d5716ce34b2fd215251e757c9f3200af2c9f8b693a4d9017bbc48aa35908f09a

Analysis

max time kernel
137s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67f346f9e08f1fcc7d9bd1a9e1981a68_JaffaCakes118.html
Size

36KB
MD5

67f346f9e08f1fcc7d9bd1a9e1981a68
SHA1

2da6f85ec9d011f1a4843dccfd2d0b9a202e17c2
SHA256

d5716ce34b2fd215251e757c9f3200af2c9f8b693a4d9017bbc48aa35908f09a
SHA512

2c1f2f60ece02e8c8f7be6a57d7b6dd3e13885b85018f0a0e9c27bb216563dc7941ad4220c4ec53fb81ef53fca1cdcb026420965640531859415fcd42eee1827
SSDEEP

768:hfmQXKJzd19RhS8OUkMUp9cXjlpMEHYKUqkA:obhd1LOUZUpuXjlp74Tqx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000045060ca412aca250d6d9cabc3f8438d3864e10a8d3015880e1aa0dcc112f6201000000000e800000000200002000000027726082efae9cc5d924720b013bf3edb99f4807b0f60d36759739fd818ea70f200000007d118cfde4dd29c724479753b8d1bccae93114f1bd2ba04ccef650144899d46b40000000935f6f71cd3d4436a6228f43e7cc92c2ecf3ce27e28f93e64fc1e2fd28517ebf8c8dacdf5f0c37d9211aa07f4f92bf899bf84c553922e06cb4922cc6519fa6f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0071390e69acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422558850"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002e3c087e07cfd9d177e864a5ddfa393f7dbe073cffc1abb017c5916c92bd0d51000000000e80000000020000200000004ee9708ef527f9380a34c0abcb9021946e13e3a5578f05ac9093235143c16ab99000000067b6c9fb2b54ed3f9d04e22a739431f79dc6ad3067d8f4e06dab4507e2f61f96b0140d8644979e7fd54898e00d5541af38ced6c5b3a159330d7b937480f943c2e761dcc8633f6ddf90ca4591a13ac926ea7acd2e54b014dcbe6d924529e79b787e8d528e906c4fbb7d16700442be9a68907b336b1e83c6a48b9142c60d97ce6ed11d52ba0ef3dbdaa16a083eda9e4a7c400000004abe86258997f96d14cb9fbabb7ff803c18751a4e3803fd49f572d1a26f3f8537b9bfc2f9bcba9f80a8b1a69fc1376f013f15234e503d72b95a8c1708ac115c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3395BDA1-185C-11EF-AB95-422D877631E1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1600	iexplore.exe
1600	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1836	1600	iexplore.exe	28
PID 1600 wrote to memory of 1836	1600	iexplore.exe	28
PID 1600 wrote to memory of 1836	1600	iexplore.exe	28
PID 1600 wrote to memory of 1836	1600	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67f346f9e08f1fcc7d9bd1a9e1981a68_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9d3211cecec7a4371e2476682aa6b09d

SHA1
af293ffed8c3b8b2d5c84f0f05b499d96dd808c3

SHA256
3533f5a0d8ee5cdefd3be114ad9f3142493a64a358700d7f344b0bbed95df92c

SHA512
81ffe5184a11e03d68941fa0df4419cbaa44b1a50597c87e62d75dbb7a05ef64376c04c9425d061ebd820ed3a1024907467e2ba884c127fc393dc7b34ea6b680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31661b523a85d9e75ce429f715fb1e5e

SHA1
a37f35d8793502a036bf5745f1f82bb020cc125e

SHA256
0ae44c7ad3efa6ec8cd4b67ab6777b92d08e152324325d0d290e2f06a1cecf28

SHA512
dbd71eb046b229bb0c7feba4f0a8d5d999ac13966762b09f05d6a25e5587e3920f1ba651c674e8bc21b7f9b7a9583a8909c205b6a09efa9efd5581144958eefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab72934fd70645033b6da63f2eeea036

SHA1
b26654e00fb926dcea23ee2ccb11a712511a2270

SHA256
ead676d37bd56ad3010a657a2fa16d142a346336b73d4f7b24a60b060eb544d4

SHA512
a44bb0a4d572bb5f4b294ea1ec82827f0539368fd5a28d7a7fc6c9281a1e27f843e0dd457288c448e60c274fdc3e625af32d784d610f9a85b01147981949f3af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a96a99342d5b76f25c5d1277827184fb

SHA1
1a31753343f4c053b6c42455c07f82ba203b3508

SHA256
1de59f4bb5018c93c493a37078b2714a726e651bb02c5ec357340fdf0607ebf1

SHA512
da3a46dc5c2c11bf61fe1c6c9f2d4a26bc16fb7b06651de33a3b039911e14aa28e02e597a4a1b9fd5bc8e6624554895d4ac51c58be4f938f7903a063574997a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
360b4d0401dab094de473ada88a6d063

SHA1
69dafe8d6982c17a8da1707adec0c2782c8b1cc0

SHA256
24ea7c06327652862c69c5f162e2668c9cb627fe7ed8b3f4ef5381d413077265

SHA512
30b854dd54d3cc12ab75d683e23226eac967377bfcef73ac8c7e6bad97647fe01bb1079f8b270dca957436c0ad2a0b92da07980b32304e00d8f28ee2bf9b2fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a908e5a28f05a556857b3f091cf5da0d

SHA1
5da68d75d9e677f44de14ae3129968982e07edf1

SHA256
84186efd77ecd3f5100b6c96020ba0959ee9df5398e1da8226c91e06d087ac44

SHA512
21d41b76990ae561f802e657ae639b0723eaaa855890d5976d326ce7ed2b3617bcb731ddea2a4b3267914b95deb1021c1c5e687d00e87926eaa4dd1e8a149ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c849e7a6ba1fb6bc24c4d84e0ffbcd9

SHA1
4837ea4507530c976689126c875022e34867531a

SHA256
612715bb3ffa8270fedf879572e58cdb389799ba38de3aafb4a733e2b38eb494

SHA512
822476ca72d06a5aa9a9c1efd4ea301a1c0df5e1d5a4cccc066c7093056454d6c58950526463aa7af4f313abcae2051f8d354e55fc95fa0e7f366c2556be47db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1539c01dac32597f5531adbe278acc

SHA1
4ebf40839668732cce626aa64b7484e1449321b7

SHA256
355824dac09594dd9a5f39d211cfaf37a79595032e8cbeb967971086acbde553

SHA512
7428ea2b80527365dd0a70eee772d6718b764827ce3ac9f3b5f623a34f77d9e3e9545365f3ed0e0c6ef85dd56123b61fb1da035575cfa31966a9dc638c2a6baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0094afb2526f1b9bef93fe58528cac04

SHA1
e2455a8ff5c0603f23bc6a6b88a7091b98a425de

SHA256
8febbe8848f149be228edc251374418c7f5e6d358030c62bc56b81cdcb81f3d4

SHA512
1650cde365eed4b2d51bea092a228027093f19355636f45fb6b75c3ab34decb53990801d42066a6f661afad2ae758ccb85bf9bfaaddfdb2354bf42ad46643c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10d41db8a0a6e6de1a70637bcf66b70

SHA1
86e8b1d7a710632920780490d84ea2acf4a60fb4

SHA256
19c53e2f87a5029b5d20d11667b14cb2512332304137169eff9661f6e74a48dc

SHA512
6c5ff97e7a069e954bea74a14e7d974831c2f695dd54f6907430758740cef29f4e93b4d52119b61dc9a8d79c8a0a862b64ce090abba5ca0fdd538ee3bcd8df29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a710fb57ddb86d3276ffcd4ad2b1a942

SHA1
8b2eb736b664b187fff600577daee49a82929b7e

SHA256
df96254427e75bbc6f3490f49f824797c7c897dff1b9b3a83cf78e3cb82831de

SHA512
a48682b8ac931d69aefd2262abb4ce9e7429dd0e1f71d2da9e31da2548ed8329e45fe924e0a6fa1da44769f42d63639b056436e04ecf9c24692fae554b0c37ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7536703994213f357686df4c9c7e9d6e

SHA1
2725134ad69b14f359b115b704e2c75f586b46ea

SHA256
d25ab2030393311cb8aef4fef6e01e09f9554223f0621105659011eb9d7cae09

SHA512
7e1f4ed02a8bdb0d524eb3111cbabe8ed9f28406d2e3b597536a8ec91ab0a48913d91f8e8cac6157e40d17dc904192f9d2eb07c15d6db77fdc947ef086a6743d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
774f443a4d34ec07b0c58c013a275ab6

SHA1
ffe2d7b684255fe693386b829b5e656fd08f1688

SHA256
f0ea7bb1a2c46cbf8352f2068bc9b20dafb6798301d2db31a4fc6cd5ac65b693

SHA512
8303683d9728b4b6ac1e132fa636de649a4ba8ec41dad04e205cce0064bd8274a5fb5853a9727a40b83bc02584895ef31f6dd270deef39743d7f89256c4169f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8181d29a9f214ed3bbc6abee8ff63295

SHA1
163aba8e12d45d90f6a83931c8e45112c3b46b82

SHA256
30cc9cbe881ab9a290d0daea70751bbb89d9694601b88e99ba10b939309989fc

SHA512
b88c8ce564ea9543253b301f92db1557f93bce18732499400ec82873d65a3a1c23264bcc1d59181d5174ea353ef4f052b02e036d64b645a58b2e7c81e8cd8884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
849dfcb0a1343ecc73c43668fd100ce5

SHA1
8e871a468b468094319c1a6cfea7bb4e2ac9b2ca

SHA256
676affa8b540aad92d5e8ee7c50389799716540a56c1637dc0cbb1ebe73de2d1

SHA512
ba159d8b1c0d00ad75cc49b32b2a78e43d8b9ae86285917c7850d68f5d00f280424acb041858688d51e524aa8372fe3b1ad4e2f065187f6a1596bd05202a5d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5277.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5278.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit