89857f7d31ef4df678f5f371e2a05407b820a5b08d7f50c52a567a275d4f0c15

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26406fe452a5ad9a63b70f80e78f3ada_JaffaCakes118.html
Size

213KB
MD5

26406fe452a5ad9a63b70f80e78f3ada
SHA1

612e2a0970c899ee3938e34d62b5272262fc3c0c
SHA256

89857f7d31ef4df678f5f371e2a05407b820a5b08d7f50c52a567a275d4f0c15
SHA512

e75c53f7c1bba2d64d885e23bdc0a9ca5bfe3a691a440a3e159f9f93c859cb2ffaae8deb49d358d5a2ad1a2bf7a35a1ade7ad178f9de6de3ee723b9bf6c71d31
SSDEEP

3072:S5YXmsKmHfTByfkMY+BES09JXAnyrZalI+YQ:S5WFEsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A38A2741-0D6C-11EF-AE43-7A4B76010719} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421356440"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2224	1948	iexplore.exe	28
PID 1948 wrote to memory of 2224	1948	iexplore.exe	28
PID 1948 wrote to memory of 2224	1948	iexplore.exe	28
PID 1948 wrote to memory of 2224	1948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26406fe452a5ad9a63b70f80e78f3ada_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5adaf2d2919c08dda417d93a604add07

SHA1
92f86c931c4f80ad9a43d249235be027a46544be

SHA256
614c372384c4540e181e3b22553df238849f458972ffb99abd37112fd921d71a

SHA512
522435ca577c2f0dda9cb5838bf3df4459e41b88fb061b525f3444273b511cd1fb7d189c4cc03790f864d0864a8e1403e2b917f586ae5a3fad4c500ff3d938b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c7e9be076c69924caa63674ea465f3

SHA1
4c695a3e83cafbe7704060c25e99f6f8dd71939f

SHA256
0f450d4dd7ca6d56cdc7fa72a38a1fe8e60517eb84aec524125f9ad6e502391c

SHA512
3f3f95794ef3553557eda7e6892ef4afc3ca00ed7c92a97b5c39b4448385f24ceb5d0307d6e4de3dd37ee94b26ec94ef256664b1b55dc4a49ad8dd9f32101d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f7b9da378e6c17da0ba53366ae2eb0

SHA1
da6e1fff618506cf56478ff22ba05d6fae5cef2f

SHA256
02a2edd7b6174e38a3c14d5530d4e3e9ed3be2b863f5329a3feccdcf27ac1aad

SHA512
1c7c4672ea0913c10e3cd96dcdf785fd043e7e656a4860f7c8767f90549a3db7fa003809f7e38e669570e092a67fef50f2ad08d08ba092a6fee2e1b39a355180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5437988ef10f9c5dfdeec841f9fe54

SHA1
85267388393a03ef294743203965267161e539b0

SHA256
816269054ef34d8a4102f8ce8742d8f8d5ca95cb6a6fc9c7418a96fb3699bbf6

SHA512
6c88c37a226b049ecdff7b1b5d40a5fffb2816e19e8678e5e5cfed08acdfa624f08b492d5ad28c391096bb4c9f2b2f18c7e9e05ecb62b0cd33c6d19eea21361c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
824dda91c0039df5f289d430af80d0af

SHA1
eaa244e05adf247632d589e59d6b775f59c7e84a

SHA256
b3cf65ae9bbd60ff2be76075a2ec6f3a975bf9e5d382f3e6a705a27221ea635a

SHA512
f396a0df3cfd647056b0dac1659f8d23e5a8e5bc3104fae0f8d109b3f07a01399ebb003e73285443c00099d50ff2e74ace938a21b206a7c3d9f8e1bd339918d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dc133adf09663aae9f7d9a2ce99e7a0

SHA1
5193103f6cbc55e7a4b9adf5557aa6a439b2f4fa

SHA256
5e3718a8762b97c357822f9c00874cc7301a27d99352e9f813a6d4ae9a3056f3

SHA512
6b084adadcd76aa3c6148d2e7da340d4fecf04d310ef3401216cc4e2a77d1bc858bd3c05652e398b1362636b96f014263017d26dc0b907b19154090af950b07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c2a95a29ed17a8b4816a1af55ea47e

SHA1
1aefbd616d95d5018a047fc3cf698a62997cfaa0

SHA256
b12ab4b57f7e71aa084acd65c4853fc57fe15dde4273befec5b7717344ff56c0

SHA512
721c7ecc3b6ee42098733f4c5d17bf2c8a1304a8c4a80a956f5ec5048a987436afdc363d48fb02be907859fc6c25af3848c6fa3375b0230ccfcda1578287f554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1426ce554bd65eafdc279857a0810389

SHA1
21b4815f783bdb852df930fa8b5f16fe3df55778

SHA256
fc765ac6f8798faca7afedf11cbede6bdde432d32123c918ff0a1e062e739b34

SHA512
8ecde1dd511b4df59ebce48598c4b24ab5fab0606a7ffe7d99b16ea753a110aa03f16cdf51b0915e7af388f78fce83b7fa644db0514b0d78e7dfbb60339eba67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aac12f820f217951320771ed0439ac7a

SHA1
4cf972bca0363362c346013f7171b9cf3d4a4ad0

SHA256
f9b0bf00c0237a9072125ad7bf472b50c595ebb792516164107defb69c1550e2

SHA512
19f63fff2ef02a7628d7a5ce8e3c7c8a4ab6e1c4699d6eb245f79a9766539440fb7af5e5d9337fe0853fc96e04bd04e8c07c8026b08861015c54cd77e660f3c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b80d03fe8eb4e1cdf2716b9eb77f902

SHA1
81ae1c6b4ff1a5bd726fe43edccde2f014ff2660

SHA256
455638c8955e747f50c1e9a89f5e9217bb4d926d102a2ca474ce8ea9ebff0751

SHA512
ad47f45a598eea803151b1c975210fe1a90c4e6d56e2dc27b3d608d73bd9b9c62fe2b02a91c0773d8ff302c3cdce09fbed936865847c16b7b0652e9c1d943277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6227c51075a362bb8b7164e4165708

SHA1
602bed3a6a444d2b061bf32987e44b3ae9e10b23

SHA256
fca3f439a2e91271923aefd5d52b013933c5a9657b76d2f9b38ce6ec04fe3020

SHA512
5bd5ef60cc9051a97a49e3220a66ff9ec37a362112cd895f6f72189480d00d9cffaffd83ec8f4a418a1beda1ddaee1e2f5e7ee7b1841e1136a4fbdddc6adb711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22f127770d0688366a605afda6adb66b

SHA1
87eaca58bcd4a362631d7f81f3929308244ea32e

SHA256
d907bf6385b991775ff3376df6b024d9a7696c3f0e3b760e5524d5eb045ed3e4

SHA512
8835767b84b71ed5b27758b3a988cf8a308acfb05ca0b4353aa2774331410f701d2cf1e9c3e12c6c73a9c4fcdf76726d9ff38934235d29f7754b113c79688155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d229a384f384760fbae1680aef33797

SHA1
0aad52243e3629f3ba953cc5394552aa0ef6998a

SHA256
78e95a092183305b2c113583094257c921c6c194db41d371b3dc9142c89cf99b

SHA512
53a02e24f3404e40576b6b7989ec6239e1127753a3f8e562196219747f60f13aa330dee67f733eb66dfe3e1a2b16e8b324982a9bbfd67a320755cb78f473e9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc90695a18cf07d99a04eb9e3b5b4db

SHA1
8320651770a74f5173842142d15aca7933190c77

SHA256
4a092ff928c3f69cae5d109edc1e7177dcb63f2263d575ad84478529fd6d24ff

SHA512
18d55d4eea3d153212c2a369a7c0e47cb2fb0054c97fc5f88bc312a015810793e7509dc89b427d9a32cb56b1f91dc14d53cbc45a7c2cd05046e403fc0b9d8d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9994aaf4d3317c86c8c2410934ac6ec

SHA1
84162f17e1731f25a4ea8714b0303fa074c47bc0

SHA256
08615ddf6047166ba017cced24b2200a33d3f13bb48fa3cc3fcabd3cddc62876

SHA512
17206358b58dfdb1c5f5849c43b759f3ddb6232ab04b0ce761ab5f8fd2a027ec572958d6e4e2bbd735925232b7578f3ba224a1c547564479562f6f1459d2f3ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58da40e6adcbfdec6de5171b2594100d

SHA1
05a5fbbc8eacd01d514ac12b41474416e7e734ad

SHA256
3b24ae5bf40389a7766d93979a87da136e437911844ee6a46a7ae48a4a91400c

SHA512
09ee80ce4daeac1da808de97046dd4482a9f832d314999375413d81f13b61292d59b826fbe19291b5ad071bb1b336aa07da831abb92b357f0628741730dc7176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
668fcf13a605e3fceaa7c88d24a6340d

SHA1
bdb59f9aa2a7ea01947ea8ea034ec82a4de702f9

SHA256
c54ef11d298fe450a8ebb63336664b22f98361e2bbeeb1d6abf3d5c66b656885

SHA512
b223501a8e41f4c63e74d8b7a528e64361428795df04fe80492fe0f0004367d4ed70eede40cc9bbea1d81cb90a5de513aa227b5157f68c47504d89a862e728b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b5d8723764354c387827fb322945e20

SHA1
87be3d59bd04884c99aa7e105f21b08249dfaec9

SHA256
a16e4f8851ee6987256f09a09ee9cd6063505410a53c171497f8058216048a48

SHA512
4e8f6d9b15da852b089f4e2ead0b489f924c53430befcca56531e5e4e257ad22b89b0f901a5f0959cf53d746809ff90c1f29cf3bfb304a398db0e7ac88171d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff88d8630243c177146fccc10891bc1a

SHA1
a6ba1c616386bdd7c774d189f00fcb480899ba8e

SHA256
d85e629e32022b2437d2473ccf040e94a321dec3a6a3730e68fb303930cc01f1

SHA512
6729ed3243da86e94aef2f998ddaec577a1aef28a0fe939b5d60a674be29b2956a1afcde188520d7235c6f1591c1da51734fc8ffc1c4bcbb6c9caf2d7b9c4b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18E0.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1940.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit