3f69875035cb3cd780cb6230caff2e7fbf94a41ad9b6dafb31ab4c9b355b2080

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

305325094b7e80338b7f558ea5a36a0d_JaffaCakes118.html
Size

21KB
MD5

305325094b7e80338b7f558ea5a36a0d
SHA1

733cba1a774859f3a5b4965d52ce0421f742c3c3
SHA256

3f69875035cb3cd780cb6230caff2e7fbf94a41ad9b6dafb31ab4c9b355b2080
SHA512

03d3ebdf9416f115a4c812f8d79c348ea6a387c1f87db9c649012c5c30929ad8a4fbb7cbf759dffafd8c0d9e6fd831a4b8056113573116d5daf7b44d02127199
SSDEEP

384:9kiOT1iqocF/jIB/G0/ezS5zV70uqLkjkV:GsVctjING024Z70nLZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006109ba6c899c07dd3459263997e3affb40a14cfc0756ff39a4c7fd60566bb768000000000e800000000200002000000079270f0b1a54d4ba88fffcea8710e7bf71b0bcb2c0cbd5f7749021cc2ddccf9620000000fae1440dc65421b9375fcc76a63fd8c3cd21416ebb5f6c7fcbc0d8ab392a0f58400000008e81d31fa993a4e1dc2e354522e1f08f9a5e06099938bd60afea963e14956eb2b6bd6ac313f9042c6cd60d03529ffce7a27162d3b853ca8e52210f170992ed74	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421525623"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D16BCE1-0EF6-11EF-B44D-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004049a38afc024e6c8c0c9d6039a402c58905f455eefa543ec6db7fda3612e3b3000000000e8000000002000020000000e137b9bc3dd541a5a11bfe7a4864cdc5b3123ca4a31d15aac2227fe7b4f31d11900000006f8175e60e7eb6c44b6d989f593d0b2e4784dc640702bd5c0c02114f8d0b528fdf82b2c9e0909ef9187017e94245d8f151906a2b67061a86639fd2a97cfcf95a9223643f6a17b96d4b6742e9f945daac00b20e53c1acf1ac07f3f26f728c61e46292b5f2b0848bcb2f3a4b5e7c7814843454926c67306943ff931c7f6d595e62ccff00474bb1479addac9a25bc5342f040000000554d8fea46611688061651da184fb1fd550d326030721e42de315851eb9e09767012884ab44225acadba49ef61c9d6a715da42ccb7dccfc8bdcd746a6655b630	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ab69a003a3da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28
PID 2952 wrote to memory of 1388	2952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\305325094b7e80338b7f558ea5a36a0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c17fbe7223d37895385dd427df1fc72

SHA1
623068faec3c0d2bc40d7d083b7666172a6415b4

SHA256
78cbe55a7b1c93d7d86d9117887303fd418dcefd80580bf3c69d8baec87054b0

SHA512
1962c90e76aaf356b83df44f393a086b0a319eabe7226879fbbcdd25f1bc36b86bd75f62c06623eedd3f60d89d4451c66b891bb9cc10059f714b275fc50b0fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e289266c01625068db788d5b3e7787

SHA1
c12b9b4029a36fd8cfc94e6ed45d4c623700afdb

SHA256
213707c0806e09c4cfd8b224899fed6d949cfc74218ac66f14cc9f93bf170269

SHA512
456ff51ffdd3d8c302c8bd51197f586bce5d8dd9a5b11919a077c101933d379be80a7c3611b775469384fd49ddff08eac59e2524bdaf9fae91d1509c4f143a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6af3aed6ebb994bd5b4e64f18aeaafb

SHA1
565096c5940d5530be677b2cf499c66cae96d41e

SHA256
d0dcf2abed2181474d97dd424967867e85666ea3e92b52113dcb5b5a50c66b81

SHA512
c0c2b4f6962af9b5b0875f9457cb71bae444b21f6fbf37659d093cd34bb106822e154dee86b2beb12f6f5eab20fb561a3f5bc0018e0653fe4ade6924e8707adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c403958b3ce89ab2b1108435572bc027

SHA1
543e7eff34e20562be9120b6d3bb1917af258698

SHA256
95f0ff3d4ffbdd753d5dc380de0d9a7b6044786b80c04586db87775f378bfeac

SHA512
dd1458aab8c42a275602a286bd1803ef78ebdcdc75994d4d45893630bb305722dadb6071b0985abaa45ba277f0c2375e1b67242d3ec75145a6f985819637c1d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
407a4a23babf7431071586eb5214896a

SHA1
3b53ac81f02bc4e3c6b3c599d25c8b32e87a7af5

SHA256
ff56440450e8d733d2fac0b6816a7b2dc13f9e4700aaf60c7f63e77a94b69405

SHA512
4dffe44bf2abed9b97d57572cdac5ce28d50137b7b41e164f25e5b119e8c09567bef769a5a714e4fb518b88d6ac06e561cb2eeb4f48addcdb91c488b7863cf91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
383aa5fcdf27ae3cc38900eb6b68a922

SHA1
932f006c88bc935d549040fc429bc6622973a113

SHA256
acc5a3159084f21aff2cdaafa5adde75b91fe1ee6f3e8c9c75570c7fc35cd967

SHA512
1ef92660f43a7d1b65c6d6da3d3f1dcaa374548e4da6a789c3b10b361f9c9e7ad1140140063b32ef62157874d267809290a28ed94ecaa13dd71ad862de7694b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f211dece7eb0c37f5893ebf48ed39311

SHA1
d16e07512db869d1c52ac0f5c34efe442eaa5f22

SHA256
f385bba6a9ec3d0b32e97fd0cc3c276891ed84e03bba2b41bca9029db65ca7cd

SHA512
92215d497cda6b667ed1f40b5b91cdf0563d3dbd84bb513d56ffd10bd39fd8e758a78704a079eee74376900be7b49426c6d33c878e6330fba3d8a621ec94b57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23a8bda10adf4303e79e2f57bdd38ca

SHA1
e74d17132706b40373b657827134d36923951488

SHA256
0d900e982ba6c7811ebac5a291f2c8f5d918d6a6f735c30041324666128d3348

SHA512
bf39ea7d753edb3284a24ab4d10035c6a68803b8bdcf631359512297716b82cd946f8ecb052d2518747ae73c4a9e1fe3b2998b57c116b5e6885dbc92c7b23787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ba8cbd182df3a493d5a42076b3589e8

SHA1
590f9da11fec102ceef0c0b7ac634a7f6cb65b47

SHA256
44f8a1b79519b364777287a870d5dfefaf12163eacd82f820a7d126afab10374

SHA512
5384f86621280e6763ed3b75c4e501a27d14161bdcb75f28eaecd1d48d0cf231c48ed1a99762601bfc370b952d7cd721c779e3cd4daacc1f325853ef10c99e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35b8961cb81e234122b36d86d8ea4c86

SHA1
9f8e7fb84e4250e0f408cde083aa752723111cd6

SHA256
99908c2d8e11252229db4e702e7d44f7408cbeb651a5ed233a26410028c7b693

SHA512
6f7c83f8b5380ed4dfe4a353c154dbd21966a8b5904471760b55760cc474a91f55542440cfa92c56b60930ca50cdb9cafb551d763c2f272b13e160b23ea10380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b151b6a826674000a85b9fc0393118

SHA1
6fb00e2207aa8b325d4a8af7a96a238fb72ac2a5

SHA256
ae507f1a7b1e6b3e27627e4071cd32b4f270633e7c2d4e3be509b4539bdebb0b

SHA512
45d7a9e1deff87511d86b0de0ad718abec58ddbeb44b00fc6b4b4f02201e47ef72efa7056a63e0360c1f067747fe6c977ce68da7d7375c418eabb2add3adbd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73fea76518f1b6c5f30e3a52126eeba5

SHA1
93dc341719123231b6018758a53c555280e5554d

SHA256
8c36c49b3bedc1e6795235c5c3bec2674cc9400b6198c670a37050d3d9cb6d2a

SHA512
f8cad3fad6af502ed4861b014001769e3c52e251fda4cb7280174a030b8227655ff13b6c623b5a2fdb4aae92ae5ce0a19b119b23356d932ac04ae3bb7ec6a434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57318328b17d621fbe74e774e7176f4b

SHA1
fffeb4efca1e34580351c52f17861aa6c37bb93b

SHA256
471826713684eaf06ca36449866c725ef460bb8c83344fb1d6f231e753abf306

SHA512
7717c29c25779c61d86848e479b0304d5c5ed2d09e827e2572f48f12dc4466bd275f9ffaffc047f4d6dbeeda83983d0e717a7b3c0d0ad7d4b6aca7868093a2d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ced138dfea09634cd6a2b08c2c3ae3e5

SHA1
b62dcba61d0702708c8d7713a3cdc4b85d1edccc

SHA256
fae64ab959d583d86c6a83a3cc0c234aebf82bbc55516bc57ac333b969147a50

SHA512
d0adf192cc21f84ac4db620e6662587d0a0aa9d26ac747a608329dbcbdd9eb58f90916b3b8f9a6753fe4af5d95f745254a923fbffd3263430967f27b4b299bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd7e1e4734683c1287be98589d94300f

SHA1
bcc444c7fcbedf2cca72d5415f5f000707a99814

SHA256
5176904b2b1e99beec74db4c6439aaf942712c2da9827badf0edcaf6f666a6d0

SHA512
2bdc80df173ef0d9fbead2b3b7405a480684ac70e1561d23802c02e6e5cf5f5c12949f43de06f362dc0d5789cbb2d980d210dcf16f14d0790abeefe4b9dc2776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8bf7baf5510b56322215268e19bc479

SHA1
3481130e1e4cf011fc52e19cd4e5aa562951aa46

SHA256
9f4d51a9cd94c1e07a4ac328b3d003bc94b732c9a229092f4e8e8a0311d9670a

SHA512
b98bd23985c3a3681a682e392d3622f8c4539d55c3e0f444d60da955baaeb73aafdd3acd7141aba487a2ad3093501debc3af3ad80504bfc75a1514e8152f7179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26A5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27C1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit