adb667b026286a37b6a17b81806c530601fde654c02528455048f19b7daa5eec

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32b475da5a73a7625fc7c2127a82485a_JaffaCakes118.html
Size

55KB
MD5

32b475da5a73a7625fc7c2127a82485a
SHA1

9526b7d00816d55716720883d95eb41562bd2c47
SHA256

adb667b026286a37b6a17b81806c530601fde654c02528455048f19b7daa5eec
SHA512

3adfe03f12b3813654bcfb31d012186dde9e7c7bf95224e9dff8162d3f24e0a32461d07a72c66ed3bde136d474fc5a77919eeb93da036ce5af06e28c0fbf04b1
SSDEEP

1536:VmsIgSyEZdmV7reguFueBh9EKwFreNXgaHNk4RP:VwgSyCXRP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bd4d4e5ba3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79963E91-0F4E-11EF-A585-5A451966104F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421563391"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f8501a6056c76e0dddba984d0f324a35089a1b1457f693f68881c46ba0560b90000000000e8000000002000020000000b85698c779f1c75861c47ecd805f06003e78ed4a1c07d8f04008277a4c21e52f20000000f1573d297c17a15ce562c2771af1b594635d6709481b03f1ccc83935c0a6f66240000000868b2b3d0edc888875b3f6ab839f2912af378b55b1b090f3d6f5cd724c72b29fea92931f08c03c6244d5d6d92a4cbc652b04525951991da2dbf95184cdab7463	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000538db6ea786415b42dc72804104a288bae954590175e4e296c9676b2f47ea80a000000000e800000000200002000000046966b96fb416dca9c0d2ab4533243f7a4b2f8d15c6e25447870aafcd30aa110900000001c032d304d44fc6ce3f3e5eaa54729ac4a9ac4a8ab8f7a0e501906e2a2432b72e32fcc2e711a46d8056242406f29a63722ceecc975af2bff3e8ebf7e477e5013adc28f74f684ddfb07ac8de377d025b917ccfa645830617d283cb96a6a5fdbb305dca248790fd17f292ccecc0d25e0a4e5681ab611a5dc0a46008ef09ba7aa32654af64d30281b49a9350d4528fb9ddd400000005d9bdc403c71567dae124226777a3aec2c3ef9648d909ed4de2219c3ce9fed15901e0a4db49fb13a8103b54184b3156aa7aec53f131de4cc98dab7a51437d3ce	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2608	2296	iexplore.exe	28
PID 2296 wrote to memory of 2608	2296	iexplore.exe	28
PID 2296 wrote to memory of 2608	2296	iexplore.exe	28
PID 2296 wrote to memory of 2608	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32b475da5a73a7625fc7c2127a82485a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928760c6505d0cc2c873850a26a1350a

SHA1
8ef9ab62f6a5d272ef3c0454ca9199c78ce4c2d2

SHA256
921738af64e96ccc847cc52f27c14319fb705226ca1b3fd6330026e8eccc1ede

SHA512
d207062cbebba05b3c4d9491e4961f03a054be5fe4ecfa64f2bc2ba4642c29c5e1103ae809f90abb340d28647411d8a3961607d04206e8761f8b3a7632b8c47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de93853583574e5d7f16951ad7460242

SHA1
f4114842099f145510454625c9ff84bb703cc9cb

SHA256
f186abdcc325529a1e66406351f7e488e505003ceb87292f80a9be7cd4655b68

SHA512
c27f0f086141e363260c193b38a9e727342126178b7ad6a6c4c281287bd9a4760f4b287f820588862a4a93b5a3d96890e11c8f221f74cff615b1381ab5445628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeda31277019138f47405315848b4faa

SHA1
78e6ebd5c38f2188e72279bc48f1fc05e6457015

SHA256
afa28cff1d0a6a71a319b9fd04a4c738bc30d2bac3c7d1dd19bce175c1d34988

SHA512
6e7c2274b1a7efa77739531c81679812ac822d4dd86161be0463ed5509d6de780ec61fcfdc1f22b8b22672588e866ac435f8be77510727da1d9a83a3a96eeb25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7167d606eec715be1fc1f270140e2df0

SHA1
6ee462bfb1158d6bfb97f132e455245ced976490

SHA256
8894b730ba546d303fd0ec1e86095b23cc395c2b70f1bd2b1c8189e64acab1fe

SHA512
761c66d0748ccc73ffd15c84a0a94c033384ace74220cc5dac5e041c479dd7d062900a1e60c306ca856350399a442ad0a7c025c9bb132bb8ffb7275aa4e4cc17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a70525effb1637fdc0646071645fbb32

SHA1
0a8303a1311665db8094f98585ddb156539a3804

SHA256
013919061237135961e5d86c6c4d490a5df2c1a8ee434516cb6f082b8f4d6de8

SHA512
09887753e195bbd4b899eca8038cf64f3d63627a266b591af0b42f499deb6480c0e577471b9ad8ffe07ad37950b17177cb02db2329715ea5507b24f28acc653e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f86507263ce42c7bccb6217c89e225f

SHA1
9e25d91a65024949d994e335537375daeb623227

SHA256
b3d73b2ac978bf5aa954c034b12be8f79ae8e571fe11d94c94dea404ce8680a6

SHA512
cf87dd18dc51c1a16538be653aa903bb2c9ba9fa3bd0dac837543bcc167f6d7ba568ec3a43b67dc8a82a634bbc87baeb6c17a04d6f2ba7309471e62c4c2923ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9148d898a5111c05b942397b7f7092d

SHA1
cd07cd86ef6ffb9ce8847a289a6f871c71b8259b

SHA256
b37dca730b603f2c8496b7937bbff6d32474d9cc0526c878c83f7f0527d15b52

SHA512
a4e7e4a5a5b89841973c867f5567225a23c2a45316c5e5b9152c067492d4c0059ad6de6b2b6f4a847571299927fdee23340473cb35703fabf074117e34e7cfe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b56d8c0d0ae71a6d65dd9fc1efd83b

SHA1
0e199c51de2bb471a0b32b643a5cbd260bda33e1

SHA256
a770a4e9c329c1c1b2fd0c46ef0902853785441409c601f85bb41a5271494541

SHA512
ed4dc91f0dfe1f689e7e4cd32481e758fb18f136be0733708b32db05abd616784d571f0d5ad072869cb092180f2b8aaa4534eb07d0d4ee1316172139fa72415b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5e34ae7f5d354fc75962dfbfc45f458

SHA1
9266b46a2016a659b0361e465bffe8608207372c

SHA256
4da80b79fa780c3264ae26aad54cf7396c1d8edb1329016a05c99b81b7c8d82b

SHA512
031871c5953d0904e6f65c9ecb3b9cbd1565ec86eeb5bd05ebbd37cc83bc05087ddcd5fd97deb4db3c2da261879f3a52c99c67eda770de2c3bf66fb99394d2e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d250bfd133613222b16566a09020a7ba

SHA1
a9f273110a28730050931f07a26fe646a015bf39

SHA256
95f8a18cf79f52c0043e843a70470baca6be62476ce8b14926a2efd965ea606c

SHA512
f007263f25a210b09cd50426dc1c77ac5835d965d8b5e1ec3a423bf97830b0110894c48928dd119b2d585f2c8757a0897f4497a0e856eb06cc0a332059aaf05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1bb472f81f601559f28a01fc0aa13e

SHA1
6c1cbf0e9a9529ed7c11c68d8d6fef23dc947700

SHA256
70d4a0715dd5c015c171df6fbf61785db28254780a8a0b1c5987fc7347141330

SHA512
3b2b073da3cf4c45e5fc3f68ed3db4c818fd89a6fb6f1f13f4f0111b649287915cdf5c000a584a9811ea4af6da12f0a9da5e5b1ab545b25bb48722bbdecb1d7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e14d81e77227733633d357fdc9fdd53

SHA1
b7cdec91509ab10c7b53f19293c7dee5aec4f6aa

SHA256
70d58e4605a5de97fe28fecc548934830386675fce92de1c94ab7117536ad021

SHA512
9f6c32e69e4def7bb54b1a3fbed042fd1854ae9cb0cbf18da0bff3f060d9dc33988d42b980c32a6f6e50a95c46220dbc73bed94e1ea6a0a555bf36a700f6aa54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27CF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar283F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit