efdd8bb61c5acd9c33c35abe35005fb6be46d10768bd54068d7374eae406d9d9

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20219b7dbe06749659277faaacadd2b0_JaffaCakes118.html
Size

4KB
MD5

20219b7dbe06749659277faaacadd2b0
SHA1

7cc58c322ff24178d600f2f8d3ba1559d1cc3e7f
SHA256

efdd8bb61c5acd9c33c35abe35005fb6be46d10768bd54068d7374eae406d9d9
SHA512

26db749ff34c4191c31e6df8b55f40aae7b2bf702cd2c4cb649d79396670e671ed018466f06ac53e05196b9bd4e3469c2e244769b6dd816abd3f8c5f1a749da5
SSDEEP

96:ziEpCmV4MSEPBDvV0n47ej/hgOKiljTR1QnyneEhRQOnm:zi0dV4GD8/h/KiZ7Qn/Ez1m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0010e5d5ea0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000084c323272fa0d104626df95bf44ef9b36b18bead8cbeadcf7e04b7241405ea64000000000e800000000200002000000025e615b29225f29376fb42fbbfba77c7af2171e80bdc379f4ce5068f3b2487cd200000002637aa2ed023f71badbd58d5f20a6a773f9f1e740701c31b535aee86c952c4b540000000bec636df3e9392d2a5f7a579f2cf7b2d5e8c2f462121edbec660b9802cafbe015ff2c0f621ac3edd01cbde58eecf20457bd503dcc199fd5982e2709336f4fa67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421234843"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86A61BA1-0C51-11EF-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000083061a81d013fccd9c462c4e4c426fcdd5600e14cad9aa6a897c1bd19fc7815e000000000e80000000020000200000000dd6e6514e73f6e5640228b3c7d9df54e3e074e4a95f23d56c44b7a5793b00e690000000182fb178d7d9051656e482e11e70300b0cc4b101c54b84b0fc0af953e1fb39a0e50ec647cb63ddd4027c3ec4bc828a463c5d90816f831c6b4c38d513e0c088610ec54e6791831d99b60720721eb7685a35607d20696bb5c9258c2b3bd823f6fbc54954ebedf04a7ce985f7006879829b5e6b1d636bbaa16295d340d66b699aedc5a7079600224f44ee2277f810b2b90440000000a2aa16b48c4a93d89dfb19036b93b9a54df2e717c6feee7c2dbaede6ea6ff525308328108681b2647200e50af93ab9045cd67a5c2052d2b87a651c3f7752d644	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28
PID 2844 wrote to memory of 1728	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20219b7dbe06749659277faaacadd2b0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f4145f4c6145d8bee6bf8b3f42f3cc

SHA1
15e1ad7d055f9adbbddc606503e3e3a91f4c3c0a

SHA256
2784b2604625b7b0b5e6bff612e778d72dc2a6b1ab8125bcd54a52606269c589

SHA512
d98df26f0df59228803d4940469942a96d9c7605a31e50ca689ae177a572cbdf918c2353149d7a9d48987515760887449c410e4d3e7662844bf5fd3a74cf8d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ae3b17803a73c486f357d7320b95ce

SHA1
3ab0cbbe524bd6efe10124979da97734d857333e

SHA256
fb1abecd3a964523549f60b8666c2437d8021338998182aa23e3a33c30fc64a6

SHA512
54a564e3ce8ea0b06166c1d3907fedd87c571007b00476ac41a81bf282475b8d73a626d2a08fff64cf3c6b5ac2bdaf9a5f352ea523097e544a1120d241843726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc5750ac933cc32fbf540f85441ce143

SHA1
e57afa94a2ec61b32d0b4a4edcd2b65f5c58099e

SHA256
3e0acabfa7a48a6257b482bd47b11c77d399a32990d354a7504726be05b8b1cb

SHA512
60494e29ae239c5771182c88cd91ec6e287b57608b510abb7632a2aa68035a09721288dc146ba819d68bdbb7c430016d21c36538a2daf38f85a30f9f892ba0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99c9631fa89ea4aa86c8874b2c48b34e

SHA1
c76aed3caf2db6c4b993d4130e460d737a719d79

SHA256
91a47880183e6b630eb2415739415be4073f2c94987b75b50c0a63c45271af8c

SHA512
ba02afbcdee75b394a4b4dd896bb0d2db85c509d0d1b36b459ce007044b94da1c125c4ff94184e6f2d51a4bfbfaf827ac17eac64fda998f58df329abc5787585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
825c0574e5289bcadab60ab809bd30a6

SHA1
d74aeed1addd79ed19127837d0cc5f71f030be94

SHA256
8e5274f8127ccba4307b7b15c8a62ca26c8b3746d0f6df7994dbd25bd019cb51

SHA512
f675d3e6336e20c1512928125ddc0c678f6b69919f0e5c3f3fed1c4bf4c4689cb8702dddd52d16f6166e3969ed4ec579522f4b96b09cf9cd678d325d91a2d112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341a01d854a924b5219f356ec6800bd0

SHA1
d1b6df5ecdbf1abfff6430c156ed6af4952fdb69

SHA256
5a8ed7c000b273dfed285cf2e051e4519af940974afaab7093d39d3ea5db3d4a

SHA512
2c6ad5b4d6d29224dfdfdad569f442bc52f0d38e7469746a1678edc4ed4ba6102821b79b92a9ad662ae921dbeec55b68dcaf63269c162b9f3c3bf4fd6bf87060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e742afe819e103b2056eec597dd8a02

SHA1
b5497b4f0180568067c7593bfbc297fce574cda3

SHA256
5eb09959369e590c8ee013ada987f7172300773ca55a1c0444ec12d43b11ff2a

SHA512
89b9f94683132a6a2c9ba363cf1177f98274090492df54d7cd7ceb28167fb371809de67a2b9c2afea6de6e3818ae5d75f1164e38f2bb1f8241f57058690953e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11e3a7f98d09737b97d19a20de7c6131

SHA1
3afcbfe01b956e81e94b0df4c37468c4895d313a

SHA256
d742d23656aebac0ce9c6774117e3beb5c7fef6271bf4c9ee686fa3a01b097c6

SHA512
698d2a7de10dbd70d4e1c30f114c63e39d3d95102c4155f18459044800eaaaf56f41ae39fcc18b75033283a18237571520e810b97ebddeb85516a436197f5f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efc1c7ba5fb92b6f0ab24e6fb3a4940e

SHA1
fc215f3f0877d8b0d502b6b2942eeadbacd3d379

SHA256
5f92a5f44b93131a28f2a830e437445f83d105d19df707b6e1db87dcfe54760f

SHA512
2f64a96916555cae741ae33afe944d2ef1fba9f03ab6cb33b70e6dddc9db7f9decf279c58b55d733022446b2468098c8f2f448f769e84492d4cb916572eb785d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d073063520d6b9510918364d5111ab20

SHA1
4e6c2ddf6141c52c058bd91f5252e6f3310117bc

SHA256
6d4948d0b48375799d462680fa14f396c1da2c33d65c902eafd2bd2783ce2ac0

SHA512
de8ed3e6d72b79a4ce60995064a97666280815c5517267a0f60d2be5fffee3614b22df46fc27ce755b55a59eca45a237a1ad0d422390bbce1de4f77288f6c47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61b338332c6e295da8114a86a086480c

SHA1
7ff44d94ebac41cfb29b113c6b3be9aa620285f9

SHA256
0df658982e1a3f96a90a17f36a626b509001b3658032c0ab86e58c2bf159dc90

SHA512
0d04ffffbbfcfc700fdb8c8c0da405efa4c7553cd69d33784af1f589a35dfd4356705d15b6b07c56e14816295d5657741b5be271b090f3df04c40e9c02c0ed59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ffd0b83a31eb54a0599ecf899cf4499

SHA1
7bacee703671b7de53647a0be822b0daeb92b362

SHA256
f375e4751cc853db8289dba7c804156417e098f3dba3eeefefce85eb64809753

SHA512
91750f94f90e7061ec20a9bafda6bbfe0b6b258c6dee0a713b437033ede3bb08ead557323dbfd5075b5ddb34dede052c00961cebd01455b209fec3f556e32abe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab403C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar414E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit