fb429e26ffe1881ed904f5aee24faa1c867880a08c102bf676a385af83cc25ae

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f19acbadaee0b837f496cf9a36e7e87_JaffaCakes118.html
Size

4KB
MD5

5f19acbadaee0b837f496cf9a36e7e87
SHA1

4875b8bbe0759062a1bca671b5c2f790f0eedc82
SHA256

fb429e26ffe1881ed904f5aee24faa1c867880a08c102bf676a385af83cc25ae
SHA512

e9b5b558eed5193c6adc5c9abcd7863a5f3dec1e7865441dbc21b44b0f38df818ba2513b022763c65a4d2f7425e014b5b41b3e7cd4253b087627855aa01b0262
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o+ICTMG7:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ffc6b03196d9b4d81987cbc4325993dec3b5b6fdbf71c5c30a75cb9befb143e2000000000e8000000002000020000000cae4fa220c73c63adedb1ba4aaae3d3452d97ec3cf43118259a7e54637b6005290000000125a56494a1d862b074d545bf868ad546fcfdfe0fd8669639fc120b4f4b58b36805eae82037264faefe9e8d9f2e454238ef5cec02430e375616599e485f313a05fbe8ef663eb19a9070cbbf85dc8fca3088941eca6a8305e38462b61f946c159abfd261a87a66c893025775143514118166a193e4fe9d8b107eececa5b049c8e85c6cc11d69602de46e35b62bc2f7c174000000034b9dca5eb2ab319204c89b521397fd9febf49888ef3a65541676212286622c769aa1e675ecb312f6166b05922451ff9d1ea502f089cf2946c3d20436d9fe3d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a052a952b2aada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422370421"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009ab8c73b7cdf82fcf3cc283225480f70fbd3154c5b6f1a1e8bcfc5f62d15e049000000000e8000000002000020000000c889175570dd9a1b6167ab0dfe9bc8de637b373f20ff37626582d5c5fccdc98a200000000942f43c70c9dc382055dff1d110af5c48e3eb8a85bfd4b64555241f098b10e6400000005e33a9bf018879b804566701dd8cfdc96f8e4b201a3109b5e60061ba348001393797b7c32c49de67ff2e5c98a600eb5bbc57ee358491c0117387b1a1cc9cd5f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E163C01-16A5-11EF-BEEC-D20227E6D795} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28
PID 2476 wrote to memory of 3012	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f19acbadaee0b837f496cf9a36e7e87_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be652d0d170ecc87d169905c6c98d38a

SHA1
c7ad440aafe880176448b09f194591cbdbd73c51

SHA256
dc47112c26a3b11a760e844e9f1a532d296b71326ac418243c3ae3378d8be83c

SHA512
1f89e6f6ada94269846dfae1fd0011fc07c7692ec8733e38593d812ac079daaca05cd414fd4db640afa68db3c85900e1ac4892db695a89f474543870b3264321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4114fddc95564a04453e8715d112f337

SHA1
cb21d1f8601f51fe278195338f698ead1f681e1d

SHA256
6f7f3d83215da29b9630b61ca692b9c2ba374f74e9a74576088ee0fa3bc90e4d

SHA512
c4f34d716841fcee715022a9e05d7cc7160b33599d98d58542ab05f9b071c4fc1475740535e302dda2c7fa1726c607f7decd2fe4f454a3ba263a9f8664cc702a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b432077a4e8fa799d72eb51c446cd3f

SHA1
78e9a39f5d25e071e8c810265b52252bbc9295bd

SHA256
f30f5ce7a09dadb4cc7a87c6e2a56cf135162a55f35c7f56ea20b7c46ce8a84f

SHA512
61edc430659d1b418091a55d7aa36eddd23c7584b5dd6a61e66f0608f005d7a900a66874aed2703583b95b02241974353137db2ec5c2addab839782f94f8420a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4641d6f15f1bd1880463fecdc6cd3f4e

SHA1
6e36729f63e5f4fbd566845e2e936327716cc9f3

SHA256
9a8e3ba23ac27c85a083b207b5cffeb91a25534ba7c4bcfd44695a93fe555747

SHA512
2942a6a81be64020fbd31271e4c35d3789adfe9718a2518379c909e903122f237960c09434eade6480468965b67fa230e5ca87769f6e7a26ccb6e3efff243c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33e5ad672893bb2a27196caefc1de48e

SHA1
c6281cf7c849bcfc16b1160a754c37f8c998c746

SHA256
c9dd591f2817e8a087b4bf74a35a60c816646e95dd014e449a963077ae60bb99

SHA512
cb737029e4d0b6d6225cc4af50cfb5ff972132ebc87df0c83c169b7b793047b73d6b97ade0cefba62d7b803652ec85221628271d11f71560681c3e1273ac3c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b593858d0aee245da7ecb3ac45e8c87d

SHA1
07f235622536f25d7ddba11debcd82433e89e90a

SHA256
f8d310928afdee4667a6dc0a6ce26bc27773a7770cdeb230ede9d9219e99845d

SHA512
69f82a0e22a1dd3727c842a439209055611dfd5ed2f06b7ab9f6ff5f9148b480069eaaa96fe23baa823976410f1346935a0663786ce44383d4370de4b511f65f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0615f47a0c4d02118dd5521a2258827c

SHA1
217a8ad8a44a285ec44f981a4dcac19841f97003

SHA256
17bfb372bc88a6dd1bb6b812836af1b8a28b11002d4d370c5ec8ec8fdc55b27d

SHA512
5a533c39a4e80dd6c69b2ddf09c604f52b75191bb507090d524db70c2823ebd94b9449e601a663407eaab2fc31c6701e6c98842cb47f3df1bf63533ffe529337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a4c3e6d1cc27510ab502db274319c4

SHA1
01f48756e783fa32b352ef23bdf4459196bc6541

SHA256
ec11e88f771238a5d02aea0859d54f2f0da1e2be99bf73057baefd745d8d6703

SHA512
a4de896dd5766cd767eb69387d291255fdc7c2b070d2827e0db52078ae28c70810b9135f2034f026fac4b54c1f1b5737f3494536c10261863d2e38884c6d0553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecb1fb0fa0e68e39a65899bbc257c4d4

SHA1
9fb8fac9a6805ac61bb05291cf620651717bfbde

SHA256
ea0fa1501dd0f3cd359becee7c7a25c415ef96a8513673562e8b4c2e83d75635

SHA512
8a2ca2e60747999b809c3f34ef1a4ae181ee01da925a39fd58b842cce44d36319fc6e1e24b0615653356178810f70983004a24623fc5b86b039df3c4715ea7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88366c39e633f260e9fda8903faad06d

SHA1
3063eaaca44d635cd643b9edb5c34ef0cbcd629c

SHA256
e2cad3eb639b2c3929c6e64a376dfb63e550b0a294279e6ba9dde74dd2c6e7e3

SHA512
52038151c55680f2942aef217c3470a05705b580b72dd0ab3e8ba363652c4fdf758f495256609ea9a83fd8a6668db34f38e7561efe52b89cf203e54b86ad714c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9275944a4ed5e19316934eb4095cd25a

SHA1
fe95fe9baa4c6df715d8dc004260d6297cda3e4c

SHA256
82253e45e009755ec130be9ae554b6e38f8f14de6af986ef470ff042e9c0050f

SHA512
dbfd54baab5599d69ceb9f39d2009cc4d5b22a4d6ec5e76c427f6852d578cc06da9d77334cffec828adc1ed267d13871e4feb43d3795a7cc4973a25125997d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2d225e6feb3ca6029fa63a15d239bc7

SHA1
47edbc8b316b0e2a237f09fcc421a35e055fb2e4

SHA256
a89a5ef5bfe833a5884e8f41525738debfe91361b22f1a982c204e2abd6c46ab

SHA512
03893d0496efa3bbd2c2cdf9a0a41e45e117422879f90d3d6d06154779b14a4785d28beaa11ab6b17b898c0714372b8f21c3195b7aba4d0af41f28fe49b04cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e9baef2d78cc5d24121c31277f98e30

SHA1
10d98c2d0d58d06a4279ff9a3ab325dcbf16980d

SHA256
632dde5087b264f41f2373bc91248710b860094a1506b5520b984d95a38c41b9

SHA512
5fa1bfce11c08b6469d7971c4fc919cf26a81b897d263d1c4a310acbb92ed3f5b1a3e4d9225c7e2c8c0313dff5967d9b01aa287b6d8ef0ae09abc5db4396bb92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6342f183649b7fced6d4d90d8c9b0ddc

SHA1
768e95cdf1a0ee520582a22a33acb485e1b510fc

SHA256
cc79fc0cacf72cd066a5e33e27513e0d8a0c197f22f6530155589537f02db74a

SHA512
b38b3c283a4bb548e4f773492e7b658d876c2d844b86ceaa0a1b108d5981d398e5a6dce99a62e4eac2469c0f66dee416d0483c543aded96c77f4153b381d936d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ba332bb9be7766fd4e53e522e627b9c

SHA1
64b9ee7218692533f46c76c2bb7db10f672dfb21

SHA256
fa222ade3df0f49f600a58ff6c7c1bc31a7550c6429c6ea07032a15f43b53c5b

SHA512
fd553c7e4ac8c1d2122be0c4ee21faeec09f442a5a8e1bc3ec04d80eb11bb74fc1f542f1cb726fb1de869c1728bd75be52fb51a121e5e9c0d55a27e706bc7c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C41.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D32.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit