1e2ebddf4b9abcd5af3cd33da752193832228582244fa06a99f8c38542cb447b

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27b595bf4f8427a6b3255f0a75f0bb31_JaffaCakes118.html
Size

68KB
MD5

27b595bf4f8427a6b3255f0a75f0bb31
SHA1

f48ff9c36390f6cf74e85f96b09fd33ea0eec833
SHA256

1e2ebddf4b9abcd5af3cd33da752193832228582244fa06a99f8c38542cb447b
SHA512

1cb6c0b069027759162b2997623fdf011e31afdb91d5ce41a8ea5bfa518157ba8b926ab7d58afefc2ac8113580437bfed45326c8b0cb47fd2c0cec624f73f305
SSDEEP

768:JirdgcMiR3sI2PDDnX0g6jBWLvoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:JwmbLQTcNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA667BC1-0DA5-11EF-B27B-DA219DA76A91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421381066"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4086eeceb2a1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b85365d436b1b55662e94e7cd7eb076e1d9f9ff86221f9b77301c13106ffd3e0000000000e8000000002000020000000d3d6da10adbc7973c9da526dd15ea30281a8502f5fcf4cf98aeb62e2ee5faf7c900000000b4b7303bbd39cb1d9e89ada956ab7b1321eaaa8875916955398d5af74f3e0e334939114642520809c00078517695435a8599bdad32b197d64fd3de2748d5d6a91ea02a48c5982d6a55ebaa0b0342e8035a96b7890c02fd7360514f1a24f6755f2ce44d2275c63f82f07f2a925a82188521de3680573910ce2ccf5643d94be168564801a3e021626011046a923453e914000000053534dd6ae0a95bb843a4b0d1a38b91afb9bcace3a129fd9ab4f2f931d2c74cf7e874c2afa16116720724735b36cfaac0f4f1f5add702c35aafdf0849e63f3cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000030653b2e4dd8d7fc7e97851a9cd8f492aaf9442457f79229d68447ce4c541539000000000e8000000002000020000000eac1cf41200a592c718d86b71fa331ffcf5d1f4c84734237cdf6dda39a90a6622000000090ae50ac5c7605c14fa10d665792ac29e0f57cf7a55899d5d19da5a147101d5e40000000fa53b1ed7a08f057888531ba30f6e1ca3c6ae345c65304cdb203ab44d9472ca15da341a982f8e12daeec11393f715e3db27a1aebda8779bc6619bee6ee849ee1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2744	1900	iexplore.exe	28
PID 1900 wrote to memory of 2744	1900	iexplore.exe	28
PID 1900 wrote to memory of 2744	1900	iexplore.exe	28
PID 1900 wrote to memory of 2744	1900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27b595bf4f8427a6b3255f0a75f0bb31_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2c17a40e9456fd83488c46f594df3ee

SHA1
9fbfa35985508f2377916eae7b74abfc1952b42a

SHA256
88d11601369383536010b66d709e9c4a86ffaef44b8fa7c2835613fed42132f6

SHA512
362033cadfb64ac2916933286db50b908ff12237f53ac78a9abd3cd7d6944e15144b3a768e418a2c48741cf6ab41bd0467451eb6894a39d9d6e501fffd24ed45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c59f51500e3a843d3aaafe1c99e8b2aa

SHA1
64f756d063e2d6eae795a31f3055cb40c08198e7

SHA256
8db62c5ea720245b8b41b12b8fafe68bc2e5314df262d93d94c69b3ab4793214

SHA512
8cfaab9998bd99c55657bad9cce02f97b5c7224e83cfcffc3098e150dfaf764c667650c35126c179ed9365aaf11193e906a0552f619fc0dec27ddddbd6926b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b2af18e158498dda3f5e1665432072f

SHA1
9aaa184bd8355ea5db8771711981c80ab05a2d81

SHA256
6ed514bd045fb8ac8889270344547960cdd064ca468917891cd309d97268037d

SHA512
89f613aff7c944ce6e925c1165f465379a10bbf734d9bd742946084d68c40e1af310e3621fa33a7c312cb043e8c81b5bacc6b7270ed2a862e89f78cd2a923900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc439a40366b1cb66a15fd1108cf1db5

SHA1
7aa1bcfcbf1e2fd06dc02b3665308b3c84057260

SHA256
0eceb7490a9e3a84472321aa86b850bd0d37b87494c2c5af49accca241737b2d

SHA512
a70e4579d88a61aa4389037acf9c02103d53a810898eb6334c34dafcde7101d70aec17b0eaf73193f7c2c86827497c7eada949e8b1594231d950cc156da858be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f71d3c2030c2818679d5d98f57f150

SHA1
2dc54b80fff9e2f10444601fff6579b22e5f946b

SHA256
8cf8046bc5b777e477bfcc59aa98f4127b0bfaf4a6f74988a6b2a3f7304684d4

SHA512
728050fb6539ceeeb454a16e94879624a8276fc9c7e2c3aff1bf8cfc6668d6646e4dc7f86718f1a0758fd20deb99ede6698723d9b4f46c8df0359b65c7a20b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b1bda7ddfc3b9bfcbb9fbcb2ecadff1

SHA1
d0fa862c0131954338d3d6d33b4fa00a718ce389

SHA256
5ced4c93da00a16be99a46a2a5a929729142125296c18470c7494f5a8f447144

SHA512
9cab03fc36d026999eccd9c72becf5d813966277ef54f314a82edc45a4ab777227e28851b4f8d1304ae8e2b114d72c0ddfae7e5758716ade38e0cee3325f1343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
186319234f6f86ddd1de1a012b72fa67

SHA1
6fef3e91f0712930b1b39aa78535a93f673f5e91

SHA256
ecc43d8055c5b3d63b8eb56e15eacc1a8e0d72a4c87a1b894e1623d87dfc13c2

SHA512
ed9b582e68c3d86fd54124ee5a4715ce8a481719578916094a818ca234782af9425bb81600dfb2a96a911a19e1de0d9f115223d3b7742150e13ccdeb0ac580b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d32c2cb9e7146acba8f96949cd9db45

SHA1
2547fde319a793eacf6459cc0506948ec0fade4a

SHA256
91e7656bb123a82f1e43e4ee5d9a5e69df2b0892c0c751cef74d3b6a8f8ae38b

SHA512
02702f7ec8639176c02762043fd948c8f5fe40c615d770cf2cda018d08aa9bd5a7c3be4c44697515dfd45fbe1606c9c093051c67f2ca9654a91b3151c9c145d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9427723cfaa346258d1c23ce079fca

SHA1
bdd6d9815e8b5df509d7c569b91b322ead38b19d

SHA256
9c27011b6574173b9fb271c518aa811f8d9d2ef617c4be16fddb89e060192094

SHA512
977f6d0242ed5be28b48fda534ca2aea0f20f8ea9b1822b06a92cb21bf2e486c86da0f9ea233300af8f5cb6c796704ff6ce76f6b447827fea8e402c4d6709436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f58e40ba978cdc1c3a352201554f80

SHA1
acfaa64a46e414b3a58eb4de53a878cf55dc1a81

SHA256
d3c9b4a59d5ef152bc1b95faaa20a0113fd098323c9b233553d2e638482db7f9

SHA512
fe42420034e95a0d36e94a69d368a01d1bef00b29c05c4d9119aa9b53b259705dddfd79feda8599645469f82afdc73cccf391e16b91239e9ae1668ff39ebec93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99bb38ddcf162264fe728b89f494e051

SHA1
6dd08e4fba5d162086c3121ba57d8ebc661ac358

SHA256
96e91eb13403e0fb9d83fe9ccbba3dfa9b1563f95ee8855ea29f13381cb90964

SHA512
8e647ddf2ef31054fab121bbd0867cc97fe609ceaa9b853ff986d725a9058a2cdbcfd3d1129c470ffe8c0a27888012fa8a0427445d1932110ffc0bf91af89a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60ec3c4c08c0bfd4a52e21702e1fdc13

SHA1
42b3201412f8ae2c9539d9e092dc53b3cdde93e2

SHA256
5489917b1d3bbe713f6edf319cec5e592694ff6f0e091f46afee7f99cb51365f

SHA512
688c94a5d76d0d954566bce13b3b145f6c20a9ea48e3f725c83ed537672a3157dc8514c8053e6188fed001543f307bdb3d2ac345357635ebf81715b246c21b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0182d9e143117236fb2f6da0c9f7a583

SHA1
74fbc383d20b6c93f16f42c3e90b3c50c680a48b

SHA256
ad2721fa6eb6c987b2630a0b5a5c1b82be2a7314eba8d0f803b0242debcddc02

SHA512
559096f592e56e569f5e42f3c2475066fdc520d3f38954d5ebe7047335f60ce0c8fbac977716ab2187ea080b0eca2d73e710735beb3f23c591b99faa284bd813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a38bae02a0354fc7aa764a1089dbf65c

SHA1
75a7c0e2a57d961cb27eabed1d388bb3e1e64c39

SHA256
b9a34bf21a121263ef02681f326e48729c4517c8f4d81508197bfa1be856d6a4

SHA512
a6acebeeb4e613436a490a10fc7e58f10ebab9944e1c396ca72a2fa4d22d51374e823e0eabbb770d051981c1e7f6464bf887726b7ff1733556d7c9e1e68cd753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9eb2aa4d9e3bca75a78c33193fc38a

SHA1
8b774b6b7553b2b36710a7f0e9cca5f6acaf7347

SHA256
5bf7d5e48f8784c08635763f0a0b5b231df0a8e0ec5abd45445d3b40e37bfd3b

SHA512
b24f5018b0312dbb5971dc686a774cbf31b007d23614b981945336f63eea5ee02e2485fc1946e3f3527d4ef1126a43c4470bd827640b484ae78d3437d9af9a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693fbc2cf8a254d887b57b98d8b6c1e9

SHA1
4de46ff5e11bb160ec1ef40b274fa9dde533a7af

SHA256
812508220714ffd35b71826417ea27a5610f01647486a31f695ae8a68eb14f6c

SHA512
97ecae63bc26f4fe02df31943d47dcf2720060a4bd92d2872aebb0356690c0d941770a5c4292a11ed3bbd95cc8b973a8b3f5add201bb8b880c7e6d23593b015c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff0feacb8273600e5ab96b08069341f1

SHA1
2e7dae5dc65a87585e0c00319266b2507758d690

SHA256
9700aa50869bcb86589d713f6338aba4cbeb5c48caee82c466e43d1c9f3b3e1a

SHA512
95d43ca2f7908bfe7f008488fca33279901751a4c8a8dca7d9bf6b9d21fb18dc6347e13ea27f46d2ef7690cc86e1062e2452d3fbddc6b00bf8ab357fa12fdda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D32.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D83.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit