8cadd07f9692f1abc72656fcee14e926872705826529b05e379e3dd7455fa7ab

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e3c5b5b894f9c04f1807fae95af3db5_JaffaCakes118.html
Size

461KB
MD5

5e3c5b5b894f9c04f1807fae95af3db5
SHA1

99f3e7a8ef506530e7d386ff8d74d40cbcb5ca45
SHA256

8cadd07f9692f1abc72656fcee14e926872705826529b05e379e3dd7455fa7ab
SHA512

0e8fa94055553e100bfbd08eee5a3e1c266b3dbae593b01690be0c5a1a5aa8237510887db6c51b6a48d056c97a4a1d4ac88641cff7d63f55130b2780e9a7a4a9
SSDEEP

6144:S0sMYod+X3oI+Y4sMYod+X3oI+YhsMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3c5d+X3b5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80810ffc93aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060e2c92b5989b34ab2328e01edcf3436000000000200000000001066000000010000200000007a235372695ebcfa6ea9d6182447841c5b32dafa6559ea358c79c14d102b0240000000000e80000000020000200000004f66984d1a664eb90375ea1a8151b00589a1aa19ac7e926dde6ef5f3c274866020000000fb0bfb9999e7ef3fadafabee6291d91ba047d4d996b85d4aae1b9ce62010f2604000000006c2a2430dfe2723185251f29dfef07ac0d6bc792854be03e55ea6e3e0580767ad67d29bafc052dfd65b0f3ef6caaec057bfb7c9cde1084a83a3771843af02d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23776D01-1687-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060e2c92b5989b34ab2328e01edcf343600000000020000000000106600000001000020000000129b844c1660c7b3f73c2fdd10da71a8e2f3ed3d0e651fb28ef296ec4d71ada7000000000e8000000002000020000000a2a018e08b244c7df7331abc17b7d2e2af4c14b0a0337e16a138ddabf355d8bb900000007abb5739b04a607236b9ed1eb4633b00759aa00f2704bc5b1730ea0b191aa3f59b127b1c3d6f94e62bb702e061da98ddabb2d9c3f72adac6b0d0a46f56fc76928ca107f932830eeb708fddca06040cc5ee6afc893b6b92133402437b8bd8e7eac841438683384a823f66b90e72a4ce5c2d27e70737895ec30c50faafc8003a1af645d3baedaef8e2be85e6bc8111342540000000c43cdf9228fc4dd3cb3c5aaf310470a229ada936007b6c6d42e62cbeca375b0af4678385517a744c9ec901cc6644756fc5fb6c914071982a1f516679b6001c37	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422357382"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e3c5b5b894f9c04f1807fae95af3db5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d256da0929bb55b0664a67a2aeb539b6

SHA1
77e0598bdffa77d710d3db3f546efd410481d082

SHA256
0bf126997115839302536d4207c1cbd7727be288fbe20d426e22e332caa98faa

SHA512
47a457903a99140aa1d7d3d20f813261d7a78e1316268b48b8827452f749f67ae3c1974bf9f81ee4e7ec3a28433f8b7d5fd50951159322dd388aa0eb0b06cc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
779aa3b92ce491530fd5be70d6211c1e

SHA1
1295f158fb0ebc455399db2b2e0ce278f0880666

SHA256
b08ec5c631a59b3aef08ed1f94458bd5dc8c87d9d5a0b18093acac63e6333a3a

SHA512
18a0b4634430dc314e2b7cf214ce72b6d8af7721f1938345403be971f6c81fafd4bd3ac774fd74f68d00a630e2a33f70f69658ea76b080ae47ba5925511f3adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b394e88edfdbac334e9675fac1259ba6

SHA1
0f85a216d50c0f15b13c845d9e8da78b47565dbd

SHA256
9a3230e7603c62be4048e74fc4ad08d128fe0a9f287cc0c4727d641f9cad0df9

SHA512
df1752707bf0a8b4b486f1c93fc91f620ec688a885d154e870d906544b1ebb32884997eaa34ea736894101fe63aec18baaccbe0c8fb4677932f04f26242a1ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6b02b0192d16c90a73e3097bda5e6db

SHA1
921d910fd67d18d250c7a5cc9e5345bd10ae7e21

SHA256
5197fc99c5ac6c63c4dd61d50a6d4d0a4d6d6017f5ed4fb0c7c4263f0e6c6645

SHA512
02cf2e410195f4f70b51be2bed04a17028a7e449e7a194977aef380e5ab254aa1fc7bcc2ac6d0d95ae1e89d6556f1d99a375ed20666400b806b1fd33480e88fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8797226702b64c59e2df07489f1987ab

SHA1
82e14c61c3e7d67ec5f256e35020b724fda7359a

SHA256
28ace1503f10c709920069562622e59daeaf8477c5faa067865aeb2be0860170

SHA512
d93e120446dd8e5a4640af7314342c484be4e03fe5fd4dadc76cb5f655eeeb8f187a2a9095d96e4bc00bea36278882291967f1914b42015ce037f58e29fcf854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f54c1429a2278ab62377219410fd8bb0

SHA1
3482668627a85cb57ab0940a418151995aa8cee7

SHA256
190d3ce264ea35ede769f92b606eb83bb7c1294e98a972d3c86e9138ef5eb531

SHA512
9ea425e8a8734691322637f5d1525357469245c6875fe642375900ea40d88d65ae34b2c46075dee5fbb35ce921006ecb647570fc3c706df87fa7546e4aa73a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2104568fd51b3afa2761cc752772285

SHA1
1c75e87bbd35a50c00e65acc9961cf272c270a7b

SHA256
0cbdff7fabd35e3dc4325f96913c1634d07dbb708f4347543fd2f42e9e276dac

SHA512
866f07de47b80097d10659698c1a7a0e73ab1e316c3ca3ccc9a7f85cf3bf82026a747bd0f990df025507a1a64bb0dcf8c14d515171c0674fd8bc69d127284a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aef99c1aa21df7712481fd1cc268910

SHA1
73b424a48ab514a443c20548c596471a1a462eff

SHA256
f869f20592c0a6071d684646f64e9e1c9124bf65ec3e1af1fe39c3f9b644cd57

SHA512
c37a07f28b886afa2ece5438b24b690c16d6614335aa2fbf962311b4ea4534cd133037b5e0820a52d285ba49342000cfbf18dc5bdf93f84cd0cedf963364109d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e8a92f897351c18ff60cb4099731583

SHA1
3de5d2751fa1e6428886e73059a0bcc43ff4a44f

SHA256
c5dfb1c951b784cdf728d44b80b64fe419b3373eda29c9f3171e564adcaafab5

SHA512
2e07d41f86febcf3b703b965e66c06eab027b9ffddfdb7d15b6887205309e94c0ba2335bad7d1ed02f48ae7f18379dea03d7f599b3166838cabc9e15a0ddab22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49a0cc6ef68351926ddb1e97671b890e

SHA1
7c5605363254bd94411fd889c756edd8d4f6fdc1

SHA256
ab0932447bf21ec0b9a7321e27938b6d85fac1372ab0141193680b6bc38d2897

SHA512
9597807581fc99be45d5587a6ad6b29a82abcf312f248b14795d1e06217a1f44a27cf23a2fef1131c9eee1636f03861396c8f397310efd8a2bf78999a8f35f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cfbcb82f9a698dde0ea03ad96d3134f

SHA1
78afe173317ae7b80bd8d9961a7a8a0e7286dd4e

SHA256
68df1eb1ba0ba76a39c2c941d91e74077ab553950c2a19d4a0139d81e73e62fb

SHA512
543e8cce6caba9f701a457e24385c704c1b9a154587a8b1fa6a485041a7e8b094cfeb8b92641aac99e5bfedfdcd84f655ebb1c15e2e6a52c6882669bbfa2564f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bcc4e0715f77a9b17f89322925208a02

SHA1
c45e9842ac19a8a0bdffe1203c51054dbc3b0a25

SHA256
54f9c05e3fbc0951ca2b913a15077f73f240c95ca64c859f54646903fc4b51d3

SHA512
4f89f23decbe557060fe680f6936df51bc773f5f2ac301430dc13689eafe45c7d86415509a6da9ce2aee3ad75132a65de8cb085b0d399e0fff0711e67c0ad1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar430F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit