657d16533d5d38fcf4de7e05dc07991b3f16be106779a790b6fcf2935a3009990f52753675c4e073f416d6d99f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2964	2112	iexplore.exe	28
PID 2112 wrote to memory of 2964	2112	iexplore.exe	28
PID 2112 wrote to memory of 2964	2112	iexplore.exe	28
PID 2112 wrote to memory of 2964	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\121e63150be7ed16d03737edcdc430f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee5e11d8021d2f8aa7c765567dd4b63b

SHA1
f50ad8fef246f86288271515185dd87e6abfb219

SHA256
07cd2a89200c15bf9571d2f7ba3ec46a504abe30ae1b4855e3bd0f77d885fb38

SHA512
5e109ff181a63f06ad5c2b72c326e731727b37448517764280f6103427265ef0229bbe23fb12f33cac18f032da80daae62d63fd3ba79bfd46a61abdcbc199253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99322d4928fa5b816dff6ccb52a1227

SHA1
0cbe70e0f67fb933bb3f05cd1e168cfdf0e6f520

SHA256
816857d03aae6aabc6244908cd8ea542fd394be5823f3688aae55d3939dcbfa5

SHA512
a90d14660d4631f5684c69e81a08d70155c0060246fa6a6b6be364e1ec88e07b37cd617b754684d00a4d6501e6a89d2e54d16e315eae7b9e6ded8ca2a946e8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7932796b4f6153d01383f8c99c84ee8d

SHA1
82e20593338077b2af0fbe29aac6b4ca312262c0

SHA256
8c18c808bebbeae3888ef276745b0d3af58acf416db798057f6c7bf5a9a73018

SHA512
18217dbbcbe941fe8577e4a3322119a111751e51a4a627cd174f19af4fc46ed8222592aa8aea952a9c39fc9e323c8044f1f86d1d161d147c1635a824ac131866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aff7cf1e98b2cbe48ff007f8eb9cf3ca

SHA1
4d21e095e7aa8cbb4da44ba4dfd08ff827ce0fc4

SHA256
941e806dcba45f009be60c4c33a6a14bc6f8760de8fdb472572357ab13547c02

SHA512
5f5c80293c6de7fb6a69cd4f37bd4b12257a79a331b25cf8d372f066a5e07b2a66b2debc2dea565758dec1b143931f426d8f7c96bbe3c0903288d2d690936a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01e53376a68170ac23c035abd85db8d7

SHA1
f378d82d55026a413e1941d91b460e2b78a6c0a6

SHA256
e4229ddb45bde5e6482a5f0efcb18f8934cc97f621388a206dcff06ce6287ba4

SHA512
b2dc42f8267c7a3f5d665e83dccecd9f1cb62248a202e88453af27cc2b4a4865570acd95c47bb5902256a454fbccc5a3c2a1bcc8612f4716791c3980a6fadb1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
467dc2fcccf2a2f9d683717cfa479343

SHA1
449ec4d04054517b39ff89b1a3c2b00bf6713cd1

SHA256
d85aeafb7eb416c6b72885f9bfe8a810e7a6faff0a3484c7ad1fd80bfdc3bb2d

SHA512
b7f69e44cf9edffd16f785d08d304b6225f288960c46c366d3734d69735e9ff7a986a83c88cea9579805fa1b822cb09e4ee7e441de17425aeb3715eef8da4550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
061af9ca9d9209acb12eeea2c65c4a2a

SHA1
43ac743d3fddf36355b902bd3488cdfeeab17241

SHA256
b45180ceb1dad5ba9b25451e5aa3b7e76329a09fc534abe0e94a5e8d73a3aeee

SHA512
85a9df1d3bc79c7970c45a988c67cafef2267388491e10de6897ca3059323424c3df156d6c7c1476832b6fed7be8dcd556ab182f9be192fb56c4d132f73ae153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f634618e8ebbcd68597f6358a5a42432

SHA1
7ca4aedadfb6b5d96463aff27c37fd21120e54ff

SHA256
f75da2be48728c44f0ae53a1023f0a7919e8c162152dc03d7d73fae85cc7d91c

SHA512
fcc7709947d0e30412fc0c3cda94876074cbe1dce77dedb5ee5bcff4073c42a0306d15ffdee83e6999142578a44a71099da69b5c9c663d1d6506931d39587ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9fa68e7d13b635bda9382bf56e333af

SHA1
cfc527e3efb673ecd28e885c035001452dc77ce6

SHA256
7985657a5d62978807d434ddb83fe00d024e7086ad9d7a4cedd3c481ba57528e

SHA512
741d883acbd19be142d5afb0b4c03b3d887e26fc7d0cf28f3dbc8b34e7b70600a86cd83e51d4235ad432d9ae39221dbcaf4f01ceabbaaba45d4757045ecdd599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a699d9ddee4972fd05cdd9c5273f56b7

SHA1
ba7171bfb6fc731dd87985fe580fb565c38f34a7

SHA256
91972b7a4eb64dd1ffa834a5b3e23d93870e3ebea25e030198baa959feaaa0d1

SHA512
1ae619236c65ada69fbb4e9368aabfb5134282521a99f9f5070e72fb5312a018eac17ed870e64beba61f477a21743f094bad5d114ae36b50e17d5e12c694260d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a1006837b7b69c432fb2869d2f2dce4

SHA1
0d5d789e4c7a24f9a9be30446ab37c4850b28aa4

SHA256
0f414e7563086b94c1c940ef54ebea2a455b762cd6f48365048d0dc98d029775

SHA512
2214f134354098d3a5421b55c1d4c0a2ccd3e84fc53e1c9b94790fbc4eef41f3d8c18bff7375213736708919f75ad3d7dd12dff98a58d2bb71cbd18b440e925c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6106967430917758eb14502eb6c2e650

SHA1
5ce649ebb0be9e2940cc13120b2fd180ed47e14a

SHA256
4d5968ecb77bb9ef0d6bfc5d019559850da76d12e59e941fb0798c9fb440c497

SHA512
7dc1057860dd5b9c6ff875f6d45515f981624e28283eb3eb4ac627362d901480f2eef060e4d6d805f77bd38ac08da3af3815b1a467711cc2c746435b8911bbc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce4aa790407bdea3bff8d9c2133b16f7

SHA1
2c533501b77688c20fe0820ea81c28942e5886ba

SHA256
372c0e9086f9c501ba9cd2e6961f72f5e98c0d3ab2997a0e5180c11cbaf82ad3

SHA512
3e775cb0bb28883d6fb042bd4de3b6d077cf97f4c27ec858d280ad2f05f9945c55e9ca2cebe85ed0dacfbdaf168df83b6760003f7cc85508670502e7b8500eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e0bae4f80bb56e67788c22a177ea22

SHA1
53bc04f7412b149e9c27afa5ba89fade5144c4c0

SHA256
72a629e4c5cdfd80f885181ce6128808634e60e826c173a9b80b3a4e8b2be6d7

SHA512
7787a8c289ab84e00f76f464a5f316b8d77f2a24d03e88b28c3f6427ed1d1f60165b53f58d831976ea051cf5b1e93e6aeab20c3c0a14ff7da8acc5ae474c331a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5314f30aef9e2c4171b2126fbf17a42

SHA1
77da2b57f696940b54bbd7e043bb0b3905b43c75

SHA256
28587d452b19609dbd751a80a7635d5116b9e65bd6a92d9283bd3292e854b7b0

SHA512
970e4a6efdf77a8daa9ed477bd03bf24ae938ca866330665e19123e8f81dcdd985386495554e33e46840d3a184a8d3cfea27a8e55057793fd8d3afe6dc434cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4914.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A34.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit