be699491df82e05266be1adbb56282d0eda1151308f122bb56f7b74f8c390bb5

Analysis

max time kernel
135s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

679be4a2ae9b2aa4cd60907caec56b9b_JaffaCakes118.html
Size

847KB
MD5

679be4a2ae9b2aa4cd60907caec56b9b
SHA1

e74e3fd1308d36472d4b11b4f5305348394f43cd
SHA256

be699491df82e05266be1adbb56282d0eda1151308f122bb56f7b74f8c390bb5
SHA512

cd4b81dc1662bf16333205b55f1cd925056cdbb6201dfc7e4f76d9f855bb45a34be6ba5c2eb628cd3efb12de33b5bddc5069e302cd662d97ab93c9084aab3ec8
SSDEEP

12288:z5d+X3N5d+X315d+X3/5d+X3l5d+X3Q65d+X315d+X3+:r+R+5+v+J+T+5+e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C0CC031-1849-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422550726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28
PID 2504 wrote to memory of 2904	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\679be4a2ae9b2aa4cd60907caec56b9b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
596d74b913d958f4a6ecc93c471521ed

SHA1
86e3053c5d493e279cac14f916b9d1545f69dc4b

SHA256
1ec0684f9406543d922f9098b98ae64e87fbb059f0ae8ece47e4f89591f95eb0

SHA512
fb9de4e4c697ea01eedaf50c9afc7dac59897568731af9bcd20dbf1f987c251ca53a8219c5218424f8253a00d29c4c85798acb594b635310b04d6b2e7bad3f0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5306cbbc8f4e8b0b816379d5dc5eef58

SHA1
7ec76e61f63248bf14a610916c9e1a8e2c40aaf4

SHA256
454483609af569df0067028ff464d03ab71a298a1a15a29132b5bff5d2e43248

SHA512
acbf8ace740209b2282afaf72a03fc09ebe819bec08c73eae878f097a4be71ab85be72a46beaeb54e7998c82eea13c9d908ec43b21073dfb9d3533649458e47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c1a65881dc99bdb9723fa3d69b730e

SHA1
2c6c5093a3752935285d84eb1ff0eac1d818e688

SHA256
8612116f4459cd57be8ff100a4e03e13579f9ea76b6055510cf15afb911fa392

SHA512
d43e7276ac2c51dc481fa380a0ef3ba6cd27b82cc22b2d1e956138d8c60c388fca26decae1f51ff6aa48c1628d71d4247bc306c3cf4df6255e4e251f7aa57532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1f807d4e31d36ecfc591d9ab6b3c932

SHA1
534ecc094a718efb414b143b6bf30447923d0f95

SHA256
74b482e270b61dd85a79812a3dced157a7b9066184913095aa7f95ad47e09481

SHA512
ce747b8c2caa0dcc6cf18b004665a550dffba8935e920207d6df3c54251c02e39df929c24a3cc85ab42626dd6e02f62711b1bb634999c1637a016e12ff43b4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a1ff94a411bae3a04656019bbf3ec0d

SHA1
d2ab8f508872962c1fb8925a76ab170d936529c2

SHA256
dcb36c26636b1c61764f3f177e2368167d64827ff8b6727e0e858748a4d3d6f9

SHA512
5219dabd712fa999ea1cd59dbc8eb2a3967152f2cbd6b80b35911317a27b58c15ce037f45335325c20693262d2a6bb30b5b39ded98e3364ae9b20dd3549a6b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ad10a7c191499c75075216940d85fab

SHA1
9b9654b45d00462f3b5d1b72535b908a8a0dd17f

SHA256
1765a1dc9a4b3f4dfd5849da61326d97dbeff4ab8ad91bdaa9cf7253e5830b48

SHA512
40a68bf4c80c1331584d43afe163d8e1f62f25abcd2317ecc46030ccdd0009184f50eefef8ccee54bbb2ed365b2f182efad9370310872034b5cd9aeab0d9a876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea5c8a678dba7c85287f0c36188b52b8

SHA1
b21ccf7cb87de377cf89d845a83f942505020047

SHA256
877522f4ac40fb1630771bf4a56d93f764a0e8866450130fddd65cd7b55b6aa5

SHA512
645563dd8542a51ba5e9361e3ad43d6cdecb261bb7144dba8d71ba9a58d904aac57d58111ba25fee1e593ebc5f552d366c9b950a8db1be803586d4940a04ccb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82dbd09391d32d4d0872e1d7ca217b92

SHA1
a205f2cdd5e3f956a7418d82015531083c56a544

SHA256
3aff22a4f7924ce4d24b9f7b8da43f047d8633ccbdc3b067b430044cd7a3bde4

SHA512
fcc0c7c32d5c582e82dc706e0d9111e04761976c39d9cc91bc04ce6cf6cb1b2304889598329d1582903a9b39e32400218a63ae09be0d923fef552626d6d36e88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3788b5a91590a0c0c1f8cc46994b8495

SHA1
301f6b8905d1688509473761b41c39f9bd324e54

SHA256
b9ebeae1719be127e398b5ee2bab3a60975a1895926a8b5a119de535c0f3904d

SHA512
fc2d57fd8352b4f706d15887116ef6f6a214ab622855b8979a423d3924ff96e3c37cf1937361b1121b486577dc2f0b38490773cffc2b7a324d50105c1149252b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec4165b3711785adacff70ea6b645516

SHA1
6a343f5534b673a31c60bd1582f0bf8feb986d6f

SHA256
ff4597ef3f7bdc9818ff8aff89738e92f255ff2ea01529b0836ffb689a8c6a8d

SHA512
3d0555355bdb03eb93a5ef03d08cada0b4fea3afc6f7902ac9b5a8354b28b8b4adfe8aca5397a8f6bacbbaff361216ec37e84508380bbe5b523037a34815d51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad4899d1822e19c20caad43f959d0b0b

SHA1
d92310f78046592e2c86ccf2d9d7aadff5fd8652

SHA256
e8841e5e2173abc2a0e5d8ec704a19ebba7f980e9515899d85655bb30ceb6c19

SHA512
8fc0eda1a0bf33d2ef6f170e3ed3438d65c6ebdc76b460d179803032eed4f056c18b377287ea4f48d9346ee0a352d87d4cb970f140b2675f77fd4c5945394459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fd146fa0655d85734d83ab1abf5e4f15

SHA1
6dc5a2e7fa285accbdb495ac2097e92ff7863985

SHA256
b31e5aa3e6b8811d85d0c0dd3bd281c744f6ca594efd7d618ae5a1431a438bc6

SHA512
94e5d49f72f7c8688f4d7d0053a0cf5a81ac81d29c3029221c72698e502ecbe6c19e857efecd19fbfab7e931ffe93ebd8ad786b66221f51763489414b04c486b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\kefuqq[1].htm

Filesize
1KB

MD5
87379d193e0f0cc5c380885bd81f7fc1

SHA1
d8f020c131453361eaffdb60d61a5352aeaca971

SHA256
627faf6cb0b14b51cea8661efc4803cfe08428b1cc9aec86ea6d07ec07606412

SHA512
6718db7f245bf0271671b6eafb08c6c4ec24143318076c73f683fbf344ea40b3d90627a9d7ba226842aff3143b272d1177b3e3ecb4d4342ccdfcbe865e786c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B36.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B38.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D23.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit