0e915a6d6e44cc4b424db5077286e5f0d186dbe8bbf4663d3389663e59be83cd

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4911eaaca9c08f39235fc52ee36fe2d1_JaffaCakes118.html
Size

23KB
MD5

4911eaaca9c08f39235fc52ee36fe2d1
SHA1

f654c57f5a2e3ee451a2da3f0a7c005288627315
SHA256

0e915a6d6e44cc4b424db5077286e5f0d186dbe8bbf4663d3389663e59be83cd
SHA512

a5cb9c95310a413027847aa2a97ed67832fd81ff74d2c5ac2f6eaf7d233b761aa9ded1c1085b236bfba01eff07604a8dd728fb7030c46137b397b25183db22a3
SSDEEP

192:uwrhb5nYmnQjxn5Q/bnQieyNnRnQOkEnt5tnQTbnxnQ6v06J4RnQNjMBSqnYnQ72:AQ/cv06k8P

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffe016c260ae7345ba1719555ab7a9e200000000020000000000106600000001000020000000210c078037c0163ed6d4391aae913e0df1576cb6372c44f9b06f0f2b780bb3af000000000e8000000002000020000000a23fad4a6f0f6da69431ec0d97cca8cce38c95767766504804c0021c9cb6a7aa200000004a9e4477412fff5630b0d9214ac14466ec0124587113a1ea8545acbca0320a124000000065aceb42e686e5a0f8226da03b1a3e9c66ae38d2371ee40b6fb7a21fe016971e390f452a17060b1a86f4b2ceb5fa60e425968e1c04506481c7c3d441003f4bf9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffe016c260ae7345ba1719555ab7a9e200000000020000000000106600000001000020000000ebaab8f4edea1a2aeef7126ec1ede65b4cb84cbb96e6d88d47c708ae9e1f92a8000000000e8000000002000020000000a3c726e88c5f517e4a6f8be27b303bda99e15c343b0ff1d6b761f5206b830d579000000091801764a08f7e10dfddd723ac8c3219e9192e71f7a28c18c0d46cb9e616d1e24990f50cd16c89d0380fa78a93b10e813a30166175ae7f10383b1b492479417ea99fb78b79e1425f3315d258e4295f25ce394dc499d9e184c0d1982ce23167d7bd408ca8371d35afbfd4d1b0ac67e75ed47a1d4f7794c6a66a7fc7f09c6ddca796af39c5bda3bca72e87b9846e2412ad40000000644232fce1f4d0388279ee1fa83fb9471b08bc35dfd88161cd2ee311f27ef32fb195569faf3314912c66f8fceb88049cee9130c4c7770a604a84ff162e940b8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308a2f2036a7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421987223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B7F46D1-1329-11EF-ADBF-FA30248A334C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28
PID 2388 wrote to memory of 2648	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4911eaaca9c08f39235fc52ee36fe2d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
78dc5504d164306c70b4be3748bec87f

SHA1
57c96841798f7ec44fe0351a917a41183196ae76

SHA256
c1d97d5237768b62713ccdab141971c5ae5b322ed7316e9ecde0d8e6ddbfd4ff

SHA512
726e23ef5831e82bac488a6c9ed969e66bce82acc482e850096b2e27b4cb5cbbb1b02cf5341fad88ff9bae361c527536d0e126e0fa672d3b764ead766285f5e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b3a483dfdda7dbdfec126701c5c53a40

SHA1
0bda7b008c07eeb6cad74cf8e07d94c21619393d

SHA256
d011dde46b953740ed6c75f40e61e7baf60baa5c0eeeee056238af09b2b4fa19

SHA512
09295f2458b7415e66ab503ad45619f3a77498fe163e8dde7fac7fa358447574b8fa3b6af82ec3bcbe128e3420ce369917be8c661067638ee6fea8158c3621ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
884b9a30a8e722768dae262ec004c8da

SHA1
a4545c085a64c77f7a5a0eef877104f549babcec

SHA256
8cf927b0adff7283f50b75bc8aafbb0f77270064e5cb5c540b6be8cf06ff50c7

SHA512
b5fc9ac274e468768599f2794643f0557241a577befdbae22626ae1a13a704a40fa6859bfee13a04a142702a6181190689914f7dee0f758b92d786eee2fed463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f42d30ba2d4110b2b8f743a63ef5bc6

SHA1
8be5949c34f7d1fe8c2edbcb217089b82f6c1e9b

SHA256
dde1d43366bfbc6a2f078871135e6ff905ac6dfe03867acb0825a5a4d0811afc

SHA512
c381034995250ca3cc3666d4f39ddac0b833e1b1da4239cda92c4acea8d12100075efd6d440ac7134bd058dca8d93dd492b855e027ccd33dfc2c63491a5f79bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c90659e5b025ad9af02b576b4c0ac94a

SHA1
04f03d480ca857f7c489d27c84ffa17bcd19a404

SHA256
e5d3d9f8ac71eedbedd6801c4722f9f7e5accbdec6621ac4909b4b62cfd4703d

SHA512
f7f35eb351cc7a86fda5dd7997fe0a69736955238d4fb50dc976a33428c587b65fb24f5c8dff20254aea1fd7ccee7cd62539147d89b8be67aadfbc0f488d795b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
132fa0bc24cc3124e2b754d9954e3b34

SHA1
e07ce5ca8d7169b4327148a7985b92e8b7ccabc4

SHA256
96147d90841fd07665e4c3d6374e42dfa7001491cd15ecb6761d2b239a770981

SHA512
f2c49cbd26632e4cca2de11f3fea380f175ea0ccbfc40f6935e0b726ee17303ae42aefc5a0e9c3f740970575a65e0c0166487b2e4236d9543d96564153154ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
72d40d035773a87310abaa593ba8367c

SHA1
173e7b68db9fffbbcfbf2cf4abafcc7a7830d244

SHA256
781dbb7424084d07651e6fade7915a0b0a4674e4f45a8f78b35dc4967c09b7ab

SHA512
cfdc4f5338fc1162b6152d475b605041c173c2f785d4f9bd4f0fd415f9d8896b77a566463b5a5c3af4a7575025615cf1c5a365e4517593f49313f6290c063482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bd5e1a5aab932f70ccc92f28d6687c67

SHA1
990bd26cf2404201380709d14c97e9e6a2c70808

SHA256
c314e038b19c5e94394e8a266abd310c08d615cbf939b84673c35453d931183b

SHA512
58ac9157b3298b6712b9710af44457d77bd338ee8b5d20ed0751b91bd79e60ff4579fe8f79c7c3c038241166a4b8fdfcb6b26bb1ea1c79b0030e12f32db90db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c6559f24d849366c8c03efca90f9e90e

SHA1
8cf9f3a2211b877c6806f59d3795f1b34455caf3

SHA256
34b62f515e20490a60276fd448756e52420829788859f3891bcc19daf5ad4e1f

SHA512
fef6fe96ac0d5f6dfca6bbccbb56dd71ac5191fa25518a600d0439cf845422acf4d5f92fab94149c9232c4f64bf18da11f61a86843ff60b6d96e2db1f2238b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fcf946740f9a7a41c5a20bdc1bda448b

SHA1
8c7e340a67d774cd37ca7593257e7763bc75a7e3

SHA256
d84a673c29f18cd5104abcbf54d366c00ac239fc55cbdd0f092365d2da46bc22

SHA512
caa29915ca7b43993cead39ce682d22bafece7a48cffab3d289fe327e19c40c54c42ab0f7a95b6ccaa368b76d9762eceb7531637afe18ff4e357fda33e65d72b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7fb162b9272b2e50664172d83a3c5229

SHA1
7a2471d9a6adbde68a91dd64c3fe2c8a434932bb

SHA256
5f0200d8d8a45cfe992c98824da85ee9f03882eccecb9ea41be3b4fd4e2b5450

SHA512
06dfebf66477a1785e33e5d7204d02aea436b7c17b26b38f217063517c3af512699f836b008f071ea3a4a4fb46dfe6b0b3d4c68648aa86f2ec3f8b1c4509e30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5718d5bb236e6332b78c2a3330ebe4e9

SHA1
1dea2b1aee2df1a3ce453fde232ddbcd2a07b69f

SHA256
f33863ec81f7d54dc5108f06cad1e67733bb8c8f8ddc0df590a9ee7776911067

SHA512
07976a38ba30c8d8d4d64f85d80445bb522bcb49471a7504896cd9cdf2a3bf58556b4aeb663de71ce8750575d5db20b49a4f58f28639d43952557973490a124e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a9ab5688d59934d22cdc95544b252d86

SHA1
357e06a9be51f45e791afa4f13fe4cfb6bb680a3

SHA256
aef3e08ee2f36f1e66b57929101a48d01f50cd9973c24bfa01cee90287a842ec

SHA512
e9a5e0bcd97913fac1643cd6ec16d4b7ba0ca7614b449f157dc2ae3e6af27c6919c077d5d950efde679be01d86712155d504761201e39615f8d447e164ab80ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
13ff1cfdf075cd4d4bcbacd8708c4d7c

SHA1
95442df6f3e8226f2ffcf9318631e79d5513daae

SHA256
5a8ffcf9876fbe9796909068c6a7127e2cd0359e698ab2aeec33d4dd71085c64

SHA512
03cd49913025dadcbf3000e53162cf6d3ce089e95811363e8838e423379866e604a3ca5b3609cbada0549fe56e23fba021fc9a377f4e08d540df416618936dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2492.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2585.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit