022ad237bde8d5f559eabab9550e282cc557f46f54f52eef9a68043cc6cdfadd

Analysis

max time kernel
115s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e913202906143f8b201bbb8c8e0273c_JaffaCakes118.html
Size

139KB
MD5

5e913202906143f8b201bbb8c8e0273c
SHA1

ac6c2d48040b979eaea22cec17225c1de0f31b99
SHA256

022ad237bde8d5f559eabab9550e282cc557f46f54f52eef9a68043cc6cdfadd
SHA512

6f1bcca02c40d1325fee73f578b3d3aefffda77792ff25d3339a9471c2b4691793e127d4ddf0432a6e0d92fbc13bec536652a361cd16dc71e8f440c4322e721d
SSDEEP

1536:SNlg2WqleyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SNfoyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBBE0EB1-1692-11EF-9542-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422362361"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1708	2932	iexplore.exe	28
PID 2932 wrote to memory of 1708	2932	iexplore.exe	28
PID 2932 wrote to memory of 1708	2932	iexplore.exe	28
PID 2932 wrote to memory of 1708	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e913202906143f8b201bbb8c8e0273c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c85d00a7e5bfb8dc9e4b8f2539bdc5

SHA1
58fe91839501d5eff1f33e04db866160d2388f59

SHA256
bd33fa3039d0c86842bf584a8bdf5f6bffc366c0d46eb3432f537c4185fcfaf4

SHA512
21f04047e6ebec25a1b6e46df6d55fec78dad4d7b5f8d740dd294043f6b162a689c970bf692d230257458ba269ff156c40787778a9e6c4e21e9c77bf8a68de9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad6e362eb5a26337f4357ebbaca28440

SHA1
d28f4158526056f4a0194a650e21da90bcd85629

SHA256
ef1492f59e969aff33f114d6b119de8cdb636cfc4dde1c53562bd126ad4d9f22

SHA512
8f9cca5d3eaed541b3df8bf88efc51c7f6732bd0ad609911f7e37647c8ca4855446abde81fd44bd73e914c58c46284308492a262478a5ce480a7d6c513d3a042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc36f328489b674ec3c6890da35b904c

SHA1
2b057b38964ee71f53fb9a68237f8baa55ac5095

SHA256
53e177497816e7929f959a99585e2410fa19a6bfdc9b89f8f70e8916303a5d3c

SHA512
f434f59d5b911c5b97450675a362d371e3d966e30b33d5518c4219aa8fc7ca7793a117ab719ede4e7d2ebd8352b55b5026e9c9b5440cb9884bb603ed9810e6ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
658bcc3b286f371ae6d55ea605b51fbc

SHA1
351d0f750ae9d45ac2da8d79224957fb24753f80

SHA256
7ab87b5022a5cc884fa091c079eb68a41f67402af9716958646aa7d5d0b9f86c

SHA512
b971d9682b21e0df076009a1d276787fac66edd3418a984d05fa8237a4115a8a7e03a5de6b43d09a014d68efa1bc7f596fc292cb8f9a2b3ba0c0a3675f5adb32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be36239874ca42b25fb0a74bb50f2fc6

SHA1
7c223d0c9ef97cc0aa74e4637e18e4404ed7d596

SHA256
d52c5406cc04d38489900b149e44ac877a4d074fa48c4d7f625785a775acc0c9

SHA512
0f9088852e0508f6dd15c717fa29eb3c3348398dd951d72cd39a4fd02f235f02b4ee323e271d613f7765a4d0c60f92743614496c6d63b8dd34f5591a6a167cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452bb5f771b479037b37d5c55476db1e

SHA1
8ef4104e6067958a007bf15925dcb9f0d47ba85a

SHA256
51d11f960730f3df7ee5e74cd50f0a77e94e8268afaba24407cbc2b0d41ec94b

SHA512
3122fa7e95c0579cbf4bbb2e6cee071ed9c848ef27f59b4d35a7cd6417a363422c505d25498521422e06ae02ae1e32f9d54251a0ab09e65d12d2695bd4cca017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd1f55b59fe51ec48a841f238932f7c1

SHA1
ba3f40f89e12a39ee0cd680912a5d4ef700f634c

SHA256
397034da833210357acf40bc0458fca519ece208706ef2626ea90533e55ba715

SHA512
c05a98cba8707d353e5cbb1405ac2faa4cb5981b82107729f3766b710142f9499ad172ed544260d65ea93439e25fc5d95ad0fe056eddcafcedda2d67d3849eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f422a6d8260707e8a8d80babf01717

SHA1
cca8a0fa80d4aadea36dda08dabb7637e66ee85e

SHA256
4ad5a1993f452de09399875784701779f82831d607c7f3f99b579d63ae9a1b22

SHA512
b3e1bbfe278cb341d2f59e09de26456fa49b12239665a74b76566d04107adfe921b9d65f2d2bd6f30f1202d57e86ae14c7ba525cd9c831257f396203af42fa7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa40cf86fd384b18cd16727a70601161

SHA1
434ace816bc46d3d1847a153d4869f79893ce6dc

SHA256
5836d8076afc6896d8bf8a9e13a91386b8eff46252f005759861c1486eacb77c

SHA512
86dcac2f8fcb1e7b27c8315fc1de035373503de54b669b7a7361eb546bf23ddf847bd428554a04256e3ac65af51a13c77cfa35fe91e6d3c99c07d28b308f44b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19907cd7e5dad3d2be484dfe5e53ea24

SHA1
30029597289ba0b18db91d01ae9c6dc1534f7f13

SHA256
709223f82b722af507170af26637777f35f8d794f8351a091381a6dd2cc6ca90

SHA512
2995b846cfc9d74df0a3259837990e57d56b55ef762b2a1104f0489d08b538a8364f7e02d6ee0d385ae0b2e2cc72dfc5b9d473bed703fc6a0c757efa0af7e098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69f263533128f7efcd308cc5fbb8af1b

SHA1
27af4f3609f7eb67cec9b4bf901ddfedc8ae24f9

SHA256
5e89336d3157913681ceb68ea0084d8df41b6aafa59b3b965326d8fe591b6ed3

SHA512
d2f9efa4a9175b895aa45cb66af46dcf56a437e647f4c0e0c36b92e6d2a0584d24363ba1abfff7482f6bfd00bb75e3cbec3bec29d6b60c0ecaf437e27adaa363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e0404f450a6ed6605ad61e2756694d

SHA1
7af475701aa0e5ad50abda1a0808c27216e76394

SHA256
da956966ac5c030cf924d3aed535e6b8e81eb8058f77d4e5fe8afa2fb7215e13

SHA512
38aaec656891754ce3c6a9e8dca1bfa3138898449ddf2da6a21aeac791e4455ac13e76bbeda8b3604ccaf046a14b7d050c245f04dab428be95c8f1e0e9a0f9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
403256489bf513456ee17e69edc9a8c8

SHA1
fa64dea8c65ad13f95ad9027a06b19ab9d9aec07

SHA256
7de712f04fba2aff2dc4df063b63aaafc9493742332333d029ae827174058f56

SHA512
d826247ea6afa1055211b81f0747e301b3adb0bbfccc3f26842e3e5ee0ad63472403f84c4ac388c82be86ed60e98f8259cf14ea8c1ca2f0f204bc50ca11ab4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a3b3808a27f47bb78c691cbdbeb87c

SHA1
3f0fe21b205946987522b9b4e078ad5377c38a02

SHA256
d1e6634c418a82e6c238a283c4747f5d604c3b1ae59d101a793231fd58568f0e

SHA512
f9442496ba194097594db8bd15fcad917f5bfcd9d22346f43303e3f9bca30c0af6d1ded981584142fa52576d897ec9267cfc6c4601f1e7b6b9daaacf7961f5b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
317ec021530b68240c619a5438f2e676

SHA1
e731b748cc94e5950edfd55066bc675b7eaf9bae

SHA256
6d6bfeb1c6007c3c50358aa5a9075dbf035c1401366f24a3fc66b2781b24943f

SHA512
29c11d99e1b8b352f3180c0d5f083a5689af8e54826c33345363bb733a278c377150791467c9537c812e6ae1203918fc82c0aea613b0a52560d147ab2dedd8b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc0f72d147d5376de120c47073b0dbb8

SHA1
e17db21d2bc7fbcee439923e0a4b75c2a04ccc93

SHA256
2f59237683eabbbf3b8a4e2bf06bdf7548f45347490e33cf2a985898847688b9

SHA512
9837c85e57d7367bb86cbfe762a0214975728eec84c447ca2d8bc1c3fc97d867fa2ea5448c460235eb690101d246629b0e3bed697daf9452712b004f94642023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24850ac0052e4818a9a478d68ed320a3

SHA1
d4d0d9446f6b79114be17d1692032ee8b46dc3b3

SHA256
e016dc7ed46b5e0663ecafdd1fe1573d2571b491e1fbb1096ae7e02d69212512

SHA512
fe0c22d30acfb9f27469079ba719668280d9afe40f9884d39b260b9ef98e821d3eb4dac5f8b328c3b2983c98aae957625e058202f5e98cd5f4d8eb84d385826d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4859392750230d8035d2baa13bde791c

SHA1
a033fd23c226f84cc0a2e3cc5ee4b8fec63deccb

SHA256
02cccb3c7f27bf32dc542eb0a61f386899f862369a12617fc76625c45562281c

SHA512
5aec4617ba730b1dce3c25e10556a1bf60486c1bc6ae5a8a83915808b15e271d15d4c45ff1b191f04677d51152f0b8df2702617e21f5119ba96e7b17c40560a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab146D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar155E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit