171ff27fa6f8146b71977112ee3ad1b0f2774bd5ee2d6471d361c241333ffd00

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26c84b5cd05b9bcfbae5b24f70de99d5_JaffaCakes118.html
Size

185KB
MD5

26c84b5cd05b9bcfbae5b24f70de99d5
SHA1

e610a6861ba831c818ab50720417b35ee177503a
SHA256

171ff27fa6f8146b71977112ee3ad1b0f2774bd5ee2d6471d361c241333ffd00
SHA512

aa874cdc5d47eff4617655febe9e9d656a180c883910bda0e0852168b4ea2c08402dcc9467ce3edd45cb84c6ddb81e7e4063898172f8f9b3750a37ca18de9997
SSDEEP

3072:jz+mct4w4X+jdfTsFarJq6zzvSAqyZM5TUe7AmoK2t4nyrzuQDEi2ZX+gb26Fu:jSHHrJETt2ORs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421364925"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65039FB1-0D80-11EF-A01B-4AADDC6219DF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2740	2188	iexplore.exe	28
PID 2188 wrote to memory of 2740	2188	iexplore.exe	28
PID 2188 wrote to memory of 2740	2188	iexplore.exe	28
PID 2188 wrote to memory of 2740	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26c84b5cd05b9bcfbae5b24f70de99d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
098e3fff2705346ece787c21ac03d0f3

SHA1
8f6923a4871978ebb148a5f1cd34530887b0f0e7

SHA256
16ed7a2c43f928bcc7ec8f7e93082abda7106a63b87e747dcca57f1cee05ccc9

SHA512
2977d9e735e742cdef931554063ce606e3ea9ef4bbf5f405bda639cca10444d0882bc5f48067e5b0e847af7ba069a2fbd97f386937fd3b19b5444d208d962e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
41d2efe97a33ef7621e43d5c800dc212

SHA1
cb361ddfd99a093df5b6dd7db8a1a7826e2470ca

SHA256
3cdccc68c8ad0a0e346b9b8ba159247af56d53a181c98277ebf1f0b00c6c82e4

SHA512
3b4c4fda50fd62129102d745f876f418b609c789ca1781fd928c9cfcdfe02496c1d8b03207a0f2ef2ce1bdbea1bb602e94ed86c6f9e8563bcf66225be89a1a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ec97b38661cbc564fa7910b9d428d9fa

SHA1
39a2adba9f8aba49e4fc93bc73d70c9cec6c00a7

SHA256
687fc8d69d9df9721112d0daa37ce0e0f3e5dd9873f9360ec299aa181da41564

SHA512
ab0d0dc65e9bbab0d1077779d1e8398aa01c928dd4d858a761c4d05c3b91a708b383dec487930b82d12d1cecc08f280729ce9105ab9bb2abbbfc76176f1bc63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1d994a6fd64dd876e7a6016124d71a1

SHA1
e6ba1e46ef7b6aa8b9323374c4f2644ca7ed41be

SHA256
22f9e023f54fcaeede74fd976a69f7f04fed654eb4d3a767e8680ea1f8da648a

SHA512
ec58dd10a6884e5d3ddcc2dea215a2695e767bb68e29ce5de5ef0b31cf6ed06c7b6238491209edaa9afe3f34a0cd2f0270ad1feb379e1c50d4582ffcd8d9843d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d48092e4fdedbbee53d67266aff4226d

SHA1
15ed37ec07874f4d1a883d0aa82439fa3fe6f0ae

SHA256
e204ef66ad48c7443447879d3869b1bd6b7153543fa0f22288b50a9268b1ed43

SHA512
629268bde2b064acde3dfb0549a3a62007f9455c56331fc397d254d96c64996d823df3b81b5d35fe8498db87e73cd420a0fca369510f0ea42fbc91376c2bc4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a38373714f994e906e5e5c397c51b319

SHA1
99bab051459ff3752b0f32520f7d89cb836d3e86

SHA256
264d40304c2df60f2c8b30cab73e93fa0891af5c191ccb50e7b4c997be23d9cf

SHA512
a70bee5ee48a83be076bfcf9d9a4608e453bb7405ba0d34f79902960761708841d4d5f68b78a609616a8871f4ee6ea81afe4459afb0545148c2c1d3b436ca415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
027c34391e9e9e0725234a69b45d958b

SHA1
cfece0646df1c24d02c587740f1067d1481555f8

SHA256
e9192c5da73aa9f1daed5d0b9b5b8b14f6e6f77d3b13fb93342bfcb6daf05132

SHA512
f72443eb137608d40ffea2b622622466cb5e3edc689fe574bbd749d3718d2665b2aba410bed89fe54076de3c59efbcf944d696b671aeb104efe29036cca9b280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96fa85b23d2e6ccb8eb720aa316daab1

SHA1
d9b783087740d024d63e7f53d83f8d1de15de797

SHA256
de7ea0dc668e32796ec35e374e4282bd3428eb9a8c1c943c931839521ec8c2e7

SHA512
c2f7cea7fcccb3c2352d343d61f738a352266b545ec2a82432f6abcd1bd65f5b823f9a41199ee4ff4a96bf51651e02fd943c32d19fa140a8d09c643fe64c4b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7025f19aafa4bc84274b2279a901e065

SHA1
e8c2dc0079753b21057cbff10d1fbaceb91abeab

SHA256
c285a2e7e4bb231bb0782347fa8d44b9077c9a81463045d35eca5d68b127bc00

SHA512
802eba2a869157094b25028a195ffa035bb14427e5bd3043da8a0be14c5ebb62dda2fcc9aa259f4a121f9e6aab2b715583bf916ce46f06fb436144ab88341603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4782fa1bef91055a7433b919d5217cd0

SHA1
268df7be2963889fefd11bd9352f345f52b9f999

SHA256
81a230f21a1b23a4b32047a68eaa3d8c95d43717eb9576b40a7259c20e5f97d4

SHA512
a8d3336cfa8bae3b14ac09b09eb3fbfc8b4e2e62f2f0e1177089c51d2da924fd856316999e8b6c31b837246b035a836f45ee930bfc1a0b3a6bfbc0ccc5364d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dab3418d8d3a6a0152da5a21f78e6b4

SHA1
f8b8929da44cd74001a87ea7f4d7c3c59e4221f7

SHA256
da4b911a890a64b9d2450757ea157522f8ef88cde8fe8982912c7948b2c07fba

SHA512
a49883f432d5d8d1d88e3080b0d722e3ddeacba1301b17821f15135f5070157495ebe0e66f469ab2be0f4afe3fc141a152f9550b1dd462c2e9c7f8b3c01827d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
171eaec161411297c105e7e3b04ec16a

SHA1
607c983f3466207713ec0b5c0310667f0b6fa1c2

SHA256
ae2ba30fd3795e939d7674316f97dcf8fb9935f1cf070c1a0d9054ffdff309b6

SHA512
4f86e067c4b730e26c16f24c5b9b31b0c753d8efccc61e49e6ab9e695d792ee1c9c5c6a97b1de432895b6f76f908126f1319b4c36055737bcfcad1c0182bc0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
635d8e1a3b990dbd04c37f25ca09de20

SHA1
7b80b628a2d78fc25771134a54a7c0be5acc516f

SHA256
fa3a79f339e4b7bddde2b0bdb2adfad2cf75ee708c13035be7e6811406bf9fdc

SHA512
e48f2872c6fa11299aee1ac11bed993960206fd101b3255c1ea4ce85c54634b83d952a4dda836af88ac6fd4a6d624487f06827a75c1f95c7237ab34b3830cd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
5604c9dbcf009dc933acea0111398cd6

SHA1
4008fc5b374d332fd910753a029431df5ed6662a

SHA256
a28cb855b0efc6a8e515b8b7ce38d941d99aeca0ecf00f9fb408a2ef3a95fd55

SHA512
2fdd5966279cb59b12a33a2e24acb3ce6ea6a0ee4d9a4529af8e26f00b6f14fde7a45054bb4ea8fc6802f277ff2e14d521dc0913d709f165552ad48dda48cc28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
72362419add299739381852568c67ba7

SHA1
fa7c53e29303de9c62a09650917114ae8e96f582

SHA256
7a4995b6540fc5ed123b88c173bd488fde2b65efdf3dfb85b4d6f02526df5081

SHA512
a2bc21d21dfb0c6ee6595e3b2556bbbbfb0be61f2322030e619d986040303e5434f4006afdcb49f830a845f483859aa195b281e46922f8434da3079b0c787b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDDD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit