7b5121524d4e03d792d78a4d19788f724437f58d83d74ee3766b05c506b4e2da

Analysis

max time kernel
135s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69eebbf8d40db1f91ee78e52d5a7dca6_JaffaCakes118.html
Size

69KB
MD5

69eebbf8d40db1f91ee78e52d5a7dca6
SHA1

15d013abd79b8acc159ff1ec3bd401fe9b3291dc
SHA256

7b5121524d4e03d792d78a4d19788f724437f58d83d74ee3766b05c506b4e2da
SHA512

67a5f14ab9a3641ea1cf6abf40b13257392dc25ead04a473f10fb3c049aa37b3a14772bde693c4124931f9d9ca8eb700b6cb515a3742589c7c7319ba8a5cd96e
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6st6CgWhoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:J3iTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b59599e622874d478d17e9efef7fee0b00000000020000000000106600000001000020000000324d3ce26032d44ecb90ee7fcaecfce095d7ed4918de7a7b05e896f5b2593148000000000e8000000002000020000000f1b05accef39e863a1dc1f7165a1f721155c7b75730bc1d4a450d4c0366240e49000000047a92dd5fad8e9a1c0eecb33273a270e9330493fc3c4d89bc5de8cfe5fc12415ee09f44895ca50c595ba7f8cc03a9554406e9cb1a72bbdbe7a77d892a67ad9a3905b65ffe1664b03a26d93db59b35eb9e7ff30399c87b02a944db023016134aaebee101fefab6afc3764c6af9e6843c93511753fe87c782c69f64a6e720f02ae5abf857a732e1a6581feff1a860bc02e40000000e6a32cb651a278420ea4e4a262fb52e620f85c432bf5e892a9b056e101ce687336799fc11a91b24d343439915af3645f0916bde4c51ae3a85bf84c82d30808b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F22B3861-18C7-11EF-8706-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422605120"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b59599e622874d478d17e9efef7fee0b00000000020000000000106600000001000020000000e4ce36e107d82df762e0291e33ac01515d3960fc18c9bb71d5c1a76cf5070b26000000000e8000000002000020000000d6efaa99ed9f6e55c10c8e0e57d5e0117bebcc3694bae2da512d8991ae0db7b220000000e80ef5877b593cdf9fb5a729bbd6f0f9a4dee72d8979173aa576d4311341f8e140000000dd554a79540812b1e5f70c943bf6cd7706f19980c45df0713fab79caf6ef35270a77ee21e48c735f5ae337aac6d759f63f6aeafa3faac74c02284dab28831052	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b56bc7d4acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE
2232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2232	2168	iexplore.exe	28
PID 2168 wrote to memory of 2232	2168	iexplore.exe	28
PID 2168 wrote to memory of 2232	2168	iexplore.exe	28
PID 2168 wrote to memory of 2232	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69eebbf8d40db1f91ee78e52d5a7dca6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f63e9fe95c2670f00a7a8d561dc6a902

SHA1
fe6ccb454099a5ca804b627a0f5e2970742f9598

SHA256
5448e79761ee70ed6b02c35476d44db967c44dcd65cf83773c93e75effe10291

SHA512
40673c2b49bad2e3d80774fd7f86eb1f3f2cc4f0d4f56009540e7315b05fe2f331dd00557cc10abf1b2e50b6ab855308305b9ce0ed54b3138d5c5c18557e9f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de470f9415a1ec2a4d1fc2caa46da85e

SHA1
f0cb86f204fb65c0a2c4189b9cb1418d8862f69a

SHA256
37018f2295a4cde554370b137ae6338725ab53c3272d3554b8708e13b74daf62

SHA512
1e44ab52f3fb45e873038a5f33cf37935459e7ef2613776a0a650e8c4a3c02ccdc276132fa58453d24300bfde77f99b09b6fb0a50cd96ff470fd6da349ab5fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
804faabb4f4fd740613d2bb1c978375d

SHA1
8a83f5c0c2529554153403d03ec49a8c3f99867a

SHA256
b9a1673e47f2a35eb9c58295596d0e199010222e1f8a94a65e9159a378672e4c

SHA512
c9f1ed98babd15736aa1289b12b3e0aef617d36467871719abd50c0dda4b4e6fb62137113e74bff1d5f10ce80de44526ac45a60105380a9dac72d3c42a097c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e09df8690b98979ccaae26f04cb57e4

SHA1
ca216007ed8fbd8e5d200ac5f3676b4decfc36d5

SHA256
0fdfc4460e69b5eb7428ee435d33e426e8c77b6aa9e27eef697b1d61b4a26e93

SHA512
66760e3505a4d47c7305063f0714d3978073876bbbd53277b3949cd70ff170fccefaf1ebd2a345c871a141359530ceca5c4316c6bdb4850e5f701a7698d11d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b01ea66f0445e03cffff157351f65c

SHA1
5a4ee0ed2061763c726690181a154316f3fba394

SHA256
12d16f196d8dd9b4adc5e67c159d62f0805fd75f1411b68c05687a308fa34d95

SHA512
d63e93af3d246ff04c7b450036657a7cff2398785203c0ea378fecc640258b499d625e18870743c0a12e0f7fb678ed4a74da5be5f45875bfe1119e4bd4800884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c907ec560107522bbd20f35e9a5be5d3

SHA1
338dd7efd5f2828830abc7a9a63099c187753e1c

SHA256
dd81e709a55a813d4e953f93c6191c8c8e71e94524182a01168fa04b90d2c1b9

SHA512
3545c750d292731cefb799bb273705c45fab0f36a7dc4c6240ac54cb36a1ad455d43a0dd6352138b29ea2c33ab70e3562a33a49cf8127596c29369470bca91db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1fe870a6145182b5465dcfaff48d94c

SHA1
a37f78f30056b6134b1f12346b9c0b07e74b6ea5

SHA256
0181ae4302d130336afe519a0aeb8ffdc4e4eb3e7621fb4f1924b5c9894418f5

SHA512
8de19f9a5b946f3935ada516a324583ad560d869bca707e342ec11e92e83a06456fea34ea01ac8e5bb6365a78193e8344835f0dffc77e2719ce7dcc0b7e111dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
643463a91de3b663b0f433efaaf41f7c

SHA1
cdf3472d9f000d9dee5c6ff93cf55a959e85a1ec

SHA256
3a34b30b37222068f3a63cd8b72b15e81dc49f33f562e246930789559f4a9e63

SHA512
2fec1a81e8f3f6462ec44f9e9920eb0afac97266e93e40fde4a97c01a169e81ef6c5be3c758081c9b000257a96fd5bdb7a3e234e9ffd62f223ce06ff71161a83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b4dbdfef86b12e851ca74f208695f3

SHA1
fbe6045229263fa809b56589fed5328c09710013

SHA256
4203817d8b70cb23fcdcfb072019078c723605172b2eabc13891782dcf9a2fa9

SHA512
ba916023a8280ad9cb8e55a4b3c8b06c51ea9361df50faf471f3b6946e7e5604d722939007196e785e8f13434a1ef64f7e014a9790e2ef13dbdce9ecd32d85dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e64774008c9074127b8a12bbce153c

SHA1
66d5c0aa5cc9a3f14000cc37c0300ec821c74073

SHA256
492965333050af92b65050144a613c784fdd6a1f1a6996bef9e082b2ea8db4a4

SHA512
c29dcd506b4e8689a6ed1f73171b82dc3212830ccb014c596d79e0704a08c1ea3302525fe4ad3230de06e62cb6e269f1cf411a99994947eb0d6d4765538b3e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe029a136e4ccf841009b54f83cbbb3e

SHA1
a25c9e8a94d0460f2cb9d343ad40601d8e51af92

SHA256
507fc41708ae134e0707f4354d965af7bd59c61ab1b8106b9e08e7d03d6eb887

SHA512
e295816f7b497d746edf5275ab24f49b878bbb92881c2847b206622a7afeacbd981e1053383414a5f91a49023cd060436e1da9f636085159f7e0f40b2706c4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac1fe57dbb69b4405ba06d4fc4782ad4

SHA1
aa6eaf935815550c782dad2bf6cf217d1028608b

SHA256
5b8cb69c67bced97c9a8b2ce03b95f0a61d59b9d0ce177c5495dcaa68135c0fa

SHA512
57fb8d02df0f03f1f9fe2fe55b61b640331d4a912b33628da7744acb5100b3bbd719a00c88473dbf7889c2dff24135873f7965bdb5d59383d6c2dab7030e47b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1018f78deb9980943a12f8bce2e4de5

SHA1
e123d168ef65a9444f52772f8eaf21c43fb1a4ac

SHA256
c6877b6d1c693364b80202c6c9ae96e1267d1aa2bc1bb8037d15d88dd2b68d54

SHA512
cca7d6163b086d0e3e0d50924f11cb080ddc7e52e6a614ee1eafa3eb7296e7c69f82ad90b220a2e3070d4351384aada61718cc9c736f2a6054b2554216d825e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a297da19f654db4f7e753955d212d28

SHA1
ec57b8e5739783891a535e4947c7ba667825e785

SHA256
45260b19182244589cb53f00a4f3a1bba9889979770fd46fb469812cb7fc52d7

SHA512
d3c682a355cace29c402858cab0c5a2fcc1fbe0982cd2c44ddc8ef85b031f72f41e01e839d1c3dde7b0ac69036eda3bab50fea3b371984e4fbd910f1790b60e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eed0d7832beaad4d8dbbd677582f8cf

SHA1
e0db9b9e77be9760603dd7877eaf0d147903105b

SHA256
7bc7e59ccfcce222422dcdc1143d966bca2ec52a9fcde0d6c89abac8610f7b00

SHA512
5b1b06c6a245bc274d3bed0feea3ad3bdcae30d0f79df6ed425cb697f7577bc147b4be469011adc74b262df75e46e935c40e7669b1eaadcea7dc18fb5ad58d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9742.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9884.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit