c631447d7594b1249034259a81c5724b635dbe09b42413630936abe76ccc7ece

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69e91b79a48d3f47f2eaa8863d86d15b_JaffaCakes118.html
Size

4KB
MD5

69e91b79a48d3f47f2eaa8863d86d15b
SHA1

6f821b8c4b7f390f907d4807cde997bb085cd2f8
SHA256

c631447d7594b1249034259a81c5724b635dbe09b42413630936abe76ccc7ece
SHA512

f89a68712fe8b990f9c7d3c389b2a7403c5d95b143c1548f8f8e463042a807713a43d2a1aefc5869b788825f999c5dc819e28540595f182ac8966524df452954
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oKG7R4d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000c03cb69d38c05dac275b9e4672a49efaee848bad912d0a6a313658c45d172087000000000e80000000020000200000008857d84df1e1ad4d2f0a2790beb7e39bfd9a85299ca66f40d1c89de923a85b599000000087059c7498fe01a034f2de86cfb9d600697905855070d3548b333af5d5020074fe2932153767481e46aeb2e48a99d2a31a2c38fad122c13194f92d4a6ebe56ac8f43455fc5e03ffd3bbf9f95c12598e6a8b4e4387bce6756e7b797dc3e0171b386122a289005b86efbb260a61b992477e81ef0967dce2e5e71eb1f85f5ec157d6b8bc13b6b897df9fe2bdef0e03ffa3740000000218d640b4d9771245873a7e701d4106c45e125378165b84ce5faedded67bb59bc3dbdec1b286ab6f3bd7786063932a6035db2ef442051c14c1614a794e351a09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F57FD711-18C6-11EF-8DB2-F2F7F00EEB0D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422604694"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000476805a1061f44c31bbf7b47d9f7f46f2586d2dd1616c8a500cb5f7a3605384f000000000e8000000002000020000000e5966aa710edbff3954886127388606d5197926669f32953588a1fdbab9e5721200000005bc9fc5cc2102625e6b07b88a1df503bf1e28b6f4735906e6a36b1ef0fa2dbe7400000001fb76d8588ac83a5191d9736ca6bd63d524b7f6ce1e593dcc451912da240cb0f48ff7a08143cb93b8a4084415d1b4d8f79de8db875456fb324a6308ddbd9f0c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107f0dcad3acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2100	2424	iexplore.exe	28
PID 2424 wrote to memory of 2100	2424	iexplore.exe	28
PID 2424 wrote to memory of 2100	2424	iexplore.exe	28
PID 2424 wrote to memory of 2100	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69e91b79a48d3f47f2eaa8863d86d15b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
044ec1722a49dcbe3ae256aa45d4fd4f

SHA1
b8611630f47361b1decbd139770876e8e1cc82ba

SHA256
ad330f2b4c4b18cc40f7aea3eb0ca9e470fb031774c77df4d1b89136d88f8509

SHA512
b6100ba105798e166f3e78fc3bded3974b549b0f990bffbcc3bfb55aebdecda860529e9368ba6a05f4401c1b8267fbd7b3b54e9be6ceefa4bddf9acb42c3049c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ce37590ebd039ed42473461411956c

SHA1
f781d987b303639021277082045f4db78d11d077

SHA256
e7d9be447b1da5b4159aa4f20aacfb1baaac861bf6c1effdfb21962772ed3faf

SHA512
7bd59da90c33ad0e3cd98ffbe710c88cbdcda37b89252b8672981b6a941e0908a45968e93cd0322f0d03d461f8f87a7dc1cd587f5873c1803696932b7adac528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
649ac67ec3cb68bb0fe7577ccef707ae

SHA1
d4f90ce1ee91570548a7d31dd4678fa01ce26940

SHA256
1bdb4a14daef825e62811721493806e353d9ea8a70ebda9e1b7f812917e92946

SHA512
32377c3ed8b983a9168dff50bbbd323f1a55384b3cd55b22e56b9ddc01a3061a56dd0fd49c703a98d463450aefd33f63aa7dc44c68fe59792666559625f941bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a59bf94d05b575aee41c96ff46d6d57

SHA1
4bade09607cb32c1e201dc0ba4e2ceb8815a3044

SHA256
b1cf06e388d6d39633f3cce9fd363373073f22704b47c6a1c0dda36d67c951e1

SHA512
ce6ab06287b8e6face337bc3f5015fa843b954258b9e78cfbae5dc2185d138078488d452deb0bd3fdcc352de8cd292747af79de1a15cb095e1666c3a2e1ee1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73658b71f8f1f80013a0d7a859b0fc86

SHA1
8958a5bd9ad18e1065b6d8e17e8e7a928a6c4a9f

SHA256
94171af19c2744b1cdff42661f1dbe058a7387f40bfa10af3607466bd255ee92

SHA512
247c18b45b6c633f6d28b123d9d340b5c172869e51a1b0dd05594dfc9251f552aa77743672fd35effda673a9b3ea1d2f1ae5ce2d6c866e8c5ea045f710ccd817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e75115d6626f4d12864eb28fab55c1f4

SHA1
410b0a0a7c1910f67f95b1f4592ec5debc44235e

SHA256
b86e8421f65234f332c47f4a24943612eede35bebbdf602bc7714a9a190e32b0

SHA512
dd7194fddedd1e1594e3068e6ea7b7d8578f6187742f17885df0e4e283450016295d9b2b93bc77f2cd6120d2dbfa17a6f3a79280cb1d5d20428ef91227bccf4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe5956db0aeb408374ffa3191e886a43

SHA1
02b300c7c6cbb03d79ef04a00786fab4143c5fd0

SHA256
51bdb1a77e615ad0f4a43e2b14f66c72b7ea8a9fa6063eb5e828ff3d8216b827

SHA512
1e674c2b0027ffc8ee834922f86c3b6ab1e599fd921ddc1ad8f6f95ce9b0de3fcb257462006ff914787e7687f18d509e79e2ff25d8285e7de4891010618fc9d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d27e2f3168dbd75c9b1db95ab1a1b9a

SHA1
954135a9238319871c878374eba5e946469f9927

SHA256
1a9fc860267f379486b931caa5ff915637c49043c6100b7f2568a872a055852b

SHA512
baa1145f6b80942b88672153a8e472f91631fab89b6cc32ed92357a72e6af7a85cf5a8320db2070c1326d29a564f0085cefd55923fa697fab187df87194867bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9483f03d86a6f92a150f10f9de39951

SHA1
f8dc01e4e99f0b33b6cc73581d31657b404f214f

SHA256
4a41de48b082fec1b4a45139a449c9d96f97d21dec1471a3e429e8c980faa395

SHA512
3ed59086be420d3f17656e8e8bca427408d404bdad120be572cfca1b17837c1cc618a0d01300c1ed724d6e1760862b0a09540871b20cdf33e6e9afa8da017e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e3948f70124be77ced8bfb94b736e8a

SHA1
e225e5fc222d6c5109c77babdbc2a68d3b984e59

SHA256
a2e2a38986afb44679a677dacfa6879b18c5c50164c4fbcb7d92080d87df1477

SHA512
a4280fe2196f4af2050e5224ce6d9055ac6f9daeb80e51a60e49101bca8ece0c9b1170db355b778a3d016252f6dd6b680e52d36b26dc01739fffb7e4c21d3efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da3b7d22ad8689b4a481541d9a6d6062

SHA1
f84212373cc43f98513ce1429a3f20406dbfcd48

SHA256
de406dc56d56229aa88247a89a7e5d808505aa5ed95582381ed9ae77b97eed61

SHA512
c86cffdee1ac48bf3a3fcce27d7dff45070e3e7b49e649eb4c761cb8c9cd6aac0362144ccfbcce730641cca7e95db626e5a185adb26b13a3fc98437e4608c375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3acaff0913e74f7394a5d2fa095146d0

SHA1
093c816012d3cff5f82f08d95df2f7d4e0d95246

SHA256
5dcbfadc8580cadbf9f50b7bbcdb32f5274a9cf8aeb1c37fa7f41ef24aaa36d6

SHA512
e7ba253187cf432b8ff2220560fa8d1cf8156f46c8609fa005f7bcbbed487cb88c18002379b96e3ea1ddeb0632ac6770a15dcef5ccf5acb6c4eb40f2e955b1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3768.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar37D8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit