210925e13665b89ad77c88b72b574f750a27b26eeff1693b92e7403ce1547075

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e87a6c6742a54b02538e798261a2764_JaffaCakes118.html
Size

30KB
MD5

5e87a6c6742a54b02538e798261a2764
SHA1

96c66b0d881dac4a89b652242176a24c4a2942ed
SHA256

210925e13665b89ad77c88b72b574f750a27b26eeff1693b92e7403ce1547075
SHA512

e2427df740acd01869593feaf564f9bb78984dd6f71dc5ee6fb172d4d012561faeb16d627196d10bd726913d901c4ffed1f92c6ac5be06ac1e3f7a281b388fa1
SSDEEP

192:Rk7oRCsb5ngvnQjLntQ/onQieSn8nQOkrntupnQTbn4nQ85vMWm2BHMunFnQ5CnI:O7oUN4Q/5H1Fq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b075975e9eaada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422361847"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88D506D1-1691-11EF-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008261abf6511bc4c92b8dd5d4e7fbbcab737e0eae9f2fe240801ba63a0c801c89000000000e8000000002000020000000ee068c421282ac88f757a3d71d76108ee84d705f2981f6fee295fd5bd3d7f358200000005bdf78beb2a0aa79e831e5ab990becfcfd93f95116cbb702c93e96c2e8f74dff40000000957a161c3bbf18c74f9229f0f16358f9c6e8f495dc870a386584cae5827c43bd215536bca13760f4d3fb1abea7797493baef12338a068d4ab880e9dde99a319a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000044e0ae55c3033571e6fb551300cec05666536ba94174fdfbf93429a65b9a352000000000e8000000002000020000000b1ac1c5ad985ff8a2b666c71cd4ff7715123d047c1c32466703821be9cf547c690000000d323aa5bc1bc655c78d7e05ee8cae042bf68eaca86abd5908c781440e19571e5ead629e50b93151a1c9b1963a26d00b9f623bb4a9562c2414ee749b3d88b5eab226911264d0619834e73d8595b9e203dfa9522b8e08cbd3d00425dbbb22a27fc708cb317f51721d1ae1f71cb6b01c7a280f2d582fbe531edf24d2fa91e996f83b971f4cbbed8d82b2b4b6de9a39155294000000008041a361fc17f01b3f3e1a5ce2ba14bf3f7f0e50ab1d388f59ff94dd7aa2c0422b5fa44ec0f89d714391bc93a0b06bd14ad5bcd8303ec4f91f5872479d41073	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3000	2208	iexplore.exe	28
PID 2208 wrote to memory of 3000	2208	iexplore.exe	28
PID 2208 wrote to memory of 3000	2208	iexplore.exe	28
PID 2208 wrote to memory of 3000	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e87a6c6742a54b02538e798261a2764_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ccc42896e1dd469557246e27659cc0d9

SHA1
bada3b765bcbb81fd7202a490a87423aa13a1887

SHA256
0683fe68e28dbdba6140d6ba61eab15dc2de550ed295bbf32cf5440b5f241190

SHA512
63dab91627c5777b914906a4fefe7fd4a69d2fead6361252ae08e034f0f7bd50eb4d183be22ad8cffc718070fef2a43b62bdf544065375e117f446104671a7d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
82cf96aaacfc739dcd22f4d265732a69

SHA1
a39a226838511536bf8e07409cc6ff78696b9c53

SHA256
628e9acf63807f8e5125ba9e755de4f3b025dc72fdb6a73d3059c19548d81242

SHA512
28e019dde05e3cbf82cd1e689c8289cd4f6d21d1fe79807468b95e5df18131c8005c76426399febbd59ec6f8dc52a93db9968855326dcae163edc4f47baf36a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
72e5831790781ef4a7f5a33b3bb04841

SHA1
43f2a3418dce1fcef4263acb832d71c9065cab57

SHA256
7c923b3f1104e894dad1cba132ee54833015bbe27f57905d15d42571ef88d100

SHA512
f20394ff6d968feb222847452e3729bf549b25c9bb2c75bc03460d802dff47509e2579943b555d1a2960bca21aa49b9ea605ce189861a7e044010706843fa3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8d18dd0bd97ffeaaf12cc7d1d49ed2ff

SHA1
5a3610916ef47038ee31a70489b5a0ae0e6a943f

SHA256
36f09d86197569bcbf2286a919521dc4bc097d017f086d9116951908e1bc8a86

SHA512
8fd992fd719ab0d86c02a3f141fb99bff9520a6d985739d0a207ac423038295bb23d0d729dd57a0cc71e9f1cdbfc47577a78e754f3189bda830dd638246a3a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9e43d19bd8f58d647a3983c7af7f2f37

SHA1
463d666774ae6d5646c1cf2fab9bc9f723455ca0

SHA256
947234993e31d02820dcb18dd1e63d517a595f4a2bb2649b8c21535b0be440db

SHA512
67107bf858dc0c27909d924e009f0c1485e9e75657211a55069bf76d047d881239e440990b00b2dee33bbc866e24715376e7a24d2f36b13909978a369c6cbb42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f06e7f5f94e5ddb42ab740869ddc3485

SHA1
de1e99b881d742ef1fdb524425ba7f36d8d8359a

SHA256
265b996d26f58c77441b2a02816a6e2701b2f454100df231a9936af9fbe23da8

SHA512
f9de93ec4bed52040f423e8d27a8203e1c19f2392a6c8f7a03c68577d230940b02111584ea06dc18c6464fed51ed42aedfd21ab4685390244ea4f20984ed82e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
58df427d77184fe23baa93971277e4af

SHA1
474ec6ef56d2213bdec0cc35f622556a7856d2c5

SHA256
6cea040db21287bc6f88f7af68c3433d15e5f03c2573430de83fe9dece780741

SHA512
5c9cece87e020894e6405fcfd9e34c6a07a01faa6ba03f2dd07982bd1c07faaf46a2bdb5aa8d7fb0b25a3deb41d997450910b2938a8bf42d0322dfce14373e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7a1622bff4a0c31cfa8eccc8843584ab

SHA1
6f07461bf8c57f21a6e70d8e599cfa91c83a6eb0

SHA256
e10214f8af7b8c2bc4a6615f815bbac9e3f896f6393162cccd1642cd5f5a20f3

SHA512
acfa36f73c6f4fe45a0926be27fd5801b94c202c46efe73fd82c581cd9974ce46ef6299da5095ba024736feab17da5b2a4181b35259fdcf59f1844bab7a2c2bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2cd749dc5e5b074a4ddfe42fda170441

SHA1
4aa86793021ace31790bff389f3ff7681ba53ccb

SHA256
a7e3f9797eda3f134e5eb2f3653ad7d39d67dbfc322e552aa386c96ef306a68a

SHA512
5207c6e419ded5796d9dedbab717022932a83805c2e2c2ea86fe5472de91d9b807119230b1c04edb5c8592b17ff78c419995af7de7a7d032fe8ba663f3fd0f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ced86a915221fccff305b1de0128a31b

SHA1
a3300bc52430e23017456edfd839b08e594dca5d

SHA256
f0404affbaf8e5eda0040ab8be33ddfb962f1241ef88b3675072821a387692fb

SHA512
47f48b082cf26575b93cc1097bccbf097318e889a843ab51ab80439d36038c6eedfbd43c06cffa7ea656108a80641c738fc38af7993970963f9ed74949b6be9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b388cc48b4bfa80a2290781a75c50153

SHA1
f3302e14bfe68ffc8f41c951e4a48cdbbaa979f8

SHA256
b3d6abf0e5d6506d75fb53f492b395671d295229a4b19e9b6d0944c8f7c49723

SHA512
5a5b13b8590bafa8fbb2cddaa98266984d5d651f4349237aa3770883a7eaff7527d4f2a63f01c7cdc196aeb43c5ad23431332f6ac271683d2fdb9c8c600d1d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
affda88821562a58e58b45eb781ccc48

SHA1
1d2336cc7f1ddcf2331d1ed5b59ac2eda6b5a889

SHA256
484a7c697ee0c925c08bc9b3ab5801a76d911b48cb3082407d64a9459a6f0057

SHA512
e1c367708c543af0ec5de20f9586e612b8deaa6af4009b73040497d12b323792de0a00be7b22cc2bd53fa0ef77518bb606994139a7b1d8bb6043e7e3aa33ca09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8c01864ea18270a56824de0653350814

SHA1
6b45295acce08f5d7da72a704afaae6e83c8e621

SHA256
725548f6c44df2f050b28f126ee4cb4196890441da2e1daa067ca9d5aa272ae2

SHA512
304df4a5891c707c503161a251b0b993aa5bcd969eb1918f882ab751a39cdf36edf73550dd3cbc5b3b2f9954ff99c5faaefd0e787d82270bc4f6af17f5d7af3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fef9319e88901c0891e362434b2ffda5

SHA1
2b2af804b47d7e47d2b4fd7a7b3e35294f64f5ac

SHA256
b87326563d57d5f5cd18ba91aa3d28f6a9326033c5d474d83defa079cdeba47b

SHA512
61ebbf1715b1a6a8cfa92fc3a39ccef7e04095705c5d20027caa8d5ea17a981c18530f8b4f901ba4a5e118c2bba0c11226b1abd72b25cb42cfdef2d594eeac2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c0d50d873e4549375ac5aa12b482717

SHA1
6d5e1fdbe4f9b4dda5be0c1daeaaa58de4bdfaa3

SHA256
7d0a6765471487916af2d44dc78a70d266a244828166320bcb65218a38e9ab85

SHA512
8f9963ef8c731bb45f1e46aea9b9b65629323eba49af43d521ba766e170219e8a2d2e810fd1e5e5d94b3d11f0be23f18c3b17db64d1c341d388361354dcfd84e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4943.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4998.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit