fdd59a09948dffa0e308cf88284d4e54dee0c3e1b6a8279ec9d5729afe18a66c

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2690569ce2e23f92766be78050fb0960_JaffaCakes118.html
Size

228KB
MD5

2690569ce2e23f92766be78050fb0960
SHA1

159815fd3e5eb1cd081a3f4cbf0f8c802d4fd5b7
SHA256

fdd59a09948dffa0e308cf88284d4e54dee0c3e1b6a8279ec9d5729afe18a66c
SHA512

4068c0e83de9040a7c2db28c540cfcc043b635c72ce0e6911c14dae26f3bd728b2baa4f3157d0817a86bd1e3ff57fa4768a1f84e9460e80a77fceb7d857c465b
SSDEEP

3072:SRyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SUsMYod+X3oI+YLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000096476ca0ea1fd4ae5163adb4e08ed4b8859b056a09836ae7f9911fd83bfce658000000000e8000000002000020000000353080b411b7bf6b5410b130042ee47076e8fe4d77799f2b33f83fd701713f832000000029e6d780d5f24532b3a286fed9cfd0396a3a275d9be0b46f665990c045dc3790400000003e0d8bc18c5940e3e78f3fc38150d31d451e0f65c3518c058fe181d6dc6f4cc2b8e173d2b9ae5678bc5083d503a35b963c98441eb88c810db6bcef8a4a42196a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000980e53fc62827dbf4dfccd0e6f2fefef650aab3dd61c83ed8a7297c65facf5c8000000000e8000000002000020000000bfc8003a81e5f24ad83d57512c6f6658033ec82adcd52029d64f1746abae8b3590000000efc4fcccb7d3be2fad519653e1555ae3bf72fc25ad95545c6febeff586804757b78532702859c71014dc933f33b90a45a463b7b00fbc657e90d7d8529daf061f05fdf43236cd1fb3311e1bca7da0c7638b14a6f4f7b6476f22a15658de1d745d4e4685bfaf1a16ed75363b17c56b13a2c8a1e03892576d862f4f26c8048bb0318b86f609111d2d2e3addad4e9943d65640000000f0c02a24bb76910f5d87c7838d991fea1885dd756ca5050151c79a34ece904d695c13c20f78172fedfe51929762f6936708a5be6eaf390bc3c5537aae8e915b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C07FA31-0D78-11EF-B3A2-4205ACB4EED4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b063953085a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421361473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1720	2860	iexplore.exe	28
PID 2860 wrote to memory of 1720	2860	iexplore.exe	28
PID 2860 wrote to memory of 1720	2860	iexplore.exe	28
PID 2860 wrote to memory of 1720	2860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2690569ce2e23f92766be78050fb0960_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
067622721f199cc3c95d5bf2f6223746

SHA1
406da63a30b93146d3f8f137b517bc179c8efe58

SHA256
3631912e680ed8708499b125728031a6366a58f6f3ec2962e19e5ab109c167dc

SHA512
24680160ac0dab0181a316ab47748163e39d53bb7c267253e30f2ccee3bd20a705e83f09cfdf85f58f43e228c4f6652723ec62835decbc8bbdad7457c95471f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a020b6f55693295ef30b984e023dc58

SHA1
7d45c606a6314a74fd222049e735d53815206fd4

SHA256
67d4935bda7491e05e18002044d3230c5dce2684eb23df21c3d0bfa924f40b89

SHA512
73c90a1fb327e93e5348062f9120148115740dd812b8dc231b95548fd0ccf90b06e7a18d0cbf9d0dab072ff4c0c843acefdd66207ed74530e4c54a085d4e53ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e619cf16bf29b28e5c8807de2387a18

SHA1
13cb963733eb66d28ee92803f28cc5a6fb4a72eb

SHA256
d1d1bdbb6f188d534112a6f636f1ee4d6a387d389584c8440a2cceb8d20d9fce

SHA512
0359cd355354f853cacd30ef27e1cecb29b50206814ef417f675121d7ef932b5542996149898106d38c5cc969d660b4d4e3d7180c9265af91e377726e166391a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7abfcb7d20626a84aa5c0a2420c037cb

SHA1
2cec707218f29f29b55452f181a1a6e480dac74c

SHA256
05d2118bf8d08aa29cfd15318e67db911ca88709cc57a4e6a691159ea40193a8

SHA512
4bb898e5c0ff3f0c4bfc30f2dcbc8123707067531e05ca94b53ea76a578fc27b01584315886878de7f652492a8f2c7f7d0ef84dbd6bac9544c43e01376d10ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf29312eaf3346b33c05ebfd4f6d8a52

SHA1
45f17039a7043f1a0e8dab77141f112dd47c88ba

SHA256
05fee20d4ddbcff0a466dfcfb739791781c8dd3b606d97bd315f6b0f10b702e1

SHA512
afa4748bbe36b7ee739606c9343b1dcee6aa2e0f0608be845c741ebdea5c66f9d849175717a9361318d448024f89276174a21a9ed74501e9cfa59ad51a03bbb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5965947df07740abb98fce6f52330b29

SHA1
5ea260c7fc696e2fdb160fb75daa6503d3807cb1

SHA256
59df4a03bccb58a0e1bfb1404e0e90d602bb0b01340185d456b7b85376011a9a

SHA512
4ad1a140cd1c6901b3ba32d6214c22f88e0d55555532c045475a95597c9876d5d64980bc0037042e90383f00d6e00b41bba79e874861316027e6afcfbb6aa2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400f5d35840f6377d07f1ac872e17ba5

SHA1
a4b4ff3732fd7e26ef33d1709f1554503a47acc6

SHA256
2e70e019ad35c21c141e9b154da25d4c1253ecabad5c7dc96827b34b91f15792

SHA512
49b7f8c284f0665d9f26ed93f76a00d651a99f79f47a24e90b24bf701b083a01d45f6dd454125c1581363a008fed5b4f6bdb19bd8cc29e41800410fc3e39d9d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da9d28e7762844dc2b409b27f8349131

SHA1
8ce753155ffcc2c47d4ac09f607a2fb5a88b82d9

SHA256
bfb6a585965246dc451dea7d1cf82e1e31d469733606badfe83518738e011002

SHA512
bbe16c092a7029d7da4f98afb247c5886416e2837c6e5a6704565ac12709ad35c5f71459cf365552cd4fad32fb709955bf9f1c0697b289f13e05de7e9ba26f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37797d38ef5eed2d90ef299fd016f49c

SHA1
d5e6b7a617535102b55da773be54ba85e79e4c16

SHA256
3b7598254b99710950b455a0823b3b9974fd3f6f7286b6e554580322ceaa27d2

SHA512
4b8855f186a3fcaa961c1cbdbb5c1ff9601718d5240aa735b76870465d849a0de5b99dd777dfde2725fa9916b8678ee1ffa02f09b86fa52d81fb796a301820f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7741c5b14a8aa12d8bf407fa6d65cc9

SHA1
495de5cea4f9e9efb7de7c433ffe894f3962ecad

SHA256
f1189e7a4c3c408e0cbf21fe9998ccfbbf48a968f0c49306570317200b765791

SHA512
fd62405ccf1d4d497f4930a622c74bb635598de4ecd9f02123b05d67d57c53a291982a856c251afaf1102c1489be0cdd22e2c20339fb0c37ce96e5d30c94e06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
654da53c0840db3d70781b00e8d9876a

SHA1
d2ee0af0034edd63c2cf15e510f896dbd7c68887

SHA256
0215e012d004b7f5d94d88978505f58514f228cef66541ec060a8b713762e334

SHA512
66d1e258d7d7cf665a65a0a1c8042acceea9e7e241007eddace0c9a211c8339138488d1ddaa43c37b08c8039e2b5201dac24510965a40359937935d293e906c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
690b194ef95cada876d44530c1fc79dc

SHA1
d41c6bb0dfd121edc9198655aa9688d3a1fe4e95

SHA256
56abba1ee8b25bf57ec895c9a4dda163d33cf2ac4372392ea32a51100e479296

SHA512
3817351010b78293b7cf6af6290991d297f8746dd7a51c92e4f569cb6ed3fe27ff489dc7d029dafc6e831b15ae51cb2c9222a82c567d6d20a6461895971f8cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e86bc6cb1ae1e42800d075143a0cec2

SHA1
29d5a74bc38df6305add6df1ee0b65a4dcc82ece

SHA256
834bb6e138ad2b5abdea67aabcf0cd80013b5f6bfdd50365baf2085cf9f09390

SHA512
110b8ef4ca293066d3a6cf1552f2008f6edda917600f81cded96a11a91a0a0885fa977d6a9f828b9d0746938c01a3bff83bac06174938485097a8aa11d6030ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51a1e3ff0c41688b5c092a5d6a75dc36

SHA1
1745cabb8792443ef80d53a944e713f54b67a397

SHA256
739316cd0764b38e7f45d8e0d51a9d5ad0cf9b31642719e66c9b9337f9a6814c

SHA512
4ba01a8f3a808ec5cf582a3d3dbb8100746a6e92f9211286aad49bd6d21df52c449c105bf1fa714db5004d234500417f695b1689d9943e500a8dd629f6d24c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3160.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31A1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit