0d4d0f38ef0f9e496f4713b98faf8070baf52e3e5c2cc13a666c03d56f90dc6f

Analysis

max time kernel
144s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c82dfaeca0b3d3c975935d7e250c2d7_JaffaCakes118.html
Size

42KB
MD5

4c82dfaeca0b3d3c975935d7e250c2d7
SHA1

e2410bbe16b64d94165bddefd0ca96bfb7230b81
SHA256

0d4d0f38ef0f9e496f4713b98faf8070baf52e3e5c2cc13a666c03d56f90dc6f
SHA512

b59ce369451b30bef1bcec267d0a721beafc23f4ad640b38712c4105a1e4c58879c77f4074165ee8b911807cd664b253b874d657ffc2a70468374e20c9184c47
SSDEEP

768:AayHHvPWloFJIvFaDY3TmfIMP14olNKnR2SGH8ar:A3HH2laJIYYjmTlNKnur

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e016f7e0c0a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f1f7a2d8b32cbe27d8234ac8aac697ae55f10945d8f846b9165a28b3436327ff000000000e80000000020000200000003e6f45702678baee6e831c2650f7fc870c56c0aad1f09f2509954ef981c489ce2000000096ce712e2a194db14bedfd61253282307b6fb3ddd594eac09514247a1241af80400000005ba4db9d592d0548c82d2350dc8c025a408632549bac9495e739d9739fe4756912957b3d0a3cf05c229f801455ca29d42f9a5ffced442d88ca0d4643ce61ac88	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000004a1ed662fdd5d8238a0a2789bae374809b5676408e232fda3bf04585df74642d000000000e800000000200002000000033a987695283df1cf9c2e3d6c7329283b553868aac62dffc42d7667a106778e49000000038401d37247c1c2eff79facfda7c981e65d3e9b5a48dc4188a7f4b28f7f818c3c1d9d6e952d6c063cec3efd483776dd9c3f3838dd1e0636aa74d2458729aa9eeb31b26b737e4b92efa32b99ece7f8d30c5d3de52049042036ee39b445991ccd8418408ae8346e9d725f51a52f53fe51272cbe81b5a3e27351418183a5b21ee1ab9d8cae45da191cbd5163e81e10aa0684000000003f103e232b4690a9d2002a4537123e5ba201b112702ca0ed404ecaf3f89a066bfae07e27812ee4371483e9630dd7a14e92d95546b58bbfee9974f5377869852	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03FDBB81-13B4-11EF-84C7-4637C9E50E53} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422046803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1964	1732	iexplore.exe	28
PID 1732 wrote to memory of 1964	1732	iexplore.exe	28
PID 1732 wrote to memory of 1964	1732	iexplore.exe	28
PID 1732 wrote to memory of 1964	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c82dfaeca0b3d3c975935d7e250c2d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4000a31bf2243b0ba21c80255dd213db

SHA1
5a2836afa65926c5c250653d813946ca56cf09a5

SHA256
f92b8331d985075bf1a8c480ba3d797904d33754181b17320e1e287d32cfab6c

SHA512
8b8fad0f5a80c2c92103dc7b60d33f8334e1bd3d1e59765a7142924e75fe4ff2bd23e7c1de82f48aa6b8d0ff800a12c575f1e7ed0ca83ba0181f57b3bacedcf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fec6a1bb5d8c04e51920c2e564182062

SHA1
33fe4f44fde9289eac8515a74b845489f2dea425

SHA256
8d6b8ac867bcace681a134a4c68d061fd4617e207c2a783b227211fd67ab1297

SHA512
4e8e78688cc04936e7fe622c82cf006974f936a7fa2623e8f6c3eb12ef4a701e2ad6b278806c964d6725d3044e0fef588409b6363e31f6d17adf65c1b8bd7417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20a07067b1209aa7d344354c63811ffc

SHA1
7ad71da57ce11324f3ad536bc1a8d0ec2845f191

SHA256
6dff566f81b6c15b8be2a3375fff84c5287f1ce9d0a68ae9dfdd50d7c9396981

SHA512
3ad6a51caf3fc61cb176cba9939b85374e72697e8c38a0b2602751e8195cd477754630abc21499aa7db38c7d32c1ef9feeb717e39f6e399ecfc027529852ccb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d971b1520f46eb0d724d33baece33054

SHA1
73aa3fd0799ed6cf633046eab6e67c6d0a8a7795

SHA256
3ac807c1c498bba48bdcbaadd5aebe15427e91e5bc26a481d40b643785cbe2f5

SHA512
466a51cff1b9747af0f7661177c991ea4f16a1f4991698e8825a0794ed880352885f17544e7cb5713b88558693f4d07994b98e4d4aff1c048be705564bff46cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa5454ba137b6e158ca60e055c5837bb

SHA1
fbf62904649889d3deb74c447c4aec9652ccb740

SHA256
f75e456ede3ff6886e725e2a943cfa753b182f4e944503988bba92b940c7b382

SHA512
c28ec3f5ba0a1f37306cd6790d1b17bca73db7a736ad67773085c0c21d3c9a640a1d2669d7b4e2c4642b0a77750da82f64f85dfb0e5cbe43ab382a5240c76562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca8baab7878028a369542a35252cdc57

SHA1
2c71d57ff394a7b7d5d80c82bfe64b461457561b

SHA256
314f29e6d9f1c03e0b64fd3f1abc760acba20d17f0a30c3538019d33e9503f32

SHA512
6a14638ba7ef21c6ae40e3797b6a0016e989a548838ddce666406a7d4542b84332c3afe25123bb0ba5589786a1339a47eee466122e40ba81b9897a53dfca8007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7694856613f1917bb3e2af5dcb76a92f

SHA1
4ec2301d1535da7b9a77524f2bd2cacde0cdb5fb

SHA256
184194a30ea6c749b0ada63539567b1f811cb29f0cab3e4fe2bc65cef2e767e5

SHA512
01ab28a9da098f49a872a5b17e58d3583640769d74bc212c525146db564cff19cb0f46cc5e89b2ab325db231f85eebd51ebdfc3def0d672ede0f2fe93802a87f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab0b3dbef3173107599d30826b7eb37d

SHA1
20e6b86169588f23ec58bb0b0081e352b788794e

SHA256
6ad6404397ad3a098eab4473127357f41cd3e14d7d03ba24d8c0822149de27d3

SHA512
ba9b2c39c01dddcb6d230b4a61c3670d06385647fc62eeb68701e5ab505bd1b8de781f253bb733b09964ea9a48caca8c62093c9f9c1502ae22e88baa3318d062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b0187ce6ff9632e3ea55d407d803187

SHA1
c9a43a7454bec421277ff7260479eb64381ed7b1

SHA256
b5d43e4b1c89e9ba56ccf2132cdd11c118181eb453af06b918d1092188f37822

SHA512
3c0634479919eee9d677c3b4e1f5959f962ff49d2645838632a03b2fbb44a6f1174827eef428752cc7ee2b45ead7545e09a9a3b46a202f84a5d0846ea38ec1d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58009db5da5eb888da6cfee93d838e9d

SHA1
9e3b23d34c5befeb5fc0cbb22da52fdc3a8e5bd3

SHA256
a07e77f5b86c19c30002f0270642260d7896953f926a9603f807874206932ece

SHA512
5f41b2d14ea1431be6e6e11a068c9c6ed56381a9aa318680e5da48f663061eabb5f6c89a212e337e91dd771ab810133556e7d1fcc56c43473412387057379a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d10c10fa6e3a575024a463f4610b04b

SHA1
4b482d6d14bfc179c42878ce18ae1fe23487d552

SHA256
b2f30f184fd2d449c9482b087cab673fa8c94271ca13a7492c5a77f296caa509

SHA512
1ef142e1feb4980b304788b5f8354a06af442b81cc9ed71e74d05654d991b7d423e55e369ae186aece5a33f7b3b00086d332502a48a1f23e1414200e6c8578e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
761a00268424b21001094e77acb7e8cf

SHA1
4f96491befde86091df406e4d429329d03f4b540

SHA256
7eca59be11d99b994a9cc356bc77ea8004338a2900b764bbc7acdc4fa1ce7401

SHA512
97633dd508b714ade81b5512203f40f14946502e21a2be89962564b020fe3967e676842bbd53ce27a8b9a83698bba5926d5c7124da71e62db8170ba63ccc3b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cbbf3b2a3da1b5175c4e3f82867ff12

SHA1
ee1175d2303858a3a518f9ee86ec06d42fe3caa5

SHA256
23a66fba49ed0c4c5ce93ad0fd0a84d86bca88e16ad07ab7df31d4820a5412c3

SHA512
9ed0df376f2523d50986984d87c74367c59a8bd4f435cb891cf6d63d68137654df1f43c2a2bd769b210a690e2e791d832bd3d7e04010569ac8047b9910cad721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee46b5c506fdff5131fa6da2d4ad319

SHA1
facb07da32a7c56596bd8796acee712b9fd99714

SHA256
dd91fd672a4c917da3d50f9375c52b7df24beeffc80a46ee00882c457f8af5b7

SHA512
3ad794379c21633d64dc727b865f66c4b914de4f53d37c99c106cdaa10227d441c8d900315f32a615837e8f30305368dd0b62c0c3c0d8bc319277e4d79b8b21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f289d16110f50b3ff049c06962ad4fb

SHA1
dce905b768da4289870eeb7e253e8264198f90bd

SHA256
9489335b30dc6d16dcad2512d993755e71581f6bdfbc1e2a6b2b1bf363715e83

SHA512
64b3f50c859b212d33b62ee44b43ae8f57338ec53a19e2466c2b3d66edafc58ff60df85bd9dcaaa7c55151914f20cce77ba832237d5737f2befa808997959ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e60d85a829e2372212b9de6164a49cb

SHA1
38071ec3699a5ef321f69a13d325aacc3d1f75c8

SHA256
ce2cf57d4c60a88f5f3ffccdb326835e032ae42642b8b0f3580aaf76c125f1f7

SHA512
e99ab694147c8faaf16e39e202f55349d2fb8aa6bce28f93b3332429e9e9a32c11710fde63abf30347baf8c5ab887b7fa847eafb101c10d631561e1e56e0cb26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8303d05d63309e353073270f7940151f

SHA1
d80c665d4952b2e17c929eb4fd071285369f3176

SHA256
0c7b8b58923961cd2becec1ce9b6f0fb35a43de0e3dd7a7f4f5ed492b87b7449

SHA512
3c3be22a275d73c8c1405d9500c05295a01765cef7405a7eef3958c97c582a9a635ae22cc7c2e03ac5380e28281be7a04838b9c627b4d0ee568737458b876cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a54055f3a8ddd14faf2da97c3ba04cae

SHA1
32bbbeb4e431647bcf1abbdfdd0ef729cc4c3080

SHA256
2caabad87545d9cd4eb920f37591b39e8b13176767d7f15a0f68a1d429c70bfb

SHA512
634e016baf3046d91e4dcdf0273d32475693952bb5558429db89f84ccdc2158141766fac13f0143ca55231bc34b06a619ed04e82dbf3c490125ba927faad4016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C1F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C80.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit