90178ef4445a249630dc09ad75dafc38ea0f6d3bff179f4c95d2e92614b92be9

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

240650b2e743fe0dd172a307d8742fe3_JaffaCakes118.html
Size

213KB
MD5

240650b2e743fe0dd172a307d8742fe3
SHA1

fcd590b3c5d43edfb2f39f0f19cf7058d6dc3afa
SHA256

90178ef4445a249630dc09ad75dafc38ea0f6d3bff179f4c95d2e92614b92be9
SHA512

e943255dfc82aafe17e5ce6ccda4aad286741308b225175672959c3195e97be0a72aa7f6958b04be937f61951356d8924ca680bd0fd6d4a4995d51170501a770
SSDEEP

3072:SI14oypH2ZByfkMY+BES09JXAnyrZalI+YQ:SIOsEsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421319015"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{811B48D1-0D15-11EF-AB95-422D877631E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1180	iexplore.exe
1180	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3020	1180	iexplore.exe	28
PID 1180 wrote to memory of 3020	1180	iexplore.exe	28
PID 1180 wrote to memory of 3020	1180	iexplore.exe	28
PID 1180 wrote to memory of 3020	1180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\240650b2e743fe0dd172a307d8742fe3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab277f1393b88700aa53eebaf8bd1615

SHA1
e354d93ad8b7b5a48b8c7c878a92bcef42e80fe1

SHA256
f3b8e58d139f8952bd01eb6ef53f722bdac667e11d80196987c06ba925402675

SHA512
78d9cd11f266bcee0bcba20548bd60dd7fdc36fa4c60c4e95b994652c12e55d4df2fbb28aff8c04a5513184d94c8527f1d40acfb512c7e1130eade02666437d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7434f3cb6dd6f70f6a15f65a18c9191

SHA1
e4acbe00e29082fed57200347f1348f7ec9dd600

SHA256
c9cc59d0a1db67258e7d97d4ab59a9f21c8d408b7ec6547179ef525a77573eeb

SHA512
3a7ace5be3f3f4f961e1bab4b563bf5ccd1b5ff4597ab469b305366904a3730dde526115de0a2c5080495981ffeeb101467b28be234c30604fca6e92887b04a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
862a78092ec2820d56b515889071fc73

SHA1
0d1015802cf3fc84812f539a43983117a70b378f

SHA256
8c6daef0ac1fe6303f0752b08a73b08d03102be2352256a5212b4ae8270f9009

SHA512
b6ed127696473245933e1e1b1d4685ae5dcfd1f429fe726086ea5b7767003e30df7ffd64d28c2f177e0ab2533eb06e36eef4554524a581652377fc70417eb5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23cb73c355df1ab361b297f296a33d02

SHA1
b8ede52b030fe8495278570eb450a9a7bd400df6

SHA256
66c6aa363bec79bdca162500c94508b5b891a729f371f1e0e0d6dd19bf26794f

SHA512
86e7ffea7bb395adf217669dfc1d7f7db31d1e13b2d54c1e2c45ee71d03eb7ba1ab0647304a2f6d6e1ea7a619794f49968258fc80f90b29677b4ceae60d32fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd4a903559cf09db0e7c90ddc94a59e4

SHA1
0b630827197a7d8e8427c57564c1648eca98ce3b

SHA256
9970cbad41e516a2d7dfdcf11abaec644b89c045d468dba805edc123a486e78b

SHA512
faf51e2328263da12769dd3db83bdac7a1efa6cf61223d6b4411beb67637d7e74b49d982425a874abb2da7e9638ee70a2e7256f2386ff6c537af0b0ed92b22ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
541f5722ff5db7ced06c744ac644d2b8

SHA1
f5cdcd64f946a7a45ad3373d369a6bf96ed08568

SHA256
501d124dc3cbe557d176a7011ad4262e3bfd0854cc029c56f1f51b55bfe3613a

SHA512
3a20fe8dac14f7885077e9be629c446c805a16aeaf445da2f12e0d2672c19705249edab0dda00eccbccfacd0c20328c919c147d8b2219f011f4a714b52fc3350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c862837b8f68611a88ef921b409dd82b

SHA1
9ccc27d6f59f430db5036e5caeea3156ad6efe03

SHA256
4833894a06d8dfda129dbb6bfaea99a07f715fdc2f0663c71558b1ebebafe880

SHA512
c0c18ea02db89c3e65aeeb64f36ca9b6eccb1b09944a8de5abd0625734276f62789dcee9122d6aaf8cccb4c1a4b13549ecaa79ad90ca2df6cf812b45dbb91a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3e2748b397350833c04c1f4a109926d

SHA1
7a9c2a7e1fd757476c21482e2688c63321e4b7c2

SHA256
4b60b1c42584ed809305503c0b4c948b14fbac6c3def248b5de22eb3c2a9485d

SHA512
34fbc76389a28a954d2f92322529ed99fe374674fc60051ae5e875c9dfd6baad940ddd936b2550fe665b106a90150e1e81cc2456a0d8d3aa7bfcd0aab113b257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f2b9e3f28b24702e35b1aea57e6da18

SHA1
9cc76e3e19ebc769ec355d59f2ee3b33c7df6f4f

SHA256
166c0da080a1d82a8580e5c3bcbf74a25f9e15ca379be30acd64e42dbf39dd41

SHA512
65d133ee98dc3ca0f16293f860afd8d0aa4eda4d1da0ca074dca8697637ca34d6b35f377cd6186b618a07baff9aec0dfe8f9b4c8cea60ed1c5fec266496735c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d99737b644a4879f07769a3581f42fb4

SHA1
909d382bc0b59623c68bca249ec593a6d1aaa470

SHA256
2d73fa0830f3ae67fc4030b029c929fde9d1ee320e8dafcbe499ab8d2ed32327

SHA512
1f3c1cf46afb0d538db340261a7f771374c78343a436d0aac55072ac40baa8aa40edba7d38b0e2a66eb1842bf9d5e74367f5df9bbeac22e76ce3a46afe3219a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
509f3cdc37ecf9c0cb3efdc36ffda70c

SHA1
1ab0dfaf6d8e36bac275cbf7ef39a9174427053d

SHA256
0bb19156cbc20e384d66db0dce97fa4a24263349880caa820cfa3240c96e6e89

SHA512
782473e7bfc361d8ab0b1b613d1eed1519f989dc733692c7d11b9829980d7f9eb5bf5c22f17958429562d3a97553bf719db739e480ab1fc06997e0806dc06d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ed18912196f07c203720b4976c26a06

SHA1
9b57ab36145522796039596f41a0bc287c5e203c

SHA256
d3cb8df5e2c6a78ba37c4d0309ee3b1aace54b2a2a2b15871bcf4a169397d3df

SHA512
ddad1edb6b54628bc971ba3b28fdef9ccd57a48dc1db59c7ab7bdcc0134c8b9881293bbabfac4c8826af1585d3c65526169c037bbf59f62ddb1eaea701bb21e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f610250a46ba173e25e86a418d237308

SHA1
a4295dbf8b0f216cb5e63f0d8b08722d0aba6c14

SHA256
b71449c1f03e93b0145452acb4780efb255f71cff03e9020751cfe96fece1291

SHA512
607e77b843770d3bb0e3b6573a84c8d99426c17f74e1ae00e82faeb6a69cd52fc38ebc2e401b49a8659c036e2de40274dd011aa1ccf687c4a41f7c5e0e3f446b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcbf4de1358b58e97d5ea3873ed693cb

SHA1
b7c53cc57325f68068503837b4cd4d90dea16211

SHA256
7256843035543b983ab49d953e7b9bd76eb02409ff3677e6ea0efda225c063b8

SHA512
41015070352d7dd9dad65c6f405ab92b727ebc17f54e57f861db6897a9e52d8b84e9b4a7be204e9ba8e0d8638225ebac70d236b649059ec537c83777561aca4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
733541380028723f49f3a2e521cf68f8

SHA1
c4ef6c66b78699081c32e2bf207f5c1f1dab3c14

SHA256
8d390392683689d1f1bc69f76c7ad03f830a91c715160f8baca6d1bf13ccfc83

SHA512
042518ee7a66c59c5a91190e85803d9b4736435614cf79a630d8bce01f216addfa02bb7d70aaf8933c5e46f8d8363e217c663a8e4c068757db7a59ba52e104a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28770fb941997b6d166aa352545cac0b

SHA1
e22baf20b863b2ee8972ca380ca0b47d0d807670

SHA256
c3aef921dc4bf2e3fb34c695eb3652d2721e02d4632784973ef97450356eb590

SHA512
62ac446c2cd6ad36474a7e5d93368565b018ae1c64d3159bd10581518c92a67281c8fb2d141513be7d364e64f6a23c3913ac60c0e3d695d2478e4b2079e3090e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6359632c50795ea61df7c51f7155d6a

SHA1
f50a210e6eb477aab4dee6f6a71b45a77b52ce64

SHA256
800498f0727b347e04dc30205d69adeb748a64c23e4bbbc83f8e339aae323096

SHA512
c380613b8d6fbbed638a821ed4babc057c3306a9f29b4f98685a5f1f9d1ef025b45aac1e7fc6d7244573ee8b52912c6ef8e7131b9b2d170a70034ceccb28372f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832444d88a39f1a4e5d02c5cc48b01bf

SHA1
07f384c0a880d9f4de6ea3316fb59e30d15cb365

SHA256
62ddd18e83aa3dbd07b1876978f33520a70a80f4cd6218e6d77b334fbab523a6

SHA512
2c5c79924b07613c2376e8983bf2442ff2cdb7e4a3c66241fcbc3522e7617e40077c6bcfc4ee389b166d5880edb57d9bc3913062bf705b1d5fab1fe43a51bcd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44c0395535b726db0570aa217e6a3943

SHA1
4615abb771c708a44e3b80d49bdcb53ccdf5d408

SHA256
261e6449130e565d01502fa51301e012f900b3dc0bd753b4d63d5a70571e9b0c

SHA512
26ff175c4658136a312386a4c27797d0416f3cc3aa809b41e7a284261e9eb0a6d49ed0c73f0d572a51e9094d178cc161ffd89f716d5245aab29ff1853011cd6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit