8add0d94d8987bb06bdf5f1411f4397ab5acbd8fb9ea8b5db2be524eff39bb0b

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

673224442256aa5f9e36ddab1e858f8e_JaffaCakes118.html
Size

23KB
MD5

673224442256aa5f9e36ddab1e858f8e
SHA1

ec3c2b6ed1fd1625dfe22489c4b94d8d5e07ed60
SHA256

8add0d94d8987bb06bdf5f1411f4397ab5acbd8fb9ea8b5db2be524eff39bb0b
SHA512

5da8e25a27259da22adbbd665638ce49cedf8544da4b2552709c07882e479bf2d1cccf462b943782454e7cf8750bea813338afbb2d3c1fcb5fcabbcaf66ed29a
SSDEEP

192:uWvAb5nS+nQjxn5Q/ZnQiekNnSnQOkEntPHnQTbnhnQWCnQt2wMBEqnYnQ7tnGYd:HQ/wmO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05517D41-1833-11EF-8AAC-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f89c1b3a8de49c4ba4d962ed94080f1e000000000200000000001066000000010000200000003014cbe05f06e29a849ad463b34d8d520710cb3d7d9402e395eddaf0312f8dfa000000000e80000000020000200000009691dd72333fdad0b712191522e6b5751cdf295f395797974a1bc3b266f526919000000060eb6b1149aa00178efe1a546a4be685b0c877e14b4a1ef8d1a36bc8eef0348e5fe743f6a74cab915b1251073393ffff64e04e0dfba15785ced4f6073b78ba7f200749970494951f54281740a6ef97c9a39e77a111d8fc62b1eea33ff5a9d8857bbbd319bf9ea1608752fcfec67f14b5ddd53dc3430df17f85e0f3d16e899094899be4ea483838a9bdca52267fad227440000000b3c788d267a2edfcc901cf483061ee1daed2b835bfb942e5ce5c19a9199db2e7c0c9e636f379664ce6e712fe676d3a79171869713fb9a45570a18d056e0b69d1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422541157"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600007da3facda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f89c1b3a8de49c4ba4d962ed94080f1e0000000002000000000010660000000100002000000071de2e32eb46aee6f3d22ea7e49c6802a39bcd61dd67be3869926df26f4253c5000000000e8000000002000020000000b8c16f537919f684123cca9aa1038d72385b2b757eed44ce823434059b114add20000000253a420af41a96dbf0ad27635c10430094716c75d4450d4ac30f68f073021853400000002dab1834391c922609814c97c18e3b2d566451440228b758fe04a5700d5180676f6e11e54936332176829b22fa79c7ca109f79a25ede46b5309817467f95269c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2736	2848	iexplore.exe	28
PID 2848 wrote to memory of 2736	2848	iexplore.exe	28
PID 2848 wrote to memory of 2736	2848	iexplore.exe	28
PID 2848 wrote to memory of 2736	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\673224442256aa5f9e36ddab1e858f8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60282a8d4bae147b06a55e7615c71f61

SHA1
c4b89e2206477a2daac664ea67fc32e488ecbc26

SHA256
054baa88a73699a1762f22de7814545e83a9a5a4a09dd6b1affc065370395ab8

SHA512
a89fdb5845ef6fc0324058a9714d9f9c4566d4f810c3e27a850972a01b10ec6134a55ad79499c4b18a839807e80d6da7e421e1e872abdf064e13c72fa6614925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfa887f2934c1388d6aaf996908d64b5

SHA1
9d3dbc2836bc58d9a4dd848a3d503d7acb254250

SHA256
63f1625b339443c8805f237fc1f4c6e5624a2f36506e87bd99907692395cc28f

SHA512
8bb68fa3276213764441f31cbc199df403d1a8f4fd886ff891732e5c2711883bf788d8253bf78f96f477c0e0b9087d26d3d5f83cd7c8f79fe82df7fa7b40e6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8440d28ad32f45ecc0add95a0fef9aee

SHA1
60aa81d6b9ccf8d8808acc4e35aa52805b8b915a

SHA256
cf8dcc68a5956b4fcfb7e201a57c26ad9ee28ee3ef6e8f4117c076d7ca1d3476

SHA512
29f8b93b83a83bf9d2b00a525395debff4b3aa78ee425f769cd01dd3ce6fa39aa752f6ec9b255f52d3c8f160610593601f79825202ce7336cea1b7e16b3003f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ec79be5b967ab934aa0f348ea934010

SHA1
70d120b8cd158d67c39fbd47298c48d471c19cca

SHA256
df46e7d65a7b0745f9c5018502e0e0bd759851b0106d2b461ce92ee458e3c27f

SHA512
9b6abf80540c198b85da69ef5f27730407fe08756bca21742ca40cb4d8e336ba6acbb15d35536c693e24f862e254bc3e0c242113755a73c6ced587f8ff5a7485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e0ff05d846f4726d003fc65a579073

SHA1
158d5e9f16f93d4e99bd338379109f55633975dc

SHA256
70e93b79a85f38247e5001617ec191f7a78587c7c9bf324e46d4a47c8e4bb9f1

SHA512
ccff356c6f19a79dadb52eb2f296d63898bbf5961d9447de421d500fb5f93dcadd3e5b6f62e183887975571140eadb1f43353bff3febbac9d7a999623ebf52b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
078fed529a8c30d84172ca3477e5b157

SHA1
f1ebeaac09173f8f710114d9bf9c478eae97246b

SHA256
a12a53c629bb1ffcaf4f88be029c60a9b146fe50db68bc0b933930668c58556d

SHA512
c45559ed8835c8ae3d47693afec7de7a3145a1f649e0bae89827115dec8afeff212ac8d6da74148c829c2fa74749213142096d7b4fd3fcbc0d4a0b55a85e344d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b71bef39f0e77a71465a3eb5494c967

SHA1
23fbe368d0640f66a37a6973489c2dc9575b6690

SHA256
0421525c05d3105d01b0927770c9af0bd3ce053e469397f6220cf9d98997ab20

SHA512
034f91ce4a6fe765eda122c58582105b035e1ac15bf820eecc6653704f5d0ec34d160e1af190acc58341d0f3feedb3864ddd7f720f4228bbca49dd60b7da988e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ad7f00eea54e9cd06c41d6f2eb1e7da

SHA1
c1fcaaa2c442b4c99a131f6ec58576f9d7410e50

SHA256
16719bbad8e845f9efb324df7022910580a33db155a67872ebadf194332106d7

SHA512
cc271d8d72346bf31234e1195890267883fb5c26104c19c74e20a7dfa7fc9d7cc8696249d2e96217e80261c2f65aecd0326c4eed4cb0bbc1d0910a6b30b7d791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1379740849f354aa87395dc2734aebc7

SHA1
60e1ecc284bb06b79132e72331e67054f3ef4c08

SHA256
af0996dea60d279253dfc9deea8e57b9bee316a5ae3a5692a2cae665a81a9ed5

SHA512
f8937ac67dc78e45bc0b60757c608106d8c10adda4799fec6ef5d92603761c0ec3d1ae5487e5d521ad9f3f97d79afefea91bde22c03f7cd94d5a5f9922802b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e166fddded350c9eef4f1f4fca82b8de

SHA1
2ff17da6988fac0a785c4fc8b7c40b42cbe06e4c

SHA256
28aad647e7fe3411cbdbc10e2492b0e5f28d8f526c0c386981a5d4b5b1af2f3a

SHA512
7f1caa5cca00c40eac057495a5dffacec141563c7ffb4d098addc6e8e4e1bde5ceaf25abec035aaca8d31a787df9950960f1afef83551d425b4ce30d25613d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3d49f18c43d439026e6858497e63c36

SHA1
2a2c11a4c8a603c05ec7f384fe712371ead635d4

SHA256
73b9c566f14d755f21137170aa7524ecd3f95464e9efdcc0c02a9fa1082e0d3b

SHA512
d316d0906fb649ea18c93543986c9b8dd2d21fe52c091db9e94f044d05c670accf7d19ba6b06d5a0d87eba8931aaf30659646c6f351d4bf68d890038b1d1b33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ad1e57e806318129adc8f7632168b5

SHA1
5960043d3a6f2b340fe621627ab191955daae3ef

SHA256
8716ef3ac6f979c914020fcc1f19c9a757895c0d61f6e668ca45cab66d10ee81

SHA512
ee1d664ed44b059e95adc8d5f5da82e9fb43efe472eaee469e4b17f1170e6ecd2277f72860daa6a1a1d9500a14b56889e79ffb9e03f65d7765ecc9f2811725c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ce10236621ca06fdbf753e6b35d6f1

SHA1
f7e5175ebb69186b5fc4d83fdb03c09d8f4ce7f4

SHA256
4e99e5b0578fcfadf074258c4800e08f774ffd376838149c805024a57fd7f126

SHA512
c24c891fc68a8ee352117abd5542d33ee68bdf1931bc8c3ab812334cc2d8df78dd3a920abcadd52e8c50913b1ba296aa7c07a26a78069e0622d39a0756c455de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55d6de337f99b9c16b56ec4b27368500

SHA1
a98a74a62dfce6d962094f903bb5f423d876bc6e

SHA256
9ff0bcd0910e8cec7053f8d8995f2cd0da30e1675b14a1c4b726dcd95efa8323

SHA512
6b55b44e6da2f4cb489e3d6347ac9592fa367aa15b744d10a156f10f660cfe508252bfcb68a53d7b218752ff4fa9bbbbdf5a4c8802878a4bc165094bd7a92d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FAB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30AC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit