21dc1366a59149d9a6d415db1f378898dfaed690ef4733db1dcad212cd3230ab

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f8626948e557cd7bdb8eb1278c415c2_JaffaCakes118.html
Size

51KB
MD5

3f8626948e557cd7bdb8eb1278c415c2
SHA1

531ff63683ac06baef7403e14052b13de802e198
SHA256

21dc1366a59149d9a6d415db1f378898dfaed690ef4733db1dcad212cd3230ab
SHA512

4126a786f3dd924d31c11abb213a573982e26695045b2d21386af5968d8692a9b6da9021f0330a29b7f76be222b1464707abfdc2c44db77b596a6f29855feb32
SSDEEP

768:SbYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:Sbl9bfisxu8kmu4eSPfiM6uwjg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004f52232fd306e65ca671722ed5a06f8c901b2d4d463c83d5cd65d8c9b7120a9d000000000e80000000020000200000003519bd44d206c851aea3539241dd8893a9a8e52461fccb6517c7945767d2ebb990000000c209566bfc88ec2c11aba3710045c451c2694796fdfc4e6561b05df50fae88c595664488838bca82a26dc8fc6f1628de1c103325a7176e182d4d076d6f316282e78c9b8a9cb0ab783e9fb40807f947b692a54b3d13105efb672e860cb31a55086f813c69ca83b058847fb1c52f044e3b461a83f1234f1b5d41d0fd3be9fbc9830e89011f14c5dc68765164b49f09e7c640000000c3a57eb7b2cbefb5cf038a907d79a9a53b44ad4ef1c05f678e105f051c822860327d235a591dbc007a1af79b34516376204799827b052e8e805edaeabd51107e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000da4b810f8f9c389b792b4954efe9d28cf963d46259edd1ad324daf60cf9eeb8c000000000e800000000200002000000088db03badff683ed11d87703d72f2a513713c1dd1b57779d46eaa99d818de50320000000307d16b21d60ef3f5f2061d8e81077ea967de933fcdc05acc6250ab44717272640000000f619506cd742f9458178937a60bebdda356ab0f86822a452f203192a5bcb57748be8600cdc3915b26635975abb201bc705cce7f70760a26077e3a325312dbd89	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421765855"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1E86A31-1125-11EF-BDA8-6EB0E89E4FD1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fbdda432a5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2968	2932	iexplore.exe	28
PID 2932 wrote to memory of 2968	2932	iexplore.exe	28
PID 2932 wrote to memory of 2968	2932	iexplore.exe	28
PID 2932 wrote to memory of 2968	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f8626948e557cd7bdb8eb1278c415c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b49a4a86dc18fb31ba6df48b8f54cc1

SHA1
d08f7a4f2a2d4ddba8ce51b13667564a71a8c8e6

SHA256
ff060b481e555988f4a82d6f6a0aae999e198e60434e56ec4e2ec8ee07fd0d76

SHA512
d599579301b8250ac19a4145551d6eb2069943486806853aabe4bd60189b79ac3089ae798a82dd9651e8b9da9b338043d7c2ef10213b8b8222115d64f782150a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fac59f8c1cd68e6b7b898590a281c784

SHA1
4f0050a9dd524bf5ba4ec5d76d0390cdc99c134a

SHA256
43621583b1fe7bf978ec1d5c4602141f9b8307b490faec33eced8ab5aed75f81

SHA512
2d1ba96e486c0f78c6849b0a7da77954aea709f38f4ef88a68ae737d9399896270ea2fff010e65f681e4251c25e27274bedc3952f33654cead01fd2008b57e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d374ebb6924cdc9ffb2d9c2e4307d0da

SHA1
654d6fbc46a1d678144c4702710b226336a6f9fe

SHA256
97104393b8ccb3170295328bf03e3b7e6a8fd645ab5e77482394066ead9bc2ed

SHA512
05941b8b879c9583df34ac5f3b8413b0a20268c615d2e11ecf80ac7c18981cd4dad08a58470bbb35f3cf046443b75314f96dc25de901d55e5a217674f66084cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40bdd48753a372687ad2d46878f12589

SHA1
11a13a5735eccd2ddc9686272727648b80f68360

SHA256
3183fda2298411eadfffdae91d80fbd04faf023872b1c23e8b389de7fdec8a35

SHA512
4af463bbfdcdd51e373b2abb48ddb525a0d55416bb24475f1573224509ac08a88d8f01f7ff3cbca22c896cfdba3d53e27a6611ef62878c0867833bd27e82ff1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9faa78f3008904da174591071bb77b05

SHA1
ed4d6bc682f6b349505a906e6e86888be2ae98bd

SHA256
f2eeb1422b8c6b9d4991570c878498a9b8f1641fc01ad8f0e6a103305bcb5e37

SHA512
3e75f70b8ea765987d510f285e2c29278b262e683c5175d49b41693b029ddd97238156f065b1a7df7204279f16618ebbed9385848a7325c6f74a8f35efb21b7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bc6a3dd98eeb5d4b3c86f40c276415f

SHA1
c458863a10ffc1fc23a2c46b3e7c910b40fe05d3

SHA256
ac4eb46d65d1306cb88e2c148dfdf139de0eecdb3ebbac0aec6a9ee4b89fa027

SHA512
9d2fec7c134d322735c00c98e256a182b851d59f93cfcf3ed76bb52764d20927627d98cd7a7b1f136e1025db60a89d9ef5c1b983565e7958f7878e5499014bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24b609a03f8e74cde39c54f423772566

SHA1
b439651f75254faf6a79674effdc8e3b4b77b511

SHA256
ce9efe6fb018f8d5ed7d5bba5f370da5cc4b8f0b6cd15128fc181079c50ce791

SHA512
fecfbc142cbaaf91d24944764d6579a44382030fa76905eaf1c628fd15e788c6debd27829c6ee0a352b96dcbabab846ec5b8942dce3d4f073691fe02e9c04ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6921ffb8f5adc42ede3a38acc6366ced

SHA1
19fba88507f8a65cf8edfb3c7e88d6dc12a1a1a4

SHA256
8f57e5bdb62f84e7efda29d61802b44a834c2d98a2b2837ed414f1a59d32dfcb

SHA512
4523abc4a36cf1d82073075bb6174cc59a429eb895024c823a4b86f45c6176f1047034ec268e5fbeaeba510fcc9dbda0b65642f8d44d22dd69f36b5020779e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2bf489f8b6f782e7e19d2227e186448

SHA1
7c35666225e130a4b3ce1962b0954a388e63af38

SHA256
525be4647ac2d87bb6b3725c8c572ac30e38216ba2b0605ec4d32543d1e9c217

SHA512
0d35f3cba8e381cde04c1a8128e87b5651828888cd80623fdc70a1c3572847d59a243b6066071eeb73a2a841cb999a9d5645a79b6a210657f3baa4385e4a5956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb4e8e781934f6ea478941b60358f76

SHA1
3ec5697c4adde270977379abd567e99a01fd0bbd

SHA256
b08040b59a95f961338163b7573398272c7b88dbc2a7d5c103e059a86cd669b2

SHA512
3ce781ca63ce25e13de4b1d708e827ba3eadf44a1086ce146216c7082166bfb82a3031167feffd38fe4d9f92a046e90ca19a74dedd57a35d1bf988cea6c8afdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffe68ae707066bc93400970fdd1fe858

SHA1
d7b8fda4022dcc364a0984af7486605f8b47c60e

SHA256
78b718de2c5d0d3c38c8132c2e68f09b444eca31a1303810d8417b7389161cc1

SHA512
16620dacb03bee53dcd75051fc19cc9044a70baa2f2f20578f3c5a1b2c786389513d5f4fa2d7d63db45e3c533c0678f2dac20f9e5ab9af448e0ff2c0e20abf5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9fb0772a086fe8e995425226e756dc

SHA1
ebc15be09ca6f73811f594af28ca35004eac8f12

SHA256
d35d9525f52e6e67f4c9cacb35917b24b70ab1872d05f0ed060929426d917ab3

SHA512
b88958b32e8c76e3605b2132cd944051a1804fa2df873ab925bb60994da8bf96996fb11b6d781ead6faeba41e12043098d6acdbd5d849c6eb71ddea3dc3e417f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d441caea2eb4992c39e2c1e2ad02df63

SHA1
6f76fbb5af2171b56f3ee434db0db6d4519084f8

SHA256
51fb6b93f2aa82c5f1e7ae17f7d9547577849e96d47b1ede06c5bc9ccf738b9d

SHA512
5ae424270541fe542c6dc77c4845b21beef1bd5881674ecc2c2846348a056ebe8ff6f6829ec113952009f1bd5cb6e766a4444dd3db20fa8e8ca37e60757a9d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
148e127614929416d4008d2bddb37ef1

SHA1
05aa1f6941b9f7305c9444bb62dcf9b7f0139982

SHA256
c77674213060221974413d1ade0134c0662bdfd65f9c86a67c88d84dd757fd77

SHA512
c8422589c85756a9449a92705b901d65b560c15c8763c9b7dca65e1c6f4f507a32baccd3fc9f835becf47c2fb3e9da678fac748e88c4a0a3b95a12de248c6797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56c512fc97f1b3a099f9a64eacc27468

SHA1
00c37a83b1ca4a4e3a168f082d27eb8fdc1c5074

SHA256
11692e16a5b4d089cca9ee888c1ed5df7ed1c081f3eeb3528aee953ba5f7431d

SHA512
64e953870adef786ff36ed74447eb5a6a11790f6c268952d90a0e7073db0e200bab389aa1a46813fbb80c2ede54c56f9224d5b07aa9779cc33fe5d346391b2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b16b744277d8b13ee6b07499c38e74c

SHA1
774cb9b225662d04f54fe6baf52250ecf83b7793

SHA256
368489fd72166ae71210c1cb6022f459b2cb90b99c8d0fb807ebad0107a539af

SHA512
f5a2eb496a69d09058048760ff2b7890390649828a2377fae408e12d33f823c9d80ecfe1d7a11f10c1a9ba48f3db77f8c3be76736060e646ad5c466c3a5a2b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bca95b6b033237be130cebae4bc8551c

SHA1
cdefcb0f4afa557a13f7eaa210a8e019fb247a48

SHA256
ccc8309784559bf45e5665424ff27b0d3d8398c92f754daeb1087339d4c0ec7b

SHA512
06e2201e90c962546a4caf838306ad8aa72f7dc68c63778f9e9d34cf0774700f7bbecf02b3016a82b1babf7e9d0f62176da547bd4ddab782b2efc6fb002a02b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3100.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3163.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit