3b8f6739c310dcb88e22402ab54131de42bf42c71a6f7aa50e100b202fd904b3

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cf53b87575bc6d3b91ee31d764bdd16_JaffaCakes118.html
Size

70KB
MD5

5cf53b87575bc6d3b91ee31d764bdd16
SHA1

d2f38bdc40cc5627e22f8f326d9f7ebcb262d572
SHA256

3b8f6739c310dcb88e22402ab54131de42bf42c71a6f7aa50e100b202fd904b3
SHA512

12d622e57dfe3d6e5173fa0c07f1d7639c550c2cf62eed107dd2887bad7fbc03458d09225b47b9618ebf423646c7a5aa381701ef0fd0870306ca049549007323
SSDEEP

768:Ji1gcMWR3sI2PDDnd0g6GbLyK7O7aA7RgoT2e1wCZkoTyMdtbBnfBgN8/lboiGh3:JvjG+CasR9TTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0078613466aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422337726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000893befc61555c602cec6c489a79202ba7af3f63d35ec2ababd77d17e4428c06e000000000e80000000020000200000008eb0d5c6295224f3976ceafb24e86df57ee7061483a6dc78b51534d2a72448b090000000c2286e6f1cf67d5fbd00a4f4a5453d28dd7f7bdf1bc66ab77463d114df1b30d0d7ab321aa613cab0532a1576780335c35feaec707b4037437c5b5e7a454e4c6a57ecb6fa56a7a4b7e01d7e8c45f87a1d2cbf649264d3a922e381c470dcc8c05c8d31c3f5ff0c31af5c65252f177b2c262bed125a36d90f9b7b64ee27e59cd5ca36e783cdb7c7852e1b3da6f5d194c00340000000c68b16d52f3adb83be5e39d2bc8a8d94c21d32470005ee149a94886ad47cc0f2ed59bfb309f29f4140d3032cd224ec67739115af8ec05b4f5741dede499e5399	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FA739F1-1659-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ff08355d37a400ccb5c0f20057b5b24b2982a9589739af369538dbe1559a0a61000000000e80000000020000200000009a396bbbc1520ee4c8eeadcbc901df3358199f1ba987f13d83f9d754ee318e0920000000538f3ee46c0febe7f94c789798ebf41c3733eb01dd265efa1d4e02ae2dc1476f4000000074c1ff34cb5a617fa09417f9609baae58d42cc1addbb8debc90d561605768f0c6a187dd023caae4db468823725bd88785256677b151533ceca9ea3d7a3e491f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28
PID 2944 wrote to memory of 1940	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5cf53b87575bc6d3b91ee31d764bdd16_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2edd76c1dfac157ccd63e3a44207bae

SHA1
8876d140866012f5091e08a81af3c70125e368a0

SHA256
0387fc62f7ab4f2712e503ad9c19a33ba0c4ef36cebaf9f8f226748b6a98c971

SHA512
16978278d1a53d828343f9f9bf6d77f4cc853c5f5070204a6a5922d4dd164aa4501d54eabb71df8d3db385a9a2aa3c5895ccfd03d4f7acdccc43ce837d750ef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e2b29045004c91e73128b7be7584b9

SHA1
f812be208a27a68e575919beb60a396a1c75ab07

SHA256
9afb66583d099856596d3c2f380689b19d43675fcb451e5f83c45f45b9f76e43

SHA512
d38f99396379cd0d2a2f7cdbc2cd319845da75fc1b76b903fba0bc34bb04279045cb6b932d5b7825f57bb0de6be45f463c8d600b6254d6eb719762691f4cc20c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17249255fd48de29dd85aa7d810cf00a

SHA1
6101dc10abc3bfc7f7befaf49cb38df31f8f7cab

SHA256
87eadc746ff0ddfd73fa58e5efaedd68018dcbfd015051b25a857071373a97f9

SHA512
0cb7eb46a4a30c1893109776acf24c44267615147c3f817c1bfc1ebf701819fadde8c7611c4dd337f42781c1e7b8e6e8449afb502c8c828c0bab4560d017f9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22d9c775bc2d12c277b49e79483ef251

SHA1
35f1f07fa11a434a022554ac431b81d450b2fbbd

SHA256
523458c448c1991ef3e21589c0af2726ea52e05022662ad9dcc2be65268cca53

SHA512
c3e6a057587c8c5b4fa6aa0cc195589d0ef9cfca4a3243a3a9264c595e207294ba109c41b129adc39e18aabe260428e45ec531795979668f734e295028e5c58f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf96658e76f1cc59946aecd323e1c428

SHA1
2544875196c97edfa7455b625bf7decf757dec03

SHA256
32d6f584d57a7f4e05f09f29f35fbe3560a48dd1903ee26bbec50b7c9170d224

SHA512
cff2d5cab4cfa8c3fe83a1bf205f82af8b22366dccd20eca2ce88a9380cbeeee579815f7850892cabb23d6c6e206c79f507501ddd5cf92e01efa2d3115263ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
101cfb974747aa1fe2130ae867bfdc8c

SHA1
c22a652ee28f9955ec54bc928bc16119b2628fd4

SHA256
8c4e9044dcd8057e6bc4c704359c8921c1971e0ba822abb49cedfeb724589e8b

SHA512
a8cda45ccd7a8acb72e08f64e4eb94b1e60d4f28a4f322ce4fbe951838cb541e7029165d0a0115b3b291814ca70d85b768740ba74b0655ce3f10df3f24b26545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a127e57da627ba3bd736b84d6167f3e2

SHA1
3a88123a21033bac31348b9f1c906520465cb05d

SHA256
2d36b3296b2a6d347d2ecf4961b627cf6225f19b5a9682ea6d6471eef22a764b

SHA512
e274cb668518ba84a7fa966c8922f0701e8ab02988fcf32b24d8699e60eac4c20e382dd1da8111832ec9ca3d5166bbe4f00212e1786a00065e7bf2d6ed2404ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b51b6f976af2320b20d3eea2f8733f83

SHA1
22b9846cfd8fd2eb30b326f6be4d86e23cf86cd0

SHA256
3aed56739f163a5645b677bd9ad2531cb038f5b1a0ffea7892413429534f42ee

SHA512
cb6b0d4a12f99af8b88dded9d0ae2d3a08fd1085a3bdbbf44a6c6a8a1c0399d8d420a291eebf12a2a99d574a5971427c9486aa4203320a93c775d0bd5f79a1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e0d7fdf2a7ee5bbffb037d6a584397

SHA1
6c736160c1f2f98844aab82179deb3958bb361a0

SHA256
6f5504c1e340d19fe9627f2e024b2d7e57f52753f1b07941c1c8a3d0be111429

SHA512
143e0d19345ee1640e0c0f8127f91adc48f0b88c005058e54fe90198ca0beb3fb0ac9b0a04f70ae53f8f260d1760fe020591257f7cae36415ee0c4f2b9801d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3f9d9bdaeb5c9ff5a859cabfc079a2c

SHA1
4eb332efee0f8cfe1e40c4ae71f9555a68a55eeb

SHA256
29071009c8bfb89b1560ff7a2e29d55465d11c6fb75bcf5f0344087cca33c4b5

SHA512
65089c4437d82bb8d7a602eecb975a4800067ba10ae1e80b4b3ef07aabbedba7dbd8af6b45ad7e24d9bc139db47ab5164c3f704a5faed06cce4f99e540ecc6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2999b77bbe740d7d0be97b3f6c059d7f

SHA1
5a6d092af6b151fca0f87e7e4645b6902c0489f7

SHA256
c8328be9fb7e63e962eedd20907f21b5aca3b1d63f108056fc516a3513edd002

SHA512
01eb234dbe058224ea4c3fe67f401f388d37a78d2444c4e81ace84aa576dcd87d475598b28bc86bf162cdc8dee459dd2d18794057f11f81b9fdb1d7fd1d41037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3ecf98fb1c67b7e825354f653e70c2

SHA1
9b5803dae78d7fea6c86df590e720079a969a5e1

SHA256
2a162fad5b71de52edb0fe6440519335c14163c13e265e0a9dd0659806e3c4cd

SHA512
9da6afd5961fe56a89ec249a4ee4d877cd95b8eee4257fae17f97b2aab0a75c64c2274295dd9fe6f04a34b73e25f70c2d221b6bf1d000fea99440556904aeb5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6673a0ae2cc3e1ddc0290d8bee50eb4

SHA1
b0305e0ba2601e2816a05417d66f535bb24fdb68

SHA256
ea72ee885e299269bbbea02af3584b4cf6620a13731cfcd172d99eb12548c8d0

SHA512
b409b83d78b387545fd6a1d04971498547c774a5a8a6012eba45f0b200ef186932f42a9a01d2958fdb1a593f4d80336fd779a0ae293bf8b2293a581779e76299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1da65beb0f611e64c2489bf6bda6b81

SHA1
67eaa1f3bb15b7735e7549c58e141c7d47f7e20c

SHA256
edd885f5b56947de3d39fa8ff14fc12855e84e15f67eb1afd68dae2ff25c339b

SHA512
637da18001725350d0d9bf312bb3eae232a63616e263d9e4a20474525d8e233651d5af3b1b078ced1093af86be63d36ee15307d3d45d51f5650761a34bd6b5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b361a4595b13d5a349c593a6a52b982

SHA1
9657f9709007f66c64ee89a5a8cc077b20d124bc

SHA256
357b57fe292733065d72cef5588fe6e512a18d04efec4b9caa71c7dc79ee611f

SHA512
f756422fe3c989cdbc73070a60ed900f9ec161c74e838b0d67b241cb8e9a58b8d0a8ac9cc256fc02f138ff81963bf5d41c33cae36015a8b1d509531b426f6ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b3dd28f3e7c65c922bcbd71e87a7f7

SHA1
2ea5b34a6586f4d2e33763ca78af772dd620d365

SHA256
8edd20b2b9b2ddd69f9e164538bca11c128833dbf608f4757539fafeda1d7974

SHA512
169719f60c690d275dc1aad01ee0c93219238bf89f7461fc18e75eb1ae09ad7d299260e92a193871311d0fab20f2a7366097861f86aca71badb994383c58add8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10dd49f0215d0c54322b93a9dfedfc79

SHA1
942b90883e2c3f77be59e3da8f4f25f9e8921e2a

SHA256
58afbadc6263865ef110cf9abb83b0de4d97c9fb8bf460af2d99ba208dfd2047

SHA512
eab4422ba1f035e533c5e4c58fadda8d7e54e9d5d3ba47826e20d831a37f2a75fa876a635b3e894fd411fc827a5f2b3cd3d4c33ef88dd2f925184d3363c97b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E52.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EB4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit