c655685529cfd9d30510a9a5f8254b88d9bad5d85f42f7d48fa95e10e5da1933

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26cd7f690155f6b5241197a38217340f_JaffaCakes118.html
Size

37KB
MD5

26cd7f690155f6b5241197a38217340f
SHA1

791bda76f606f3e2f8952ca9f6bbe1d198a13423
SHA256

c655685529cfd9d30510a9a5f8254b88d9bad5d85f42f7d48fa95e10e5da1933
SHA512

55eb01e00202643d9a591cb2df581142cdb383723dd7286fbfaf0c513b8dfdafa75109b8a83b6ecfe8583d29611331725407590888f88df38fbce7be852f98b6
SSDEEP

384:xcQ/hH6/bwcSfrT14XYVTZ9j8ZrnuHtYQSFbzEI4pQaRWOmorq:xLQtIryUt9j8xnbbZ4pQmWHorq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000004ec5ba9a2e8d537482edeba5586f04e73651acbd49611188c36dae4adce5b16000000000e80000000020000200000001aa256b163ca87b9eb0b696bf84cbb99596680971d75cc03ee84d713b4537e169000000063995c41ebbca0af9f2dab0925337c451c1f5cc6faf1864b9ba5ebc2a14937e6bebc99508207e6ee03357f59a2c02013616ef391a744064c779d4ed4ad3f6878708932090d064f606b2ec091150f9e87710b46d9a1a15f692ad0f82bc2e5289ab4c44d9b1c2f513c9340b653d413c08726d03d1e69e25cb6d8fa7a8e6ee35711bc7d6236631a9aa6582756e7553f4d35400000008863bc140cb2baf9d6e82813711014ce9c772238f2be09cc98939449504fb85937325968a6477a0aa63813137e719b67781e8c31dab2287abe4f874ceeaf6336	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28F0B2A1-0D81-11EF-B2DC-EA263619F6CB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000063c66c6a5bbad62e2153b2ec0d9cc36aa23a03114c128299ef7ea329ff0b5631000000000e8000000002000020000000a48ba38eb6342a81acae0e92856cd3fb99e987c436e63c85da3a62cbe2a8a78320000000aec2272cb1ac681d052cba5df721f298d55687336a909fd1063a3e99399470db40000000249c47b80bc8c5e622b92bf7ccf12597832df9e82a9538974d5c51ca23731585baebf2354c566a3bdd2745b50ef6ebdcb6be8e38a179434df6f0e54c5e2e327e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421365255"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c737fe8da1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28
PID 2896 wrote to memory of 2944	2896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26cd7f690155f6b5241197a38217340f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dadded80a11949dee3f8f14044cf6b16

SHA1
69fd321cb8ca1f409b513f0842acf88513a1d088

SHA256
f89ff913bdc107051c2474a2e16d31e9d88e65afdd845aae056052a7004c8f83

SHA512
1ee5c9fa5e73d56ed09df32f032ab1ee74b75b7840cd24eb218520c7b7a82c689e98c49fe2eb76aa53f09602210b2bcae39ccf4a1450f974a07eb1b329e024f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12881267fb4cf03082abc2578dddd05b

SHA1
7e1c9b4bc3ae16eee0f4bec73e8d5c33dcf82e14

SHA256
6e371ebe90329bc524b14e857c90ebb897028e175dae58d871ed169f8d4d6fb1

SHA512
24da09c2acb9b41dac75a2083f0bc53f74c59a43e4d3fb445947a467bce64bac94a1bb797bad116452ab6dc938bc00fa4341dd4e8180c1d2d3f99cfb66764164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e897369fd6838cda138bcdec8a31eff0

SHA1
bd47108f8f52de1166163242ee9bae4fc5cb619f

SHA256
ae16c3e2f72c8db5fe2ad65b195501037533f876f99e3e61e5214e333904d7c6

SHA512
2fa1650775baaba7449060d8fc7f96a95a2184f78d092387540c5b0b9ba2219f4fe6997663b8ea9b195c51d8fd6e515d97b95097e233e63b1e41dd553d38a265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64af50ccb5b77d19a1fa48129398df22

SHA1
4bfbbabd0ad6879f02e15402891fb121e8002c40

SHA256
748dae9e4afd14c4b848f2953e780b3c9350ab2c813c92115ec1d09535556559

SHA512
c9266888550e08c2413214c4d875404b35366982ea9c718daea3c2a284d9d34ba2bfbffb3ee4e04f8fdd3dbdc43b50a99ec73ae6fdac12411577c8664086dbf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2511bf38b1e65de5bfb6adcd3cf08d5e

SHA1
810e04d05f9639bcb3b6bd63546bea25e4f011df

SHA256
6055ff6b7f5fc543d6e3fb9611ce2fbe735e8c7d1139bf622fc50cff8f373bba

SHA512
0f974bc015cc9e1d62d7f62c30fd898213f455bb74b5881055b3e35995ae5a379a52eedae72c520ace1574c568459b86a5e93bf5671a24ef68587b32e282d501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdddda78d251192fc77aa2651e9a6824

SHA1
35b3c4c54475c9b860b8b2e245a70330594e2a4a

SHA256
3b201dd219812c9c85147cd740c097e5e59837658dff1d6b5acba104b0e1967d

SHA512
bd22edd23997c37d6d89f63565684040d49ae4d17ea0c832ec7102fb87cdff72d0e5754cd382a68128d66c507d89f29318b80908402c361555b6810d653e6a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67dcf0c9149366916cd7a22e34555d54

SHA1
61d8a085b54dffa69a323877998d0c1654c91262

SHA256
7a6389e541ac0f2d204f6aab0f616d0de4561649486ad277b51103859702b6e3

SHA512
f592d5509113126dcae56c22a11c25a577a5634f4958967e8b47769690cdaece2f1b4489a736297299cab3c49de217d0bfd1fe91d48c9881e8ec2e99ac86367a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10dd571e71aa76f8eba1224a6802061a

SHA1
49b31bd9635667780ef3a246548cb62d4b17d80d

SHA256
d5e68c94ca3d558c3478861d292231175d95afc6566acb974870f54a2163fb65

SHA512
266b124ceaf003e65179df1cacfbb3740c9de53243fc1489c16cf1e3263ab8e03bb9b7df417ce7bfa104646093211bd0c068d3bba4c544febe5d6b6b7b971aee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
745dfd14acf693e82c222c13f5eef4e9

SHA1
dd87247963e955f335a60ee4697c6077cfd39951

SHA256
8ce248fb541795a7918dfdd6766682fb2d37ed4ffa51e64a4861ca2aca6a5c4d

SHA512
b7318dc9c08369c8307cb7aebd9a978810c918d2e62531b67482fbbc00f6a11c902a5ce1bb6551d7683cfc852f4236280af3d4c77dc3d62947459721296f9c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac633a6971aad2cf2d383d70037a834b

SHA1
f8717ef84539d1e6ab2dd3917c0bda142dc868a6

SHA256
460cceb1ae7bb3a5f219c0a9d778fe26106e6f794fdcb0645b610dbf00d84342

SHA512
313e8d82f24c43f6ca91f02f308d1872e5d9cf74f0a2f93dfdeeffc8ca25464f84463530c0d24e0cdfc567e8405a81091d785d91ab8c5b349d9ce705a2d17b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76bce1963d116188d0877e0754f96018

SHA1
bb5719d32ba6fbdd00b5ec8132539a3c02abdb46

SHA256
0a1e8361dcf1534819371fe754734a10885d5cc5e0fb40710da1b41fba7baf2e

SHA512
4d45bd4566d636e30009100bf57b8b1281140b0119264178122b17c6b0ea557b9085f9bc9c5c41ebc4d2618bdf1b3accd00e916ca986e11934c959a06c3a1a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ce49ac62eb0319ee7e1e67b873bca4

SHA1
cc8cfc560087734a78efb67e18aae1ac057b0a7b

SHA256
92c1a094da68085ebd43c5212ce74e0ff92b28a4116fe3170a09b6207c1bcaa4

SHA512
fae3af832dae1f48ee3441bc47da0ec3f12c2cbd23e876641c7628ee1bac9a0eb3c3c1613c0a892d08d5b0e90c3816e90ee01ee09666ff3be4a8df9f5728f1fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a87ece5f942313084186ca19675081b

SHA1
ce9222e3c9970ec90ff98ea380418f8ab786fd03

SHA256
bb4dc1cb8cfaff603b774245c67433a23bf72bfdfc31fb249d49992c7423bfa2

SHA512
7b0915dc2ba3aebb29afd48cec082c5ad2a30ce6b54e7bc02ae7e5c0d1ed18f84f5af82c37402c81d1983224682692de521f3a8fb9fda10e75bac7df105540ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB5E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACCD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit