b87ddcb4c9d2d274dffc79c9abd224397b99c9bd7e959954fa97207ee51da7c1

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50e94608032913e0888a6d48f1c0fa4a_JaffaCakes118.html
Size

28KB
MD5

50e94608032913e0888a6d48f1c0fa4a
SHA1

6f525b8fe919555de06968f21061d8bc1149a8c5
SHA256

b87ddcb4c9d2d274dffc79c9abd224397b99c9bd7e959954fa97207ee51da7c1
SHA512

b2eaf55ac3bed2410873bb23f954f18c21d16f3868872c5ec2958ea3fd1c00e513578e6adb29a3cb1398be9a5abbc81d566c2d07ecdaa3f8503595ea3e1b0757
SSDEEP

384:SNej7rlZEnrVla6lvWlgMdplpFLLtl+HFliQVNNhlx9hHy1NWCVhMLUBeDR5j/65:SN+75maqvug6pB+DiQgZAL9pDzen

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422133043"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD373BC1-147C-11EF-8B6F-CA05972DBE1D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30063cbb89a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d20eba3b8957284d8143c76d54fd0954000000000200000000001066000000010000200000006a18d0d80de762296f95f5d325170bf4b18c2356e680e2293369b390a42832ca000000000e8000000002000020000000cd8bc85afc0c64d6078f6454953bd5b7f999394efdc1ac3b0f5abbc29e86585e200000004622c9b7809d62a0ddcad7b0160ca11d4db1ed4e5a4b94ba9050cc34dd2f0d7e40000000dc29380bbe1a9a9e2331013e3024c230551f0a8c9f11507b2629eb99b5ea53b36c675bbdbdb46a1cc2f8f5a507c6716ac9a324b6c490f832729509aca74bc1af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d20eba3b8957284d8143c76d54fd095400000000020000000000106600000001000020000000c2ae3d3d9fa14bd462c1485948da45dedc9c5c78dc506dd181ca070cacd2e0ff000000000e80000000020000200000008aec25556890b92621a1c5491ad942972056daea5ee4606e1a309d85aef14ed590000000b93caf341f0e89b9a9d6159902c3cd1af9136337fc1c5aec80340020cea6a1e1e2fd47c4b63792a14173537f793a73ce5e273de8ab7b5c5c7e05060209bbca96be3c1c2977f61c3ae074d2feb920c04d7e5d41a1e9b076e31214a8fbc323618f2bda73bf7122ecea0ad024a9bed877c65091d7f31fbadaa5ede60bad031f1e129f5099446b7df2b575114b4c4409a73e40000000cf64041a7fcfbf46142f6b89d6e94f3b62ade966e9642d353f35c506d6131e47f03f786660a247d335a89ce0f51fa46c59503deab582ec3c61687f961cedd284	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2716	1728	iexplore.exe	28
PID 1728 wrote to memory of 2716	1728	iexplore.exe	28
PID 1728 wrote to memory of 2716	1728	iexplore.exe	28
PID 1728 wrote to memory of 2716	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50e94608032913e0888a6d48f1c0fa4a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0395020b35dd8541314695d8970ee9e

SHA1
53a4a14b8474cd6e7b5880ae6029d33db7585687

SHA256
a85792d03195724427a0313ee43ef79817481f5af1a04d30143046ddef0bbdc3

SHA512
f192e19853dbf8d801f1ed6bf53f5a068eef366a394a97a791bcf3240007caf95b8e5577ca5e598030bdb746c15d23aed3f306522f7974f6e76be1b13506e3dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c8216df857569e0f46bd3811ec8394a

SHA1
3f976426a7f403db14a449f717b48c78b17bf3c9

SHA256
18ccc3740a8f7d629b1f89c19e10a502f444bcae992cc6720b13608f5741db72

SHA512
29ad43d7b5e393bdc0076f3bedbdbd745a3fc76c1412dfc0b316025c11af05a5a6bece11db88f3385880dd5eb8719852faff8c0813cd4f6593d9d446627774b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6382643e34bc1828927044178ca5dd1

SHA1
3e5eb282551a45f4e9cf886b27f035e717537be2

SHA256
c411531be0a2b3d70561d1ec95a81f05d57d649e4579324fa3c05c75ee693523

SHA512
7c20bf1873bcbbb8ccb9aec5cf6903f045f48d1db0edae5112ebc00ca867ecd7cf943812affaa0368c03b18a8f6bba17ff0f995317357fb1b5138ea33ad8bedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e1415ba0f4cc4dda4e39e6a958ca99

SHA1
a2377a9b3abc632361b405b57949bf1a55a206ba

SHA256
eff684d97b104085dc28d2b8c3e0420a9b308808b717ba49a5366e4a88d36476

SHA512
c2a9d9c6066146a58dcabe18863b27f7327b3bc5c027e97d6de9adf6a7564d341aeb914956d039dcc0edc1b95f564dcadef48d1b3a560494b062be4a605a8e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aca9e8e6b7987d7df09cd19966005116

SHA1
eded05ef9e8f38b72b360b3ac3022a3a8cce672c

SHA256
ef23222b959111e60fb51cdd0fc2cd283813d709fc1fd41e80af34aae992089f

SHA512
368504349989b8ff68f03820859c5b2555b2ba583e5a46ab845f8ebec57eec98d10a8d926c130aeeb6227cd34dd639561d82b33ac119e889103dae88a95c90e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa9ebaf5e751e9f27cc4358c122785d6

SHA1
7d24f4f949d665758ca357159a4de927bd9eb2aa

SHA256
f7217a16a897bea6a1fd885561ebc03fb93113e0d8fcdeaf5fcdf795eee13e14

SHA512
ca574be9a7a0144ad8a9dfb4f055eab7d24baa312d839eb406c15481ecb6422dadcaefd1b02bda961aed9622ff3f3c002b2a4669c4875e7d6ef493a32a34851a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c8df67b8d80a6f9a3b4d191bfac1ff

SHA1
a9a6765d178961941cbcbfa4bcd71418eeaf1d77

SHA256
3a98f6c6def1fc72b65b587031e17346178d154b2bf75dc2f43f131b36b01b88

SHA512
9d7b9feaf37da2c1c6e821319f5d80a861ceca42f86d673557fc4b235c5aaa024dcf8048713b6bf6b1e118ca3f09d4a91fd5ec0f5f29116e08c8c7aeed7e9e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d02db60187d332e929482777c55503c

SHA1
0077c632404697dd5b95a86c6b1ce5c5ffe88a0e

SHA256
c69fbf4d58ccb9b5f6adc8d1905cbc089e2325c8e47c473fd4fb48edc89564e7

SHA512
50f5e019758e25c133a1f428bfff8b5974b56a2556edfe9fead0d3ccf0d857fef1cd4b1cb9729d8b31d6251aa2828605eb6d63b0e1f9dbcf715b7b44123e597a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14534ce9715223f0e0de54334fc224a0

SHA1
85fee098d2dbddcd6cb6cf61c213ce7e599e932e

SHA256
600aba72073e019fcb82049497d153daa53792f516cab4a87a36971e63737cce

SHA512
4125afc2a12a33293a9ecc63ee9185754abb7905b0c289ed11156514c09e2213a08c452c013f7fc7cbf2e2f11b402344dc21a20a1e7322faeee38986e12421f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b541ddc4f73bb3fd5c285482b858a0fa

SHA1
9cbb211893b6221e0210d815810765b83bdd3f80

SHA256
04ee401ffa247f4ecbb41773cc3b78ee8be8c5719d94d61ccbd355ab24a6fcf7

SHA512
889c37bb2df85c396f2f7a68e4ad780406c1516ad37cbf273fe1fdf8840a8f1207285abe11a42d9112fd7ed0636810b6b886c5fedbca6385fd76056825835a85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ef249496fb557254f3b8b78bc3000a6

SHA1
6750b5affadc2bbd150b714dcb495de27a1413d0

SHA256
30ed22a4a727d4e615951162ce703ad92c084f63914fe04cd6fa3febca935852

SHA512
6d3bda2500759f7e5f55d022ed6d3d3a443b7f7a7a31b0ecc9f10c4a265bc9bae214aa8a73f8fe5150ee20cf2a53ba53e067af78727b78b275cf34f3a474f656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9da52af52cd9ac9384da8ee41263d97

SHA1
0ecfd9ada94e9d29cbca70ed2ee212915806e8f1

SHA256
7102f884f4542268742cef4363d181d835c38be41d454d06a9eec3fb732d00f1

SHA512
d1f4e5f897c57638d8d5951f17fa1ff3ee0f284615e22c61999f71fea246ed9cec82d8c9ca4fe23085663b985e1028050c281565a7340e66340831ac0952993b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
397db4c9a80e618c3cb6bdf0c547a41b

SHA1
0f218dab95cf0cfac5603e1f48e17f8b09173113

SHA256
1379725b6cdf9c993a128a575a97dcf3cbe3d7c6037594db8eae8b64424b216f

SHA512
b1bff68f1b9cc0da65ff4ba5968eb3340a6e611d333e0c1c0d8062c24492fc1f53593e65636627142bb2ff69f6e3f001deb489cc9d5e66427a2ed538e5f9dc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\wp_shopping_cart_style[1].htm

Filesize
795B

MD5
5d8d79c3cb9af023240b1be6f5057aaa

SHA1
df22980677b134e83d878893f7c7984e0d78a240

SHA256
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6

SHA512
66f432b622cee0bcc06cbc0f833de1471ea36c295b4cd93eb848d97e69c2252acd2fc8972db51ea35475a424f4d6cb5001325525fb04f71b8704eb24de1c4008

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCA4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD96.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit