5f1d308aa872d59b10ba89f9e9ae6b626a1204227cf040d6e2b837218b03000c

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b3eacaeaaf5104de643bc4863378fbd_JaffaCakes118.html
Size

6KB
MD5

5b3eacaeaaf5104de643bc4863378fbd
SHA1

8e3ed2ed7ce2d020fd55151e9d16a0fdb43defc5
SHA256

5f1d308aa872d59b10ba89f9e9ae6b626a1204227cf040d6e2b837218b03000c
SHA512

1a4fd5154de9cf432f3d6210d4df9a7778d9b8508ac00a2868da6c37e708e0559108add95bab1a92a9294516b49b3c3960667dec271b1c528c325c1299950eb4
SSDEEP

96:+IVub4Tsuxe5nLlQ63wZUWRwHW1ugd9BI/M69jPUwp9v+/DLp:+Isbyo5hQiPWRw2ld9BI/M6hPUwPS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8033a8cc28aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422311353"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f86457eded3bed75a036ce93a47e81ebd3c890978f16fa739a68b393673cc817000000000e8000000002000020000000b555cec6583e31048efa7923e3534b0327b2c5d150b06ee5a9e5a68a5925df86200000009d2c5a9cc86c0c7fcec0d3ffa407b30ebee881e1577bbc6871ee2f52ce2fc6124000000025051f64f8ab99003b906cef171c6bccafe64a2eee6d1c62973be819ad747afb8932ef10c68b0ade8ad99f86b162a826b0ae65938c60b0b1b558de285197b5fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c1034ff7e97f69211582e9962ddc53c044ecfd0ccb52f25163cf03f423597e2a000000000e8000000002000020000000dbfa5049c6d1f21bef77311599bfbd995dac5e2ba51e2bc2fd9fb24b189d0e969000000012935afe7c64cea0826b547814db1c8f0fac47a9e649f566b50beb1a3a619d9d902c0310d4b1148be8dcf79d1e2ce7671bd196385e2812ac108afee22352d6190aef0046b0b687afd6d210b7ca4138f59738bd313437c9941232885d5a2c8b00d7a8a4b980f921ad60d2f9da776f5f323e8ffc7a4d53920f5ae3148e8641cb9ac226dec18e1653011549d8e48f1cb6aa400000000a903371b8b13d05085dba7ce4076fd6d2905af8e38dc736c0bacb3b02013d95c431b075375de0a83127b68790366c2ea8a73a218ba454be3c4f5aea5d7198dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8073A31-161B-11EF-B0F4-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3040	2992	iexplore.exe	28
PID 2992 wrote to memory of 3040	2992	iexplore.exe	28
PID 2992 wrote to memory of 3040	2992	iexplore.exe	28
PID 2992 wrote to memory of 3040	2992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b3eacaeaaf5104de643bc4863378fbd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6cb16d7650e03300cc6069b470d6a00

SHA1
19bca08200a1c8e76a0d84505c79f533d1713ec0

SHA256
7e6796d4e528d531ec7932a80247a576088c727c17900bf0df192a443b2ee2e2

SHA512
92254e713c96e23e6a057f8d320de03a1aaf693a7c10b3547d9ebf55d19be41a883c83c3f7eb066c83923ee318f935b5062579072d96fb448788429d1064962c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad61dd7b7ba66c2dc60c48c27d16722a

SHA1
f699b796f4b51dc4d83fb0047fc9c2e67e426f0f

SHA256
3c46249b51dc8600100ee8e7ea63f5908197b758650b918b00ad5ddbfecd330a

SHA512
46fc01df553665d7a2d1d6550aac3a30ae34187b1b7c3fc6a0583ecce5de5126003679115527e81870155a729c072435a8e136e5bb61e2c33072313a94a69af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15dd8efaa0859eb981e9b728ddc34eb9

SHA1
550e645eff48b425a69890aa8588ed314a6c5481

SHA256
b76ca335a5696b39ff0b4a7b49bf782e43dc865bae8e31af53bcc7ce315b28ec

SHA512
6ac14253811f54ed7a68be8fdffa82aa5fe4885c195ff248345fcdbccc5d8157e8e7d72094997c59b9deeff4e5f384fb7082cc8f8fde504ffcfe77258e914324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bab0e38ab96edda7498f7d4d626451f

SHA1
db045dd6e1e229e91a6b9b03e6f9e05396cec0d9

SHA256
2d9d70a4f097d480a2d44e469bcfcd1f6e1b2bdbdf5aeb5ab2bc43dfb2df6221

SHA512
cc8753b1b10a26ab8fb6e30afb3a098efb65d046cfd765e0b3a69893ca08f3297581eb17cf4b6915755a4927ae233ab8bb4afdcc26c5c0d97fb5229d9d42580f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71a54633493ec9ea50ff0f4e81b5bfa5

SHA1
bb1b64c8d0ae692706ce494cadc4fc2feeec1ccb

SHA256
cb1779953d1634eb43c9489c40b7f34939ebeff250142428050a371cc02133b5

SHA512
3c6cedfebff51ba9d7dad66bcb95c2f0e401c78ee98575cd3979fbf2ab24bab8dfb5ca08b4d8cc76580c9ef56731c34340e7eb0b1c36ea63aff738834e2ecd40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b5c78022dc5030e953479b2f10bbe9

SHA1
e5c1d33835f4a9438ecb864d44f8b406beafd0e2

SHA256
3d55fda95969e7bf5534cf0db68bbdc8d662ef76448e9f0e6d4d32669b59f3e7

SHA512
fc11602b93278312dc1dbc45ac39a3a44f1a0ff2565f34f4b4664ee6832b88592955f3ce99e1ab572b9e4d887b5017277f431669c1fe24418d44a2908ee8bd08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6281ee4b736e2af688eb2de877599088

SHA1
f466e2705f8dae8b977910e7c5c6f1bdf711e904

SHA256
03c3c540fc8ed203c98fa2916414c2b64dbdf6a11825ba3f4fc568ef20ef353a

SHA512
6c118420e9b9972d57535b6500fae92d145168f3ef981f5ce6991ba00ba3f309d6b31b1f5010fca33aeccd2b071f8de0d2a0aa49f3d9bcc871795181079953ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
511331bedbbff200064a25fe257e8348

SHA1
945a1c084956f84ded4330d9c3724b924b793885

SHA256
f3130cbe641a0a7b98ed354478a1de08493c157646ca2e7723e10c25c42ab0b7

SHA512
327d6e2f4cd5d750f97f3252bc113ed80e59fbc0e9a00b430e9de8f480f5f44900b863f8b3edb647445e3d97f1fba3f1675b0a831dab3591675f9cf175c5520b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
374ca9f1575f8b4eb46fb0797c317905

SHA1
46cd453c0e9f598e723a57b7df1fada863891fcc

SHA256
20d13a914d6566b9e1fdbf7cb29044f812fcb2b51392482b62039aa85a6894ec

SHA512
9a04f2b02d0132725dacff9376b6f419b0c298d1ed43aa3fa26d5ed782ed6a794ae1cf9ed2259428eee762a1519dcd8008c45b09ed820f55a52665696cc09c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
177a62526021dc9993a0e474517522a8

SHA1
d2670749aa853a44fc30d406142cbd401085c6fb

SHA256
cc843b146fa12fcee0480d30220c41fad97618470faefdcf3df965afd399a4d2

SHA512
453345049b05af23b13dcbd6537491638b2cd8c1a8550bf6255c33e24d33ad5178d2d8fe9ed5e73897dbad7c90f5ea272670b6fa6dd332815ce0bdd1e5786e46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fda709cf3be1301ab53b06cbd4e21a08

SHA1
54c9c5d798561bd63b213d78142c92cea93c8488

SHA256
82ff0f4ae6642cb23e6296b7e538f2578b617735771e3ac34d990fdef3448fd6

SHA512
12fa46e18fb351bdf4eff6a9c8870ae93ef4fdc19f0086b4afe74ddfdc810a98acbd27c7d8cec6fc41ecd2b7d08a3fc4701a60f018e24f871188cc1df531b132

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5eb42debcaaeba585b40db0ec36e0da

SHA1
2d8ae4caa9121888da3babc6450bf70c44175ff3

SHA256
399f7881a0ac6783b34b8f68d227c9ab985170c10dee975e9fae0d6fd44b6b74

SHA512
d245f38e370ff1291846305dc615f3edaafd483da68f8316e383e3aff2731fbcf02d4e00b9946332e38024e3fdd403105f1a7c169cab5c699a788160f2553e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e418adcd8bde4c4f6f2657042c7ef44

SHA1
408c02e4b48dc484d12299435cdff941ce07966e

SHA256
b90a1d8afbbc1ad2cd0d7c197a3cfeff98db4ffc20f917e1d50bb9c42cb7dc56

SHA512
5a49bd8c549f08fc54c3ab96c07390dfd09ff0c61384d7d15744c474f0ba1a8d85187616a2bf7cbfc7eb5bcf31026b1b83e039ff49a7b2bee994363c96f8e50e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb853e7235fa6c7a7d97486a2c733518

SHA1
2aeb413b20c842b984e44bec4d37224fa8e71011

SHA256
22e2bb4a46b9f6ce1263acc41ce08b1d617dcf5e7b78633d17827a3ab397c294

SHA512
627ae013a71480f085a1e093dc514c74cab0b71c52e67bb8cc28ef99f778d6eff324701bdccc0e002c90d72f23db3720f34111464e9b5409d66d20082b76763c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
745b2be5f7005a2d2d9a32b17616a1da

SHA1
ebffd75be29a0e3e406b39afda795115d39d3f04

SHA256
5a1b6eb81ac368c63ea2cbd86d1f910d80e82329e836d0a394efe620463b6b88

SHA512
2135ae41bf6da660bf735553e5fcbd83e661b7a067a4ca2fa2753f14d1d393f46dbd46b2e416c7e794e9803c2e86032b6815b3e69edfef6a79d9aeac8db486db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c9abab9e2b9b0dfe3064721d2e2445

SHA1
ea4aaf78c87c2dc856cc2a12409e6e814bdc5cae

SHA256
12f1f78d7a9cff6f8c9fa00a93726dcfca4dcdb4081200a957380de7c3eb2f4c

SHA512
df2c473ec20c6cddac0ea6251d10af5caa2845a1fbf5bf184c1a7a036cc2dc5fc4d4a97bd3c8fbdea838f5ddd2144852dba1c640390a30d896e58eeb4fe03b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D89.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E6A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit