809fbe0dd77c627b1e670e53ed4f8e81752b943f3979cb13162e24e3a7dd09c5

Analysis

max time kernel
138s
max time network
154s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497090b0cd70d3bcc1d26dffaeb908ac_JaffaCakes118.html
Size

51KB
MD5

497090b0cd70d3bcc1d26dffaeb908ac
SHA1

e5628da788cc0ec6e13eaaf3a11ca60117579e10
SHA256

809fbe0dd77c627b1e670e53ed4f8e81752b943f3979cb13162e24e3a7dd09c5
SHA512

e30729c16eab6be73faff98ee95c07859bfae47d7c2a0ccc57d4fb0e3218470d12218f90f32393b9ed3830a3d878e31e967c0b2e4e4953638ed18b7646928b40
SSDEEP

1536:SfQCQcOvU0+yHjc2HfeaiDktVzlU4mecddm/enyWfqDxRWR6RQLcRFLR7OgZ:S/ROjXPOdwUyWfqDxRWR6RQQRFLR7OgZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1489F81-133D-11EF-B837-5AD7C7D11D06} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000595e726c1700ef7646ad5352fbfb4b5ec0ba9dcdf79209034f5a539964e7be28000000000e8000000002000020000000582926b5201bf69a07f4ab2b9b5f5cf749d2a0aba0f926f1aba3b010a88508222000000028c406d53cdc9e23d3acebc5951c84c04f7785e8ec7efc86489ccbe070f86bdb400000009f8d12681b8a470cf16d2834cf58eddd4f1ac1b6c0de866e62d256ba73221bf15d3caac220c31f3ee40061f60c1179be05ebade13324bae2d13b05b6a65c1eb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421996091"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000000f47d97ca6f13cb2c06182b3698e6553a042235ab7de0969f95ab5f54d8fd71000000000e8000000002000020000000e514aa2b355df0c0bba5ee9954438224cdce24096fed56bf5a202dd3c918b95290000000529cc2e618cdc37535dcfa05e82ad5e25f56edeeabcc5a7753ab9248f867221106c5de3a6b3b5317a2d23e0203e242ab0ffd794680d78fb7d1c3472662682d96d41eb7bbbdfbccfe9b788ad263f1c70ccc6de9c2a0944a2f376d62bc23efba870c8a5956c0853cebe3bda984081103fcdbed8befd995b7be10053f762aa483cf48507459ec9a316df3adabd92e6767d5400000000ad4e66d149b10c4901340b13f75cbe82ecb82b55a87882d87fea72587a8657df5e6ea592e47f7292e790113b57a2d989cb3f3f34b95bb5f0ec635cb568f4e23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402e3aca4aa7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	iexplore.exe
1740	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28
PID 1740 wrote to memory of 2872	1740	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\497090b0cd70d3bcc1d26dffaeb908ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e54828a4ab7521a8c9910dfc10ce5338

SHA1
d0ed899f1d8cc039457fb639193a9023ede411da

SHA256
f85dc915363b8b774f090b5c85d9443b75c8db62f644b38cf001c3fd5c9f506f

SHA512
79349d8bd47bdad51741e92729f2f5ea89621e1e9ace8b7534d1ed91e63b9048c420969796e301b53113a1e109112cb3ccd352b005e23cc83d39b57b38139f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd51e639a525cb1be38b56b82e90e9c0

SHA1
364c90ebf94790f4e7e2f43cf7ab3add39d34853

SHA256
704dbbf17dd094a11f0ac578d29f25b6acf7d35537db585f21ebe7b0d6ab1d40

SHA512
5067cd215663f1f32569b6e18c22d465694189e5f3b02250a2f5c017b166a8141b885b7abafc50fe317a59decbd3d20d31c5bb62b3cd289d9e30d45f5eb55029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a96d4d3dfc739b7bccaff0c7140e63

SHA1
e1fa792cdf251dfb22be09ee15e8b6c09a010610

SHA256
55269c4cb00620ca59df934c7c29cbe273d05ae00f41d911350016968ff19fc3

SHA512
5bb11d10b08f16367d12c4688bc9c828e157ce8c6fb8b46035f1dade92ebac9e7142f2b515412d4c6c9bf59865a156aa4e8f29fdc3724f5b0edbb03dcbf02d1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89a487de96a0075092c62429baaad362

SHA1
cc174faa450e244385f7207b67c52f226719ca65

SHA256
0955a4ccf7bb610400b6f9ec79d9e3f589671e5ec50f7cc97f245fd0b511fe15

SHA512
7cd2ee4f0d06a763ba30b4590ca0373b89bc64f29296f412518b87b9d06191418f5e68499cb11ed92a3492096970cc5b9142589f2ef2ca2d83db4b4532120b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86e8e1237f38641028d1190e13b4750b

SHA1
3cf92267d31a86013a8d195be5efa8080b82f549

SHA256
ee3467c1f53ee9d117304f7ab78e772aa744b788cfb08885567b0a5f679cf03f

SHA512
59a592837d977c4b2a2a594ea2e200ef738a2cbb35ec8dc2ed5625807706fe99ce6bfef3ec5f4c8f2504dbbeacd361916f4d6073d628c42d66c834f2f9cd296c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd7e0d06c72088a4f6cb92e4a22106e7

SHA1
6ddb2ed44806296644aa1754543c55fb96ff3d77

SHA256
aa85221e1e2dbfc63638e64124316357e5bcd87fa253411902cf607dd0386cc1

SHA512
a400a959a838ef905193794bfb7714d7259b49609a6cf5916b127194cd8d89334ee243a5f1cc5b048e0c5987f15299235cb4126c733f749904822c817f05fb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
028ef9741da780f435e862bfa8e9aacf

SHA1
174e6dfe95d176450e0f57145981311764a217c6

SHA256
f88e32dea0000031ceca191e08ae4e45eafc28a5d772ac0bf478a540c7658492

SHA512
50f65525c52dfd90c7fc2f60984751f9fff04b7d801dd2539a73c1ae9741e95f08f5f53106c61339e6002bc1020ae36cb3940a43792db7e58410dfaf12864255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be2142d283a2060c995ef76b1728b7a6

SHA1
287f4503943b416fc0459583dd6169b2d03f6f85

SHA256
92b20f10d8b701c1aed84f57a242728b20e0125a6eaa4408b0fca6a301a7e4c8

SHA512
b24d36c88af1398946032bf0f286d6ec4e505c6e5e128364e55f262dd13044f386a62c5e35ca2ab0438d1d8c0bb56cae8cc8554c8d7022c585d5edc2d01837f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb170356b3b132514eddae5e3f7ef48

SHA1
64619610a56b94b3983084d2302200824681ea95

SHA256
da731d8385bee5a97ef1568f2aeb04a32295d84e9179d828a6cb5bc6bc967258

SHA512
9ac0807620c1fffb1ec8ab45858b65ead011a6a3fe76a1f3f6448f771399f525acb007aa5cc14f7fb1aa41727fc7b87ba0a1baa1ce6cc79dfa1d0f8c93cc3051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79007fbd49b2160cd124a27f8d2ba6e8

SHA1
c8495886e81907d1777f87bfca5dc24843cf30b6

SHA256
ffd6c1b67179ce5c6ec014010ca20f8f4793ab748f50acc89745c1188272d084

SHA512
044745e23ecff165dddb54d181fb930352d61a524602d1826f773b997e06f57168543ccb760354cffc5a029f26bbf95309613fd97241b25d18fa903e8c2a6ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea26c5f6aa18e439a520f0fe449dcb2e

SHA1
ad7f8c9d545439311ea2349348d834a9d9eb83e5

SHA256
468e15233bd18cee553c5171c46a0fc8c33836ad6d2c433a434963e9c68b5a07

SHA512
b03e98cf44426ae2cbebbbcf76a6895378de81f7d81f5eb17bde298553a863b4787f0abee0a9111c9e264e3f689845d3100d4e02ea92e5d705a36ec01d7371ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6095ca527828dfce26c4fceac97ebf6

SHA1
54927b7cad4905318a89f0fa214d7e9795c84114

SHA256
7195addb2cdf995b6e17a60e69f33516c86e47477e535e10d7396e0a904d6191

SHA512
a3dcb7430a3db3e328dd9758cde92a89a5d84168ecad6f2f0cd11b53018a1dd239de8ad4fc45f04cec2b93e3e8d3f6aa9d59b1801db0888e32e1dfcafd4eb75c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe02c446281a80b13e8d9d317e09af47

SHA1
8c6066291075977d677ca92710629b9025f5d4d1

SHA256
ddc83fe49c609bcaf711c917498c3994ed2fc13e648ad16a0ef36c8b031c2624

SHA512
726366f5bbdc7210a521a6ac6e6b30f9a1ce3d56ba52712f2b7a4a4052062a8c948d787c0677b87125161e2039c73a260424e6c33ceff94ad3009a19a8709051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b01697b7a5ed90a782b806e8758e4e3

SHA1
f4fd46e1c1fc3369991d2f8ba84e0fcf2f66760b

SHA256
343157a89522b7cbdf62f3848ac981968af3fc4a85f6ea9bd0ebd4b1459d2a0d

SHA512
6b2541256402f8e7333991d42d227f30a2b9aeca3e4c9b3d14efd6a6c05c7d74ea6674700097a95297e019098bc9853ad2f763ce0daf9e830d2ef2e55acd754e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9575d28fbe3136f386085d8134e74740

SHA1
f73ee693a92a04f430e494a867407129949164d7

SHA256
4d871d4ad76f5f005e70c3d8bae5f80ccd676406d4080211653043ebdc47f0c7

SHA512
02290319d4b68bb26e13bc5aa6b46e0cb4c01db0905d0f36a08a3d7bcbd7377f5ed33c5b7d3fd64f9836fe54e42cad0a5aa1c48961c2255be3a00cd179c09783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4efa83a51e12acc3b6320c2c6d95a84d

SHA1
9575c8101a4f7d181fa402e336596c3959025349

SHA256
f6aa4a92533a251c5416117e2cafe2e2c574567208ed4151d443060cd4bb3252

SHA512
4ea5c7b34a258bf86a0dce46626708fb53d7dc03d9281d9f2ef5bd2fd4422de05b7b9078c0280a3dcc0c2976be373fec069caa074985631f43c710f6f7fc502c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc2c37be5a4b439ecf02ef615d7a8be7

SHA1
ceb13d0d574b1941b6d0642776df257cf66208c8

SHA256
77bb588314c4b86ba3fc2165debe3de8977b36642e827c22b9b1cc4d2d120e1b

SHA512
e055518c13cce44842eecc1b31540fd958f1f6c10e3a622d518d8f565b624c1f6a7a60c80bebfa175896bbe1f80c6fa443941c026c71fc005ab95574aaec2068

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D0A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5151.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit