df25a92ac65a80b5b540e1210ed819fdbaf1e5465d191cb9ae28b290591cdc32

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20948ee09b673ca1cdcf5cd8be9c3b92_JaffaCakes118.html
Size

22KB
MD5

20948ee09b673ca1cdcf5cd8be9c3b92
SHA1

7df59368d3abf402edbab4b6cd79a5d770139d7d
SHA256

df25a92ac65a80b5b540e1210ed819fdbaf1e5465d191cb9ae28b290591cdc32
SHA512

d616fc937e8e5af168c73e3737a8515d758c6c9d7f0d96625c8db6780ec64283ab8df89e227d5a5c8dee5042d7baddf1df81a7d4e99c736506ff35e07caca958
SSDEEP

384:aV/PMSKCs3U/nb2fEGxAwUXIRnhDzz8RjetdCXM/Y2TmJ4aVvg1NieCCvf1Xm9H/:MPM3lwn9GPUs8Rjet0XhNCLvf1ozi+N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000cd50cfa18e14a7245d9cf2b8a86039fd0dec3dd77c2620bef68b5f4b6ed09c1c000000000e8000000002000020000000d8897eadf86d8741784579135d533487aec589933b361e0a30a3867dbe694f8c20000000f349d6cc394f433a6816cec0926cfa406371ff9d51f9076cc1619a55b6a4b1f7400000002c358b51de657b1a87691e5a162a4f6b2a5af871f5269fa06811a4272107a02c06c4717eb565a04f1ff29b5153c9a1e399c64d4e92168f09c9c13f0ded85e2fb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004e43472f3a092b6383a4b1d1008f0f95229cccbb5e48c4ae8a73d5e8a12d6f90000000000e800000000200002000000016c1ffadd02042b262615e0d0c60f33f2d05ec4ea33d4e6055331199caa7f20490000000bba0f34f9eda00d1648ec0420db1aa64cf5e7db55cd32aa9aa7ffb46dfcf59acea4b08bba5a707cd92a5102e61eaf2ac555e4c33464d7836c772526da75cbecb5f8b825e46775364037da4d17104920b5f3c3188fa23305dd841f066aacb58edc4c6583a7208ba7a0ef9c98a051f2301d6dc0510a8ebf443830b5f42c52f202e9bd7e34a6edb849007f326f91dad69cf40000000944c325964b442405e0e5bfd4a7a6776cc59171b1b52aaea32b9e9c67e703d7fc023dc57fb50c3f370be92d82395d4abcbbb6db8ef631257fdb88a3d1340be4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421247336"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C866CF1-0C6E-11EF-AD38-76E827BE66E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f8a1727ba0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28
PID 2236 wrote to memory of 2548	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20948ee09b673ca1cdcf5cd8be9c3b92_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fc3787edc3dc82598bd1a778cba2584

SHA1
39ce11c240775b3bdf1ec3f3c8c797fa238d9922

SHA256
606e33613e78245e75f26feca0e2608e79fde14aa36b5db32b0da88648d6748b

SHA512
dae3f98502f91b576b46de1563b05c671378d86bffc8c0f7dbdf08d0e10264110f6256881e6ea0d94ff42ccbfeeb1622ec40342e3ae9fd7569f7c805b1b44e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581c4d982fe0f625d0c942672ad08d88

SHA1
0ad917e9807eb7d0fe9d9c95ddcfd7b19ca5620d

SHA256
19712a1d5de00676952ec91024407900dc0f9e5aea14c523c542892b311ce44e

SHA512
b0f87ba30025de8982e0d972a665323ded990a52512208ee8b3a601861ac2192f5cf09f0a15d7d31b26f96dc9f90021496d786855be835381456d615b1b2b5e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fb03a667f571e4b39dd5d245e795b28

SHA1
3238a765b103028abebbebdaa44f48e88ff2fca3

SHA256
1d7bc9def1a8e3c77b6a2876ce6894e8fa8fd48cf3e90cc3c4bfd6ad2e6f75d2

SHA512
1f8cd3ef2e71d29ea6e4928f0fb49d4cb0979fbe0b05212ffbf824d17b90b6101f6f043b3e11314eb0a12c78db5ec9700d1178391f0df25a24ef22e6ca8a1485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
321d2e7e548cc9a816fac2e9b70a4c40

SHA1
645832caffe14880a0d099e0dba14d9e76869404

SHA256
f5c414092fa469458297e1b2dcfa8fc417c53c9eaeee0cb0b5d87c0597fffdb9

SHA512
e7570cee59826d4ab23bd45cb823ccde6bbd5377d174ad33de9281bc8603e0ebb0049c4e36018a4cbe80193f7429b75cccd9d467dc9eeb170d79d6d447cc9b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d82eb1309c8b16d4833b9a1b0edf24

SHA1
7b82b25bbd1049582a23a6cc9687eb8413b84180

SHA256
160307f739a7d7a58bfb83ef84ac712beeecf5931354778a9c5e9b019d14c0e0

SHA512
6a6527587bff1c238393ec7e90ed0fd911b7c6e1874f7c5374ab289ab9b51f8190c8a1b7c581dc2e9d8843ca8e5553967c305d035b663337a0da38ee96c07473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7105450a6f81c45b4e6fd38fde97ab9d

SHA1
8c39b6218b00275ed20238021e694ae5f344b071

SHA256
16a9d112182904e103f0126d70b87aa9689e516f814a68da204e4908cb0f24e9

SHA512
4120dbdee22dbb96cf1205c9435412782eab5e03bfc0da52642e8e832f091b9f5d50a1c333b69c5fb06956bb743534c556f56de39265b48a35b9eeb184368158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48cb6d295cc68621763662405c476c5d

SHA1
5c3023dc8e265e1c8f729c8f63cbb91bd43b1b41

SHA256
ceeb26e005ea7c64ab6bc5036a3699e6e0277ca5a76ebe6a582ac3742ad0fd85

SHA512
574ef5e793136cd2f23c0fb743b42591c7f0384ff1e95a87dbeb628ede45edb44296dbba1f085f1779df76663dfbf59aa2c7032fef63667e755dd0ccc3c7f38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f90a3ec4cd0b481dee0ef8344cfe1408

SHA1
58929a4909c3b0012c023445f705be5dfb03fa9e

SHA256
3c63277fba4c1f5916ff4b872faa4328ea766a91739ac89efc1d8bea8034eb5d

SHA512
88a8511bc8444fc465371e30d82317e4ad9491af068403399644cb4afa507b1b1a40270bcac974adf39af9d2dc695f4f0ac2740fa40a967e83979de197102d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceda6b17500a5d6b2681370d4858c048

SHA1
9edf3db7a9f1776e82b61bf5210d37a5f1520182

SHA256
860e3ca4448f8db68c0b3d768fb745887a223a26a2c222bbdd9ba09d16ff847f

SHA512
caba8eff5a26db9c4ad442eedbb520fdf4a32fd0397ada822a3dc3a774c67c349b99b5f8749be368dc0faaaabdd14b6f673795a3b5c0639e33523a3c02dc1129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0da46607798a4f9e87eb88178549892

SHA1
bb32f79fbdb598be88ddefd44d768f3cb518c243

SHA256
a8d1bd2ed2f99225a0121f0cf16a55cd999c04f8695e6d0cdead9fca5d2cd047

SHA512
9300810a5bae61ad62beb1b4fabc0b0fad38b15e3a0f2d8f4fd21bb7ac7b0567875e95140d7fafe1366dc9f139e6eaba0c67436823aece9b0c6ff7d1296b84f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aacb0675f2bf4ce588c6db5e60c01ad8

SHA1
0b807b811a9d866b26ea7700a8a4c7decb8e5a9f

SHA256
7887a9567c596c160ad831273f7a9a927df742d17b44b00288ca718195cd0f0e

SHA512
5bd8493d711b0e814d9b38951dff47debd25783308030aab3b2180a7effdafd41d1de1cd62b9aa6d231022cde89f59490cca892bcd6ff60653635213e369c908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e6a16bbbcf17208d31a73ed5ffeb9a

SHA1
6b0c163b3dbe6b186b26034a777ff86791f1256c

SHA256
30789eda8b778216435539cebe412bbbe5f24dc10815f9399d53079f3afbb486

SHA512
ba6b94f335a72bb8e49f52fe4d7d780cc4310548daf2ac29f2006590c9f6c727eb4ff58ec005369ca34a2267720aa673d3ebcc8665b2072736da1cd5412f0784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f39d813a0eb519da26662a1f9c433c32

SHA1
e6d9cf750fa90ae9b1289406ee12ed3a0d6dfc81

SHA256
9a0fcfb1181f9a5402d9b41b2b59d05d69880aca68dbcfef9373eb5fa48ffe99

SHA512
8ac6c7e814d65b2132310c005a39f2ad492a2952581f318db895ad8d62f11932396c99f21a797fb7510da883643696ad352b1b1e28e62a99e348c5c531a3158b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12cf2c4d8997f8e875d5d21df02e381b

SHA1
27f2fd54bb1d735415f6a13c9ce932a4eae05696

SHA256
7bd9d2639efbbbfa539a9e7a1c74d9c107dc5dd908cd460ab6f4b74cd7ce177b

SHA512
aa914d90768497170e28d378e5db44f000770671ba33536daf1c9a2eb015cec9edf5f09e6aa9468470f9b2ca6f78844fde91d5f584cd861f316d2d32ea180bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ef96c36d0bf7ec77cc289fb10be6095

SHA1
fdf14eaac8dea7b34ecca8c258152a4aa82aff38

SHA256
b8eac23c517bd20b130f333e0ea2f4e6dd62aecb7f761e56b32bc04286a5f3c9

SHA512
b6d01b0c96805c3691b17a20e8e7c5629ea2cb46d8c5b374f26e63b321b24f6a4e071cebcc6e66d1077bda0dee4e669fcfb17228d73b50a8760aca0792a8ed4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dc33209991f06034e506b0dce030f96

SHA1
dafccb8a6af4144940fdb0a338faf9b7bdeacd87

SHA256
6b4dfe069efb82f1d544f5f0ba9706ce5d82953c78e9881d5fb00c098c505e9f

SHA512
6e3ed0b4408343e6903a00f214fd08932f96c324ab232c91a0da4673b910ac0dc8cda2d92490b41c522ea354f972ad2633169f08b4f055131a7ff1935638147c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a39c0ac561aa8af11723bac1c0d583c

SHA1
d80c206cf85aa402215bfd72fd208174f971adc0

SHA256
bab370d961cadc477f98f7495690763e418b508d944468fc3bc8ea97dec1bcba

SHA512
cc3662643ceb6017d41f09542bed387dc5a12ae2b02cb33246c8b4662027e68469f4da06e53fcc0ded08d6022579d5fbd5de9f146d95aeb502cf7d004028269e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27ED.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27EE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit