3ed0461a93f4419e039104f4dfe913f6f33c5599947f5cf69e5b064eab787679

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64784884b3e5cde0904d1d3d0fc7b79a_JaffaCakes118.html
Size

483B
MD5

64784884b3e5cde0904d1d3d0fc7b79a
SHA1

8029a6336148e9c1b247167bda58b3b0062c83df
SHA256

3ed0461a93f4419e039104f4dfe913f6f33c5599947f5cf69e5b064eab787679
SHA512

8d3f111994d0488f437b85c2a0002742608ed303f4c6129cf708753e6a9dfd4b3908584d220369d96e60aa58a3155f952a2839b8639b0f35e79182ba9a0c0711

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000f3d1ea53ea36e5b8b10f57fb533f8934411c6f6bbf5f2fbea91ec204895557a000000000e8000000002000020000000afc8fd83cfcc8e98155fa7538073619f5ba15a502be526907117c3e181b3451820000000e61d25dac4f5ca8ac0db1650b08b7295e802b98e443f16941d2c43da3605c1b640000000163470c66462eb1c9305680a55906bc71b871df009333713b884349ccfae010bdb21477f713a617c00481e7f6c8e5ad317330c04758af00bf59b25392565b681	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5046f744b4abda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{82356791-17A7-11EF-B393-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000074d5f8491c0ee5134bbb0903d23c151aa440a5c9cd53aa532a893b53e1e52506000000000e8000000002000020000000aa7dcbdd6a3f60120bc31ef024cffa01b42f1a9ef85c91c88652b69f84b451f790000000dae5959fcb7c4e22fb7b7f8848a406a371b2dc668924eb1518d93f1657ef5854a1924e9d8d9817e6d06e8caf83373751fde8cd11c8735c6174f197554c8d6302d8106bc22d154014666463d68f414303263b914d38e4114eb7a4106f6601416842c913371695986b4cc94bba3e71669880f11fa2bd4e2da92b7b23c8170dc09ca2aa2bdbcdf0630a7eba3751af63b0e8400000007b77110214fe978eac0f7c3c357fd86f37fdd3588084bf208e2b425364b3fc5201dc69ae28969b41e550dcdc89f96dfaf12c4f236706fcc1dc4695ca9099c4b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422481240"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2928 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2928 iexplore.exe
2928 iexplore.exe
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE

pid	process
2928	iexplore.exe

pid	process
2928	iexplore.exe
2928	iexplore.exe
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2928 wrote to memory of 1316	2928	iexplore.exe	IEXPLORE.EXE
PID 2928 wrote to memory of 1316	2928	iexplore.exe	IEXPLORE.EXE
PID 2928 wrote to memory of 1316	2928	iexplore.exe	IEXPLORE.EXE
PID 2928 wrote to memory of 1316	2928	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64784884b3e5cde0904d1d3d0fc7b79a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66b55b80856933ddcf14019bf9107097

SHA1
6e3a3388f70f913cb9d06907f4313962be79420a

SHA256
4d617ad1f5caf4cebe821af5332ef49d66b21f45f0507625eaa3363a1dcb4bbb

SHA512
ce367dec2b7d1e795ac3cc4c34e6b1a8a9afdfa71f45f4c2cb6f0b1e54a7a98851277d02cdaea8131b8569a0495681326a84bd8f53b9ae2b919dea0a976b744a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c0f4d9bd4ab3f280f9aaeaa8d28ace9

SHA1
730a7c154d79e73052d8d98ea7a2ac9cf290a8ef

SHA256
c7102897a31f19807c1800e49dc50c13498acce2943a5e238f7641c144b8829c

SHA512
94c3e85e84cac2fc01140d827de2803fba044a1925c697f02ac40b7c1fa1443674fa4c959c0d011a4fa1377ec1cbd223a0986dfbf469dcf8c7f547d8ce850bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe5daf515c656d96c0b24b9d7e25a76c

SHA1
5efe670546b1c2295b666883472d1012747cadae

SHA256
d14a6b0310c147a5aab45769a32991ddee8cd01de780d9a883a53229e03ed444

SHA512
439d43061ee1ae834bfdb636c2d857677783c26ba6c256d5e9f14856820889d6e444b6e02de2996b3c8468362f772f165c31dea6278369e0c3672223526ed703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12890bf987044c6611cc8441abbd3918

SHA1
8445ec3bf78ee90b688b9f01a95d6667c64ae3ed

SHA256
766a276b1a1d2554348870967e837727e2181d330d167997b707289e944b90d4

SHA512
82fc172502dedcd689a426ac3cb004f95356743fa8a5938d76513d4b597bda782add7fe9eb825fcb61192767e80cda31757f1d9f71e68c69a0335a539e226c06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3172dd95f104fa4f9635c9908a2f94a

SHA1
5e79c9545351ae3cf30610018db5096f9e1e125f

SHA256
0c1cc07a5bf97578cafac99a43a95638e74ce187baae39bd7cb251b618f43a81

SHA512
398ae8547ca36272046870a284c80a21af6c4be0bbaaf64d55c9959db381aeefcb2a5bba1553169369ea7e7423e2f8b173f6121c1eb5594cb32fef01c93ac91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17aad5890a4741fe7511a3d97f0b2cbd

SHA1
949eeed58a95615534de9977f9cc9b191b6cb395

SHA256
20ff1a3e084635bdf1f877396ee5d991bc99815ea465d1d92be116743c5e91c6

SHA512
a869f44ff61bfd4b82b2abf196fc1938005f4cadfe34e57f6384e16e773e766afd7634f583bc7592eb456ca7c1c517bf3f2bc5039ebc24642a4d4b485f686db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d70d750c7614a89364a42cb1f8ffeef8

SHA1
e82f6b471cc63b65a3f36ee24c458dee296e6ded

SHA256
664bb2abb2675a614107351fdb89e08f1421a3f856705c9feda9132f9339eb3a

SHA512
e5a9915f5767b3f153a90c8de8529dd71e927f3d64ecb39e7ab0dabe67034c716fc707336a354cc922b6cecafd546789a08e45139e676dee1435be5807cc177a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80530d047c6286458f4739f3fda52edb

SHA1
ea5ab61fb692e0f63a20ecc520b03c85ced683a0

SHA256
bb7c12adf5fddc429c53c982bfdee6108d4bad86a0a3bec78456a6aef05525dc

SHA512
de108bfed0988872134316c3d3a539366a3e89087971f163f9946dda2ec6597313b48cf19bb9c9f27a2c2f31cfa651fb53cf681270fbd547dc437c3d6f2fdbaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05dc6b146606b538f64fbae85d4d62bf

SHA1
36049f6871b7afa329d665f5f1c07b52e211d0fe

SHA256
bdce75149d60a7bfa0c5e0cd73b5774f7868743208fd8a179592c4562a0a1ddb

SHA512
7064315e419f6643ab6e1b8cdf9cc6c16e30d47b33ad88638ed35dcc471a855dbab062311201b7f7d76aab1bd4ca9f941bca85d0977d36c820b96fb7699e0e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a523f4c8a157ed82ae0800ecb016775

SHA1
73379c07536b03ec4349e6a6fb89ba4a6036f3a0

SHA256
7e984c763c7b4ea42ff0bb9cf996c2798f3d33d957628dd26b869e709d5f1fa5

SHA512
39f1faa23330d208fa924e470247f2df906b5d99f61a4d7164513d4909b0edd49ee93c1b99a37ef26e7af4a72419ea8da55e44f5bc94f6a3e98621a8c2d95689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e6f0c5efd121b391475936540b78f3d

SHA1
9cfa079cc9b2180f41323c4178ba384db028da2a

SHA256
f3aaf87ca183f8bd61cb5e0c362c0174667f27d69de73b014b92ea82e94fae7e

SHA512
1f501c328303d9d1f7ef49b31b496712bc95154637157b106f3fb02c11f1b7d35cc903fff4415cefed43aae77c274e658374301865ca25adb1099d831f593d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13c545cef8b88f6e5d702802a8f3a33e

SHA1
868acbc25cc69f88839b3e09bb5b85982fba2789

SHA256
803e223f258fe049051d44640a7e88c98cb16658c65be1155dfaca17996b2bc3

SHA512
39ae6d7581df1ef17350786b89e7458e5abaee764d44778b71bcb4d21bdc3a1189ad165488377db331589ddf9a3576124cc6377a0c66a385a4095940f9cf758e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ea2c8574d7763f9406bbe690185eed3

SHA1
c04804c5640553b9dadabdb0fe50b88dee5daca0

SHA256
ee27bac5c301999acf3daebc660140169619ff8160c5b6e5c755a0c97aa61550

SHA512
97af51793c47172c69d40e6eb304a419ad82c0f70caf3bc306f99a1dc2f6c538954ba31fd0a7fd67091bd1fb6413308a05c784edb18029e2852f9346ca3ff592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad1d7dd2a6db5b5bc7f4c13260c928cd

SHA1
9937f3fff45eaafa25c9fb5fe0eb867c262abb00

SHA256
c39bd3f1c9ce570bfea70bb9eaff573c8acc704a179e89b3a480a795a6460905

SHA512
65cf1fcef6c350ea766a305e5cc8922bdefb3663c6a75500afdd8e2bf860d09b54e07e7c93ec32eb0cb16a54d2f3dcc0d11e233d553eafab200a2c4d81378376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a042f844630160bf1e07f39159d1bc3

SHA1
22c03fa46c409654aca13cc33fe14c58fb955f8f

SHA256
eafc5446c45c07126c73d1fb33d19fe603e43ab88203b2d4ac84906d64284be2

SHA512
1c342e43f0d4707b4298f253458fd836010aa1449df5e31acc89c877dd00c33215308897ec47baaf67b43f3d78eb2a0ff6e121cc527b1f93a71e72738af978ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21d03ac7c8070bc162094043968e8c8a

SHA1
cdba134edd115fc77575f630aeb908c4771c8498

SHA256
81675c77a940f61f84803b969a91087246c98327be2ec3ed574dfaf5729cc94d

SHA512
1c7b66e98bdd1f20e56f556fa8ef00aff678be0afa86f01cf33f62d8821176f81425bc550c794955f41a8681d8ee3d8662fd1a152294386896449ae5632f5361

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab393A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39AC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit