bd419f5dad63d9305578d021158197b9f7dc99ff37c90a57858e06b17f42214a

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20959beaf831b10f335c3903d53dd11c_JaffaCakes118.html
Size

23KB
MD5

20959beaf831b10f335c3903d53dd11c
SHA1

1e3acf5ec403111ad0210321095962af971f0bc4
SHA256

bd419f5dad63d9305578d021158197b9f7dc99ff37c90a57858e06b17f42214a
SHA512

b07513a23ec44efa11c76b175e74e3e4c336306556bcec3c51e5ea0e980f07259831d0c071da9de9f3246fb952e9dc7a19f599011fb586253c587c4185fc0098
SSDEEP

192:uwLZb5nMinQjxn5Q/7nQieaNn7nQOkEnttBnQTbnlnQKdjovMB6qnYnQ7tn2Y0nE:oQ/CXAY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b548d65dd560f37a09a3111f68a7c07fee5a5f0bd49935c14eaa438d1bfe0dfc000000000e80000000020000200000007d5d4303467e9142613648140844742356672e8e8a8b443a3c85bef769664999200000008fe6a3cfb57dbdf8b7f84e45eafcebacc05638f1faafb380ca7f3c842cd004954000000054eb02dec8f3920150b5f63a45bab634a35f2e28da5041616c1df56b84a38e57653daf68e53f1253bc07679df139dcc84e507c33b0b092020578ab96fd737c82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d5264778898939f0036339bf3bf35d53c2ad6a85cd86ccf1cea9c71782147ef2000000000e80000000020000200000008292fdcce693e46eabfba8acfd5f08dbcf863c72857f59beac20e4f26a3c32cf90000000ce3cfb27c0b9d18810dd1443bae8aa3f0bad7809e516c37b5bd9cf76df367d838d19d26f26022a71dbf40fa2a6dfa1be161f8ed4839b8381e6e2e0d1a040371b1afdacea914c2fa145234a2a22962f8bc8630ed23c9a68d319fa1bfddd7c8cb272db4b1cfa28f2c88a1d3c1aca8ed4892f9d13fa719a94b33e6546e9937e7474826014ef24e5e25fdd724675cfbcb5a940000000cea517b60aef6ef0d18b14457258419b10820979421c6ab9a508c38f097d0638c41e2a2c5864bec9ce836d7bd60e597939fb1ae8cc16219bb6dce689cd54659d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421247426"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFBA07D1-0C6E-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307478a47ba0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28
PID 3020 wrote to memory of 2556	3020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20959beaf831b10f335c3903d53dd11c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b370c9430df5838b504ff928842b8897

SHA1
797e6fe6713111dd744ac4436689a5150e65268a

SHA256
06242340f939a84eb81560d7ddf94d220d5c24211fe9e320948e600df41f734a

SHA512
0a8ee37a0c1e40f133d49f540054d2a8986d7ed4cf1c411e8cdeabf473b18f7e8d9432157089f7366c821b19904422c1dbd42013709b8c6efa0bd3aefdcfe584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563564f986eb35a7c0af9e2ea887210e

SHA1
2a9f779ba4fe0cc59880cd31ba68e493aca241cd

SHA256
1ac14e3fdb036b08cd2b522ff6834a2c83b597223f8fbbcf2cb37783dea5ab1c

SHA512
aeacda30776a4ce5b3607b3903e93efabb96b7f39e8a9e97d57b5dac0094b9a2ece93278a36eab7ed5be72a9c3dc913d2ec7257f9204039063a6ebb4c5eb8f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a02e35542beefad7021a6d804ce1639

SHA1
1421c7c8982075cf0db912d5513cb4b35a8d7bde

SHA256
9c2199e0b1925549a593900ea86d5e71a6281451fa7a080b3d01e9ffea89234f

SHA512
1d3257315f4f685c936d120f9f44a01e4b7a818bd7c6248e8488a002fe29b3c84e8703fcab070151726342ea2723682193f94458051de50ccd174595d728319e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c38a32fb13a02f3f44640cc483bee3f2

SHA1
fc1744d1d222e2c230e737bc826ee673aef47e2a

SHA256
51eb8a35ce8666f07cae7f788ddc008bfe1db61dd7b4986dbde35f39ad90ed73

SHA512
7479d732fd376595d2f63a08369b0e381a8549513526ced109c22aace6718e68303be8dc248f12637c778d8e2cccd3d8742d5aa9fb0a126bf7da63c97b60c81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e47bee05ae0ca85620b758ba240d88b1

SHA1
92d2c97ea5f48a0378e9b084a07bb5f841b5a26e

SHA256
846b79e811e4a7b9d566ff6fa7ee92790a77c1ea99272a45b79b876401919258

SHA512
0031adf716ffe99509e4c550f8889b9d962efc70c2a11abdcd62eb27da3e88e9b6d6cce6d153cbdceb712e15e0d38879e976738563384574f7ad90643f4958a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
988fc5e04261dab5ffd353712d0733b3

SHA1
3a1f1b578c7d449219d882c0833d991a433a8df3

SHA256
deccfd0ef7171de2b975b08dee87385495edf49e97444b828f87ec0a4a42f35c

SHA512
90159851723a760a0a960bb933aa9ce0980b92941c315fa242b358caf3a198ff2c4566b0b3b6638f7cd503e4db8260aa17ff4faf9e84a89f52b0874ae5113d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8fcaa70b9d29ef89f3b0abb635b57e5

SHA1
66133a52ed6e6b3d1f3156d9211e13d3288161eb

SHA256
ab3eb053091c2b0f617f08f9e4f69943c34f80ce03042506f1839d119c363d9c

SHA512
8940d5ef8173c1dda029f7713ba72dedb0699ef7dffd72e1e40eb8e9e17f6e713487a20cd0fa0f242a5420a1da9db84531ab98d6085e849ec4c8c01ccf36eccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ffb4f8da11d7dc1fca7972373b54cc

SHA1
6e090a59e2371fededdef5c3cd0cbeccf4a2b5cb

SHA256
8a983c8d252604623c13f95a058c2b32fa8cf3452a6988a7855e13808454bf65

SHA512
a8b40463972a9373efe320ef1c2ee00bef2bdde3566b44a40ce1a7aa0bdee594cbf493f60f5178b280a38d8737af622f72cf5a415909fb2c95e8b9032dcea99e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74898bee71d26b3b447085c52abb3b08

SHA1
059004308482bc794b5c22ddf559e2e77bca2630

SHA256
47d245ebccf1c278af069a1a58d10b9233715605f9de014e0ee52ee769f4b9a3

SHA512
b5881be133374968b6ac5ab24eaa83104802d39a541a9fcf42a9740449fcd3bf679ed921a0a9e1b2df6aefe7cd3aef54ad061676d85f68d533a9ad24abf4f965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
543ddd24f04301218ba34c4108bb29bc

SHA1
2870275ead8ccff74f8762ee7e64ae1782d47ef5

SHA256
b0209235fe5ffc6d428f6be300a75944a35715fbada8fc1fc4baf164f960fa1c

SHA512
2519fa406f72e12671967e529fdd432a89ca6d4e2dec50ff5e04be6d24100e3a6c56f92301a3ffe27b52e890963c8d02b762da751d57d9587924cdc0c8703532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f79c982775886bfab8e3eaefd86413b

SHA1
edc0f4b466c26492deca661e4641240fade960c4

SHA256
d046b713daf603a4fb3b594bfd2cc8ae931d3100cd38d1df8c991d4ca52f4f54

SHA512
a44f256e40dc93741d2a97dd9e0100e57892239c415c0e85125c8b8d10ab219232a30256157f0e78e188860132a80d1ec9eec660df7d75dacfa3d7efed926a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d43962d438b5fa339f1bc0443cbbd4e

SHA1
322df64d1f8b12fd336a18d9563249f4528c02af

SHA256
11ae6608712256d120a89767f5e23e988f9c5a7cafec09be6a77361920046976

SHA512
40fa39ade3ff910aa9b9561296067db35f68e0ccb8488150b327fb2e0f9babb28db85b50f4085ad95249b3dd4f4d3ac07ee6013182073e7c9285f2f5ab736652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4905afd915e02f383c685d91b92f276

SHA1
633729ebed3a985908d22b671fd52e0638609906

SHA256
31250c1c1f8dba7257512cb1945f253066d026c0f66981481d4533b0431d159b

SHA512
dee8f700892f3460c739334f65fc30689431a1f2cc028e5bb7a0da2f103931babf2bc749e1b44260c4ee8306a39114bf2baef8c669c24336121a2c2cc5eb2be1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
299f2c8b1325e6de50e8f5da76f09cd3

SHA1
429465e72c37f5527ac74e8b19f38a7730ca9a11

SHA256
58f3baed85492601876ee227ca2db3711da47b8b6d3cd23803fd4503c6616389

SHA512
28a94ad752711466dab5f0b0b414f62cf767a6ddeedcbf2717b4b021d2157dc690897b5b54dc46ebfdfbce510bc2ed7b604d4d4e2b68a4531d6628837562461c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f026a94545d960ebaf405a5840c8177f

SHA1
5ed6d3915292d433caa0439004cc1825fe197a50

SHA256
6918f054d54124732389d45f4680557f8436a05d9ca5199a64ca2f4941e38e3b

SHA512
59ceeb1e3ee4d5f0365f7d5afd15f838b2d5537cfa857a827d808b8dff0e726a71cf7a843723906395e81c18565cb960750d5ab970703a7a89079a20d93984d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
463ab76996b338835f9e861362037b0c

SHA1
153f676333479fb46c997c0a9eb84f3057257c56

SHA256
7ec1a564920b8034c2af7dd84055b46fbadfd0f87ab431337c135b5635181c71

SHA512
2f18cafac1c712312302567c32e3ec3eff2ed8b5b244deba258acb1ab7fb5a468b2d2a2be6a5b3475db0b2a172da5f6e5dab48ca7ae2ca5200430c5d5bd46bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AEA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B3B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit