25f520cd744dfb86b07228924518f174f4fcfe64391ca6daea6b9c1c49a0641e

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28bd12b5b5d63e9aec670f6670a25035_JaffaCakes118.html
Size

568KB
MD5

28bd12b5b5d63e9aec670f6670a25035
SHA1

23e0dc003717c5dfbab6545e814d334dbac36499
SHA256

25f520cd744dfb86b07228924518f174f4fcfe64391ca6daea6b9c1c49a0641e
SHA512

2cce6a38bcd5a39cedb455406d6f070c6635ad7a6b4182e53e4619b1b9f7788a789e9c548f7a432fd5c119ec71464ac75b8f9a8c628b8a1a8916244046d1fa2a
SSDEEP

6144:/sMYod+X3oI+YtsMYod+X3oI+YHsMYod+X3oI+Y8wsMYod+X3oI+YMsMYod+X3op:D5d+X3j5d+X3Z5d+X3+e5d+X3g5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421398433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{695048E1-0DCE-11EF-92D3-66DD11CD6629} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000188afaf1527f565628a00f19d2b2211234ba76f7a2869e8bbc05ad4211c918b5000000000e80000000020000200000006e77ce686c969c44a71b3d7c9e31ae384d233a9167444e0e7fb9108cd7d9b62d900000006662b6be598dd65754048283cac720573aac1b91f39db5c5545df4e6f32aad817a13e06156a1c7976e63ab5eb786f63683523b59c48a1a0cb98572fe01b3785f9937e3a4748923fdeb55329be5b501a70a6eb629e1fd1697ad1f6a2c9185495c83be1305ced9de26373600a4f84db2d0e96ba8d6a495e87ef4e03064f752a32c60910dfd799e23e8877135a514b8417240000000734a0ca30df8bd95472b2dc92f88ec8ea53509335a67e28f0bac1059fad6300415ac8d55c5e3597a20fff267451ff72ece02d3e23a214391ec7e1a78f20e4698	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b1de7cdba1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008f1f5b3d7f6d77e2f4b9e465d31a3b9d75d070dda147de86865486ed9cff441c000000000e80000000020000200000004dd6739734a2dded3ff998c6b0fe59d8e7178e7434eb41ecd20549c4aeda7bfd2000000095f0209991d879e2e7e4157e42a5ffffe259a6828f8711278aba04ff2a8c8c3e4000000018868a456555ecf9b762e348666f042e69a4b9effb4d1f5cc179816fe3ad42a134aa6e4bea9e194810c5a0cb3f0fc8fdfb52ccfbd0abcf7af7d96a1556471675	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE
1448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1448	1976	iexplore.exe	28
PID 1976 wrote to memory of 1448	1976	iexplore.exe	28
PID 1976 wrote to memory of 1448	1976	iexplore.exe	28
PID 1976 wrote to memory of 1448	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28bd12b5b5d63e9aec670f6670a25035_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c090af12ba218103fcd4785bd1eeb6e5

SHA1
f8555add0fe5f24914eb0e4350ae647cb47a592e

SHA256
51fe2c86e8effa2a697ebba0defe1a986e94c2ee173c58c5094c838ba44896c6

SHA512
e2721a3a92048509267a3ad95970a6d4452d59c2ed324c6aff90a9360861dd91e61b38ae9758888ba572f8e828e75c88205f70ace10ab95d71e834fb1b77b1ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7d91bf9dc2842de8d7c073e9f1d46ab

SHA1
c87845b0ec610e09a1b933b33d58a6bca6f4d2cf

SHA256
943b2e15b44e51fcd4eb9fdd82ea9a0cdab351d899834cef3502e5e4fde47bda

SHA512
3f98442dfd1754a4673981d370e7eb34cc79369ddd9ed4c65c89251ce15136fd19eff1f8c1dab185e272cdc6d9b33e0fe47595422d18ae3c661ed24797d094e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54b041a242c10415b15b0c314c1b814a

SHA1
dbb2d883bb36c7e7b71e562818fdf072019c7f6a

SHA256
d099bcd77c3113d09575e0d1e35f54a6630ff8381e0b0315909b62ba212c0190

SHA512
675e778752a04ba7eec55b51d4140b12e3b68e4ccf3174ba697df757b78021ab8aed094ddc560427af8f45597907c85d4cfa5bd903f8bcf4b2c3c1800c2a207c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffc0fac640f9714652bff3647ffec16

SHA1
5bf45b8b0b719fe5a44e41e15a25807e77d75ed0

SHA256
408a8707c24d1aa27fc026d76365b55d9dcb29941191040a7b3cd85a8bfd56ff

SHA512
a7aa42d55b5eea4bd0ecf8c84fa67d4cf2d8cd07dc95b54c489f1e086643cf517f016a19799f66b48521017fca6c1222768fc36f19300bb1adc027262583088c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b824ea0d9231fcf5db89b0db549493d

SHA1
dcceec71d0cc59ba233ebb24adb4be4342766e81

SHA256
30731f2341530dcbcc658b9d43710f9cd6fc2f53947325e9528d492b683fb7f8

SHA512
74f2476b451631ad3fb63239e7099df724b561d31a08729d7a975e1902bbe962dc33932f042220a97c8738f45c37d7d40daf10a7000084b61d385d60fdbb24a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ef37434a90e6ab3f8c3621cab444d12

SHA1
857c252c5f0222d49e93a2f1958669fadd71b405

SHA256
ee07e96f3faeb931a76c55c600a00ab02f7112ee0f9d6a6a19f6073bf9daace7

SHA512
4f36db5c4cc039ccefe098ddd9d1d747a65e703d43e993b64b8ecb76e0d09828bd38be4301a92a94200262b44f47c2f812b9b218dc6cb65dbb8cca45a9895576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6351c8d65e711eea8de341eb85d9c2dc

SHA1
f45cb8b3f5a1718d8ee960bc1d7d14c05ac6d06f

SHA256
492e08a191d34f824a9359536bab21906d3f29a8cb2fb9a3ec4b183513c002b6

SHA512
b942392f2d3fdb051173d8ae999c97ca7031ea4b18b4338c6f3f140c772d990bb2603e33fbd15c468f27b7231fdb6597cb2e2bdceeb9f1b3f476c502affe0168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51aa81e1fb90e68e8241246980b2534b

SHA1
d0bb5fdb3f9f98f5438557273066ba7b8e3e7f51

SHA256
d4bf6569066d5a384012809e52a6837fb3add64b800751490d1c46bcd7238367

SHA512
2d449625872815805c364414a687ddca0935e305dfa53920f625c7f371a340b7cefa4dfbe021e224efcb33070b9cd5495390e453712a43e8e3460bf29b15e2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98a6468180a7a80f5ec0fce6a7bcb5a3

SHA1
199740313f42e003611a89e0262c74e16e7839bf

SHA256
f8c6c0e4390e00a0f0d1ea6caf2d4ae9e999b93802d05af864d6ca7823103905

SHA512
938ddf3728f6d2d1a0e63f58e9702c8aabdb8cbf946adc440b2e78eeea2992e2492f0c68b0d87100fcac6b6c399fae91379d3d8c107105fef3e9e6983af3887c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f92d2ae481b832abd74f01608780fc5

SHA1
9ac525579483a5d772fcdadbe543ef4a84082339

SHA256
e7ddd7de372ead5d499b67c1f8a4cb6e3002afe8e91cd548f307405e2d0ef4af

SHA512
206902c620c578d0393493150f657c6c6a0353fcfc30f2f3c4aecb02eac6abe4f1b9fb17393eeda82426ce98dfa989472615f7e72eceab467b596b901ffbe878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8a3f5e6930dd4f262bbf64caa0af9d7

SHA1
060ff81d1bfb687bcbcefa61a10cbb4a71cb467c

SHA256
c9fb34fb680fb33df49477b5b4a4eab2f92c68d1c470a625a3f5efdbd7c6281b

SHA512
542e3ea15ec43cb5fa5c94ce66ea2f5ebddff80139c1009389cfc5b023b1a93c2c4acb9f7da97bdc37bab78ff327189281a03f9156e0cfb41c69b5a43300c506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db9963d086a2cf935b1251cec51dc33

SHA1
e4e8c98497f36db070220eb14758575b3824e6ee

SHA256
80e08b2133986bf12b1c7f2df8a2602a0e8847b9eb0194892ae6b7349818f1c3

SHA512
a17767fc5125c655f62cd55bed1e978ee44f3dd4ab76abc1e722badd3354a6ded599e1941d4f1c86c1534a371dbedbd00de719cb06d56844878dec7c7ccb2522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfad2b7ab78022a50fa408e709a3b4b1

SHA1
7e423f19f8d26b567dd0d167046c726cf07fef62

SHA256
0af34e7585e20411bc3b8930a3690d3fad08386dba679ac0feee8b97fda7e45f

SHA512
d454500464441a9c09b0354746a18927d98815ba5ad040699c86877cbef0cbaa539bd81a3b5f3187dba089ab19d1d07cddfd04cf855718e6e671e2e0e07e1642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
904d9af2ab6d06a12d14f3e917c27a10

SHA1
0e2a40fd70148e263ccffd0460f9dd300cab59b3

SHA256
fdc191b1902ef66b84499e4638891b1448b0a9230e34c51406da20430c88536f

SHA512
509e246dc9d8c0721945d67bf2efa6e17620e20cf61f3c9244a7cdf8951a85c6ec7efdd9efaa1235534f7d5d358cd1be84a02d84b94602327476a78b3ff620c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbc9f673565c6db6652c159c3cb964f0

SHA1
b6a68923849769f278a8d02f0a2acda146bfd969

SHA256
58eb150353ba9a205c2e807b7f70f93be730b0b3d100303b2fb3b073afa81600

SHA512
94c6c1902f50b47891cac65c50e83b600cd68f6cd1a6cca1daf279e32932218848ade2bde160c334575456e661e9cef0870b38e0c6f118f3c55eb232e4ce2248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91db590f21957f68f7ea3f462b1daae7

SHA1
94e8a081395dd2dfcca821f3f3f54b9adf612d2c

SHA256
46a09ba163671e347c24e665fb7d911e13ae6cf14f59a60c4b4df641b1c11f1d

SHA512
544a53f265f2a62aac1f234ddee531e69b1079de83b1c5402087ffe9f573dda3973d6e44ab153cb1f1dd4c8c50deb4730a9278d93844b635d3b2f72364b930c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21B6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22D5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit