771bbd32832ff72ebde00a15ba2cb1b02824b355bde6afc1b09545e203378c99

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

66f64fc9b5f4807516f09ccfeb98b82f_JaffaCakes118.html
Size

460KB
MD5

66f64fc9b5f4807516f09ccfeb98b82f
SHA1

fba444ffb7361f8301420a2f9acf76917f1ad60f
SHA256

771bbd32832ff72ebde00a15ba2cb1b02824b355bde6afc1b09545e203378c99
SHA512

85a99935b718af704d31d93dff657a636442f0bedd228590e1682d07b6f279ff2d74103230896523c0eaba6ae944a87c9f91329791ec0f30a5774c1f34a78b56
SSDEEP

6144:SbsMYod+X3oI+YisMYod+X3oI+YTsMYod+X3oI+YLsMYod+X3oI+YQ:Q5d+X3O5d+X3R5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000575880fd2d6e445b5fa2a007b87436f000000000200000000001066000000010000200000005f422efbb2bfcd915b49861bca2a37aae9f79b23629fea1ff37900b632b2a5c1000000000e80000000020000200000002fe36c1cb3223319bdbb2f5976021af20e43cc623e02cb550334b29abc3afb1d200000004b3832f74995de4c38092d5e4c773c983916987e1affadfb7d5239386971803840000000d19ecb219bfb61581f7601bb6268da472578bc64aa388143de4f4ff04de0523a62c004ab2d293e7608e3dd5518b3e15718779417d68cbcb48844af35391f211f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600726b133acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422535927"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000575880fd2d6e445b5fa2a007b87436f0000000002000000000010660000000100002000000008a349353fd13143a08c32d00f7f142b5c10198a6f67967bc36eeed934420ddb000000000e800000000200002000000051b68ef40d52e98b17621f9ece4e438f66513853664cc5205697235f49fc585290000000b85f415a49716c7b84c02fe904da27779090d6437fdf9c6df32deb2c2c392b1527ead071fdbc1a3baee68bfa9cc377ce235273d8557c7c695bd806e8e53641511685b862467d18a2556534f7d4b47e18f8a8c77d0ba568188c477d479d6dee0d6eed7f216f59ba26946c65f312ee928daf7d231adf4d4c94fbcf156844506b31a2426acb7143178864bb2509fbb9f0714000000063781476b3f37ec73c927f2c33f62d1e9a6179f74dcbfbd93a784efcfd0d5ab161bab0163bf0016af265dca760d1ac76e649673c5217d27d3ecad8957a37e97e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D898F731-1826-11EF-8A74-66F723737CE2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2988	2372	iexplore.exe	28
PID 2372 wrote to memory of 2988	2372	iexplore.exe	28
PID 2372 wrote to memory of 2988	2372	iexplore.exe	28
PID 2372 wrote to memory of 2988	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66f64fc9b5f4807516f09ccfeb98b82f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d251c92e7382a05dfc9805c48890e923

SHA1
526f28d5d538c2580186d0fd91910e2d713bbf0a

SHA256
6033a243a47486436904922a04b42122410f5e0ff7bf4144c2202ddc0c8c48df

SHA512
e4d1faf15537f875afaa6258ea6acafd19e8bc69a36bfa14842bcd68555ef2a133cbf0a8c88eceb613d4dbfed7fd7b165c70620fff6b015d70aac604cae5bde4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce13839995c01c8ee007cbb0e99fe217

SHA1
2b93ca33e721f97995b996049458aa9f26625514

SHA256
0a82ad6add457224b89875ff5feffe877c4bef0c527e854c5c90edca6e74fb9e

SHA512
7f1257e6bbfcd1c80c44f717ad29a41bb16080dcf3d6bda40f227ac84f1f5b7c83024a7306bdbd2c94d1dfce1a0c4356dea3ef32065ab756c5039d91026ce9dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d2b2a788cb65721d2526622a5233234

SHA1
19a961c74ab2d129cae45b7819f9190612c2dcff

SHA256
5554fa5ee8193903f1de2689c86145ae9a9ca0b94daffd4449696e04d5bea25b

SHA512
ee75863d961399f048a8cc78bfc571f61248e827c03c1e29dbbb0ea6937f2cbea4071394751b860721b5be1f4f5a91129cacd4b5eb0a06371a66def126b72ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c97ee4e927bded1978ea149d031db4d6

SHA1
cbef5e2a6f2754d959fce78a0252561aaab5579d

SHA256
440ad487f08280920c3379e1de6eb025c00af6fb63bd8a5b70d36c63a487dca4

SHA512
4ae6025edd54c7ec9796c59334ceefe82abf57c76748b1df7e2cbf6ee9699613e205a00832509a408cd71c214bd9eb58c5d2bd3e6f58a044348c388f632f22a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d59396d9e35190e4d497ef5be647d004

SHA1
60e777afac4ff1082bd73e182a771f0e4a292ba7

SHA256
66755120f20b437f74a36ce6517b3b09d32f423bc2798855b620616c2e282e8b

SHA512
d641573939101ca70e6e50e05454b8a6811897a7c15edbf4829615dd529f6c8cec256e3265a860ba41b7950d7af5b307bc3d038825a3462c6cb91b9c3b68822f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3e1974c8493fc004eb5613b54cb6c97

SHA1
b6b814eb3d7989d9145345dbf5355241f366188c

SHA256
17049cab4bc56b19f6058b3ee87978ef30d1325dbafb99b915cb829e470c83cc

SHA512
41cd5bc8a12641bf4afbc2f9d7210f3954a5422e2966e2406b2801e668d89df39448c3a9fb8edefcb0d04ea8105cebc98a151a14d29465bd4a4267e9895b5a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a4111a87ba701b27962f4b55a2b665

SHA1
15316ae74f2e0944dec5e907d4aae58aa2ea46ca

SHA256
a915313a69af4220ecf1e3b942d6db5cd7b7396d5dbd6ddf0b884a8b1fa2f204

SHA512
ef31187d415ebfe58434b2d4bb314d09a6c30271c9992ad676ace184877691a21d1828e52e5d15969dc07f40e879fd4a82c8e9deb8d62b7857212e51df1e79cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66367e4754380f0352696e5fc8788e33

SHA1
0532d66ba0a87eb5effb68c4c6a8b288ed5e8a61

SHA256
039b1d84cc68e66ee590369f64b21b488463c7e028010b369374ce79837d3e92

SHA512
f0e597f9c53752df10d62cbead0e0d938157147681653d014a27c40963363d807f9ce8b2456d9904f653faae79e357fc84fb2ec8cfeee765664e692e84541eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b45c748e34cca64778faed65d8c2e6b

SHA1
ce9d63cc93258199a428485f1f9d76f56186a66e

SHA256
47335c839f5f73bb5717b2dcd286ee2d62275c7487ec1bde5c4f057a4fa2581f

SHA512
a7886286e22e26b0794a1b2c07283e7af4607f627a73d21fb9569e1d848a86b11968ee5aeb7fe0d56ad4f645566b3e33d9c5b358f0d8c48fa31cd256d4044ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64c71cf0d88fb01159ed612171f693a8

SHA1
8b643a17a4fb067acff43fc5e10946a5a5b76205

SHA256
0d59d138e768718a3356a5ca75c7d1a8972ffe755b920c87a2fe57213c9bd23a

SHA512
6a7a3c4b161b4119d1ac0bb9aa518ba82d0f5a8babe01d2c858e742d72162f130b2a1703c2bd4ece0265f9984b7da514aaf5a7525983629388ed12dccc8aa576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c70e5dc0681776127063cef4c9826c6b

SHA1
47a21fd8de957f8af45caf3fe23f9b58c5ce3ae2

SHA256
06440ca4d9454f6af0ec3f7d8dc61aad55ca5f40f1280a09615cabc7bf1ca99b

SHA512
e40476b20a7aec80409efe9ba1aa035e8760127f687b2110c85aef72dc8fca8315342a3bbe4bab582e6c6c14257a3f326cecbbf6591448a6fbe8a260804e81b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6cafd96b81a07a0d05574809402871fc

SHA1
5e57c25752453a648cd531bd6334eb77b005feaf

SHA256
9ad9c8c7bd69596c52423d9d1cf2bb90940ccf0b6523186e11f6099ac93a0c4e

SHA512
6d34379981659adb0b616168101cbdd00e482a182be18369c48f76c2a3acb19ab3dd9517a7258b82c0fdb21fdbc1b029ece8e143cc4e1ea11f20e4e7da6dedc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3440.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit