572d945f42a3ad3e9c269e769faf46146e058636a7c501ac8235c327d6f246e8

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bdb50737d186a81d2a7e38fe0d28460_JaffaCakes118.html
Size

121KB
MD5

5bdb50737d186a81d2a7e38fe0d28460
SHA1

db7c83c58a621678c8c729a7a745e0b03ceaa4ad
SHA256

572d945f42a3ad3e9c269e769faf46146e058636a7c501ac8235c327d6f246e8
SHA512

67b4e3a54b9689f905c27f99c950d674fb3d5fb93024bd2644936fbdb2054530d937d0e4fb31be1e6a1c68d817ad392b4ba7fdcb91cc72e4bce83d521961182d
SSDEEP

1536:Sey1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SLyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105fbdd73daada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000afaaec2b9efa3f8dff6a9a594cf97595917966cc712fa2ab2c8a2bfabe95dc22000000000e80000000020000200000004c3785e3630cb67b2014554507ec433ef596b963f8cc421a5adc8f443fa7e4c020000000af6d78e856556bec34f5d353229755ec91c6c3fb8ec5aefbce3b2afd19279872400000008abcb63c8c7b75256879d84adfd38d072cb261814db1c49a619f432865b8758758f708d733b46dbcbcee94d5495a45aeb6590a8c51ab8854bca85d2821a33410	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03209411-1631-11EF-805B-F637117826CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422320390"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000de8e79a3942b00506e85f5e427f5077c63ddf464484e054b8e20cffd5933ffb4000000000e80000000020000200000007692c6411192b479eaa7fd8eec54f19c6baed65d1755edd528d7af9d9860cbfb9000000029b81c68e83664dc2032b52ebfc2e866d4305bc1cabf6379de2c9bfe87144365ae355ea838b7943c14f778317edfd4680c4a0f5bb52b2888be4de33ab35d0e91d80c1313d155357338dfa23d1da0f6b5d2166329e0784a8a03d5be135f6346fee284fbbb4c68ec9c1d38dfad8fc79d73deffdf6a40f25f2086e09b647f8418e4b476fe8f7bfd4428726caa57b1a6a62940000000092744e4edb1238c2d738aac30cc09c2c32c8ee566f304db24e7f0af1303b024d240825aa628cd2a21d14fe627e1c4b499bc633678ca7c432473fc6c5375365d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28
PID 2436 wrote to memory of 2348	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bdb50737d186a81d2a7e38fe0d28460_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaca48e5c9e7dac721ca0815958a93ea

SHA1
15c4f339302dbbd7345016e81b314ef98dabc39a

SHA256
be7de80291847cd546ae9cc15cfc2a33e169a38c4246d3de759231bbe46309cb

SHA512
44e7348f172f5f7b6486e81559d9d5acd8f83ecfd6ed6fc1bf6aae70511f33035f2d748e9cae5318e102229730ca4927eb2a242fe226c4f00a11bef71b9d8ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adff880f028dd690dcc34d6be88a6eb7

SHA1
1933cf529bd5e20ce8d3fe4e1c135c4b9b5e2f4e

SHA256
a360bce1e7e8fba15fce42cd1f717fae6d2b2e61c67718fc7b80911f79838e4f

SHA512
30a2909a5c29ef6518b1599c6bec60db36494705d20d4d3d6d61c38e6338dcf1576c0d05f5c8fcd0933fdf07a1a790f373796d9758269deafd8d299b1e7e87fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecc4c07fd1ecfbf459ed7a3c23708633

SHA1
37fe8dc3f2bbf6a0ed9b4abbf310ae37dc3f1da9

SHA256
9f3526f54ffd0bd230d97082095e47de7dc2eef1a08d855c23ca6f118435487d

SHA512
9916991ba27bfa6850390ada09affb732f17587bc57b57e8bebcceaf1cb1cb80755dfa2020bfa39f8f1d2d352474dee5d328ddc405b28d8a16c982a88bee5526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188e281c6960a5263f2054a8bac9756d

SHA1
30664a42e8436d515a0fc76bd2ef91f459fd880a

SHA256
c9062db5c87aec29a8f71d3a0df66fc793665ab05ef3a62daac2a51e77358bcf

SHA512
2bdb0b0cd0cc91a27d3c310e88f61730b41d6ce395731707d3e9c9712736145cb2ef7e988fe927a8b4f93b1727ae070ce373148f477f20db48ed20cb8e23ed9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d475a15f6b0c95c27a0f54f4846c2f

SHA1
d48a8033b415816edb25d2f3bd7644ba57397b04

SHA256
38c10524b3891ee30e4eaf70e02c56328e8a3a16b67e182b6f6926e74eb3cd66

SHA512
117ab9dd4c2c62950eb4b30e64d643a2eab0c139ba44a422ee361ab1132d4996630d8ef7e47fd78205ce79ce6f8aadc8ebe74b931ed8dba1505aac74aad35edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4404bb3a185bcbacd792f14ab144462e

SHA1
75053d410b4050988ccd24b076b099554ef90914

SHA256
446beb7453e0ebd84fd4062cc0f4c2df5a6a0e9c19d403de9f5195082857db4b

SHA512
58002f4ae4b8ab4792be1a17248157f5f946ed718daa4f61e13de42f2de19ab03975711fed17e5c69af94bb81d7a6b7ba886cb3f5919ac38bc6ebdc7ccad395c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dea76a8b88251f4acbbce2b3ee48fe6b

SHA1
7708a646d0350d66d139c8790b34e459c4d5233c

SHA256
7ae37b3eab8ca02b54ccd5176a0fbc4a83cd87420594c953ab2d0d572ac08935

SHA512
1db7e235e98250b53a419bd023d8c9f48debb8ff7e3042d68f7483a669be5b8e2f7814c5052aa46c4a7fa6d9017f625377923c2f31d088d3a32a4f694cf1a2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac70ffa572efdb5414c38ee98154b69

SHA1
8895971beb757c1e1315bf86872641372ef66e72

SHA256
242378fd6df72ff73564956119be63fe8fde52a3f7dba57ed65245624d71fa39

SHA512
354a0b18272a0d8f44411eb622bb062fb6a1510850cc9a77a419b6f6d840ade52afac4679a56a254e5dbf9cfe6f1e7ab98f4e0709c6ab53efc4b63301e90f2a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53af34bd041861544bba9da0b1606e0f

SHA1
23da960323ccef3a2415b518b5095dd3b6bf3a40

SHA256
12ed0149f3e008c122ea4c57e5af6e940cc78517e4e15ccf3a1975657c93d481

SHA512
f119e417f654e192cb463ae2f70ebfaa800b15827dc13212d55098868d825f2f024746da952b3e80cde32fb307c71b720fa57ab62c537245373727366180338c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e5ea285b5e5760d1b3f1257eef74cac

SHA1
b573b53115d99d8b0ddbfd4ba0923b0494b9be6b

SHA256
ce08809b7e41bc9eed5f8d12458aeadd2ac25cab5b841c58d68afb6dd0159507

SHA512
940472a03571c1b092fc14abe97a5a333116fa5a00522a5566868bed804f4fd4633b1ae6b13a63c4ca26e809d54ac9bfd7d44eb095384a907ef33b4cb0b70438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe0dfb62e9ef6626dad978a4c229794

SHA1
dcff26f406d321bd40746d15f750dc48eac93968

SHA256
c5dbb6fd7540aaf23e912eaef052de42d23bf6111fb34ef72de8f429d31e2769

SHA512
38feb61f189836901962a46cd4b582adc9c410bc25213114d868434fc47a35fe80385976a28ec2f6d83009fc7731c8c69cb099599fbbd6b01bb256df0fdb0366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64bd9376d674698829ed9414eb58d39b

SHA1
3f953ec60234c65ee977b91e10ee147341b5466e

SHA256
c93881dd9e3fcd4d38ba970cce440b7ebe76d683ff1924db0f6520d57a3857ad

SHA512
cd0d00ba484d4dc0086fff5dfb87c238be4c77dbcb5da5b25fa37d6e1f0ee719f6ef3c944cf30233c30095552989ebbce743de17e6d009492fba166f5d95b0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65831ccf3d446399d5661ebb9569ed55

SHA1
9784b69ac60959f9ac201338febc9e810dfd30f0

SHA256
17d464182c24b92e40fc7e2564f12e34fa9e4fca1faefa32a80de18a448b9b7f

SHA512
7b3bcde1b98932ebdb3eda4c2aeadd7bd4b95613c284112118d7249d003845148df2fc2381ef423067a489c45a5121cc247f9f86be0b84952bad6d0a8867ac96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d304fe94a386f51ba7e5cb9da65add2

SHA1
99a64b8a538c34eecff53bd7d157ddec27e249e0

SHA256
ef9c78760b8291492131e634c39d1b7ada74d292ba25f9237e2af503a062c364

SHA512
6f8b6b391ec100f047167456e1ca1a4d8aa3e8a1fcd2cfb30a68d89cd35228b14c30e4eb30da35275441e565e258816d4070230f95a22f60a20ccbd4a10ff895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d5d7c329039330f0322cfcbdf7ded2

SHA1
43ea2de610083d4a7a0f40198f53e2ca94a18a22

SHA256
160a42cba351d958315400a7eef08fc9568178bdb6eeb5f8451f04222fb02f08

SHA512
df20228ddaecb323a4493b3a7a0c5c6ddcfa0ab13a743aabd14bd897bbeb61cfce503338f0e3f2a7d695f36bd771b1911fd5093997fb7b33d46cf77b21cf32ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2981.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29E4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit