5d26324111a59b378bc13ba13afb6b6e50ab98afe634b3841b9ac2330fad5644

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

676e0764d8290b0f6cf6d2eb698b8e64_JaffaCakes118.html
Size

139KB
MD5

676e0764d8290b0f6cf6d2eb698b8e64
SHA1

acb1db680aada0d51ab4ab3d913055bce4d982da
SHA256

5d26324111a59b378bc13ba13afb6b6e50ab98afe634b3841b9ac2330fad5644
SHA512

53450e97421de4a29e3daa02f823e0c034d575febe4b065d272b9cfb9624763748713f3b2712763b1198c85ab6d131ae9f5214fb24f749f79534ce9ac706a874
SSDEEP

1536:S7Tp+vTla/PMVfyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:S7omMyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422546660"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801c6aec4cacda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5F59B01-183F-11EF-81DB-4E87F544447C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000335ba58247bb3697787ae8e47b7dc2177f49ba65da9ab965e2289b8f70ac24c9000000000e80000000020000200000002aafddf0d5a81e837cf6087a523e1f2df2777c0285e1042f66caa85e8ee67b4620000000f028f41b8152746d05e1b2a5158da71810d1ddc7313bdce85315f13aefe6776340000000bf3b20d00f11af35d83283fb59456b794979fbc1dae09bf7263288b0b2775626fe93bb9a002690a071f30b914a94fabe0d015431c7eebd5ac0f71084a99a26ed	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000bcc16fa32aad2a16b17017412f6fbdbd26f7f6506fcbd0be5d7a1e69952e5df9000000000e8000000002000020000000b6d9bcbc419f693038b30a04587165e7704c10e79828e8e3ca582802bb8c8d6090000000fcc6e8a43e723a69c2085270e43abdb150d945063b904f19c39f5305fd2258d2125cee57e59a84275b7c17f1abfff6b34762a2b0981e72c44721ac3869ecd9a9a8b500e0d2b0cb65c0bee0bec1b7df1c22d67f09f3fac9f09b922ca4b6bd60c1199b56f80edd0f7db04cb60065508783209eab73f32e2c96742a1a14df5d182a7b1d1544762fd454a94bba0f2e2c7a6a40000000b20ddfd43944b47c80c883a41a53ebe27cfed2846d30de5236b6172ce25030e2dbcd54dad3a35b18d35e67a16e6892e6c7f295b6102329a8ac8f655707e67d20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3060	2188	iexplore.exe	28
PID 2188 wrote to memory of 3060	2188	iexplore.exe	28
PID 2188 wrote to memory of 3060	2188	iexplore.exe	28
PID 2188 wrote to memory of 3060	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\676e0764d8290b0f6cf6d2eb698b8e64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d305bc310d4fb16452aab8a65bfc80c

SHA1
9100339f53f2975580fe195af5f6c6d2a4e11ad8

SHA256
d2a0f54f47c1f71b94b231c1e00be2884a92768425ba9554fd59c24b1b6d19a9

SHA512
52d60ea9cb17d02823193e5f2ed12143dfc85b4e6061b0ca17c4c3b5c113255c2f0c58b5d2976448d461b23b3abfcad0dabeb3c6ef5c6dc629288813d2afbd40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04d3829ad229d09c2f77a1e8f4b71d10

SHA1
17f0aa4fee77ddf500ef45ba11763c03dcc41b80

SHA256
9ac68a67efa26dec381c65ac9408831fcfde7e4097ef2f2378732ba1d34ebdb7

SHA512
206fa4e21bd789780331bbe39aa8253cd5f5853456b9073dc2180c353e3c1f972ee165736e1f6ffc7440651b72a932aded613ea4f93de13a1e15545a6efa787e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3482181efe1b149a40ab07734603445a

SHA1
50806b40958223598c03c867189567243a9f3726

SHA256
230ead8d6fdf192b60879a12ba1c2a47d0c2314c7f525af6494768b7dfa180df

SHA512
5898d2c57b83c66dd2314c4bef742e438e766e9ad55280ed4c0b60e65c330bfe2d5d8a5036230ac486899d6d55e240bfda79452605486cbbef286cef9f953a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
385a2bff11dc659875801a74a294137f

SHA1
3a89b55425c7be7bb5dfcd2adb07b5349714dad5

SHA256
0e11f1e695ef89be1dc5871c2c0c1473472a748572e9a770c52a859734d1fe07

SHA512
0300764a64fef5c3caea4401025fcdb6dcf2d56735aac093dae21f772721b8211efc7cfeafa0127957b8f519dcfaea175248cec1b693d9156031072e9346246a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a596864f2e89f586cb7f84c5959c487

SHA1
639f0715bbf9093425105eacabc02dda05812c29

SHA256
ab288bf9f05c8a9301aa5a5c613729d1c58141c494458f2756452f69bad17111

SHA512
093a4b75c8948d3b2e504a8784a923763b4acaac4c2cd3f0caaf0bd3c3f9572ecef729653262ab6e2edf4189b31ad0d3e9ba28829f623265f7566254705ea176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1d4c2cecb1378f0f9e2ac63fdedd281

SHA1
1104097249261719ccbd47f8712c2e331d049403

SHA256
5377fd1b7b4cdda875c224c3a7def0fabd5f831967e6b9ef0e211c20bbf542ef

SHA512
d0d0e23da2dabcc5b59fd9ecfea7adec448170268920b97b0b1adee3065704dee853f21289cb02865289bb8ed421fc7ad2243a51db7cefffb62db3b45b40ef2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5c796b1b6cfe1fe1c148126982a7f58

SHA1
5ac01d385a2cbc32141b2107c8bc0938796a26df

SHA256
69e1346edab8a47ada77fc8479496d239996979955ee984b65b9d722ce5ef5cb

SHA512
75aadf60ac229411387079150b10e5d54fae5240f1a9c838a4d461f39207bed0ee80494b1e0a25f82a71045fd07b934110fbebe438f98a739d0150604402026c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c74e909849db3ff8a0b09bbc0205fce6

SHA1
856d1257bd4cd4631e4960d89d1a7e548b478f4d

SHA256
cbb3539212abffee85cbfe8b42a1a23dc1b26caf11c6e452032224677529b192

SHA512
883c4ff37463c84d883b9e14d2ca403b5fa587a744ed13d6301f730490200d22d4b6354c25da0d41ea780502ad0b5869b0c3ce2cb98299aa4655dcd922df20c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2daf84ae271cf32a6eb61ac02895e18e

SHA1
49919ca09d6d7a64b7b6d3655e2591e418804228

SHA256
6ffbe54b9d5b88b0225388edcf27d3c8e39d31fb7996dcce90aa299a60902ea8

SHA512
43eaecba177c9243acc34eed067209f764fb9e28ff8b9ea8718c1f312fd7e5d9f5d464058fb4aaf557b8beac5e7ed65b84371dc0ceb14787021c35efaf89cb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91c117f6c51052d2e45914e8a2ef365b

SHA1
1a5c58e8b207c8a514a30c88e7f6a9c7926f3d2b

SHA256
f96e2ffa7b451a2cca4722ac3a6dc87b758dce113e80cd61f3d3ffa68b367f2d

SHA512
e6e0e9a87844615f8fde575ef31e5b20ef16ca901536e79403db098a2a41c9b2bf530fd00f5bb3238b3c1fb338ffa186d5b997ab1bc388a22c53aa75ff1d34e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4feadbb5ebf575b92695532769187a11

SHA1
f092dd39522dd2a8ef4a1ef117673d253b00f43f

SHA256
70fe2cb04763dc466af7c44a17791dcc6ca98f6ce1a1bf73133efc76990ee69c

SHA512
318edfdfbefe03edf8980d88a5424bdad6a0933bebb48118367e798180dead7052a1417dad5ae88641514af0576db461a32ea0136f54e4eed0a997199f5f5a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19BA.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A3A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit